Skip to content
Vayra Platform
Menu

Data processing addendum

Last updated

About this addendum

This data processing addendum (the "DPA") is a template. It forms part of the written agreement for the Vayra Platform, Vayra White Label, Vayra Intelligence, and related services (the "Agreement") between Vayra Health & Wellness, Inc. ("Vayra") and the partner organization named in the Agreement ("Partner"). It applies only when incorporated into a signed Agreement. The final terms are those in the signed version.

Capitalized terms not defined here have the meanings given in the Agreement.

Definitions

  • Partner Data means personal information, including protected health information, that Partner or its authorized users submit to the Platform Services or that Vayra processes on Partner's behalf in providing the Platform Services.
  • Protected Health Information or PHI has the meaning given in the HIPAA Privacy Rule (45 C.F.R. 160.103).
  • Subprocessor means a third party that Vayra engages to process Partner Data in providing the Platform Services.
  • Security Incident means a confirmed unauthorized access to, or acquisition, use, or disclosure of, Partner Data in Vayra's systems or the systems of its Subprocessors. It does not include unsuccessful attempts or activities that do not compromise the security of Partner Data, such as pings, port scans, denial-of-service attempts, or blocked log-in attempts.
  • Data Protection Laws means all laws that apply to the processing of Partner Data under the Agreement, including HIPAA and applicable state privacy and health information laws.

Roles of the parties

Partner is the controller (or "business," as applicable) of Partner Data and, where Partner Data includes PHI, is a covered entity or a business associate of a covered entity.

Vayra is a processor (or "service provider," as applicable) of Partner Data and, where Partner Data includes PHI, is Partner's business associate or subcontractor business associate.

Clinical services delivered through the Platform Services may be provided by Vayra Medical, P.C., a separate professional corporation, or by Partner's own clinicians. The roles of any clinical provider with respect to patient information are set out in the Agreement and any applicable clinical services agreement. For Partner Data, Partner acts as the controller (or business) and Vayra acts as the processor (or service provider). Where Vayra Medical, P.C. provides clinical services, it acts as a covered entity for the protected health information it creates or receives in that role, under its own clinical services agreement and business associate agreement.

Scope and duration

This DPA applies to Vayra's processing of Partner Data in providing the Platform Services under the Agreement. The subject matter, nature, purpose, categories of data, and categories of individuals are described in the Agreement or its order form. Where the Agreement does not describe them, they are: subject matter and purpose, providing the Platform Services; nature, hosting, storage, transmission, support, and the other processing the Platform Services require; categories of data, business contact and account data and the patient information Partner submits; categories of individuals, Partner's personnel and Partner's patients and prospective patients; duration, the term of the Agreement plus the export and deletion periods in this DPA.

This DPA remains in effect for as long as Vayra processes Partner Data, including after the Agreement ends until Partner Data is returned or deleted as described below.

Partner's instructions

Vayra will process Partner Data only on Partner's documented instructions. The Agreement, this DPA, and Partner's configuration and use of the Platform Services are Partner's instructions. Vayra will not:

  • sell Partner Data or share it for cross-context behavioral advertising;
  • process Partner Data for any purpose other than providing the Platform Services, or as required by law;
  • combine Partner Data with personal information Vayra receives from other sources, except as permitted by Data Protection Laws and the Agreement; or
  • use Partner Data to train any general purpose artificial intelligence model.

Vayra will inform Partner if, in its opinion, an instruction violates Data Protection Laws. If Vayra is required by law to process Partner Data other than on Partner's instructions, it will notify Partner first unless the law prohibits notice.

Partner is responsible for the lawfulness of its instructions, for obtaining any notices, consents, or authorizations required to provide Partner Data to Vayra, and for the accuracy of Partner Data.

Confidentiality

Vayra will ensure that its personnel authorized to process Partner Data are bound by written confidentiality obligations or an appropriate statutory duty of confidentiality, receive appropriate privacy and security training, and access Partner Data only as needed to provide the Platform Services.

Security measures

Vayra will implement and maintain administrative, technical, and physical safeguards designed to protect Partner Data, appropriate to the nature of the data and the risks of processing. These include:

  • hosting the Platform Services on Microsoft Azure in the United States;
  • encryption of Partner Data in transit and at rest;
  • multi-factor authentication for workforce access to production systems;
  • role-based access controls under the principle of least privilege;
  • audit logging of access to and changes involving Partner Data;
  • network isolation of production data stores;
  • vulnerability management and timely application of security updates;
  • backup and recovery procedures; and
  • periodic review of these measures.

Vayra may update its security measures over time, provided that updates do not materially reduce the overall protection of Partner Data. Additional information is available on our security page.

Subprocessors

Partner authorizes Vayra to engage Subprocessors to process Partner Data. The current list of Subprocessors for the Platform Services is published at /legal/subprocessors. Some Subprocessors, such as pharmacy fulfillment partners and the payment processor, are identified in Partner's Agreement rather than on the public list.

Vayra will:

  • enter into a written agreement with each Subprocessor that imposes data protection obligations no less protective than those in this DPA and, where the Subprocessor handles PHI, a business associate agreement;
  • remain responsible to Partner for each Subprocessor's performance of its obligations; and
  • give Partner notice of any new or replacement Subprocessor at least 30 days before it begins processing Partner Data.

Partner may object to a new Subprocessor on reasonable data protection grounds by notifying Vayra in writing within 15 days after notice. The parties will discuss the objection in good faith. If they cannot resolve it, Partner may terminate the affected Platform Services on written notice, without penalty, as its sole remedy for the objection.

Assistance with requests and obligations

Taking into account the nature of the processing, Vayra will provide reasonable assistance to Partner in:

  • responding to requests from individuals to exercise rights under Data Protection Laws, including rights of access, amendment, accounting of disclosures, deletion, and correction. If Vayra receives such a request directly, it will forward it to Partner and will not respond except as Partner instructs or as required by law;
  • meeting Partner's obligations regarding security, Security Incident notification, and data protection assessments; and
  • responding to inquiries from regulators about Vayra's processing of Partner Data.

Vayra provides this assistance at no additional charge where it is reasonable in scope. Assistance that requires material additional effort may be charged at Vayra's then-current professional services rates, agreed with Partner in advance.

Security Incident notification

Vayra will notify Partner of a Security Incident without undue delay and in any event within 72 hours after Vayra confirms it. The notice will include, to the extent known, a description of the Security Incident, the categories and approximate volume of Partner Data and individuals affected, the steps Vayra has taken or plans to take to contain and address it, and a contact for further information. Vayra will supplement the notice as more information becomes available.

Vayra will take reasonable steps to contain, investigate, and mitigate the Security Incident and will cooperate with Partner in meeting any notification obligations. Unless required by law, Vayra will not notify affected individuals or regulators on Partner's behalf without Partner's prior written approval.

Where a Security Incident involves PHI, the breach notification terms of the business associate agreement also apply.

Return and deletion

On termination or expiration of the Agreement, Vayra will make available to Partner a full export of Partner Data in a commonly used, machine-readable format. Partner may request the export for 30 days after termination.

After that window, Vayra will delete Partner Data from its active systems within 30 days, and from backups in accordance with its standard backup rotation, unless retention is required by law. Where Vayra must keep Partner Data, it will continue to protect it under this DPA and process it only for the purpose that requires retention. On request, Vayra will confirm deletion in writing.

Where return or deletion of PHI is infeasible, the business associate agreement controls.

Audits

Vayra will make available to Partner information reasonably necessary to demonstrate compliance with this DPA, such as written responses to security questionnaires and summaries of relevant policies.

If that information is not sufficient to address a specific compliance concern, or if a regulator requires it, Partner may conduct an audit on at least 30 days' written notice, no more than once in any 12 month period unless following a Security Incident, during normal business hours, under a confidentiality agreement, and in a manner that does not unreasonably disrupt Vayra's operations or compromise the security or confidentiality of other partners' data. Partner bears the cost of its audit. Any third-party auditor must be independent, bound by written confidentiality obligations, and not a competitor of Vayra.

Data location and transfers

Vayra stores Partner Data in the United States. Vayra will not transfer Partner Data outside the United States without Partner's prior written consent, except as described on the subprocessor list or as required by law.

Relationship to the business associate agreement

Where Partner Data includes PHI, Vayra and Partner will also sign a business associate agreement ("BAA"). With respect to PHI, the BAA controls if it conflicts with this DPA. More information is available on our business associate agreements page.

Order of precedence

If this DPA conflicts with the Agreement, this DPA controls with respect to the processing of Partner Data, except that the BAA controls with respect to PHI. Each party's liability arising out of or relating to this DPA is subject to the limitations and exclusions of liability in the Agreement.

Governing law

This DPA is governed by the law that governs the Agreement.

Contact

Questions about this DPA can be sent to legal@vayraplatform.com or privacy@vayraplatform.com.