Data Processing Addendum

Effective Date: [Effective Date]
Last Updated: [Last Updated Date]
Version: [Version Number] · [Link to prior versions]

Draft notice. This document is provided for informational purposes and as a high-quality starting draft. It does not constitute legal advice. Axiogen's actual policies and agreements must be reviewed, customized, and approved by qualified legal counsel licensed in the relevant jurisdictions before publication or use.

This Data Processing Addendum ("DPA") forms part of the Terms of Service, Master Services Agreement, or other agreement (the "Agreement") between Axiogen AI Inc. ("Axiogen"), and the customer identified in the Agreement ("Customer"). It applies to the extent Axiogen processes Customer Personal Data (defined below) on Customer's behalf in providing the Services.

How this DPA is executed. This DPA is incorporated automatically into the Agreement where Customer Content includes Personal Data. Customers who require a countersigned copy may complete the signature block in Annex IV and return it to [Legal Contact Email]. Where Customer has signed a separate data processing agreement with Axiogen, that agreement governs to the extent of any conflict.

1. Definitions

Capitalized terms not defined here have the meanings given in the Agreement.

"Applicable Data Protection Law" means all laws and regulations applicable to the Processing of Personal Data under the Agreement, including, as applicable, (a) the EU General Data Protection Regulation 2016/679 ("GDPR"); (b) the GDPR as incorporated into UK law by the Data Protection Act 2018 and the UK GDPR ("UK GDPR"); (c) the Swiss Federal Act on Data Protection ("FADP"); (d) the California Consumer Privacy Act, as amended by the California Privacy Rights Act, and its regulations ("CCPA"); and (e) other U.S. state comprehensive privacy laws ("U.S. State Privacy Laws").
"Axiogen Data" means Axiogen's proprietary dataset of practice, provider, and professional information and derived analytics, as defined in the Agreement. Axiogen Data is not Customer Personal Data (see Section 2.3).
"Customer Personal Data" means Personal Data contained in Customer Content that Axiogen Processes on behalf of Customer in the course of providing the Services.
"Data Subject," "Personal Data," "Processing," "Controller," "Processor," "Personal Data Breach," and "Supervisory Authority" have the meanings given in the GDPR; "Business," "Service Provider," "Consumer," "Sell," and "Share" have the meanings given in the CCPA; and equivalent terms in other Applicable Data Protection Law are construed accordingly.
"EU SCCs" means the Standard Contractual Clauses annexed to European Commission Implementing Decision (EU) 2021/914.
"UK Addendum" means the International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner under s.119A of the Data Protection Act 2018.
"Restricted Transfer" means a transfer of Personal Data to a country that does not ensure an adequate level of protection under Applicable Data Protection Law, where such transfer would be prohibited without an appropriate safeguard.
"Security Incident" means a Personal Data Breach affecting Customer Personal Data.
"Sub-processor" means any third party engaged by Axiogen to Process Customer Personal Data.
"Services" means the Axiogen platform, API, and related services described in the Agreement.

2. Roles and scope

2.1 Customer as Controller; Axiogen as Processor

For Customer Personal Data, Customer is the Controller (or, where Customer acts on behalf of another controller, a Processor) and Axiogen is the Processor. Under the CCPA, Customer is a Business and Axiogen is a Service Provider.

2.2 Customer instructions

Axiogen will Process Customer Personal Data only on Customer's documented instructions, which consist of: (a) the Agreement and this DPA; (b) Customer's and its Authorized Users' configuration of and use of the Services; and (c) other written instructions agreed by the parties. Axiogen will inform Customer if, in its opinion, an instruction infringes Applicable Data Protection Law, without obligation to conduct a legal review. Axiogen may Process Customer Personal Data as required by law, in which case it will inform Customer of the legal requirement before Processing unless the law prohibits this on important grounds of public interest.

2.3 Axiogen Data — independent Controllers

Axiogen Data, and any Personal Data it contains about healthcare professionals and practice personnel, is collected and maintained by Axiogen as an independent Controller, as described in the Privacy Policy. When Customer accesses and uses Axiogen Data, Customer does so as a separate and independent Controller of its own Processing. Each party is individually responsible for its own compliance with Applicable Data Protection Law in respect of Axiogen Data, including providing notices to, and honoring the rights of, Data Subjects. The parties are not joint Controllers. The Processor obligations in this DPA do not apply to Axiogen Data, but the parties will cooperate in good faith to route and respond to Data Subject requests relating to Axiogen Data (see Section 8.3).

2.4 Customer obligations

Customer will (a) ensure it has a lawful basis and has provided all notices and obtained all consents required for Axiogen to Process Customer Personal Data as contemplated by the Agreement; (b) not upload to the Services any special categories of Personal Data, Protected Health Information, or other sensitive data unless the Services are configured to accept it and, for Protected Health Information, a Business Associate Agreement is in place (see HIPAA & Business Associate Information); and (c) configure and use the Services in a manner consistent with Applicable Data Protection Law.

3. Details of Processing

The subject matter, duration, nature and purpose of Processing, types of Personal Data, and categories of Data Subjects are set out in Annex I.

4. Processor obligations

Axiogen will:

Confidentiality. Ensure that personnel authorized to Process Customer Personal Data are bound by confidentiality obligations and receive appropriate data-protection and security training.
Security. Implement and maintain the technical and organizational measures described in Annex II and in the Security & Trust Overview, and not materially reduce the overall level of protection during the term of the Agreement.
Sub-processors. Engage Sub-processors only in accordance with Section 5.
Assistance. Provide the assistance described in Section 8.
Breach notification. Notify Customer of Security Incidents in accordance with Section 7.
Deletion and return. Delete or return Customer Personal Data in accordance with Section 10.
Audit. Make available the information and permit the audits described in Section 9.
Records. Maintain records of Processing activities carried out on behalf of Customer as required by Article 30(2) GDPR.
Purpose limitation. Not Process Customer Personal Data for any purpose other than providing the Services, and in particular not use Customer Personal Data to train or improve models made available to other customers, and not combine Customer Personal Data with Axiogen Data except as necessary to provide the Services to Customer.

5. Sub-processors

5.1 General authorization

Customer authorizes Axiogen to engage the Sub-processors listed at [Link to current Sub-processor List] (also summarized in Annex III) and to engage additional or replacement Sub-processors in accordance with this Section.

5.2 Notice of changes and objection right

Axiogen will give Customer at least [30] days' prior notice of any new Sub-processor, by updating the Sub-processor List and by [email to Customer's designated contact / subscription mechanism at the Sub-processor List page]. Customer may object in writing within that period on reasonable, documented data-protection grounds. The parties will discuss the objection in good faith; if Axiogen cannot reasonably accommodate it (for example, by not using the Sub-processor for Customer's data), Customer may terminate the affected Services on written notice and receive a pro-rata refund of prepaid, unused fees.

5.3 Sub-processor obligations

Axiogen will impose on each Sub-processor, by written contract, data-protection obligations that are substantially no less protective than those in this DPA, and will remain liable to Customer for the performance of each Sub-processor's obligations.

5.4 AI model providers

Where Axiogen uses third-party AI or machine-learning model providers as Sub-processors, Axiogen will contractually require that such providers do not use Customer Personal Data to train, retrain, or improve their models and do not retain inputs or outputs beyond what is necessary to provide the service to Axiogen (or a short abuse-monitoring window disclosed in the Sub-processor List).

6. International transfers

6.1 Hosting location

Axiogen hosts the Services in the United States [and offers hosting in [EU / other region] where specified in the Order Form]. Customer Personal Data may be accessed from other countries by Axiogen personnel and Sub-processors for support and operations, as disclosed in the Sub-processor List.

6.2 Transfer mechanism

To the extent the Processing involves a Restricted Transfer, the parties agree that:

EU transfers. The EU SCCs are incorporated by reference and apply as follows: Module Two (Controller to Processor) applies where Customer is a Controller, and Module Three (Processor to Processor) applies where Customer is a Processor; Clause 7 (docking) is included; under Clause 9, Option 2 (general written authorization) applies with the notice period in Section 5.2; the optional language in Clause 11(a) is not included; under Clause 17, the governing law is the law of [Ireland / Member State]; under Clause 18, the courts of [Ireland / Member State] have jurisdiction; Annex I and Annex II of the EU SCCs are populated by Annex I and Annex II of this DPA; and the Supervisory Authority in Annex I.C is determined in accordance with Clause 13.
UK transfers. The EU SCCs as modified by the UK Addendum apply; Tables 1–3 of the UK Addendum are completed with the information in the Agreement and Annexes I–III; for Table 4, either party may end the UK Addendum as set out in Section 19 of the UK Addendum.
Swiss transfers. The EU SCCs apply with the modifications required by the Swiss Federal Data Protection and Information Commissioner, including that references to the GDPR are read as references to the FADP, the competent authority is the FDPIC, and Data Subjects in Switzerland may enforce their rights in Switzerland.
Data Privacy Framework. [If and when Axiogen is certified:] Axiogen participates in the EU-U.S. Data Privacy Framework, the UK Extension, and the Swiss-U.S. DPF, and transfers from the EEA, UK, and Switzerland to Axiogen in the United States may rely on that certification; the SCCs apply as a fallback if the certification is invalidated. [CONFIRM CERTIFICATION STATUS; otherwise delete.]
Other jurisdictions. Where Applicable Data Protection Law of another jurisdiction requires a specific transfer mechanism, the parties will cooperate to put it in place.

6.3 Transfer impact and government access

Axiogen represents that, as of the Effective Date, it has not received any legally binding request from a public authority for access to Customer Personal Data and is not aware of any law or practice that would prevent it from fulfilling its obligations under the SCCs. Axiogen will (a) review the legality of any government access request and challenge it where there are reasonable grounds; (b) notify Customer of the request where legally permitted; and (c) disclose only the minimum information required. Axiogen will maintain a [transparency report / summary of government requests] available on request.

7. Security Incident notification

Axiogen will notify Customer without undue delay, and in any event within [48 / 72] hours, after becoming aware of a Security Incident. The notification will, to the extent then known, describe the nature of the Security Incident, the categories and approximate number of Data Subjects and records concerned, the likely consequences, the measures taken or proposed, and a point of contact. Axiogen will provide updates as further information becomes available, take reasonable steps to contain and remediate the Security Incident, and cooperate with Customer's reasonable requests for information to enable Customer to meet its own notification obligations. Axiogen's notification of, or response to, a Security Incident is not an acknowledgment of fault or liability. Axiogen will not notify Data Subjects, Supervisory Authorities, or the public of a Security Incident affecting Customer Personal Data without Customer's prior consent, unless required by law.

8. Assistance to Customer

8.1 Data Subject requests

Axiogen will, taking into account the nature of the Processing, assist Customer by appropriate technical and organizational measures in fulfilling Customer's obligation to respond to Data Subject requests (access, rectification, erasure, restriction, portability, objection). The Services include self-service functionality for Customer to access, correct, export, and delete Customer Personal Data. If Axiogen receives a request directly from a Data Subject that relates to Customer Personal Data, Axiogen will, where it can identify the Customer, promptly forward the request to Customer and will not respond substantively except to confirm that the request has been forwarded, unless required by law.

8.2 DPIAs and prior consultation

Axiogen will provide reasonable assistance to Customer in conducting data protection impact assessments and prior consultations with Supervisory Authorities, to the extent they relate to the Services and Customer cannot obtain the necessary information from the Documentation, the Security & Trust Overview, or Axiogen's security packet.

8.3 Requests relating to Axiogen Data

Requests from healthcare professionals relating to Axiogen Data (as independent-Controller data) are handled by Axiogen under its Privacy Policy. If Customer receives such a request, it may forward it to [Data Protection Officer / Privacy Contact Email]; if Axiogen applies a suppression or correction to a record, that change will be reflected in the Services for all customers.

8.4 Costs

Assistance under Section 8.2 beyond what is generally made available to all customers may be charged at Axiogen's then-current professional-services rates.

9. Audits

9.1 Information and reports

Axiogen will make available to Customer all information reasonably necessary to demonstrate compliance with this DPA, including [the most recent SOC 2 Type II report — if issued], summaries of penetration-test results, security policies, and completed industry-standard security questionnaires, on request and subject to confidentiality obligations (the "Security Packet"). See [Link to request SOC 2 report under NDA].

9.2 Audits

Where Customer reasonably determines that the Security Packet does not provide sufficient information to verify Axiogen's compliance, or where an audit is required by a Supervisory Authority or Applicable Data Protection Law, Customer (or an independent auditor mandated by Customer and reasonably acceptable to Axiogen, bound by confidentiality) may conduct an audit of Axiogen's Processing of Customer Personal Data, subject to the following: (a) no more than once per 12-month period, except following a Security Incident or where required by a Supervisory Authority; (b) at least [30] days' written notice; (c) during normal business hours and in a manner that does not unreasonably interfere with Axiogen's operations or compromise the security of other customers; (d) the scope and plan of the audit to be agreed in advance; (e) Customer bears its own costs and reimburses Axiogen's reasonable costs for audits exceeding [two] business days; and (f) audit findings are Axiogen Confidential Information. Audits of Sub-processors' facilities are conducted through the audit rights Axiogen holds in its contracts with those Sub-processors.

10. Return and deletion of Customer Personal Data

During the term, Customer may export Customer Personal Data using the Services' export functionality and API. Upon termination or expiration of the Agreement, Axiogen will make Customer Personal Data available for export for [30] days and will thereafter delete all Customer Personal Data (including copies held by Sub-processors) within [90] days, unless retention is required by applicable law, in which case Axiogen will isolate and protect the retained data and delete it when the requirement ends. Backup copies are overwritten in the ordinary course of Axiogen's backup rotation, not to exceed [35] days after deletion from production. On request, Axiogen will certify deletion in writing.

11. CCPA and U.S. State Privacy Law terms

To the extent the CCPA or U.S. State Privacy Laws apply to Customer Personal Data, Axiogen, as a Service Provider / Processor:

will not Sell or Share Customer Personal Data;
will not retain, use, or disclose Customer Personal Data for any purpose other than the business purposes specified in the Agreement, or outside the direct business relationship between the parties;
will not combine Customer Personal Data with Personal Data it receives from other sources, except as permitted by the CCPA regulations (for example, to detect security incidents or to perform services on behalf of Customer);
will comply with applicable obligations under the CCPA and provide the same level of privacy protection as required of Businesses;
will notify Customer if it determines it can no longer meet its obligations under the CCPA;
grants Customer the right to take reasonable and appropriate steps to ensure Axiogen uses Customer Personal Data consistently with Customer's obligations, and to stop and remediate unauthorized use; and
certifies that it understands and will comply with the restrictions in this Section.

For clarity, this Section does not apply to Axiogen Data, in respect of which Axiogen is an independent Business / Controller (see Section 2.3 and the Privacy Policy).

12. Liability and precedence

Each party's liability arising out of or relating to this DPA, including the SCCs, is subject to the exclusions and limitations of liability in the Agreement, except to the extent Applicable Data Protection Law or the SCCs prohibit such limitation as between the parties. Nothing in this DPA limits a Data Subject's rights under the SCCs.
In the event of conflict, the following order of precedence applies: (a) the SCCs (for Restricted Transfers); (b) this DPA; (c) the Agreement.
This DPA will remain in effect for as long as Axiogen Processes Customer Personal Data.
Axiogen may update this DPA from time to time to reflect changes in Applicable Data Protection Law or the Services, provided that no update materially reduces the protection afforded to Customer Personal Data. Material updates will be notified to Customer at least [30] days in advance.
This DPA is governed by the law governing the Agreement, except where the SCCs require otherwise.

Annex I — Details of Processing

A. List of parties

	Data exporter (Customer)	Data importer (Axiogen)
Name	As set out in the Agreement	Axiogen AI Inc.
Address	As set out in the Agreement	[Registered Address]
Contact	Customer's designated privacy or account contact	[Data Protection Officer / Privacy Contact Email]
Role	Controller (or Processor, where applicable)	Processor
Activities relevant to the transfer	Use of the Services for commercial, medical-affairs, insights, and compliance purposes	Provision of the Services as described in the Agreement
Signature and date	Per the Agreement	Per the Agreement

B. Description of Processing

Item	Description
Subject matter	Provision of the Axiogen platform, API, and related services to Customer, including hosting, storage, processing, analysis, and display of Customer Content.
Duration	The term of the Agreement plus the export and deletion periods in Section 10.
Nature of Processing	Collection (via upload, integration, or user input), storage, organization, structuring, matching against Axiogen Data, analysis, scoring, display, retrieval, transmission to Authorized Users and Customer-designated integrations, export, and deletion.
Purpose of Processing	To enable Customer to plan and manage commercial and medical engagement with healthcare professionals and practices, to analyze markets and territories, to document outreach for compliance review, and otherwise as instructed by Customer through the Services.
Categories of Data Subjects	(1) Customer Users — employees, contractors, and agents of Customer and its authorized affiliates who hold Platform accounts. (2) Healthcare professionals and practice personnel whose Personal Data Customer uploads or creates in the Services (for example, CRM contact records, call notes, interaction history, consent flags, and Customer's own classifications), in their professional capacity. (3) Customer's business contacts incidentally referenced in Customer Content. Customer should not upload Personal Data of patients; see Section 2.4.
Types of Personal Data	For Customer Users: name, work email, job title, role and territory, authentication identifiers and SSO/SCIM attributes, IP address, device and browser information, activity and audit logs. For healthcare professionals and practice personnel: name, professional identifiers (e.g., NPI, license number), practice affiliation, business contact details, Customer's interaction notes and history, Customer's segmentation and targeting attributes, consent and communication-preference flags, and records of outreach sent through the Services.
Special categories / sensitive data	None intended. Customer must not upload special categories of Personal Data or Protected Health Information unless separately agreed (see HIPAA & Business Associate Information).
Frequency of transfer	Continuous, for the duration of the Agreement.
Retention	As set out in Section 10 and the Agreement.
Sub-processor transfers	As set out in Annex III and the Sub-processor List.

C. Competent Supervisory Authority

Determined in accordance with Clause 13 of the EU SCCs. [For UK transfers: the Information Commissioner's Office. For Swiss transfers: the Federal Data Protection and Information Commissioner.]

Annex II — Technical and Organizational Measures

Axiogen maintains the following measures, which are described in more detail in the Security & Trust Overview and in the Security Packet available on request. Axiogen may update these measures from time to time provided the overall level of security is not materially reduced.

Domain	Measures
Information security program and governance	Documented security policies reviewed at least annually; an accountable security lead [title]; risk assessments conducted at least annually and upon significant change; security and privacy training for all personnel at onboarding and at least annually; background checks for personnel with access to production systems where permitted by law.
Certifications and attestations	[SOC 2 Type II — if issued, state scope and period; if in progress, state status. Do not list certifications not held.]
Access control	Single sign-on via SAML with multi-factor authentication for Customer Users and Axiogen personnel; automated user provisioning and deprovisioning via SCIM; role-based access control with least-privilege defaults; row-level access controls enforcing tenant isolation and Customer-defined data scopes (e.g., territory); periodic access reviews for production systems; privileged access restricted, time-bound where feasible, and logged.
Encryption	Data encrypted in transit using TLS 1.3; data encrypted at rest using AES-256; encryption keys managed through a cloud key-management service with restricted access and rotation; secrets stored in a dedicated secrets manager, never in source code.
Tenant isolation	Logical separation of each Customer's data enforced at the application and database layers; Customer Content is never exposed to other customers and is not used to train shared models.
Network and infrastructure security	Services hosted with [Cloud Provider] in [U.S. region(s)]; network segmentation with private subnets for data stores; firewalls and security groups configured for least access; DDoS mitigation and web application firewall; hardened, centrally managed configuration; no direct public access to databases.
Application security and secure development	Secure SDLC with code review required for all changes; static analysis and dependency vulnerability scanning in CI/CD; separation of development, staging, and production environments; no production data in non-production environments except as de-identified; infrastructure as code with change tracking.
Vulnerability management	Continuous automated vulnerability scanning; [annual — confirm cadence] penetration testing by an independent third party; remediation SLAs by severity [e.g., critical within 7 days, high within 30 days — confirm]; coordinated vulnerability disclosure program (see Contact).
Logging, monitoring, and detection	Immutable, tamper-evident audit log of user and administrative actions; centralized security logging; automated alerting on anomalous activity; log retention of [period].
Incident response	Documented incident response plan with defined roles, severity levels, and escalation paths; plan tested at least annually; Customer notification in accordance with Section 7 of this DPA; post-incident review and corrective actions.
Business continuity and disaster recovery	Encrypted backups taken at least daily and stored in a separate location; documented recovery objectives [RPO / RTO — confirm]; backup restoration tested at least annually; multi-availability-zone deployment for core services.
Physical security	Hosting in data centers operated by [Cloud Provider], which maintain physical access controls, environmental protections, and independent audits (e.g., SOC 2, ISO 27001). Axiogen personnel have no physical access to hosting infrastructure.
Data minimization, quality, and retention	Provenance metadata recorded for Axiogen Data; retention schedules implemented per Section 10; data returned or deleted at end of term; secure deletion procedures.
Vendor and Sub-processor management	Security and privacy due diligence before onboarding; written contracts with data-protection terms; periodic reassessment; Sub-processor List maintained and published.
AI and model safeguards	No training of shared models on Customer Content; AI features operate within the requesting user's access permissions; third-party model providers contractually prohibited from training on Axiogen inputs or outputs; model outputs logged for audit; human-in-the-loop design for outreach content.
Personnel and confidentiality	Confidentiality agreements for all personnel; acceptable-use policy; device management with disk encryption and screen lock; immediate access revocation on departure.
Data portability and deletion	Self-service export via the Platform and API; deletion on request and at end of term; certification of deletion on request.
Accountability	Records of Processing maintained; DPIA support as described in Section 8.2; data-protection point of contact at [Data Protection Officer / Privacy Contact Email].

Annex III — Sub-processors

The current list of Sub-processors, including name, purpose, location of Processing, and the transfer mechanism relied upon, is maintained at [Link to current Sub-processor List]. Customer may subscribe to notifications of changes at that page. As of the Effective Date, the categories of Sub-processors are:

Category	Purpose	Location	[Sub-processor name — to be completed]
Cloud infrastructure and hosting	Compute, storage, database, networking, key management	United States [and other region(s) where selected]	[●]
AI / machine-learning model services	Language-model inference for Platform features, under no-training terms	United States	[●]
Email and notification delivery	Transactional email, alerts	United States	[●]
Customer support and ticketing	Support case management	United States	[●]
Product analytics and monitoring	Application performance and error monitoring, usage analytics	United States	[●]
Identity and access	SSO / SCIM integration [if third-party]	United States	[●]
[Other]	[●]	[●]	[●]

Axiogen's affiliates, if any, that may Process Customer Personal Data for support purposes: [●].

Annex IV — Signature block (optional)

Where Customer requires a countersigned DPA:

	Customer	Axiogen
Entity		Axiogen AI Inc.
Signature
Name
Title
Date