OpenCoreEMR Data Processing Addendum

This Data Processing Addendum (“DPA”) is an Attachment to the Agreement. This Version 1.1 restates and replaces the version of this DPA last updated June 12, 2026. A record of changes from the prior version is maintained at https://opencoreemr.com/dpa/version-history/.

1. Definitions

1.1. “Agreement” means the agreement between Customer and OpenCoreEMR (the OpenCoreEMR Terms of Service, a SaaS Agreement, or other commercial agreement between the parties with a different title).

1.2. “Audit” and “Audit Parameters” are defined in Section 9.3 below.

1.3. “Audit Report” is defined in Section 9.2 below.

1.4. “Controller” means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of Processing of Personal Data.

1.5. “Customer Instructions” is defined in Section 3.1 below.

1.6. “Customer Personal Data” means Personal Data in Customer Data (as defined in the Agreement).

1.7. “Data Protection Laws” means all laws and regulations applicable to the Processing of Customer Personal Data under the Agreement, including, as applicable: (i) the California Consumer Privacy Act, as amended by the California Privacy Rights Act, and any binding regulations promulgated thereunder (“CCPA”), (ii) the General Data Protection Regulation (Regulation (EU) 2016/679) (“EU GDPR” or “GDPR”), (iii) the Swiss Federal Act on Data Protection (“FADP”), (iv) the EU GDPR as it forms part of the law of England and Wales by virtue of section 3 of the European Union (Withdrawal) Act 2018 (the “UK GDPR”), (v) the UK Data Protection Act 2018 and (vi) the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations, including the HIPAA Privacy Rule (45 C.F.R. Part 164 Subpart E) and the HIPAA Security Rule (45 C.F.R. Part 164 Subpart C), as amended by the Health Information Technology for Economic and Clinical Health Act (“HIPAA”); in each case, as updated, amended or replaced from time to time.

1.8. “Data Subject” means the identified or identifiable natural person to whom Customer Personal Data relates.

1.9. “De-Identified Data” has the meaning given in the Agreement, and includes data derived from audio or video recordings and transcriptions thereof.

1.10. “DPA Effective Date” is specified on the DPA Setup Page.

1.11. “DPA Setup Page” means a separate document executed by Customer and OpenCoreEMR which causes this DPA to become an Attachment to their Agreement. If the DPA is integrated into the Agreement, then this means the relevant sections of the Agreement. Where Customer has accepted the OpenCoreEMR Terms of Service online rather than executing a separately negotiated agreement, the Terms of Service constitute the DPA Setup Page and the Agreement for purposes of this DPA. In that case: (a) the DPA Effective Date is the Effective Date of the Terms of Service; (b) the Subprocessor List is located at https://www.opencoreemr.com/subprocessors; and (c) the default Schedules identified in Section 1.19 apply.

1.12. “EEA” means European Economic Area.

1.13. “Key Terms” means Agreement, DPA Effective Date and Subprocessor List as specified by the parties on the DPA Setup Page.

1.14. “Patient Authorization” means a valid authorization from an individual meeting the requirements of 45 C.F.R. § 164.508, including, where applicable, the statement required by 45 C.F.R. § 164.508(a)(4) that the disclosure will result in remuneration to OpenCoreEMR.

1.15. “Personal Data” means information about an identified or identifiable natural person or which otherwise constitutes “personal data”, “personal information”, “personally identifiable information” or similar terms as defined in Data Protection Laws.

1.16. “Processing” and inflections thereof refer to any operation or set of operations that is performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

1.17. “Processor” means a natural or legal person, public authority, agency or other body which Processes Personal Data on behalf of the Controller.

1.18. “Restricted Transfer” means: (i) where EU GDPR applies, a transfer of Customer Personal Data from the EEA to a country outside the EEA that is not subject to an adequacy determination, (ii) where UK GDPR applies, a transfer of Customer Personal Data from the United Kingdom to any other country that is not subject to an adequacy determination or (iii) where FADP applies, a transfer of Customer Personal Data from Switzerland to any other country that is not subject to an adequacy determination.

1.19. “Schedules” means one or more schedules incorporated by the parties in their DPA Setup Page. The default Schedules for this DPA are:

Schedule 1 - Subject Matter and Details of Processing

Schedule 2 - Technical and Organizational Measures

Schedule 3 - Cross-Border Transfer Mechanisms

Schedule 4 - Region-Specific Terms

1.20. “Security Incident” means any breach of security that leads to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data being Processed by OpenCoreEMR.

1.21. “Specified Notice Period” is 72 hours.

1.22. “Subprocessor” means any third party authorized by OpenCoreEMR to Process any Customer Personal Data.

1.23. “Subprocessor List” means the list of OpenCoreEMR’s Subprocessors as identified here: https://www.opencoreemr.com/subprocessors.

2. Scope and Duration

2.1. Roles of the Parties. This DPA applies to OpenCoreEMR as a Processor of Customer Personal Data and to Customer as a Controller or Processor of Customer Personal Data.

2.2. Scope of DPA. This DPA applies to OpenCoreEMR’s Processing of Customer Personal Data under the Agreement to the extent such Processing is subject to Data Protection Laws. This DPA is governed by the governing law of the Agreement unless otherwise required by Data Protection Laws. Except in connection with a Security Incident, OpenCoreEMR reserves the right to charge Customer for any excessive or non-standard assistance provided in connection with this DPA, including but not limited to support with audits, questionnaires, and/or Data Subject or other information requests, that materially exceeds the scope reasonably necessary for routine compliance with this DPA and Data Protection Laws. Such fees will be charged at OpenCoreEMR’s then-current rates, with prior written notice to Customer.

2.3. Duration of DPA. This DPA commences on the DPA Effective Date and terminates upon expiration or termination of the Agreement (or, if later, the date on which OpenCoreEMR has ceased all Processing of Customer Personal Data), subject to Section 2.7.

2.4. Order of Precedence. In the event of a conflict among the documents comprising the agreement between the parties, the following order of precedence shall apply: (a) any separately negotiated written agreement between the parties, signed by authorized representatives of both parties; (b) any Standard Contractual Clauses or other measures to which the parties have agreed in Schedule 3 (Cross-Border Transfer Mechanisms) or Schedule 4 (Region-Specific Terms), solely with respect to Restricted Transfers; (c) the BAA, solely with respect to PHI and subject to subsection (d); (d) the provisions of the Agreement governing De-Identified Data, solely with respect to their subject matter; (e) this DPA; and (f) the remainder of the Agreement. The absence from a higher-ranked document of a provision addressing a subject covered by a lower-ranked document shall not be deemed a conflict. To the fullest extent permitted by Data Protection Laws, any claims brought in connection with this DPA (including its Schedules) will be subject to the terms and conditions, including, but not limited to, the exclusions and limitations, set forth in the Agreement.

2.5. HIPAA Business Associate Agreement. To the extent OpenCoreEMR Processes Protected Health Information (“PHI”) as defined under HIPAA on behalf of Customer, the Processing of such PHI shall be governed by a Business Associate Agreement (“BAA”) between the parties. The following order of precedence applies to BAA arrangements: (a) Customer-Provided BAA. If Customer and OpenCoreEMR have executed a separate BAA provided by Customer, that BAA shall govern the parties’ respective obligations with respect to PHI and shall take precedence over this DPA and OpenCoreEMR’s Standard BAA solely with respect to the Processing of PHI. (b) OpenCoreEMR Standard BAA. Where no customer-provided BAA is in effect, Customer’s acceptance of the OpenCoreEMR Business Associate Agreement published at https://opencoreemr.com/business-associate-agreement/ (the “Standard BAA”) is a condition of receiving the Services, and the Standard BAA is hereby incorporated into the Agreement by reference. In either case, in the event of any conflict between the applicable BAA and this DPA with respect to the Processing of PHI, the BAA shall control, subject to Section 2.4. The BAA governs OpenCoreEMR’s use and disclosure of PHI. The creation, ownership, use, disclosure, and commercialization of De-Identified Data is governed by the Agreement and not by the BAA or this DPA.

2.6. De-Identified Data. OpenCoreEMR’s creation of De-Identified Data from Customer Personal Data is a permitted business purpose under this DPA and is a use for which Customer instructs OpenCoreEMR pursuant to Section 3. Once data has been de-identified in accordance with 45 C.F.R. § 164.514(b) and, where applicable, the standard for deidentified data under the CCPA, it is not Customer Personal Data, is not PHI, and is outside the scope of this DPA. The rights of the parties in De-Identified Data, including ownership and the right to license, sell, or otherwise commercialize it, and to use it for the training, fine-tuning, evaluation, and development of artificial intelligence and machine learning models and systems by OpenCoreEMR or third parties, are governed exclusively by the Agreement. Nothing in this DPA limits, restricts, or conditions those rights. OpenCoreEMR shall: (a) maintain De-Identified Data in a form that cannot reasonably be used to infer information about, or otherwise be linked to, an identified or identifiable natural person or household; (b) publicly commit to maintain and use De-Identified Data in deidentified form and not to attempt to reidentify the data, except as permitted by applicable law; and (c) contractually obligate any recipient of De-Identified Data to comply with the requirements of this Section 2.6.

2.7. Authorized Uses and Retention. (a) Where an individual has provided a Patient Authorization, OpenCoreEMR’s use and disclosure of the data covered by that Patient Authorization, in accordance with its terms and applicable law, is a Processing activity for which OpenCoreEMR has a lawful basis independent of Customer Instructions, and is permitted under this DPA. Customer shall promptly notify OpenCoreEMR of any revocation of a Patient Authorization of which it becomes aware, and OpenCoreEMR shall honor the revocation prospectively.

(b) During the term of the Agreement, OpenCoreEMR may store, retain, and Process Customer Personal Data as reasonably necessary to perform transcription, de-identification, expert determination, quality assurance, validation, and model evaluation, and to create, verify, and maintain De-Identified Data. Following termination or expiration of the Agreement, OpenCoreEMR may continue to retain and Process identifiable Customer Personal Data solely (i) for the period necessary to complete de-identification processing already underway, not to exceed ninety (90) days after the later of termination or the close of any export period under the Agreement; (ii) where the data is covered by an active, unrevoked Patient Authorization under subsection (a); or (iii) as required or permitted by applicable law. At the end of the period described in subsection (b)(i), OpenCoreEMR will de-identify or delete the identifiable Customer Personal Data. Retention under this Section 2.7 is subject to the security measures set out in Schedule 2, and retained Customer Personal Data remains subject to this DPA until de-identified or deleted. Section 8 (Data Return or Deletion) is subject to this Section 2.7 and otherwise applies in full.

3. Processing of Personal Data

3.1. Customer Instructions.

(a) OpenCoreEMR will Process Customer Personal Data as a Processor only: (i) in accordance with Customer Instructions or (ii) to comply with OpenCoreEMR’s obligations under applicable laws, subject to any notice requirements under Data Protection Laws. This Section 3.1(a) does not limit Section 2.6 or Section 2.7.

(b) “Customer Instructions” means: (i) Processing to provide the Cloud Service and perform OpenCoreEMR’s obligations in the Agreement (including this DPA), including the creation of De-Identified Data as described in Section 2.6, and (ii) other reasonable documented instructions of Customer consistent with the terms of the Agreement.

(c) Details regarding the Processing of Customer Personal Data by OpenCoreEMR are set forth in Schedule 1 (Subject Matter and Details of Processing).

(d) OpenCoreEMR will notify Customer if it receives an instruction that OpenCoreEMR reasonably determines infringes Data Protection Laws (but OpenCoreEMR has no obligation to actively monitor Customer’s compliance with Data Protection Laws).

3.2. Confidentiality.

(a) OpenCoreEMR will protect Customer Personal Data in accordance with its confidentiality obligations as set forth in the Agreement.

(b) OpenCoreEMR will ensure personnel who Process Customer Personal Data either enter into written confidentiality agreements or are subject to statutory obligations of confidentiality.

3.3. Compliance with Laws.

(a) OpenCoreEMR and Customer will each comply with Data Protection Laws in their respective Processing of Customer Personal Data.

(b) Customer is responsible to (a) comply with (i) Data Protection Laws in its issuing of Customer Instructions to OpenCoreEMR and (ii) Security Incident notification laws in fulfilling any obligations to give notices to government authorities, affected individuals or others relating to any Security Incidents; (b) ensure that it has established all necessary lawful bases under Data Protection Laws to enable OpenCoreEMR to lawfully Process Customer Personal Data for the purposes contemplated by the Agreement (including this DPA), including, as applicable, by obtaining all necessary consents from, and giving all necessary notices to, Data Subjects; and (c) review the information made available by OpenCoreEMR relating to data security and make an independent determination as to whether the Cloud Service meets Customer’s requirements and legal obligations under Data Protection Laws.

3.4. Changes to Laws. The parties will work together in good faith to negotiate an amendment to this DPA as either party reasonably considers necessary to address the requirements of Data Protection Laws from time to time.

4. Subprocessors

4.1. Use of Subprocessors.

(a) Customer generally authorizes OpenCoreEMR to engage Subprocessors to Process Customer Personal Data. Customer further agrees that OpenCoreEMR may engage its Affiliates as Subprocessors.

(b) OpenCoreEMR will: (i) enter into a written agreement with each Subprocessor imposing data Processing and protection obligations substantially the same as those set out in this DPA and (ii) remain liable for compliance with the obligations of this DPA and for any acts or omissions of a Subprocessor that cause OpenCoreEMR to breach any of its obligations under this DPA.

4.2. Subprocessor List. OpenCoreEMR will maintain an up-to-date list of its Subprocessors, including their functions and locations, as specified in the Subprocessor List.

4.3. Notice of New Subprocessors. OpenCoreEMR may update the Subprocessor List from time to time. At least 15 days before any new Subprocessor Processes any Customer Personal Data, OpenCoreEMR will add such Subprocessor to the Subprocessor List.

4.4. Objection Right. Customer may object in writing to OpenCoreEMR’s appointment of a new Subprocessor within ten (10) days after notice, provided such objection is based on reasonable data protection grounds. In such event, the parties will work together in good faith to resolve the objection. If the parties are unable to reach a mutually agreeable resolution within a reasonable time, Customer may terminate this DPA by providing written notice to OpenCoreEMR, and OpenCoreEMR will refund Customer a pro-rated portion of any prepaid, unused fees as of the date of termination.

5. Security

5.1. Security Measures. OpenCoreEMR will implement and maintain reasonable and appropriate technical and organizational measures, procedures and practices, as appropriate to the nature of the Customer Personal Data, that are designed to protect the security, confidentiality, integrity and availability of Customer Personal Data and protect against Security Incidents, in accordance with OpenCoreEMR’s Security Measures referenced in the Agreement and as further described in Schedule 2 (Technical and Organizational Measures). OpenCoreEMR will regularly monitor its compliance with its Security Measures and Schedule 2 (Technical and Organizational Measures).

5.2. Incident Notice and Response.

(a) OpenCoreEMR will implement and follow procedures to detect and respond to Security Incidents.

(b) OpenCoreEMR will: (i) notify Customer without undue delay and, in any event, not later than the Specified Notice Period, after becoming aware of a Security Incident affecting Customer and (ii) make reasonable efforts to identify the cause of the Security Incident, mitigate the effects and remediate the cause to the extent within OpenCoreEMR’s reasonable control.

(c) Upon Customer’s request and taking into account the nature of the applicable Processing, OpenCoreEMR will assist Customer by providing, when available, information reasonably necessary for Customer to meet its Security Incident notification obligations under Data Protection Laws.

(d) Customer acknowledges that OpenCoreEMR’s notification of a Security Incident is not an acknowledgement by OpenCoreEMR of its fault or liability.

(e) Security Incidents do not include unsuccessful attempts or activities that do not compromise the security of Customer Personal Data, including unsuccessful login attempts, pings, port scans, denial of service attacks or other network attacks on firewalls or networked systems.

(f) Where a Security Incident affects PHI, OpenCoreEMR’s notification obligations under the BAA apply in addition to this Section 5.2, and OpenCoreEMR will provide a single notification satisfying both where practicable. Where the periods stated in the BAA and this DPA differ, the shorter period applies.

5.3. Customer Responsibilities.

(a) Customer is responsible for reviewing the information made available by OpenCoreEMR relating to data security and making an independent determination as to whether the Cloud Service meets Customer’s requirements and legal obligations under Data Protection Laws.

(b) Customer is solely responsible for complying with Security Incident notification laws applicable to Customer and fulfilling any obligations to give notices to government authorities, affected individuals or others relating to any Security Incidents.

6. Data Protection Impact Assessment

Upon Customer’s request and taking into account the nature of the applicable Processing, to the extent such information is available to OpenCoreEMR, OpenCoreEMR will assist Customer in fulfilling Customer’s obligations under Data Protection Laws to carry out a data protection impact or similar risk assessment related to Customer’s use of the Cloud Service, including, if required by Data Protection Laws, by assisting Customer in consultations with relevant government authorities.

7. Data Subject Requests

7.1. Assisting Customer. Upon Customer’s request and taking into account the nature of the applicable Processing, OpenCoreEMR will assist Customer by appropriate technical and organizational measures, insofar as possible, in complying with Customer’s obligations under Data Protection Laws to respond to requests from individuals to exercise their rights under Data Protection Laws, provided that Customer cannot reasonably fulfill such requests independently (including through use of the Cloud Service).

7.2. Data Subject Requests. If OpenCoreEMR receives a request from a Data Subject in relation to the Data Subject’s Customer Personal Data, OpenCoreEMR will notify Customer and advise the Data Subject to submit the request to Customer (but not otherwise communicate with the Data Subject regarding the request except as may be required by Data Protection Laws), and Customer will be responsible for responding to any such request.

7.3. De-Identified Data. Because De-Identified Data does not identify and cannot reasonably be used to identify any Data Subject, it is outside the scope of Data Subject rights under Data Protection Laws, and neither party is required to attempt to reidentify De-Identified Data in order to respond to a request.

8. Data Return or Deletion

8.1. During Subscription Term. During the Subscription Term, Customer may, through the features of the Cloud Service or such other means specified on the DPA Setup Page, access, return to itself or delete Customer Personal Data.

8.2. Post Termination.

(a) Following termination or expiration of the Agreement, OpenCoreEMR will, in accordance with its obligations under the Agreement and subject to Section 2.7, delete all Customer Personal Data from OpenCoreEMR’s systems.

(b) Deletion will be in accordance with industry-standard secure deletion practices. OpenCoreEMR will issue a written confirmation of deletion upon Customer’s request.

(c) Notwithstanding the foregoing, OpenCoreEMR may retain Customer Personal Data: (i) as required by Data Protection Laws, (ii) in accordance with its standard backup or record retention policies or (iii) as permitted by Section 2.7, provided that, in each case, OpenCoreEMR will (x) maintain the confidentiality of, and otherwise comply with the applicable provisions of this DPA with respect to, retained Customer Personal Data and (y) not further Process retained Customer Personal Data except for such purpose(s) and duration specified in such applicable Data Protection Laws or in Section 2.7.

(d) This Section 8 does not apply to De-Identified Data, which is not Customer Personal Data and which OpenCoreEMR may retain and use indefinitely in accordance with the Agreement.

9. Audits

9.1. OpenCoreEMR Records Generally. OpenCoreEMR will keep records of its Processing in compliance with Data Protection Laws and, upon Customer’s request, make available to Customer any records reasonably necessary to demonstrate compliance with OpenCoreEMR’s obligations under this DPA and Data Protection Laws.

9.2. Third-Party Compliance Program.

(a) OpenCoreEMR will describe its third-party audit and certification programs (if any) and make summary copies of its audit reports (each, an “Audit Report”) available to Customer upon Customer’s written request at reasonable intervals (subject to confidentiality obligations).

(b) Customer may share a copy of Audit Reports with relevant government authorities as required upon their request.

(c) Customer agrees that any audit rights granted by Data Protection Laws will be satisfied by Audit Reports and the procedures of Section 9.3 (Customer Audit) below.

9.3. Customer Audit.

(a) OpenCoreEMR shall provide Customer with its current SOC 2 Type II report upon Customer’s request; provided that OpenCoreEMR shall obtain its initial SOC 2 Type II certification no later than March 31, 2027, and shall provide evidence of such certification to Customer promptly upon completion. Until such certification is obtained, OpenCoreEMR shall provide its then-current SOC 2 Type I report (if available) or equivalent compliance evidence upon Customer’s written request. Such report shall serve as Customer’s sole method of assessing OpenCoreEMR’s data security controls in lieu of direct audit rights. However, if OpenCoreEMR fails to furnish an acceptable SOC 2 report within thirty (30) days of Customer’s request, or if the provided report does not meet mutually agreed criteria for currency or adequacy to verify OpenCoreEMR’s compliance with this DPA or the parties’ compliance with Data Protection Laws, Customer shall then have the right, at Customer’s expense, to conduct an audit, of reasonable scope and duration, of OpenCoreEMR’s data processing operations pursuant to a mutually agreed-upon audit plan with OpenCoreEMR that is consistent with the Audit Parameters (an “Audit”).

(b) Each Audit must conform to the following parameters (“Audit Parameters”): (i) be conducted by an independent third party that will enter into a confidentiality agreement with OpenCoreEMR, (ii) be limited in scope to matters reasonably required for Customer to assess OpenCoreEMR’s compliance with this DPA and the parties’ compliance with Data Protection Laws, (iii) occur at a mutually agreed date and time and only during OpenCoreEMR’s regular business hours, (iv) occur no more than once annually (unless required under Data Protection Laws or in connection with a Security Incident), (v) cover only facilities controlled by OpenCoreEMR, (vi) restrict findings to systems that Process Customer Personal Data only (but such Audits will not involve or impact Personal Data that OpenCoreEMR Processes on behalf of other customers) and (vii) treat any results as confidential information to the fullest extent permitted by Data Protection Laws.

10. Liability

10.1. Notwithstanding anything to the contrary in the Agreement or this DPA, each party’s and all of its Affiliates’ liability, taken together in the aggregate, arising out of or relating to this DPA, the Standard Contractual Clauses, and any other data protection agreements in connection with the Agreement (if any), shall be subject to any aggregate limitations on liability set out in the Agreement. Without limiting the parties’ obligations under the Agreement, each party agrees that any regulatory penalties incurred by one party (the “Incurring Party”) in relation to the Customer Personal Data that arise as a result of, or in connection with, the other party’s failure to comply with its obligations under this DPA or any applicable Data Protection Laws shall count toward and reduce the Incurring Party’s liability under the Agreement as if it were liability to the other party under the Agreement.

11. Cross-Border Transfers / Region-Specific Terms

11.1. Cross-Border Data Transfers.

(a) OpenCoreEMR (and its Affiliates) may Process and transfer Customer Personal Data globally as necessary to provide the Cloud Service.

(b) If OpenCoreEMR engages in a Restricted Transfer, it will comply with Schedule 3 (Cross-Border Transfer Mechanisms).

11.2. Region-Specific Terms. To the extent that OpenCoreEMR Processes Customer Personal Data protected by Data Protection Laws in one of the regions listed in Schedule 4 (Region-Specific Terms), then the terms specified therein with respect to the applicable jurisdiction(s) will apply in addition to the terms of this DPA.

11.3. De-Identification Standards. Customer acknowledges that de-identification under 45 C.F.R. § 164.514(b) is a standard established under United States law and does not, by itself, constitute anonymization under the GDPR, UK GDPR, or FADP. Where Customer Personal Data is protected by those laws, OpenCoreEMR will treat such data as Customer Personal Data unless and until it has been anonymized in accordance with the applicable standard.

Schedule 1: Subject Matter and Details of Processing

Customer / “Data Exporter” Details

Name: ____________________

Contact details for data protection: ____________________

Main address: ____________________

Customer activities: ____________________

Role: Controller

OpenCoreEMR / “Data Importer” Details

Name: OpenCoreEMR Inc.

Contact details for data protection: Matt Summers, matt@opencoreemr.com

Main address: 455 Market St., Suite 1940, PMB 629461, San Francisco, CA 94105

OpenCoreEMR activities: Providing the Services to Customer

Role: Processor

Details of Processing

Categories of Data Subjects:

Customer may submit Personal Data to the Services, the extent of which is determined and controlled by the data exporter in its sole discretion, and which may include, but is not limited to, Personal Data relating to the following categories of data subjects:

● Prospects, customers, business partners and vendors of Customer (who are natural persons)

● Employees or contact persons of Customer’s prospects, customers, business partners and vendors

● Employees, agents, advisors, freelancers of Customer (who are natural persons)

● Customer’s users authorized by Customer to use the Services

● Patients of Customer

Categories of Customer Personal Data:

Data exporter may submit Personal Data to the Services, the extent of which is determined and controlled by the data exporter in its sole discretion, and which may include, but is not limited to, the following categories of Personal Data:

● First and last name

● Title

● Position

● Employer

● Contact information (company, email, phone, physical business address)

● ID data

● Professional life data

● Localization data

● Patient diagnoses and medical conditions (ICD-10/ICD-11 codes), consistent with the OpenEMR encounter and diagnosis data model

● Medications, prescriptions, and medication administration records, consistent with the OpenEMR medication and prescription data model

● Laboratory orders and results, vital signs, and clinical measurements, consistent with the OpenEMR lab and vitals data model

● Clinical notes, SOAP notes, care plans, and encounter documentation, consistent with the OpenEMR forms and documents data model

● Audio and video recordings of clinical encounters, and transcriptions thereof, where Customer enables recording features

● Immunization records, consistent with the OpenEMR immunization data model

● Insurance and billing information, including payer details, policy numbers, and claims data, consistent with the OpenEMR billing data model

● Date of birth and patient demographic identifiers, consistent with the OpenEMR patient demographics data model

● Emergency contact information

Sensitive Categories of Data and additional associated restrictions/safeguards:

The following categories of sensitive data may be processed, consistent with the OpenEMR data model. Restrictions/Safeguards: Such data is processed for healthcare treatment, payment, and operations purposes and for the purposes described in Sections 2.6 and 2.7 of this DPA; subject to the HIPAA minimum necessary standard; encrypted at rest and in transit; and access is restricted to authorized clinical and administrative personnel.

● Health and medical data, including diagnoses and medical conditions (ICD-10/ICD-11 codes), medications and prescriptions, laboratory results and vital signs, clinical notes and care plans, immunization records, and treatment history

● Voice and, where video recording is enabled, facial characteristics captured in recordings of clinical encounters

● Medical imaging data references (e.g., DICOM study identifiers and associated metadata)

● Insurance and billing information, including payer identifiers, policy numbers, and claims data

● Government-issued identifiers (e.g., Social Security Numbers or national equivalents, where collected by Customer)

● Date of birth and other demographic identifiers

Frequency of transfer: Continuous

Nature of the Processing:

Such processing as is necessary to enable OpenCoreEMR to comply with its obligations and exercise its rights under the Agreement, including collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction processing activities.

Purpose of the Processing:

OpenCoreEMR agrees to process Personal Data for limited and specified purposes described in the Agreement, this DPA (including Sections 2.6 and 2.7), or as otherwise directed by authorized personnel of Customer in writing (email acceptable).

Duration of Processing / retention period:

OpenCoreEMR agrees to process Personal Data as instructed in the Agreement and this DPA for the duration of the provision of the Services to Customer, and the longer of such additional period as: (i) is specified in any provisions of the Agreement regarding data retention; (ii) is permitted under Section 2.7 of this DPA; and (iii) is required for compliance with law.

Transfers to Subprocessors:

Transfers to Subprocessors will occur where necessary for the provision of the Services in accordance with the Agreement and this DPA.

Schedule 2: Technical and Organizational Measures

1. Security Staffing.

● Organizational management and dedicated staff responsible for the development, implementation and maintenance of OpenCoreEMR’s information security program.

● Employees must complete management-approved security training during onboarding and revisit such training annually throughout their tenure.

2. Audit and Risk Assessment. Audit and risk assessment procedures for the purposes of periodic review and assessment of risks to OpenCoreEMR’s organization, monitoring and maintaining compliance with OpenCoreEMR’s policies and procedures, and reporting the condition of OpenCoreEMR’s information security and compliance to internal management.

3. Security Controls. Data security controls which include, at a minimum:

● Logical segregation of data;

● Restricted (e.g., role-based) access and monitoring; and

● Utilization of encryption technologies for Personal Data that is transmitted over public networks (i.e., the Internet) or when transmitted wirelessly or at rest or stored on portable or removable media (i.e., laptop computers, CD/DVD, USB drives, back-up tapes).

4. Access Controls. Logical access controls designed to manage electronic access to data and system functionality based on authority levels and job functions (e.g., use of unique IDs and passwords for all users, periodic review and revoking/changing access promptly when employment terminates or changes in job functions occur).

5. Password Security. Password controls designed to manage and control password strength, expiration and usage, including prohibiting users from sharing passwords and requiring that OpenCoreEMR’s passwords that are assigned to its employees:

● Be at least twelve (12) characters in length;

● Not be stored in readable format on OpenCoreEMR’s computer systems; and

● Newly issued passwords must be changed after first use.

7. Physical Security. Physical and environmental security of areas containing Personal Data managed by OpenCoreEMR that are designed to:

● Protect information assets from unauthorized physical access;

● Manage, monitor and log movement of persons into and out of OpenCoreEMR’s facilities; and

● Guard against environmental hazards such as heat, fire and water damage.

8. Operational Procedures. Operational procedures and controls designed to provide for configuration, monitoring and maintenance of technology and information systems, including secure disposal of systems and media designed to render data contained therein as undecipherable or unrecoverable prior to final disposal or release from OpenCoreEMR’s possession.

9. Change Management. Change management procedures and tracking mechanisms designed to test, approve and monitor all material changes to OpenCoreEMR’s technology and information assets.

10. Incident Response. Incident response management procedures designed to allow OpenCoreEMR to investigate, respond to, mitigate and notify of events related to OpenCoreEMR’s technology and information assets.

11. Network Security. Network security controls that utilize firewalls and segregated access, and other traffic and event correlation procedures designed to protect systems from intrusion and limit the scope of any successful attack.

12. Vulnerability Management Processes.

● Vulnerability assessment, patch management and threat protection technologies, and scheduled monitoring procedures designed to identify, assess, mitigate and protect against identified security threats, viruses and other malicious code; and

● Third party vulnerability assessments are conducted periodically and vulnerabilities are remediated as appropriate in accordance with OpenCoreEMR’s internal risk assessment policies.

13. Business Continuity/Disaster Recovery. Business resiliency/continuity and disaster recovery procedures designed to maintain service and/or recovery from foreseeable emergencies or disasters. OpenCoreEMR Business Continuity and Disaster Recovery procedures (including restoration from backups) are reviewed and tested annually.

14. De-Identification Controls. Documented procedures governing the creation of De-Identified Data, including the method applied under 45 C.F.R. § 164.514(b), retention of expert determination documentation where that method is used, controls designed to exclude records in the categories identified in the Agreement, and contractual controls prohibiting recipients from attempting reidentification.

15. Policy Review. OpenCoreEMR’s security and privacy policies are reviewed and approved annually for OpenCoreEMR’s business operations.

Schedule 3: Cross-Border Transfer Mechanisms

1. Definitions. Capitalized terms not defined in this Schedule are defined in the DPA.

1.1. “EU Standard Contractual Clauses” or “EU SCCs” means the Standard Contractual Clauses approved by the European Commission in decision 2021/914.

1.2. “UK International Data Transfer Agreement” means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner, Version B1.0, in force as of March 21, 2022.

1.3. In addition, “Designated EU Governing Law” means Ireland, and “Designated EU Member State” means Ireland.

2.1. The EU SCCs are hereby incorporated by reference as follows:

(a) Module 2 (Controller to Processor) applies where Customer is a Controller of Customer Personal Data and OpenCoreEMR is a Processor of Customer Personal Data;

(b) Module 3 (Processor to Processor) applies where Customer is a Processor of Customer Personal Data (on behalf of a third-party Controller) and OpenCoreEMR is a Processor of Customer Personal Data;

(d) by entering into this DPA, each party is deemed to have signed the EU SCCs (including their Annexes) as of the DPA Effective Date.

2.2. For each Module, where applicable the following applies:

(a) the optional docking clause in Clause 7 does not apply;

(b) in Clause 9, Option 2 will apply, the minimum time period for prior notice of Subprocessor changes shall be as set out in Section 4.3 of this DPA, and OpenCoreEMR shall fulfill its notification obligations by notifying Customer of any Subprocessor changes in accordance with Section 4.3 of this DPA;

(d) in Clause 13, all square brackets are removed with the text remaining;

(e) in Clause 17, Option 1 will apply, and the EU SCCs will be governed by Designated EU Governing Law;

(f) in Clause 18(b), disputes will be resolved before the courts of the Designated EU Member State;

(g) Schedule 1 (Subject Matter and Details of Processing) to this DPA contains the information required in Annex 1 of the EU SCCs; and

(h) Schedule 2 (Technical and Organizational Measures) to this DPA contains the information required in Annex 2 of the EU SCCs.

2.3. Where context permits and requires, any reference in this DPA to the EU SCCs shall be read as a reference to the EU SCCs as modified in the manner set forth in this Section 2.

3. Swiss Transfers. Where Customer Personal Data is protected by the FADP and is subject to a Restricted Transfer, the following applies:

3.1. The EU SCCs apply as set forth in Section 2 (EU Transfers) of this Schedule 3 with the following modifications:

(a) in Clause 13, the competent supervisory authority shall be the Swiss Federal Data Protection and Information Commissioner;

(b) in Clause 17 (Option 1), the EU SCCs will be governed by the laws of Switzerland;

(d) the term Member State must not be interpreted in such a way as to exclude Data Subjects in Switzerland from enforcing their rights in their place of habitual residence in accordance with Clause 18(c); and

(e) all references to the EU GDPR in this DPA are also deemed to refer to the FADP.

4.1. The EU SCCs apply as set forth in Section 2 (EU Transfers) of this Schedule 3 with the following modifications:

(a) each party shall be deemed to have signed the “UK Addendum to the EU Standard Contractual Clauses” (“UK Addendum”) issued by the Information Commissioner’s Office under section 119A of the Data Protection Act 2018;

(b) the EU SCCs shall be deemed amended as specified by the UK Addendum in respect of the transfer of Customer Personal Data;

(c) in Table 1 of the UK Addendum, the parties’ key contact information is located in Schedule 1 (Subject Matter and Details of Processing) to this DPA;

(d) in Table 2 of the UK Addendum, information about the version of the EU SCCs, modules and selected clauses which this UK Addendum is appended to are located above in this Schedule 3;

(e) in Table 3 of the UK Addendum: (i) the list of parties is located in Schedule 1 to this DPA; (ii) the description of transfer is located in Schedule 1 to this DPA; (iii) Annex II is located in Schedule 2 to this DPA; and (iv) the list of Subprocessors is located in Schedule 1 to this DPA;

(f) in Table 4 of the UK Addendum, both the Importer and the Exporter may end the UK Addendum in accordance with its terms (and the respective box for each is deemed checked); and

(g) in Part 2: Mandatory Clauses of the Approved Addendum, being the template Addendum B.1.0 issued by the ICO and laid before Parliament in accordance with section 119A of the Data Protection Act 2018 on 2 February 2022, as it is revised under section 18 of those Mandatory Clauses.

Schedule 4: Region-Specific Terms

A. CALIFORNIA

1. Definitions. CCPA and other capitalized terms not defined in this Schedule are defined in the DPA.

1.2. The definition of “Data Subject” includes “consumer” as defined under the CCPA.

1.3. The definition of “Controller” includes “business” as defined under the CCPA.

1.4. The definition of “Processor” includes “service provider” as defined under the CCPA.

2. Obligations.

2.1. Customer is providing the Customer Personal Data to OpenCoreEMR under the Agreement for the limited and specific business purposes of providing the Cloud Service as described in Schedule 1 (Subject Matter and Details of Processing) to this DPA, creating De-Identified Data as described in Section 2.6 of this DPA, and otherwise performing under the Agreement.

2.2. OpenCoreEMR will comply with its applicable obligations under the CCPA and provide the same level of privacy protection to Customer Personal Data as is required by the CCPA.

2.3. OpenCoreEMR acknowledges that Customer has the right to: (i) take reasonable and appropriate steps under Section 9 (Audits) of this DPA to help to ensure that OpenCoreEMR’s use of Customer Personal Data is consistent with Customer’s obligations under the CCPA, (ii) receive from OpenCoreEMR notice and assistance under Section 7 (Data Subject Requests) of this DPA regarding consumers’ requests to exercise rights under the CCPA and (iii) upon notice, take reasonable and appropriate steps to stop and remediate unauthorized use of Customer Personal Data.

2.4. OpenCoreEMR will notify Customer promptly after it makes a determination that it can no longer meet its obligations under the CCPA.

2.5. OpenCoreEMR will not retain, use or disclose Customer Personal Data: (i) for any purpose, including a commercial purpose, other than the business purposes described in Section 2.1 of this Section A (California) of Schedule 4 or (ii) outside of the direct business relationship between OpenCoreEMR and Customer, except, in either case, where and to the extent permitted by the CCPA.

2.7. OpenCoreEMR will not combine Customer Personal Data with other personal information except to the extent a service provider is permitted to do so by the CCPA.

2.8. De-Identified Data. Notwithstanding anything to the contrary in this Section A: (i) the creation of De-Identified Data from Customer Personal Data is a business purpose for which Customer discloses Customer Personal Data to OpenCoreEMR, and OpenCoreEMR’s retention, use, and disclosure of Customer Personal Data for that purpose is permitted under this DPA; (ii) De-Identified Data is deidentified data within the meaning of the CCPA and is not personal information; (iii) the restrictions in Sections 2.5, 2.6, and 2.7 of this Section A on retaining, using, disclosing, selling, sharing, and combining Customer Personal Data do not apply to De-Identified Data; and (iv) OpenCoreEMR’s obligations with respect to De-Identified Data are those set forth in Section 2.6 of this DPA and in the Agreement. For the avoidance of doubt, this Section 2.8 does not authorize OpenCoreEMR to sell or share Customer Personal Data, and OpenCoreEMR does not do so.

2.9. Authorized Uses. Section 2.5 of this Section A does not limit OpenCoreEMR’s use or disclosure of data pursuant to a Patient Authorization as described in Section 2.7 of this DPA, which is undertaken by OpenCoreEMR on a lawful basis independent of Customer Instructions.