Data Processing Addendum

“Applicable Data Protection Law” means all laws and regulations applicable to the processing of Personal Data under the Agreement, including, to the extent applicable, the Illinois Personal Information Protection Act (815 ILCS 530), the Illinois Biometric Information Privacy Act (740 ILCS 14) (“BIPA”), the California Consumer Privacy Act as amended by the California Privacy Rights Act and its regulations (“CCPA”), other U.S. state comprehensive privacy laws, and U.S. state data breach notification laws. If Customer submits Personal Data of individuals located in the EEA, United Kingdom, or Switzerland, the Parties will execute a separate international transfer rider before that data is submitted.

“Controller,” “Processor,” “Business,” “Service Provider,” “Data Subject,” “Consumer,” “Sell,” “Share,” and “Personal Information” have the meanings given in Applicable Data Protection Law. For clarity, Customer is the Controller or Business and TapFlow is the Processor or Service Provider with respect to Personal Data.

“Personal Data” means any information contained in Customer Data that identifies, relates to, describes, or is reasonably capable of being associated with an identified or identifiable natural person. Personal Data under this DPA consists of Workforce Data and incidental operational data, and excludes Restricted Health Information, which Customer is prohibited from submitting.

“Workforce Data” means Personal Data about Customer’s employees, contractors, clinicians, students, volunteers, and other Authorized Users, such as name, work email, work phone, role, department, site assignment, employee or badge identifier, professional license and certification details, competency and training records, and records of checkpoint scans, task completions, and other activity within the Services.

“Security Incident” means a confirmed breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or unauthorized access to Personal Data in TapFlow’s possession or control. Unsuccessful attempts or activities that do not compromise Personal Data (such as pings, port scans, blocked login attempts, or denial-of-service attacks that do not result in unauthorized access) are not Security Incidents.

“Subprocessor” means a third party engaged by TapFlow to process Personal Data on TapFlow’s behalf in providing the Services.

“Restricted Health Information” has the meaning given in the Agreement — individually identifiable health information about a patient, resident, or other individual receiving care, including information that would be Protected Health Information under 45 C.F.R. § 160.103 if held by a covered entity or business associate.

Roles. Customer determines the purposes and means of processing Personal Data and is the Controller (or Business). TapFlow processes Personal Data on Customer’s behalf and in accordance with its documented instructions as Processor (or Service Provider). Where Customer acts as a processor for a third party, Customer warrants that its instructions and this DPA are consistent with that third party’s requirements.

Individual Plans excluded. This DPA applies only to organizational Customers that have executed the Agreement or an Order Form. It does not apply to self-service Individual Plans purchased by individual healthcare professionals under TapFlow’s online Terms of Service, for which TapFlow acts as controller as described in its Privacy Policy.

Details of processing. The subject matter, nature, purpose, and duration of processing, the categories of Data Subjects, and the categories of Personal Data are described in Annex I.

Customer instructions. TapFlow will process Personal Data only (a) to provide, secure, support, and improve the Services in accordance with the Agreement; (b) as further documented in Customer’s configuration of and use of the Services; (c) as otherwise instructed by Customer in writing, where those instructions are consistent with the Agreement; and (d) as required by applicable law, in which case TapFlow will inform Customer of the legal requirement before processing unless the law prohibits doing so. TapFlow will notify Customer if it believes an instruction violates Applicable Data Protection Law, and may suspend the instruction until resolved.

Customer responsibilities. Customer is responsible for (a) the lawfulness of the Personal Data it submits, including providing all notices to and obtaining all consents from Authorized Users required by Applicable Data Protection Law and its own policies; (b) the accuracy and quality of Personal Data; (c) configuring roles, permissions, retention settings, and data fields appropriately; and (d) ensuring that its instructions comply with Applicable Data Protection Law.

Prohibition. Customer will not submit, and will ensure its Authorized Users do not submit, Restricted Health Information to the Services in any form, including in free-text fields, photographs, attachments, task and checkpoint names, and credentialing records. Customer acknowledges that the security measures in Annex II are designed for Workforce Data and operational data and are not represented to satisfy the HIPAA Security Rule.

Not a business associate. The Parties agree that TapFlow does not create, receive, maintain, or transmit Protected Health Information on Customer’s behalf and is not a business associate of Customer within the meaning of 45 C.F.R. § 160.103. No business associate agreement is or will be entered into for the Services, and nothing in this DPA will be construed as one.

Remediation. If Restricted Health Information is nonetheless submitted, Section 8.4 of the Agreement applies. TapFlow will, at Customer’s written request and expense, take reasonable steps to delete the information from production systems within ten (10) business days and confirm deletion in writing. Backup copies will be overwritten in the ordinary course of backup rotation. Customer is solely responsible for any assessment, notification, or reporting obligation arising from the submission.

Workforce health-adjacent data. Customer will configure the Services so that credentialing and competency records do not include employee health information (for example, immunization records, fit-test results, or medical clearances). If Customer elects to store the fact and expiration date of a workforce health-screening requirement (without underlying medical detail), Customer is responsible for determining that such use complies with applicable employment and privacy law. Any employee health information submitted in breach of this Section is submitted at Customer’s risk; TapFlow does not apply safeguards specific to health information to it and may delete or quarantine it, with notice to Customer where practicable, without liability.

Biometrics. The Services do not collect biometric identifiers or biometric information as defined in BIPA. NFC and QR scans identify tags and locations, not individuals’ biological characteristics. Customer will not use the Services to collect, store, or transmit biometric identifiers or information.

TapFlow will ensure that personnel authorized to process Personal Data are bound by written confidentiality obligations, receive appropriate privacy and security training, and access Personal Data only to the extent necessary to perform their duties.

TapFlow will restrict access to Customer’s tenant to personnel with a legitimate support, engineering, or security need, and will log administrative access to production systems.

Measures. TapFlow will implement and maintain the technical and organizational measures described in Annex II, and will not materially reduce the overall level of protection they provide during the term of the Agreement. TapFlow may update Annex II from time to time to reflect improvements or changes in technology.

Customer controls. Customer is responsible for using the security features available within the Services (including role-based permissions, single sign-on integration where subscribed, and timely deprovisioning of Authorized Users) and for securing its own devices, networks, and credentials.

Authorization. Customer authorizes TapFlow to engage the Subprocessors listed in Annex IV and, subject to this Section 6, additional or replacement Subprocessors.

Obligations. TapFlow will enter into a written agreement with each Subprocessor imposing data-protection obligations no less protective than those in this DPA, to the extent applicable to the services the Subprocessor provides, and will remain responsible for each Subprocessor’s performance.

Changes. TapFlow will give Customer at least thirty (30) days’ written notice (which may be by email to Customer’s administrative contact or by posting to www.tapflowhealth.com/subprocessors with an email notification mechanism to which Customer may subscribe) before authorizing a new Subprocessor to process Personal Data. Customer may object in writing on reasonable data-protection grounds within that period. The Parties will discuss the objection in good faith; if TapFlow cannot reasonably accommodate it, Customer may terminate the affected Order Form on written notice and receive a prorated refund of prepaid, unused fees, as its sole remedy.

Notification. TapFlow will notify Customer without undue delay, and in any event within seventy-two (72) hours (or any shorter period required by Applicable Data Protection Law), after confirming a Security Incident affecting Customer’s Personal Data. Notice will be sent to Customer’s designated security contact (or, if none, its administrative contact) and will include, to the extent then known: the nature of the incident, the categories and approximate number of Data Subjects and records affected, the likely consequences, the measures taken or proposed, and a TapFlow point of contact. Customer may report a suspected Security Incident to TapFlow at support@tapflowhealth.com. TapFlow will supplement the notice as information becomes available.

Cooperation. TapFlow will take reasonable steps to contain, investigate, and remediate the Security Incident, and will provide reasonable cooperation and information to assist Customer in meeting its own notification obligations under Applicable Data Protection Law. TapFlow will not notify Data Subjects, regulators, or the public on Customer’s behalf unless required by law or agreed in writing.

No admission. Notification of a Security Incident is not an acknowledgment of fault or liability.

Customer can access, correct, export, and delete most Workforce Data directly through the Services’ administrative functions. If TapFlow receives a request from a Data Subject relating to Personal Data processed for Customer, TapFlow will not respond substantively (other than to direct the individual to Customer) and will promptly forward the request to Customer, unless legally prohibited.

Taking into account the nature of the processing, TapFlow will provide reasonable assistance to Customer, at Customer’s expense where the assistance is material, in responding to Data Subject requests, conducting data-protection impact assessments, and consulting with supervisory authorities, in each case to the extent required by Applicable Data Protection Law.

Documentation. On written request no more than once per twelve (12) months, TapFlow will make available information reasonably necessary to demonstrate compliance with this DPA, which may include its most recent security questionnaire responses, summaries of independent assessments or penetration tests, and policies and procedures, subject to confidentiality obligations.

Audit. If the documentation is insufficient to demonstrate compliance, or following a Security Incident, or where required by Applicable Data Protection Law, Customer (or an independent auditor bound by confidentiality and reasonably acceptable to TapFlow) may conduct an audit of TapFlow’s relevant controls on at least thirty (30) days’ written notice, during normal business hours, not more than once per twelve (12) months, in a manner that does not unreasonably interfere with TapFlow’s operations or compromise other customers’ data. Customer bears the cost of any audit unless it reveals a material breach of this DPA. Audits of Subprocessor facilities are limited to the reports and certifications those Subprocessors make available.

TapFlow hosts Customer Data in Microsoft Azure data centers in the United States and will not transfer Customer Data outside the United States without Customer’s prior written consent, except for transient remote access by TapFlow support personnel or Subprocessor personnel located outside the United States, which is subject to the safeguards in Annex II.

During the Subscription Term, Customer may export Personal Data through the Services’ export functions at any time.

Following the Transition Period described in the Agreement, TapFlow will delete Personal Data from production systems within thirty (30) days and from backups in the ordinary course of backup rotation (not to exceed thirty-five (35) days after production deletion), except to the extent retention is required by applicable law, in which case TapFlow will continue to protect the retained data under this DPA and process it only for the purpose of that retention. On written request, TapFlow will certify deletion.

This DPA is effective on the Effective Date of the Agreement and continues for as long as TapFlow processes Personal Data on Customer’s behalf.

Each Party’s liability arising out of or related to this DPA is subject to the exclusions and limitations of liability in the Agreement, and this DPA does not create any additional liability, super-cap, or carve-out unless the Agreement expressly provides one.

TapFlow may update this DPA on notice to Customer to reflect changes in Applicable Data Protection Law, provided the change does not materially reduce the protection of Personal Data.

Limited purpose. TapFlow is a Service Provider/Processor. Customer discloses Personal Data to TapFlow only for the limited and specified business purpose of providing the Services described in the Agreement and Annex I.

Prohibitions. TapFlow will not (a) Sell or Share Personal Data; (b) retain, use, or disclose Personal Data for any purpose other than the business purposes specified in the Agreement, including any commercial purpose other than providing the Services; (c) retain, use, or disclose Personal Data outside the direct business relationship between TapFlow and Customer; or (d) combine Personal Data received from Customer with Personal Data received from another person or collected from TapFlow’s own interactions with Consumers, except as permitted for Service Providers under Applicable Data Protection Law (for example, to detect security incidents or to build or improve the Services without using the data to build profiles about individuals for another customer).

Compliance. TapFlow will comply with the obligations applicable to Service Providers/Processors under Applicable Data Protection Law and will provide the same level of privacy protection required of Customer. TapFlow will notify Customer if it determines it can no longer meet these obligations. Customer may, upon reasonable notice, take reasonable and appropriate steps to stop and remediate unauthorized use of Personal Data.

Deidentified data. Where TapFlow creates deidentified data from Personal Data under Section 8.7 of the Agreement, TapFlow will take reasonable measures to ensure the data cannot be associated with an individual, publicly commit to maintain and use it only in deidentified form and not attempt re-identification, and contractually obligate any recipients to do the same.

Certification. TapFlow certifies that it understands the restrictions in this Annex and will comply with them.