Data Processing Addendum

Parties and how this addendum applies

This Data Processing Addendum ("DPA") is between KERA Tech Solutions L.L.C., a company registered in Kosovo and based in Prizren ("ClaimParrot", the processor) and the organization that accepts the ClaimParrot Terms of Service ("Customer", the controller). It forms part of the Terms and applies for as long as ClaimParrot processes Customer Personal Data.

Customer does not need to sign it. If Customer needs a countersigned copy, download it from this page, complete the Customer details in the last section and send it to legal@claimparrot.com. A countersigned copy has the same terms.

Definitions

Customer Personal Data: personal data in the content Customer or its users submit to ClaimParrot (requests, files, workspace entries and messages) that ClaimParrot processes on Customer's behalf.

Data Protection Laws: the laws that apply to that processing, which may include the EU General Data Protection Regulation (GDPR), the UK GDPR, Kosovo Law No. 06/L-082 on Protection of Personal Data, and US state privacy laws such as the California Consumer Privacy Act (CCPA).

Subprocessor: a third party ClaimParrot engages to process Customer Personal Data. Security Incident: a breach of security leading to the accidental or unlawful destruction, loss or alteration of, or unauthorized disclosure of or access to, Customer Personal Data. Other terms, such as controller, processor, personal data and processing, have the meanings given in Data Protection Laws.

De-identified by design; not a business associate agreement

ClaimParrot is designed to receive de-identified case information only. Customer must not submit protected health information (PHI) or any information that identifies a patient. ClaimParrot screens requests for common identifiers and deletes, without processing, any request found to contain them. Customer Personal Data is therefore expected to be limited to business contact details of Customer's staff and incidental personal data in Customer's content.

This DPA is not a business associate agreement under HIPAA. ClaimParrot does not agree to create, receive, maintain or transmit PHI for Customer, and does not sign business associate agreements.

Roles and instructions

Customer is the controller and ClaimParrot the processor of Customer Personal Data; under the CCPA, ClaimParrot is Customer's service provider. ClaimParrot is an independent controller of the account, billing, website and outreach data described in its Privacy Policy.

ClaimParrot processes Customer Personal Data only on Customer's documented instructions: the Terms, this DPA, the requests Customer sends and the settings it chooses, unless the law requires otherwise (in which case ClaimParrot will tell Customer first, unless the law forbids that). ClaimParrot will tell Customer if, in its opinion, an instruction infringes Data Protection Laws.

Customer is responsible for the lawfulness of its instructions and for having a lawful basis, and any notices or consents needed, to share Customer Personal Data with ClaimParrot.

Confidentiality of personnel

ClaimParrot ensures that everyone it authorizes to process Customer Personal Data is bound by confidentiality, and limits access to the people who need it to provide the service. Today that is the ClaimParrot operator.

Helping Customer comply

Taking into account the nature of the processing, ClaimParrot will help Customer respond to requests from individuals exercising their rights, and with data protection impact assessments, prior consultations and security obligations, to the extent Customer cannot do so itself. If ClaimParrot receives a request directly from an individual about Customer Personal Data, it will pass the request to Customer and will not respond itself, other than to say it has been passed on.

This help is free unless a request is manifestly excessive, in which case ClaimParrot may charge a reasonable fee agreed in advance.

Security incidents

ClaimParrot will notify Customer without undue delay, and in any case within 72 hours, after becoming aware of a Security Incident affecting Customer Personal Data. The notice will describe, as far as known, what happened, the data and individuals affected, the likely consequences and the measures taken or proposed, and will be updated as more becomes known. ClaimParrot will take reasonable steps to contain the incident and to help Customer meet its own notification duties. Notifying an incident is not an admission of fault.

Deletion and return

Customer can download its packets from its account at any time. Customer Personal Data is deleted on the schedule in the Privacy Policy. When the Terms end, ClaimParrot deletes the remaining Customer Personal Data within 90 days, or sooner if Customer asks, unless the law requires ClaimParrot to keep it. Copies in provider backups are overwritten in the providers' normal cycles and are not used for any purpose other than recovery.

Audits and information

ClaimParrot will make available the information reasonably needed to demonstrate compliance with this DPA, including written answers to a reasonable security questionnaire once a year. ClaimParrot does not currently hold a SOC 2 report or ISO 27001 certification.

If that information is not enough, or a supervisory authority requires it, Customer may audit ClaimParrot's compliance at Customer's cost, on at least 30 days' written notice, during business hours, no more than once a year, under confidentiality, and without access to other customers' data.

International transfers

ClaimParrot is established in Kosovo, and its Subprocessors process data in the United States and the other countries listed at claimparrot.com/subprocessors. ClaimParrot transfers Customer Personal Data only with the safeguards Data Protection Laws require.

Where Customer is subject to the GDPR and a transfer to ClaimParrot needs a safeguard, the Standard Contractual Clauses adopted by the European Commission in Implementing Decision (EU) 2021/914, Module Two (controller to processor), are incorporated into this DPA, with these choices: clause 7 (docking) applies; under clause 9, option 2 (general authorization, with the notice period above) applies; the optional wording in clause 11 does not apply; under clauses 17 and 18, the law and courts of Ireland apply; Annexes I and II are the details and measures in this DPA; and the competent supervisory authority is the one determined under clause 13.

For transfers subject to the UK GDPR, the UK International Data Transfer Addendum applies with the same information. For transfers subject to Swiss law, the Clauses apply with references to the GDPR read as references to the Swiss Federal Act on Data Protection, and the Swiss Federal Data Protection and Information Commissioner as a competent authority.

CCPA service provider terms

For personal information subject to the CCPA, ClaimParrot will not sell or share it; will not retain, use or disclose it for any purpose other than providing the service, or outside the direct business relationship with Customer; will not combine it with personal information from other sources except as the CCPA allows; will comply with the CCPA and provide the level of privacy protection it requires; will tell Customer if it can no longer meet these obligations; and allows Customer to take reasonable steps to stop and remedy unauthorized use.

Liability, precedence and governing law

Each party's liability under this DPA is subject to the limitation of liability in the Terms, except where Data Protection Laws or the Standard Contractual Clauses do not allow it. If this DPA conflicts with the Terms, this DPA prevails on data protection matters; the Standard Contractual Clauses prevail over both where they apply.

This DPA is governed by the same law, and disputes go to the same courts, as the Terms, except where the Standard Contractual Clauses require otherwise.