1. Roles and instructions
For processing covered by this DPA, Customer is the controller or business and PatientLock is the processor or service provider, except where applicable law assigns different roles. PatientLock will process personal data only on Customer's documented instructions, including instructions contained in the MSA, Service Order, SOW, and this DPA, unless law requires otherwise.
2. Processing details
The subject matter and purpose of processing are delivery, operation, security, support, and administration of the purchased services. Processing may include collection, organization, storage, retrieval, analysis, transmission, restriction, deletion, and other operations necessary to provide those services.
Categories may include customer administrator and workforce contact information, identity and access records, security and device telemetry, audit and support records, and other personal data a customer configures the service to process. Duration is the service term plus any lawful retention period.
3. Confidentiality and security
PatientLock will ensure persons authorized to process personal data are subject to confidentiality obligations and will maintain technical and organizational measures appropriate to the nature of the processing and the risks presented. Current security information is maintained at Security & Trust.
4. Subprocessors
Customer authorizes PatientLock to use subprocessors needed to deliver the services, subject to this DPA and the applicable agreement. PatientLock will maintain a current list at Subprocessors and will impose data-protection obligations appropriate to the services performed.
5. Data-subject requests
Taking into account the nature of the processing, PatientLock will provide reasonable assistance to Customer in responding to requests to exercise applicable data-subject rights. If PatientLock receives a request relating to Customer-controlled data, PatientLock may direct the requester to Customer unless law requires a different response.
6. Security incidents and regulatory assistance
PatientLock will notify Customer without undue delay after becoming aware of a personal-data breach affecting data processed under this DPA and will provide information reasonably available to support Customer's legal obligations. PatientLock will also provide reasonable assistance with security assessments, impact assessments, and regulator consultations to the extent required by applicable law and relevant to PatientLock's processing.
7. International transfers
If covered personal data is transferred internationally and law requires a transfer mechanism, the parties will use an applicable lawful mechanism identified in the executed agreement or an incorporated addendum. No particular hosting region is promised by this public DPA unless documented in the customer-specific agreement.
8. Return and deletion
At the end of the services, PatientLock will return or delete covered personal data as required by the executed agreement, unless applicable law requires retention. Backup and security records may persist for limited periods under ordinary retention and recovery processes.
9. Information and audits
PatientLock will make information reasonably necessary to demonstrate compliance with applicable processor obligations available to Customer. Audit mechanics, confidentiality, scope, frequency, and cost allocation are governed by the MSA or a mutually agreed audit process.
10. Liability and precedence
Liability under this DPA is subject to the limitations and allocations in the Master Services Agreement unless applicable law requires otherwise. If this DPA conflicts with a customer-specific signed data-protection addendum, the signed addendum controls for that customer.