Data Processing

1.1. “Protected Health Information” or “PHI”

– has the same meaning as in 45 C.F.R. § 160.103, limited to the information Sylora receives, creates, maintains, or transmits on behalf of Customer through the Service. PHI generally includes individually identifiable health information that is transmitted or maintained in any form or medium, but for the purposes of this DPA, it refers to such information that is electronically maintained or transmitted (ePHI) unless otherwise specified.

1.2. “Business Associate”

– has the meaning given to it under HIPAA (45 C.F.R. § 160.103). In this DPA, Sylora is the Business Associate to Customer (who is a Covered Entity) when processing PHI on Customer's behalf.

1.3. “Covered Entity”

– has the meaning given at 45 C.F.R. § 160.103. For this DPA, Customer is the Covered Entity (e.g., a healthcare provider or clinic) that has engaged Sylora to perform services involving PHI.

1.4. “HIPAA”

– refers to the Health Insurance Portability and Accountability Act of 1996, and the regulations promulgated thereunder, including the Privacy Rule, Security Rule, Breach Notification Rule, and the HITECH Act amendments, as each may be amended from time to time.

1.5. “Personal Data”

– means any information that identifies, relates to, describes, or is reasonably capable of being associated with an individual person or household, and is subject to protection under applicable privacy or data protection laws. This includes, but is not limited to, “personal information” as defined under the California Consumer Privacy Act (CCPA) and its amendments, to the extent applicable. For clarity, Personal Data includes PHI where PHI is concerned, but also covers other personal information Customer may provide (e.g., contact details of Customer's staff).

1.6. “Services”

– means the voice-first AI scribing platform and any related services provided by Sylora to Customer, as described in the Agreement. In the context of this DPA, it is the service during which Sylora might process Personal Data or PHI on behalf of Customer.

1.7. Other definitions:

Terms like “Breach,” “Designated Record Set,” “Individual,” “Minimum Necessary,” “Required by Law,” and “Unsecured PHI” have the same meaning as in the HIPAA regulations. “Subprocessor” means any subcontractor engaged by Sylora who will have access to or process PHI or Personal Data on behalf of Sylora in providing the Services.

2.1. Roles:

For purposes of data protection and privacy law, Customer is the Controller (or “Covered Entity” under HIPAA) with respect to the Personal Data and PHI that it provides to Sylora for processing. Sylora is acting as a Processor (or “Business Associate” under HIPAA) for and on behalf of Customer. Sylora shall process Personal Data and PHI only as a service provider to Customer, and only for the purposes of providing the Services in accordance with the Agreement and this DPA.

2.2. Customer's Control:

Customer remains the data controller/owner of Personal Data and PHI. As such, Customer is responsible for determining the legality of the data processing, obtaining any necessary consents or authorizations (for example, patient authorizations if required for certain uses), and ensuring that instructions given to Sylora are lawful. Customer shall not direct Sylora to process any data in a manner that would violate applicable law. Sylora will inform Customer if, in its opinion, an instruction infringes applicable data protection law, but Sylora is not responsible for performing legal research for Customer.

2.3. Business Associate Agreement:

This DPA is intended to satisfy the requirement for a Business Associate Agreement under 45 C.F.R. § 164.502(e) and § 164.504(e), and reflects the parties' understanding of their obligations under HIPAA. In the event of any conflict between a provision of this DPA and the HIPAA regulations, the HIPAA regulations shall control. The parties agree that any PHI Sylora receives from Customer or creates or receives on behalf of Customer is being done so in the capacity of a Business Associate.

2.4. Service Provider (CCPA):

The parties also acknowledge that Sylora's handling of Personal Data may be subject to certain U.S. state privacy laws. To the extent the California Consumer Privacy Act (CCPA) and its amendments apply:

• Sylora is a “Service Provider” to Customer, and Customer is a “Business.”
• Sylora shall not (i) sell or share Personal Data (as “sell” and “share” are defined in the CCPA), (ii) retain, use, or disclose the Personal Data for any purpose other than providing the Services and as permitted by the Agreement, (iii) retain, use, or disclose the Personal Data outside of the direct business relationship between Sylora and Customer, or (iv) combine Personal Data received from Customer with personal information received from other sources, except as permitted under CCPA (such as for business purposes of performing the contract, or for certain internal purposes like detecting security incidents, etc.). Sylora certifies it understands these restrictions and will comply with them.
• If any other state laws (e.g., Virginia CDPA, Colorado Privacy Act, etc.) apply to the Personal Data, Sylora agrees to cooperate in good faith to comply with any analogous requirements (such as a contractually required prohibition on selling data or additional individual rights assistance).

3.1. Performance of Services:

Sylora is permitted to use and disclose Personal Data and PHI solely for the purpose of providing the Services to Customer in accordance with the Agreement and Customer's instructions. This may include processing PHI to transcribe notes, generate documentation, and perform analytics as part of the Service functionality. Sylora shall not use or disclose PHI except as allowed by this DPA or as Required by Law.

3.2. Prohibited Uses:

Sylora will not use or disclose PHI in a manner that would violate the HIPAA Privacy Rule if done by Customer (Covered Entity). In particular, Sylora will not:

• Use PHI for any of its own marketing or advertising purposes.
• Sell PHI or use or disclose PHI for purposes other than those permitted here. Sylora will apply the HIPAA “minimum necessary” standard to its use and disclosure of PHI, limiting such use or disclosure to the minimum PHI necessary to accomplish the intended purpose.
• Use or disclose Personal Data outside the scope of Customer's instructions or this DPA. Sylora does not have any independent rights to the data and will not attempt to re-identify de-identified data without authorization.

3.3. Internal Management and Legal Responsibilities:

Notwithstanding the foregoing, Sylora is permitted to use and disclose PHI for its proper management and administration or to fulfill any of its legal responsibilities, provided that: (a) any disclosure for such purposes is Required by Law, or (b) Sylora obtains reasonable assurances from the person to whom the PHI is disclosed that it will be held confidentially and used or further disclosed only as Required by Law or for the purpose for which it was disclosed to the person, and that the person will notify Sylora of any instances of which it is aware in which the confidentiality of the PHI has been breached (per 45 C.F.R. § 164.504(e)(4)).

3.4. De-identified Information:

Sylora may de-identify PHI in accordance with 45 C.F.R. § 164.514. De-identified data is not considered PHI or Personal Data under this DPA, and Sylora may use it for any lawful purpose (such as analytics, research, or product development), provided that the de-identification is performed in compliance with HIPAA standards. Sylora will not attempt to re-identify any de-identified data without Customer's express written permission.

3.5. Aggregation Services:

Sylora is permitted to use PHI to perform data aggregation services as defined by HIPAA (45 C.F.R. § 164.504(e)(2)(i)(B)), meaning combining PHI with other data it holds in its capacity as a Business Associate of Customer to permit data analyses that relate to the healthcare operations of Customer. Any aggregated data that does not identify Customer or any individual may be used by Sylora for lawful purposes, provided it meets any necessary de-identification standards or otherwise is permissible under HIPAA.

3.6. Adherence to Privacy Policy:

Sylora will handle Personal Data in accordance with the commitments in its Privacy Policy insofar as they provide additional protections. However, if this DPA or the BAA terms impose stricter obligations than Sylora's general privacy policy, Sylora will adhere to this DPA and BAA for Customer's data.

4.1. Compliance with Security Rule:

Sylora shall implement and maintain appropriate administrative, physical, and technical safeguards to protect the security, confidentiality, and integrity of ePHI as required by the HIPAA Security Rule. Specifically, Sylora will:

• Ensure the confidentiality, integrity, and availability of all ePHI it creates, receives, maintains, or transmits on behalf of Customer.
• Protect against any reasonably anticipated threats or hazards to the security of ePHI, and prevent unauthorized uses or disclosures of ePHI.
• Ensure compliance by its workforce with these security requirements. Measures include (but are not limited to) access controls, encryption, audit logs, secure workstations, and personnel training as described in Sylora's HIPAA Compliance Statement (provided for informational purposes). Sylora will regularly evaluate and modify its safeguards to ensure ongoing protection of PHI.

4.2. No Unauthorized Disclosure:

Sylora will not divulge, copy, transfer, or allow access to the Personal Data or PHI to any third party (except as expressly permitted by this DPA or instructed by Customer). All employees, agents, and subprocessors of Sylora with access to PHI are subject to binding confidentiality obligations and have been trained on handling PHI securely.

4.3. Subprocessors:

Sylora may engage subcontractors to assist in providing the Services. Sylora shall ensure that any Subprocessor that accesses or handles PHI or Personal Data is bound by a written agreement that imposes the same obligations on the Subprocessor as are imposed on Sylora under this DPA. Sylora will restrict Subprocessor access to only what is necessary for them to perform their function. Sylora remains fully liable to Customer for the performance of Subprocessors with respect to their handling of PHI or Personal Data.

4.4. Geographic Limitation:

All Personal Data and PHI processed under this DPA will be stored and processed solely within the United States, unless Customer explicitly agrees otherwise in writing. Sylora will not transfer or permit access to PHI outside of the U.S. (either directly or via remote access) without Customer's prior written consent. This ensures compliance with any regulations or preferences for U.S.-only data residency.

4.5. Access Controls and Minimum Necessary:

Sylora will ensure that only those workforce members who have a legitimate need to perform Services have access to PHI. Sylora will follow the “minimum necessary” rule in 45 C.F.R. § 164.514(d) – only the minimum PHI necessary for a given task will be accessed or used. Sylora has implemented policies to limit access accordingly and conducts periodic access reviews to adjust permissions.

4.6. Security Incident Management:

Sylora will identify and respond to suspected or known security incidents. It will mitigate, to the extent practicable, harmful effects that are known to Sylora of a security incident. Further details on breach notification are in Section 6 below.

4.7. No Improper Alteration:

Sylora will not materially alter or destroy any Personal Data or PHI except as instructed by Customer or as provided for in the Agreement (for example, deletion after a retention period or upon termination). If PHI in Sylora's possession is requested to be amended or corrected, Sylora will assist as per Section 5.2 below.

5.1. Access and Disclosure Accounting:

Should Customer need to provide individuals with access to their PHI or an accounting of disclosures (as per 45 C.F.R. § 164.524 and § 164.528), Sylora will reasonably cooperate. Specifically:

• Access: Upon request, Sylora will provide Customer with the PHI in Sylora's possession that constitutes part of a Designated Record Set, so that Customer can meet its access obligations. If an individual directs a request for access directly to Sylora, Sylora will promptly forward the request to Customer and not provide direct access (unless otherwise required by law or agreed in writing).
• Amendment: If Customer requests Sylora to amend PHI in Sylora's records to correct an error or omission (pursuant to 45 C.F.R. § 164.526), Sylora shall incorporate the amendments as required. Alternatively, Sylora may provide Customer with the capability to make such amendments through the Service. If any request for amendment is received directly by Sylora, Sylora will forward it to Customer.
• Accounting of Disclosures: Sylora will document disclosures of PHI as needed to enable Customer to respond to an individual's request for an accounting of disclosures (per 45 C.F.R. § 164.528). This includes disclosures made by Sylora or its Subprocessors, except for disclosures excluded from the accounting requirement (e.g., for treatment, payment, healthcare operations, and other exceptions under HIPAA). Upon Customer's request, Sylora shall provide an accounting of such disclosures to Customer, including the date of disclosure, the PHI disclosed, and the recipient, so that Customer may fulfill any accounting obligations. If an individual requests an accounting directly from Sylora, Sylora will forward it to Customer.

5.2. Responding to Individuals' Rights (Non-HIPAA):

For Personal Data not governed by HIPAA (for instance, personal information of Customer's personnel or other data subjects under state laws), Sylora shall assist Customer in responding to verifiable requests from individuals to exercise their rights (such as access, deletion, etc.) under applicable privacy laws. For example, if a California resident submits a valid deletion request to Customer and it pertains to data stored on Sylora's systems, Sylora will, upon Customer's instruction, delete the relevant data and confirm to Customer. Sylora will also, upon request, provide reasonable information about the categories of data it processes for Customer if needed for Customer's consumer disclosures.

5.3. Regulatory and Audits:

Sylora will make its internal practices, books, and records relating to the use and disclosure of PHI available to the Secretary of HHS for purposes of determining Customer's or Sylora's compliance with HIPAA (per 45 C.F.R. § 164.504(e)(2)(ii)(I)). Sylora shall promptly inform Customer if such a request is made, unless legally prohibited.

5.4. Customer Audits:

Customer (or an independent auditor acting on Customer's behalf, not a competitor of Sylora) has the right to conduct a reasonable audit or inspection of Sylora's facilities, systems, and documentation directly relevant to the processing of PHI or Personal Data for Customer, in order to assess compliance with this DPA. The following conditions apply:

• Customer must give at least 30 days' written notice of a requested audit, and the parties will mutually agree on the scope, timing, and duration of the audit. Customer will avoid causing disruption to Sylora's business and will conduct audits during normal business hours.
• Customer may perform one such audit in a 12-month period, except additional audits are permitted if a significant data security incident has occurred or as required by a regulator.
• Sylora may require auditors to execute a non-disclosure agreement to protect the confidentiality of Sylora's other clients and security information.
• In lieu of a Customer-conducted audit, Sylora may present recent relevant audit reports by independent third parties (such as a SOC 2 Type II report, ISO 27001 certification, or summary of a HIPAA compliance assessment) that address the controls in question. If such reports sufficiently demonstrate Sylora's compliance, that will satisfy the audit request.
• Customer is responsible for its costs of the audit. If the audit requires Sylora to engage significant resources (beyond a normal level of support), Sylora may reasonably charge for such support, but only after discussing and agreeing with Customer on those costs.
• Any findings from the audit will be discussed and Sylora will take corrective action where reasonably necessary and agreed upon.

5.5. Law Enforcement Requests:

In the event Sylora receives a subpoena, court order, or other request from a law enforcement or governmental authority (including civil or criminal enforcement demands) for disclosure of Personal Data or PHI that belongs to Customer, Sylora will, unless prohibited by law, promptly notify Customer and cooperate with Customer's efforts to limit or contest the disclosure. Sylora will only disclose the information strictly required by the valid legal demand. This aligns with Sylora's obligations under HIPAA to ensure any such disclosures are permissible and that Customer is informed.

6.1. Notification Obligation:

Sylora will report to Customer any use or disclosure of PHI not permitted by this DPA, or any Security Incident that results in unauthorized access, acquisition, use, or disclosure of PHI, of which Sylora becomes aware. In the event Sylora discovers a Breach of Unsecured PHI (as defined in 45 C.F.R. § 164.402) occurring at Sylora or a Subprocessor, Sylora will notify Customer without unreasonable delay and no later than 60 calendar days after discovery of the Breach. It is understood that Customer, as the Covered Entity, will be responsible for determining whether to notify affected individuals, regulators (like HHS), or the media, as required by the HIPAA Breach Notification Rule, but Sylora will assist Customer in doing so.

6.2. Content of Notification:

Sylora's Breach notice to Customer will include, to the extent known at the time:

• A description of the incident, including the date of the Breach and date of discovery.
• A description of the types of PHI involved (such as whether full name, social security number, date of birth, diagnosis, etc., were involved).
• The identification of each individual whose PHI has been, or is reasonably believed by Sylora to have been, accessed, acquired, or disclosed during the Breach (or information on the number of individuals and how Customer can obtain a list of impacted persons).
• Any steps Sylora has taken or will take to investigate the Breach, mitigate harm, and protect against further incidents.
• Contact information for Sylora's incident response coordinator or other relevant contact person.

If any information is not yet available (e.g., we are still determining the full scope of affected data), Sylora may provide an initial notice with known facts and follow up with supplemental information as it becomes available.

6.3. Mitigation:

Sylora will immediately take steps to contain and mitigate the effects of any Breach. This may include isolating affected systems, changing access credentials, applying fixes, and recovering data. Sylora will also take corrective action to prevent a recurrence, such as additional training, discipline for responsible personnel (if applicable), or enhancing security controls.

6.4. Security Incidents:

Sylora will also report to Customer any Security Incident (as defined by HIPAA – attempted or successful unauthorized access, use, disclosure, modification, or destruction of information or interference with system operations) affecting ePHI, of which Sylora becomes aware. However, Customer acknowledges and shall be deemed notified by this section that routine, unsuccessful incidents (like pings, port scans, blocked malware, or unsuccessful login attempts) that do not result in unauthorized access to PHI are not required to be reported, given that they occur frequently and are managed by Sylora's security measures. Sylora will document these non-material incidents and make such documentation available to Customer upon request. Any incident that materially lowers the protection of PHI or potentially compromises it will be treated as a Breach or potential Breach and reported as above.

6.5. Breach Investigation Cooperation:

In the event of a Breach, Sylora will cooperate with Customer's investigation and risk assessment. Sylora will provide any available information Customer needs to evaluate the likelihood of harm and to fulfill any reporting obligations. Sylora will also assist in preparing any required notifications to individuals or regulators if requested (though the responsibility for such notifications remains with Customer unless otherwise agreed).

6.6. Documentation:

Sylora shall maintain documentation of all reported Breaches and Security Incidents, including their results and Sylora's response. This documentation will be retained for at least six years (HIPAA requirement) and provided to Customer or regulators upon request, as needed for compliance verification.

7.1. Term:

This DPA is effective as of the effective date of the Agreement (or as of the date PHI is first provided to Sylora, if later) and shall continue until Sylora no longer processes any Personal Data or PHI on behalf of Customer (for example, until the Agreement is terminated or expires and all data is returned or deleted).

7.2. Termination for Breach:

If Customer becomes aware of a material breach of this DPA by Sylora, Customer may provide written notice to Sylora describing the breach and afford Sylora an opportunity to cure the breach within 30 days. If Sylora does not cure the breach within the cure period, Customer may terminate the Agreement and this DPA. Under HIPAA, if Customer reasonably determines that Sylora has violated a material term of this BAA and cure is not possible, Customer may terminate this DPA and the underlying Services. Conversely, if Sylora determines that Customer has breached its obligations under HIPAA or this DPA (for instance, by misusing the Service in a way that causes Sylora to violate HIPAA), Sylora will notify Customer and provide an opportunity to cure. If Customer fails to cure, Sylora may terminate the Agreement insofar as it relates to processing of PHI (and possibly cease the Services), consistent with 45 C.F.R. § 164.504(e)(2)(iii).

7.3. Instructions upon Termination:

Upon termination or expiration of the Agreement, Customer will have the opportunity to retrieve its data as per the Agreement (see Terms of Service – typically a 30-day period for data export). After such period, or upon Customer's sooner written instruction, Sylora will proceed with data deletion as described below.

7.4. Return or Destruction of Data:

Except as provided in subsection 7.5, upon termination of the Services and this DPA, Sylora will return or securely destroy all PHI and Personal Data in its possession or control that was received from Customer, or created/received on behalf of Customer. Sylora will not retain any copies of PHI, except as required for the purposes below. This requirement applies to PHI in the possession of Sylora's subcontractors as well – Sylora will ensure they likewise return or destroy PHI. If Customer opts for return of data, Sylora will provide the data in a commonly accessible format. If destruction is requested, Sylora will use industry-standard methods (such as NIST 800-88 guidelines for media sanitization) to irreversibly delete electronic data, and will shred or pulverize any physical media containing PHI.

7.5. Infeasibility of Return/Destruction:

If Sylora determines that returning or destroying certain PHI is not feasible (for instance, if it is stored in backups that are impractical to isolate, or if retention is required by law), Sylora shall notify Customer of the specific reasons. In such cases, Sylora will extend the protections of this DPA to the retained PHI and will limit further uses/disclosures of that PHI to those purposes that make the return or destruction infeasible, for as long as Sylora maintains the PHI. For example, PHI stored in encrypted backups may be retained until those backups are overwritten or become obsolete, but Sylora will not use the PHI in any live environment and will continue to safeguard it.

7.6. Certification:

Upon Customer's request, Sylora will certify in writing that it has returned or destroyed all PHI as required at the conclusion of the DPA, or that return/destruction was infeasible and that extended protections are being applied (as per 45 C.F.R. § 164.504(e)(2)(ii)(J)).

7.7. Survival:

All obligations in this DPA that by their nature should survive termination (including confidentiality, security, breach notification, and the requirement to protect any retained PHI) shall survive the termination of the DPA until all PHI is either returned or destroyed or protections are no longer needed.

8.1. Hierarchy:

In the event of any conflict between a provision of this DPA and a provision of the Terms of Service or other underlying agreement between the parties, the provision of this DPA shall control with regard to the parties' privacy and security obligations for Personal Data. All other provisions of the underlying agreement remain in effect and apply to the extent not inconsistent with this DPA.

8.2. Amendments:

This DPA may be amended only by a written instrument signed by both parties. However, the parties agree to take such action as is necessary to amend this DPA from time to time as required for compliance with HIPAA or other applicable privacy laws. For example, if there are changes to HIPAA regulations or new state laws that require certain contract terms, the parties will negotiate in good faith to incorporate those. If any aspect of this DPA is found to be not compliant with the law, the parties will amend it to ensure compliance.

8.3. Indemnification:

[Optional provision, depending on parties' agreement: Each party shall indemnify and hold harmless the other party from and against any and all claims, liabilities, penalties, fines, costs, or expenses (including reasonable attorneys' fees) resulting from the party's breach of this DPA or its violation of HIPAA with respect to PHI handled under this DPA. For clarity, Sylora will indemnify Customer for breaches caused by Sylora's failure to comply with its obligations, and Customer will indemnify Sylora for breaches or violations caused by Customer's instructions or misuse of the Services.]

8.4. Limitation of Liability:

[If the main agreement includes a limitation of liability, specify how it applies: The limitation of liability provisions in the Agreement apply to this DPA. However, such limitations shall not apply to any fines or penalties imposed on either party by regulators (to the extent those cannot be limited by contract) or liabilities arising from a party's gross negligence or willful misconduct in relation to PHI.]

8.5. No Third-Party Beneficiaries:

There are no third-party beneficiaries to this DPA. The individuals whose data is processed are not third-party beneficiaries, and this DPA does not grant them any rights or causes of action. The rights and obligations are only between Customer and Sylora.

8.6. Interpretation:

Any ambiguity in this DPA shall be resolved in favor of a meaning that permits compliance with HIPAA and applicable privacy laws. This DPA shall be interpreted as broadly as necessary to implement and comply with those laws. The headings are for reference only and do not affect interpretation.

8.7. Governing Law:

This DPA is governed by the same law as the underlying Agreement, except to the extent that law is preempted by federal law (such as HIPAA). The forum and venue for disputes under this DPA shall be the same as for the Agreement. However, any provision required by HIPAA or other privacy law is governed by that law.

8.8. Notices:

All notices required by this DPA (such as breach notification or notices of new subprocessors) shall be given in accordance with the notice provisions of the Agreement. In addition, a copy of any data breach notification shall be sent to the Privacy or Security Officer of the other party (if designated). Notices regarding an amendment of this DPA or other legal notices should be addressed to the signatories or their successors.