Data Processing Addendum

Effective October 1, 2026

This Data Processing Addendum ("DPA") governs Corialto's processing of personal data on behalf of a business customer when incorporated into a Service Order or otherwise accepted in writing. "Customer Data" means personal data submitted to or processed by Corialto for the configured service.

1. Roles and instructions

Customer determines the purposes and lawful basis for its customer, patient, lead, employee, and business-contact data. Corialto processes Customer Data only on documented Customer instructions and as necessary to provide, secure, support, troubleshoot, and administer the contracted service, or as required by law. Where applicable law assigns different terminology, the parties intend the closest equivalent controller/processor or responsible party/service-provider relationship.

2. Customer obligations

Customer represents that it has a lawful basis to provide Customer Data to Corialto, has delivered required privacy notices, and has obtained required consents or authorizations. Customer must not place regulated sensitive data into the service unless the Service Order expressly permits the relevant data category and all required provider agreements and controls are active.

3. Confidentiality and access

Corialto will limit access to Customer Data to personnel and service providers who need it for authorized purposes and who are subject to confidentiality obligations appropriate to their role.

4. Security

Corialto will maintain reasonable administrative and technical safeguards designed to protect Customer Data against unauthorized access, use, alteration, or disclosure. Safeguards may include access controls, credential protection, encrypted transport, provider-native security controls, logging, and environment separation where available. No security measure eliminates all risk.

5. Subprocessors

Customer authorizes Corialto to use subprocessors reasonably necessary to provide the service. Corialto will require subprocessors that process Customer Data on its behalf to be bound by data-protection obligations appropriate to the services they perform. Current core providers and categories are listed in the Subprocessor & Service Provider Register. Customer may object in writing to a newly added subprocessor on reasonable data-protection grounds; the parties will work in good faith on a practical alternative where feasible.

6. International processing

Customer Data may be processed in Mexico, the United States, and other locations where approved providers operate. Corialto will use applicable contractual and provider safeguards where required and will not represent that a particular transfer mechanism applies unless it actually does.

7. Data minimization and retention

Corialto will configure workflows to collect only information reasonably necessary for the approved business purpose. Retention depends on the Service Order, customer instructions, provider capabilities, operational needs, and legal obligations. On termination, Corialto will delete or return Customer Data under its control within a commercially reasonable period, subject to legal retention duties, backups, provider limitations, and data the Customer retains in its own connected systems.

8. Data-subject requests

Taking into account the nature of the processing and available functionality, Corialto will provide reasonable assistance when Customer receives a valid request for access, correction, deletion, restriction, objection, portability, or equivalent rights relating to Customer Data processed by Corialto. Customer remains responsible for evaluating and responding to the request.

9. Security incidents

Corialto will notify Customer without undue delay after confirming a security incident involving Customer Data under Corialto's control that requires notice under applicable law or the Service Order. Corialto will provide reasonably available information and cooperate with Customer's response. Notification is not an admission of fault or liability.

10. Audits and information

Upon reasonable written request, Corialto will provide information reasonably necessary to demonstrate the data-protection controls relevant to the contracted service, subject to confidentiality, security, provider restrictions, and reasonable limits. On-site audits or extensive custom assessments require separate agreement unless mandated by law.

11. Sensitive data and healthcare

This DPA does not by itself authorize processing of Protected Health Information under HIPAA, payment-card data, government identifiers, biometric data, children's data, or other specially regulated categories. PHI processing requires an executed BAA and a Service Order that identifies the approved healthcare workflow and data path.

12. Order of precedence

If this DPA conflicts with a signed BAA regarding PHI, the BAA controls for PHI. If this DPA conflicts with a customer-specific Service Order regarding processing instructions, the more specific written instruction controls unless prohibited by law.

13. Contact

Privacy and data-processing requests: hello@corialto.com.