Contract analysis

1. DEFINITIONS 1.1 "Aggregated Data" means de-identified, aggregated statistical data derived from Customer Data that cannot reasonably be used to identify any individual, policyholder, claimant, or specific Customer claim record. For the avoidance of doubt, Aggregated Data must be rendered such that no individual data subject or specific Controller record can be re-identified through any reasonably foreseeable means

2. SCOPE AND PURPOSE OF PROCESSING 2.1 Scope. This DPA applies to all Customer Data processed by Processor in connection with the provision of the ClaimsIQ™ platform and related services under the Agreement. The scope of Processing encompasses all functionalities of the ClaimsIQ™ platform, including, without limitation, claims triage, fraud detection, analytics dashboard generation, reporting, and data visualization

3. CUSTOMER DATA OWNERSHIP 3.1 Sole and Exclusive Ownership. Controller retains sole and exclusive ownership of all Customer Data, including all intellectual property rights, proprietary rights, and any other rights of any nature therein. Nothing in the Agreement or this DPA shall be construed as transferring or granting to Processor any ownership interest, title, or proprietary right in or to any Customer Data. All

4. AGGREGATED DATA 4.1 Permitted Creation. Subject to all conditions and limitations set forth in this Section 4, Processor may create Aggregated Data from Customer Data solely for the purpose of improving, enhancing, and benchmarking the ClaimsIQ™ platform and its underlying algorithms, models, and functionalities (collectively, "product-improvement purposes"). For the avoidance of doubt, Aggregated Data may not be

5. DATA PORTABILITY AND RETURN 5.1 Export Upon Expiration or Termination. Upon the expiration or termination of the Agreement for any reason (including termination for cause, termination for convenience, or non-renewal), Processor shall provide Controller with a full, complete, and usable export of all Customer Data in Processor's possession or control, including all Customer Data held by Subprocessors, in industry-s

6. SUBPROCESSOR MANAGEMENT 6.1 Current Subprocessors. Controller hereby acknowledges and consents to Processor's engagement of the following Subprocessors to process Customer Data as of the Effective Date: A complete list of current Subprocessors, including additional detail regarding the nature and scope of processing performed by each Subprocessor, is set forth in Appendix 2 to this DPA. 6.2 Subprocessor Obligation

7. DATA SECURITY 7.1 Security Measures. Processor shall implement and maintain appropriate technical and organizational measures designed to protect Customer Data against unauthorized access, acquisition, use, disclosure, alteration, destruction, or loss, taking into account the state of the art, the costs of implementation, the nature, scope, context, and purposes of Processing, and the risks to the rights and freed

8. DATA BREACH NOTIFICATION 8.1 Notification Obligation. Processor shall notify Controller of any confirmed Data Breach without undue delay and in no event later than twenty-four (24) hours following Processor's confirmation that a Data Breach has occurred or is reasonably believed to have occurred. Notification shall be made by telephone to Controller's Chief Information Officer and by email to Controller's General

9. REGULATORY COMPLIANCE 9.1 CTDPA Compliance. Processor shall comply with all applicable requirements of the Connecticut Data Privacy Act, Conn. Gen. Stat. §§ 42-515 et seq., as in effect from time to time, including, without limitation, requirements relating to: (a) data protection assessments for processing activities that present a heightened risk of harm to consumers; (b) the facilitation of consumer rights requ

10. AUDITS AND ASSESSMENTS 10.1 Audit Rights. Controller shall have the right, upon not less than thirty (30) days' prior written notice to Processor and during normal business hours, to audit or inspect, or to engage a qualified independent third party (subject to appropriate confidentiality obligations acceptable to Processor, acting reasonably) to audit or inspect, Processor's compliance with this DPA, including P

11. DATA TRANSFER RESTRICTIONS 11.1 Location of Processing. Processor shall process Customer Data only within the continental United States. Processor shall not transfer, store, access, or otherwise process Customer Data in any jurisdiction outside the continental United States unless Controller provides prior written consent to such processing, which consent may be withheld in Controller's sole discretion. For the a

12. DATA RETENTION 12.1 Retention During Term. During the term of the Agreement, Processor shall retain Customer Data only for as long as necessary to perform its obligations under the Agreement and this DPA. Processor shall not retain copies of Customer Data beyond what is reasonably required for the provision of the services and shall implement data-minimization practices to limit the volume and duration of Custome

13. PERSONNEL 13.1 Authorized Personnel. Processor shall ensure that only personnel who have a legitimate need to access Customer Data in connection with the performance of Processor's obligations under the Agreement are granted access to such data. Processor shall maintain and enforce access-control policies that limit access to Customer Data to the minimum number of personnel necessary to perform the applicable pro

14. RELATIONSHIP TO AGREEMENT 14.1 Incorporation. This DPA is incorporated into and forms an integral part of the Agreement. All references in the Agreement to exhibits, schedules, or addenda shall be deemed to include this DPA. The terms and conditions of this DPA are binding upon the parties and their respective successors, assigns, and permitted transferees to the same extent as the Agreement. 14.2 Conflict. In th

15. TERM AND SURVIVAL 15.1 Term. This DPA shall remain in full force and effect for the duration of the Agreement, including the initial five (5) year term commencing on April 26, 2024, and any renewal terms agreed to by the parties in writing. This DPA shall terminate automatically upon the expiration or termination of the Agreement, subject to the survival provisions set forth in Section 15.2. 15.2 Survival. The fo

16. MISCELLANEOUS 16.1 Amendments. This DPA may be amended, modified, or supplemented only by a written instrument duly executed by authorized representatives of both parties. No oral agreement, course of dealing, or course of performance shall be deemed to amend or modify this DPA. Any amendment to this DPA shall specifically reference this DPA and shall state the effective date of the amendment. 16.2 Notices. All n