Data Processing Addendum — Template

For the purpose of the GDPR (Regulation (EU) 2016/679), UK GDPR, Swiss FADP, and similar regimes, the customer using CUBE OneCare is the "Controller" and CUBE Collective LLC is the "Processor" with respect to personal data submitted to the platform.

For Covered Entities under HIPAA, this DPA supplements but does not replace the Business Associate Agreement. Where the two documents address the same subject matter, the stricter standard controls.

The Processor processes personal data as instructed by the Controller for the sole purpose of providing the CUBE OneCare services. Categories of personal data include:

• Identity and contact data (name, email, phone, postal address).
• Account and authentication data.
• Health and clinical data (PHI) uploaded or generated by the Controller.
• Usage, telemetry, and audit-log data necessary to operate and secure the service.

Categories of data subjects include the Controller's staff, patients, care providers, dependents, and other individuals whose data the Controller uploads to the platform.

• Process personal data only on documented instructions from the Controller, including with regard to international transfers.
• Ensure that personnel authorized to process personal data are under a legally-bound duty of confidentiality.
• Implement and maintain the technical and organizational measures described in the Security overview, including encryption, access control, resilience, and regular testing.
• Respect the subprocessor regime (§ 4) and only engage subprocessors with equivalent data-protection obligations.
• Assist the Controller in responding to data-subject requests (access, rectification, erasure, restriction, portability, objection).
• Notify the Controller without undue delay — and in any case within 48 hours — of any confirmed personal-data breach.
• Make available all information necessary to demonstrate compliance and allow for audits, including inspections conducted by the Controller or an auditor mandated by the Controller, subject to reasonable scoping and NDA.

A current list of subprocessors is maintained at /legal/subprocessors. The Controller grants general prior authorization for the listed subprocessors. The Processor will notify the Controller at least thirty (30) days in advance of adding or replacing a material subprocessor; the Controller may object in writing on reasonable data-protection grounds, in which case the parties will cooperate in good faith to resolve the objection.

CUBE OneCare primarily processes personal data in the United States, and EU data residency is not offered today. Where personal data flows from the EEA, UK, or Switzerland to the United States or another third country and a transfer safeguard is required, the applicable instrument (for example the EU Standard Contractual Clauses (2021/914) or the UK International Data Transfer Addendum) is agreed and executed in the contract before the transfer. No SCC instrument and no transfer-impact assessment is in place today.

The Processor will provide reasonable assistance to the Controller in fulfilling data-subject rights requests under Articles 15-22 GDPR. Where a request is received by the Processor directly, the Processor will promptly forward it to the Controller rather than respond on behalf of the Controller (unless required by applicable law).

On termination of the services, the Processor will, at the Controller's election, delete or return all personal data processed on behalf of the Controller and delete existing copies unless applicable law requires storage of the personal data. The Controller has access to self-service data-export tooling throughout the term to retrieve their data in structured machine-readable formats.

The liability of each party under this DPA is subject to the limitations of liability set out in the underlying Service Agreement between the parties. This DPA does not diminish any liability allocation to the contrary in individual order forms.