Data Processing Addendum

This Data Processing Addendum (the "Addendum") is between Swift Parse LLC, a California limited liability company doing business as Schema Care ("Schema Care"), and the organization that has accepted the Schema Care Terms of Service at schemacare.com/terms ("Customer"). The Terms incorporate this Addendum, so it takes effect for Customer when Customer accepts the Terms, or on the version date above if Customer accepted them earlier. It supplements the Terms, which this Addendum calls the "Services Agreement".

Words defined in the Terms have the same meaning here. In particular, "Customer Content" means the files and information Customer or its users put into the Service and the Output the Service produces from them, and "Health Data" means any medical record of a real person and any information about a real person's physical or mental health, health care, or payment for health care.

"Applicable Law" means each law that applies to the processing of Customer Content under this Addendum. Where they apply, it includes state medical privacy laws such as the California Confidentiality of Medical Information Act, state consumer health data laws, state breach notification laws, and state insurance data security laws.

"Subprocessor" means a third party that processes Customer Content on Schema Care's behalf. "Security Incident" means unauthorized access to, or acquisition, use, disclosure, alteration or destruction of, Customer Content, or an attempt that Schema Care reasonably believes succeeded.

The Terms allow Health Data in the Service only under a Business Associate Agreement signed in the dashboard (a "BAA"). This Addendum does not change that rule. It covers all Customer Content, including Health Data that HIPAA does not treat as protected health information, such as records a law firm or insurer holds that no covered entity sent on its behalf.

Customer decides why and how Customer Content is processed. Schema Care processes Customer Content only on Customer's behalf.

Schema Care processes Customer Content only to provide the Service as the Terms describe, to follow Customer's documented instructions, and as the law requires. The Service reads medical records and produces organized documents, timelines, summaries and abstraction answers that cite their source pages, with a human review queue and export.

Schema Care must not do any of the following with Customer Content:

• sell it, rent it, or share it for advertising;
• use it, or anything derived from it, to train, fine-tune or evaluate any machine learning model, including models hosted by a Subprocessor;
• use it for product analytics;
• combine it with data from other customers or other sources; or
• de-identify it, unless Customer agrees in writing to a named purpose.

If Schema Care believes an instruction violates Applicable Law, it will tell Customer and may suspend that processing until Customer confirms or changes the instruction.

Customer is responsible for having every authorization, consent and other legal basis needed to give Customer Content to Schema Care, as the Terms already require.

Schema Care keeps Customer Content in data centers in the United States.

Schema Care treats Customer Content as Customer's Confidential Information under the Terms.

Schema Care gives access to Customer Content only to workforce members who need it to provide the Service, and binds each of them to written duties of confidentiality. Schema Care must train its workforce in handling health information at hire and yearly. On the version date of this Addendum, no workforce training is yet recorded.

Schema Care does not disclose Customer Content to anyone except its Subprocessors under Section 5, or as Section 9 allows.

Schema Care keeps administrative, physical and technical safeguards designed to protect Customer Content against Security Incidents. It designs them to the HIPAA Security Rule (45 CFR Part 164, Subpart C) for every customer, whether or not HIPAA applies to Customer.

The safeguards include encryption in transit with TLS 1.2 or later and at rest with keys Schema Care controls through AWS Key Management Service, multi-factor authentication for every login to the Service and every console sign-in to Schema Care's AWS accounts, access limited per workspace and per matter, an append-only audit log of record activity kept six years, and no analytics or tracking scripts on any page of the app.

Schema Care must also require multi-factor authentication in every other vendor console, which is not complete on the version date of this Addendum. Its written security policies and risk analysis exist, but on that date the policies are not yet formally adopted and the risk analysis is not yet signed. Schema Care must adopt the policies and update the risk analysis yearly. Customer may review them on request under confidentiality. The page at schemacare.com/compliance describes what is in place today and what is not done yet.

Schema Care may update its safeguards if the update does not reduce the overall protection of Customer Content.

Customer authorizes the Subprocessors listed in Section 14.

Schema Care must give Customer 30 days' notice before adding or replacing a Subprocessor that will process Health Data. Customer may object in writing within that period. If the parties cannot resolve the objection, Customer may end the Services Agreement without penalty, and Schema Care will refund any fees Customer prepaid for the period after the end date.

Schema Care binds each Subprocessor by written contract to data protection terms at least as protective as this Addendum, and remains responsible to Customer for its Subprocessors.

When a person asks Customer to access, correct or delete their information under Applicable Law, Schema Care will help Customer respond, by providing exports and the access history for a record, within 10 days of Customer's request.

If a person contacts Schema Care directly about Customer Content, Schema Care will forward the request to Customer within 5 days and will not respond to the person itself.

Schema Care will give Customer reasonable help with security questionnaires, risk assessments and regulator inquiries about the Service.

Schema Care will notify Customer of a Security Incident without unreasonable delay, and no later than 10 days after discovering it.

The notice will include, to the extent known, what happened, when it happened and when it was discovered, the types of Customer Content involved, the people affected, what Schema Care is doing to contain it and prevent it happening again, and a contact person. Schema Care will send new information as it learns it.

Customer decides whether and how to notify affected people, regulators and others under state breach notification laws. Schema Care will give Customer the information Customer needs to meet those laws' deadlines.

Notices will not contain Health Data. A notice that needs it points to a secure location in the Service.

Unsuccessful attempts, such as pings, port scans, denied sign-in attempts and denial of service attempts that reach no Customer Content, need no notice.

Customer sets the retention period for its records in the Service. When that period ends, Schema Care deletes each source file, its OCR output and its derived data.

When the Services Agreement ends, Schema Care will, at Customer's election, return or delete all Customer Content within 30 days. Encrypted backups that cannot be selectively deleted expire within 35 days, and this Addendum keeps applying to them until they do.

Within 10 days after deletion, Schema Care's authorized representative will certify it to Customer in writing, naming the systems covered, the method used and the date.

Schema Care keeps Customer Content longer only where Applicable Law requires it or under a legal hold in Section 9, and only for as long as needed. Audit log entries, which carry record ids but not record content, are kept for six years.

If Schema Care receives a subpoena, court order or other legal demand for Customer Content, it will notify Customer promptly, unless the law forbids notice, so that Customer can seek a protective order. Schema Care will disclose only what the demand legally requires.

Customer Content may include material protected by attorney-client privilege or the work product doctrine. Processing by Schema Care is not intended to waive any privilege or protection.

On Customer's written notice of a legal hold that names the records and an end date, Schema Care will suspend deletion of those records until Customer releases the hold or the end date passes.

Once a year, on request, Schema Care will answer Customer's written security questionnaire.

Schema Care has no third-party audit report, such as a SOC 2 report, and has not been independently audited or certified. If it obtains one, it will give Customer a copy under confidentiality on request.

If the questionnaire does not answer a reasonable question about Schema Care's compliance with this Addendum, Customer may audit that compliance once a year, at Customer's cost, on 30 days' written notice, during business hours, through an independent auditor bound by confidentiality. Customer may also audit after a Security Incident that affected its Customer Content. No audit may give access to other customers' data.

Customer must not send Schema Care records protected by 42 CFR Part 2 unless the parties first agree in writing to qualified service organization terms under 42 CFR 2.11. Schema Care will not redisclose any Part 2 records it receives except as 42 CFR Part 2 allows.

Each party must indemnify the other against third-party claims, regulatory fines and penalties, and reasonable costs arising from its own breach of this Addendum, under the procedure in the indemnity section of the Terms.

Each party's total liability arising out of or relating to this Addendum is limited by the limitation of liability in the Terms: the fees Customer paid Schema Care for the Service in the 12 months before the claim arose. Liability under this Addendum, the Terms and any BAA counts toward that one limit, not a second one. The limit does not apply to liability the law does not allow to be limited.

If this Addendum conflicts with the rest of the Services Agreement, this Addendum controls as to Customer Content. If a BAA is in effect, the BAA controls as to protected health information, and this Addendum controls as to all other Customer Content.

Notices under this Addendum go by email. Schema Care's notice address is security@schemacare.com. Schema Care sends notices to the email addresses of Customer's workspace owners and shows them in the Schema Care dashboard. Customer must not send Health Data by email to any Schema Care address.

Schema Care may update this Addendum as the changes section of the Terms allows, including at least 30 days' notice before a material change takes effect. The version number and date at the top of this page change with every update.

The laws of the State of California govern this Addendum, without regard to conflict-of-law rules, except where federal law applies. The venue section of the Terms applies.

Schema Care offers this version of the Addendum and is bound by it as of its version date for every Customer. Signed: Swift Parse LLC, doing business as Schema Care, by its authorized representative. Customer's acceptance of the Terms is its electronic signature, as the Terms provide.

Amazon Web Services, Inc. is Schema Care's only Subprocessor. It hosts the Service and provides record storage, OCR, AI model inference (Claude models on Amazon Bedrock), the application database, encryption keys, logs and the audit copy, and email delivery, under the AWS Business Associate Addendum covering Schema Care's AWS accounts.

Location: the United States. Storage, OCR, the application database and hosting run in the AWS us-west-2 region. Model inference runs in the US AWS regions us-east-1, us-east-2 and us-west-2.

Claude models run inside Schema Care's AWS account through Amazon Bedrock. Anthropic is not a separate Subprocessor.