Data Processing Addendum

1. Scope & Role

For the purposes of applicable data protection laws, the Client acts as the Controller (or Covered Entity) of personal data and PHI, and VLMS acts as the Processor (or Business Associate). VLMS processes data only on documented instructions from the Client and for the purposes set out in the governing Statement of Work.

2. Categories of Data & Data Subjects

• Patient demographic and contact information.
• Protected Health Information (PHI) — clinical, coding, claims, and payment data — as defined under HIPAA.
• Workforce identifiers of Client staff necessary to perform the services.
• Technical logs and metadata generated during service delivery.

3. Processor Obligations

• Process personal data and PHI solely on documented Client instructions.
• Ensure that personnel authorized to process the data are bound by confidentiality obligations and receive annual HIPAA training.
• Implement and maintain the technical and organizational measures described in Section 6.
• Assist the Client in responding to data-subject requests and regulatory inquiries.
• Promptly notify the Client of any Security Incident or Breach of Unsecured PHI in accordance with the timelines in the HIPAA Breach Notification Rule and Article 33 GDPR (where applicable).

4. Subprocessors

VLMS may engage subprocessors to provide specialized components of the services. A current list of subprocessors is maintained and available on request. VLMS will give the Client prior written notice of any intended addition or replacement of subprocessors and will flow down materially equivalent data protection obligations.

5. International Transfers

Where personal data is transferred across borders, VLMS relies on appropriate safeguards — including EU Standard Contractual Clauses, UK Addendum, and equivalent mechanisms — and applies supplementary measures as necessary based on a transfer impact assessment.

6. Security Measures

VLMS maintains an Information Security Management System aligned to ISO/IEC 27001:2022 and the HIPAA Security Rule, including:

• Encryption of data in transit (TLS 1.2+) and at rest (AES-256).
• Role-based access controls, least-privilege provisioning, and multi-factor authentication for all privileged accounts.
• Network segmentation, endpoint protection, and centralized logging with 24x7 monitoring.
• Vulnerability scanning, annual third-party penetration testing, and documented remediation tracking.
• Documented incident response, business continuity, and disaster recovery plans — tested at least annually.

7. Audit Rights

VLMS makes available to the Client the information necessary to demonstrate compliance with this DPA, including third-party audit reports (for example, SOC 2 Type II or ISO 27001 certifications). On reasonable notice and subject to confidentiality, the Client may conduct audits of VLMS's relevant policies and controls.

8. Return or Deletion of Data

On termination of the services, and at the Client's election, VLMS will return or securely delete all personal data and PHI in its possession, unless applicable law requires continued retention.

9. Liability

The liability provisions of the Master Services Agreement apply to this DPA, subject to any additional liability caps required by applicable law.

10. Contact

For DPA requests, subprocessor lists, or data-subject inquiries, contact our Privacy Officer at privacy@valiantlifecare.com or through our contact page.