1025-00009 · Calderwood & Harkness LLP · Transaction Documents

exhibit-c-data-processing-addendum.docx DOCUMENT M&A / Corporate

9 / 12 ← → ✕

EXHIBIT C

DATA PROCESSING ADDENDUM

This Data Processing Addendum ("DPA") is Exhibit C to the Enterprise SaaS Subscription Agreement dated April 26, 2024 (the "Agreement"), by and between:

Quorum Insurance Holdings Corp., a Delaware corporation ("Controller" or "Customer"), with its principal offices located at 280 Constitution Plaza, Suite 1400, Hartford, CT 06103;

and

Clearpoint Analytics, Inc., a Delaware corporation ("Processor" or "Provider"), with its principal offices located at 200 South Wacker Drive, Suite 3100, Chicago, IL 60606.

Effective Date: April 26, 2024

RECITALS

WHEREAS, the parties have entered into the Agreement, pursuant to which Processor provides Controller with access to and use of the ClaimsIQ™ platform and related services;

WHEREAS, in connection with the provision of such services, Processor will process certain data provided by or on behalf of Controller, including data containing personally identifiable information, protected health information, and other confidential and proprietary information relating to Controller's insurance operations;

WHEREAS, the parties desire to set forth their respective rights and obligations with respect to the processing, protection, and security of such data in compliance with all applicable federal and state data protection and insurance privacy laws;

NOW, THEREFORE, this DPA is incorporated into and forms an integral part of the Agreement and governs the processing of Customer Data by Processor in connection with the provision of the ClaimsIQ™ platform and related services. Capitalized terms used but not defined herein shall have the meanings ascribed to them in the Agreement.

1. DEFINITIONS

1.1 "Aggregated Data" means de-identified, aggregated statistical data derived from Customer Data that cannot reasonably be used to identify any individual, policyholder, claimant, or specific Customer claim record. For the avoidance of doubt, Aggregated Data must be rendered such that no individual data subject or specific Controller record can be re-identified through any reasonably foreseeable means, whether used alone or in combination with other information available to Processor or any third party.

1.2 "Applicable Data Protection Laws" means, collectively: (a) the Connecticut Data Privacy Act ("CTDPA"), Conn. Gen. Stat. §§ 42-515 et seq.; (b) the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), as amended by the Health Information Technology for Economic and Clinical Health Act ("HITECH"), and the implementing regulations set forth at 45 C.F.R. Parts 160 and 164, to the extent applicable to Customer's workers' compensation insurance lines; and (c) the NAIC Insurance Data Security Model Law as adopted in the State of Connecticut; together with, in each case, all implementing regulations, official guidance, enforcement directives, and amendments thereto as in effect from time to time during the term of this DPA.

1.3 "Controller" means Quorum Insurance Holdings Corp. and its subsidiaries, including Quorum Property & Casualty Insurance Company, a Connecticut-domiciled insurance company, Quorum Specialty Underwriters, Inc., a Delaware corporation, and Quorum Digital Solutions LLC, a Delaware limited liability company, each as applicable data controller with respect to the Customer Data it provides or causes to be provided to Processor under the Agreement.

1.4 "Customer Data" means all data provided by or on behalf of Controller to Processor, or collected by Processor on behalf of Controller, in connection with the Agreement, including without limitation: claims data, policyholder personally identifiable information ("PII"), protected health information ("PHI"), adjuster notes, underwriting data, loss-run data, reserve information, subrogation records, and all outputs, reports, analyses, models, scores, dashboards, and derivatives generated from the foregoing using the ClaimsIQ™ platform. Customer Data includes data in any form — structured, unstructured, digital, or electronic — regardless of the medium in which it is stored, transmitted, or processed.

1.5 "Data Breach" means any unauthorized access to, acquisition of, use of, or disclosure of Customer Data, whether intentional or inadvertent, including any "Security Event" as defined under the NAIC Insurance Data Security Model Law and any "breach of security" as defined under the CTDPA or other applicable state breach-notification statutes. A Data Breach also includes any event that compromises the confidentiality, integrity, or availability of Customer Data such that notification to affected individuals, regulators, or other parties may be required under Applicable Data Protection Laws.

1.6 "Personal Data" means any information relating to an identified or identifiable natural person included within Customer Data, including PII and PHI. An identifiable natural person is one who can be identified, directly or indirectly, by reference to an identifier such as a name, identification number, location data, online identifier, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.

1.7 "Processing" means any operation or set of operations performed on Customer Data, whether by automated means or otherwise, including collection, recording, organization, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure by transmission, dissemination, alignment, combination, restriction, erasure, or destruction. For the avoidance of doubt, Processing includes any transient or incidental access to Customer Data that occurs during the provision of the services under the Agreement.

1.8 "Processor" means Clearpoint Analytics, Inc., acting in its capacity as data processor under this DPA with respect to Customer Data processed on behalf of Controller.

1.9 "Subprocessor" means any third party (including any affiliate of Processor, but excluding Processor's own employees) engaged by Processor to process Customer Data on behalf of Controller in connection with the performance of the Agreement.

1.10 "Supervised Users" means the up to one thousand two hundred (1,200) named users across Controller and its subsidiaries who are authorized to access and use the ClaimsIQ™ platform under the Agreement, as more particularly described in Exhibit A (Statement of Work) to the Agreement.

2. SCOPE AND PURPOSE OF PROCESSING

2.1 Scope. This DPA applies to all Customer Data processed by Processor in connection with the provision of the ClaimsIQ™ platform and related services under the Agreement. The scope of Processing encompasses all functionalities of the ClaimsIQ™ platform, including, without limitation, claims triage, fraud detection, analytics dashboard generation, reporting, and data visualization capabilities, as deployed across Controller's claims-processing operations located in Hartford, Connecticut; Dallas, Texas; and Jacksonville, Florida, and as accessed via remote connectivity by Controller's field adjusters and other authorized personnel. This DPA governs all Processing of Customer Data regardless of the geographic location from which Supervised Users access the platform or the format in which Customer Data is transmitted to or stored within the platform.

2.2 Purpose Limitation. Processor shall process Customer Data solely for the purpose of performing its obligations under the Agreement, including operating and maintaining the ClaimsIQ™ platform, providing the services described in Exhibit A (Statement of Work) to the Agreement, generating outputs, analyses, reports, and dashboards as directed by Controller, and performing such other processing activities as may be reasonably necessary to fulfill Processor's obligations under the Agreement. Processor shall not process Customer Data for any purpose other than as expressly authorized under this DPA or as subsequently directed in writing by Controller.

2.3 Controller's Instructions. Processor shall process Customer Data only in accordance with Controller's documented instructions. The Agreement and this DPA (including the appendices hereto) constitute Controller's initial documented instructions to Processor regarding the Processing of Customer Data. Any additional or supplemental instructions must be provided in writing and must be authorized by Controller's General Counsel or Chief Information Officer (or such other officer as Controller may designate in writing from time to time). Processor shall promptly notify Controller if, in Processor's reasonable opinion, an instruction from Controller infringes or would infringe upon any Applicable Data Protection Law, and Processor shall not be required to comply with such instruction until the matter has been resolved between the parties.

2.4 Prohibited Uses. Processor shall not:

(a) sell, rent, trade, or otherwise make available Customer Data to any third party for monetary or other valuable consideration;

(b) use Customer Data for purposes unrelated to the performance of the Agreement, including without limitation for Processor's own marketing, advertising, or business-development activities;

(c) combine Customer Data with data obtained from or on behalf of any other Processor customer or any other source, except as expressly authorized under Section 4 (Aggregated Data) and subject to all conditions and limitations set forth therein;

(d) process Customer Data in a manner inconsistent with Applicable Data Protection Laws, including any processing that would cause Controller to be in violation of its obligations under any insurance regulatory requirements; or

(e) transfer, disclose, or otherwise make Customer Data available to any government authority or regulatory body, except as required by applicable law or valid legal process, in which case Processor shall comply with Section 12.3.

3. CUSTOMER DATA OWNERSHIP

3.1 Sole and Exclusive Ownership. Controller retains sole and exclusive ownership of all Customer Data, including all intellectual property rights, proprietary rights, and any other rights of any nature therein. Nothing in the Agreement or this DPA shall be construed as transferring or granting to Processor any ownership interest, title, or proprietary right in or to any Customer Data. All right, title, and interest in and to Customer Data shall remain with Controller at all times, regardless of whether such data is in the possession or control of Processor or any Subprocessor. For the avoidance of doubt, this ownership extends to all derivatives, outputs, reports, analyses, models, and scores generated from Customer Data using the ClaimsIQ™ platform, except to the extent such outputs constitute Aggregated Data created in compliance with Section 4.

3.2 License to Process. Controller hereby grants Processor a limited, non-exclusive, non-transferable, revocable license to process Customer Data solely for the purposes set forth in Section 2 of this DPA and solely during the term of the Agreement (including any renewal terms). This license shall automatically terminate upon the expiration or termination of the Agreement for any reason. Processor acknowledges that this license does not confer upon Processor any right to use Customer Data for any purpose other than as expressly set forth in this DPA.

3.3 No Implied Rights. Processor acknowledges and agrees that its access to and processing of Customer Data does not create and shall not be construed to create any lien, security interest, right of retention, or other right, title, or interest of any kind in or to Customer Data. Processor shall not assert any such right, title, or interest against Controller or any third party, whether during or after the term of the Agreement. In no event shall Processor withhold, restrict, or limit Controller's access to Customer Data, including in connection with any dispute between the parties regarding fees, payments, or other matters arising under the Agreement.

4. AGGREGATED DATA

4.1 Permitted Creation. Subject to all conditions and limitations set forth in this Section 4, Processor may create Aggregated Data from Customer Data solely for the purpose of improving, enhancing, and benchmarking the ClaimsIQ™ platform and its underlying algorithms, models, and functionalities (collectively, "product-improvement purposes"). For the avoidance of doubt, Aggregated Data may not be used for any purpose other than product improvement, and Processor may not create or use Aggregated Data in any manner that would identify, or reasonably be expected to identify, Controller, any Controller subsidiary, or any individual data subject.

4.2 De-Identification Requirements. All Aggregated Data must be fully and irreversibly de-identified such that it cannot reasonably be used, alone or in combination with other information available to Processor or any third party, to identify any individual, policyholder, claimant, beneficiary, adjuster, or any specific Controller claim record, policy, or business operation. De-identification must comply with all applicable standards under the CTDPA, HIPAA (including the Safe Harbor method or the Expert Determination method set forth in 45 C.F.R. § 164.514(b)), and the NAIC Insurance Data Security Model Law. Processor shall maintain documentation of the de-identification methodology applied and shall make such documentation available to Controller upon request.

4.3 Prior Written Consent. Processor shall not create, derive, or use any Aggregated Data without Controller's prior written consent, which consent shall not be unreasonably withheld, conditioned, or delayed. Any request for consent must be submitted to Controller's General Counsel or Chief Information Officer and shall describe in reasonable detail: (a) the intended use of the Aggregated Data; (b) the de-identification methodology to be applied; (c) the categories and volume of Customer Data from which the Aggregated Data will be derived; (d) the technical and organizational safeguards that will be implemented to prevent re-identification; and (e) the retention period for the resulting Aggregated Data. Controller shall respond to any such request within thirty (30) days of receipt.

4.4 Prohibition on Re-Identification. Processor shall not attempt, directly or indirectly, to re-identify any Aggregated Data or to link, correlate, or associate Aggregated Data back to any identifiable individual or to Controller's specific data, records, policies, claims, or business operations. Processor shall implement technical safeguards reasonably designed to prevent re-identification, and shall contractually require all personnel and any third parties with access to Aggregated Data to refrain from any re-identification attempts.

4.5 Prohibition on Sale or Disclosure. Processor shall not sell, license, sublicense, distribute, publish, or otherwise disclose Aggregated Data to any third party, whether for monetary or other valuable consideration or otherwise. This prohibition applies regardless of whether the Aggregated Data has been fully de-identified. Processor may use Aggregated Data solely for internal product-improvement purposes as described in Section 4.1 and may not share Aggregated Data with any affiliate, partner, customer, or other entity.

4.6 Compliance with Insurance Data Privacy Laws. All creation, use, storage, and disposal of Aggregated Data must comply with Applicable Data Protection Laws, including all insurance-specific data privacy and security requirements applicable to Controller's lines of business. In the event of any conflict between this Section 4 and any Applicable Data Protection Law, the more restrictive requirement shall govern.

5. DATA PORTABILITY AND RETURN

5.1 Export Upon Expiration or Termination. Upon the expiration or termination of the Agreement for any reason (including termination for cause, termination for convenience, or non-renewal), Processor shall provide Controller with a full, complete, and usable export of all Customer Data in Processor's possession or control, including all Customer Data held by Subprocessors, in industry-standard formats, specifically: (a) ACORD XML format conforming to the then-current ACORD standards applicable to Controller's lines of business; and (b) comma-separated values (CSV) format with appropriate field headers, delimiters, and character encoding. Controller may designate additional export formats upon reasonable advance notice, and Processor shall use commercially reasonable efforts to accommodate such requests.

5.2 Export Timeline. The data export described in Section 5.1 shall be completed within sixty (60) calendar days of the effective date of expiration or termination of the Agreement (the "Export Period"). The data export shall be provided at no additional charge to Controller, and Processor shall not impose any fees, surcharges, or conditions on Controller's exercise of its data portability rights under this Section 5. Processor shall work cooperatively with Controller and any successor service provider designated by Controller to facilitate an orderly and timely transition of Customer Data.

5.3 Export Format and Integrity. All exported Customer Data shall be complete, unaltered, and machine-readable. Processor shall ensure that exported data accurately reflects the Customer Data as maintained within the ClaimsIQ™ platform as of the date of export, including all metadata, data relationships, and data structures necessary for Controller to import and utilize the exported data in its successor systems. Processor shall provide reasonable technical assistance to Controller in validating the completeness, accuracy, and integrity of exported data, including by making available knowledgeable personnel to respond to Controller's questions and to resolve any data quality issues identified during the validation process.

5.4 Destruction and Certification. Within thirty (30) calendar days following completion of the data export under Section 5.2 (or, if later, within thirty (30) calendar days following written confirmation by Controller that it has successfully received and validated the exported Customer Data), Processor shall:

(a) permanently and irreversibly destroy all copies of Customer Data in Processor's possession or control, including all copies maintained on primary systems, backup systems, disaster-recovery systems, and archives, and including all copies held by Subprocessors, using industry-standard data-destruction methods (such as cryptographic erasure, secure overwrite, or physical destruction of media, as appropriate); and

(b) provide Controller with a written certification, signed by an authorized officer of Processor (at the level of Vice President or above), confirming the complete and permanent destruction of all Customer Data in Processor's possession or control and in the possession or control of each Subprocessor, specifying the date and method of destruction.

5.5 Ongoing Access During Transition. During the Export Period described in Section 5.2, Processor shall continue to provide Controller with reasonable access to the ClaimsIQ™ platform, at the service levels specified in the Agreement, for the purpose of verifying the completeness, accuracy, and integrity of exported Customer Data and facilitating an orderly transition to any successor platform. Such access shall be provided at no additional charge to Controller and shall not be subject to any limitations beyond those set forth in the Agreement during its term.

6. SUBPROCESSOR MANAGEMENT

6.1 Current Subprocessors. Controller hereby acknowledges and consents to Processor's engagement of the following Subprocessors to process Customer Data as of the Effective Date:

A complete list of current Subprocessors, including additional detail regarding the nature and scope of processing performed by each Subprocessor, is set forth in Appendix 2 to this DPA.

6.2 Subprocessor Obligations. Processor shall enter into a written agreement with each Subprocessor that imposes data protection and security obligations that are no less protective of Customer Data than those set forth in this DPA. Each such agreement shall, at a minimum, require the Subprocessor to: (a) process Customer Data only in accordance with Controller's documented instructions as communicated through Processor; (b) implement appropriate technical and organizational security measures; (c) comply with Applicable Data Protection Laws; (d) permit audits and inspections as contemplated by this DPA; and (e) notify Processor promptly of any Data Breach or other security incident involving Customer Data. Processor shall remain fully liable to Controller for the acts, omissions, and defaults of its Subprocessors as if such acts, omissions, and defaults were those of Processor itself.

6.3 Notice of New Subprocessors. Processor shall provide Controller with at least thirty (30) days' prior written notice before engaging any new Subprocessor or replacing any existing Subprocessor for the processing of Customer Data. Such notice shall be delivered to Controller's General Counsel in accordance with Section 16.2 and shall include: (a) the identity and legal name of the proposed Subprocessor; (b) a description of the nature and scope of the processing to be performed by the Subprocessor; (c) the geographic location(s) where the Subprocessor will process Customer Data; and (d) the data protection and security measures implemented by the proposed Subprocessor.

6.4 Right to Object. Controller shall have the right to object to the engagement of any new or replacement Subprocessor by providing written notice to Processor within thirty (30) days of Controller's receipt of Processor's notice under Section 6.3. Controller's objection must be in writing and must state reasonable grounds related to data protection, data security, regulatory compliance, or the Subprocessor's ability to meet the requirements of this DPA. Controller shall not be required to provide any reason beyond a reasonable data-protection or regulatory-compliance concern in order to exercise its right of objection.

6.5 Resolution of Objections. If Controller objects to a proposed Subprocessor in accordance with Section 6.4, Processor shall, at its own expense: (a) refrain from engaging the proposed Subprocessor for the processing of Customer Data; or (b) propose commercially reasonable alternatives to address Controller's objection, which may include engaging a different Subprocessor acceptable to Controller or performing the relevant processing activities without the use of a Subprocessor. If the parties are unable to resolve Controller's objection within thirty (30) days following Processor's receipt of the objection notice, Controller may terminate the affected services under the Agreement without penalty, early-termination fee, or other charge, and Processor shall promptly initiate the data-return procedures set forth in Section 5.

6.6 Audit of Subprocessors. Controller shall have the right, upon reasonable prior written notice and during normal business hours, to audit or inspect, or to engage a qualified independent third party (subject to appropriate confidentiality obligations) to audit or inspect, any Subprocessor's compliance with the data protection and security obligations set forth in this DPA. Processor shall use commercially reasonable efforts to facilitate such audits, including by exercising its contractual audit rights with respect to its Subprocessors for the benefit of Controller. The costs of any such audit shall be borne by Controller unless the audit reveals a material breach of this DPA by the Subprocessor, in which case Processor shall bear the reasonable costs of the audit.

7. DATA SECURITY

7.1 Security Measures. Processor shall implement and maintain appropriate technical and organizational measures designed to protect Customer Data against unauthorized access, acquisition, use, disclosure, alteration, destruction, or loss, taking into account the state of the art, the costs of implementation, the nature, scope, context, and purposes of Processing, and the risks to the rights and freedoms of data subjects. Such measures shall be commensurate with the sensitivity and volume of Customer Data processed under the Agreement and shall be no less protective than industry-standard practices for the processing of insurance data, including PII and PHI. The specific security measures applicable to Processor's processing of Customer Data are set forth in Exhibit D (Security Requirements) to the Agreement.

7.2 Cross-Reference to Exhibit D. Without limiting the generality of Section 7.1, Processor's security obligations under this DPA include, and Processor shall at all times comply with, the following requirements as further detailed in Exhibit D (Security Requirements):

(a) Encryption Standards. Encryption of Customer Data in transit (TLS 1.2 or higher) and at rest (AES-256 or equivalent), as specified in Exhibit D.

(b) Access Controls. Role-based access controls, multi-factor authentication, least-privilege principles, and session-management controls, as specified in Exhibit D.

(c) SOC 2 Type II Audit. Maintenance of a current SOC 2 Type II audit report covering trust service criteria relevant to the processing of Customer Data, conducted by Hawthorne & Ellers, CPAs LLP, or another nationally recognized independent audit firm acceptable to Controller.

(d) Penetration Testing. Annual independent penetration testing of the ClaimsIQ™ platform conducted by Sentinel Cyber Solutions LLC, or another qualified third-party security firm acceptable to Controller, with prompt remediation of identified vulnerabilities.

(e) Incident Notification. Incident detection, response, and notification procedures as specified in Exhibit D, which are supplemented by the Data Breach notification requirements set forth in Section 8 of this DPA.

7.3 Insurance. Processor shall maintain, at its own expense and throughout the term of the Agreement (and for a period of not less than three (3) years following expiration or termination of the Agreement), the insurance coverages specified in Exhibit D (Security Requirements), including Technology Errors & Omissions / Cyber Liability insurance coverage in an amount not less than Ten Million Dollars ($10,000,000) per claim and Twenty Million Dollars ($20,000,000) in the aggregate, carried with Northern Ridge Mutual Insurance Company or another insurer with an A.M. Best rating of "A-" (Excellent) or better. Processor shall provide Controller with certificates of insurance and evidence of coverage upon request and shall notify Controller in writing not less than thirty (30) days prior to any material change in, cancellation of, or non-renewal of any required insurance coverage.

8. DATA BREACH NOTIFICATION

8.1 Notification Obligation. Processor shall notify Controller of any confirmed Data Breach without undue delay and in no event later than twenty-four (24) hours following Processor's confirmation that a Data Breach has occurred or is reasonably believed to have occurred. Notification shall be made by telephone to Controller's Chief Information Officer and by email to Controller's General Counsel (using the contact information set forth in Section 16.2), followed promptly by written notice delivered in accordance with the notice provisions of the Agreement. In the event Processor suspects but has not yet confirmed the occurrence of a Data Breach, Processor shall promptly notify Controller of the suspected breach and provide updates as additional information becomes available.

8.2 Content of Notification. Each Data Breach notification provided under Section 8.1 shall include, to the extent known or reasonably determinable at the time of notification:

(a) a description of the nature of the Data Breach, including the categories of Customer Data affected and the approximate number of data subjects and Customer Data records involved;

(b) the date and time the Data Breach occurred and the date and time it was discovered by Processor;

(d) a description of the measures taken or proposed by Processor to address the Data Breach, contain its effects, and prevent recurrence;

(e) the identity and contact information of Processor's designated point of contact for communications regarding the Data Breach; and

(f) any other information reasonably necessary for Controller to assess the impact of the Data Breach and to comply with its notification obligations under Applicable Data Protection Laws.

Processor shall supplement the initial notification with additional information as it becomes available and shall provide regular status updates until the Data Breach has been fully resolved and remediated.

8.3 Cooperation. Processor shall cooperate fully and promptly with Controller in investigating, remediating, and responding to any Data Breach, including by: (a) preserving and producing all evidence, logs, records, and forensic data related to the Data Breach; (b) providing all information and assistance reasonably required for Controller to comply with its notification obligations under Applicable Data Protection Laws and to any applicable state insurance regulator, including the Connecticut Insurance Department; (c) coordinating with Controller on the timing, content, and recipients of any required notifications to affected individuals, regulators, or other parties; (d) implementing all remedial measures reasonably directed by Controller; and (e) making available Processor's personnel, including security and engineering staff, to participate in investigation and remediation activities as reasonably requested by Controller.

8.4 No Limitation on Indemnification. For the avoidance of doubt, Processor's indemnification obligations under the Agreement with respect to Data Breaches — including Data Breaches caused by the acts or omissions of Processor, its personnel, or its Subprocessors — are uncapped, as expressly set forth in Section [applicable section] of the Agreement. The limitation-of-liability provisions of the Agreement shall not apply to Processor's indemnification obligations arising from a Data Breach, and no provision of this DPA shall be construed to limit or reduce such obligations.

9. REGULATORY COMPLIANCE

9.1 CTDPA Compliance. Processor shall comply with all applicable requirements of the Connecticut Data Privacy Act, Conn. Gen. Stat. §§ 42-515 et seq., as in effect from time to time, including, without limitation, requirements relating to: (a) data protection assessments for processing activities that present a heightened risk of harm to consumers; (b) the facilitation of consumer rights requests, including requests for access, correction, deletion, data portability, and opt-out of the processing of Personal Data for targeted advertising, sale, or profiling; (c) purpose limitation and data minimization; and (d) transparency obligations. Processor shall implement all technical and organizational measures necessary to enable Controller to fulfill its own obligations under the CTDPA in connection with Customer Data processed by Processor.

9.2 HIPAA Compliance. To the extent Processor processes PHI in connection with Controller's workers' compensation insurance lines or any other line of business that involves PHI, Processor shall comply with all applicable requirements of HIPAA, as amended by HITECH, including:

(a) the Privacy Rule (45 C.F.R. Part 164, Subpart E), including requirements relating to the use and disclosure of PHI, minimum necessary standards, and individual rights;

(b) the Security Rule (45 C.F.R. Part 164, Subpart C), including requirements for administrative, physical, and technical safeguards for electronic PHI; and

(c) the Breach Notification Rule (45 C.F.R. Part 164, Subpart D), including requirements for notification of breaches of unsecured PHI to affected individuals, the U.S. Department of Health and Human Services, and, where applicable, the media.

The parties shall enter into a Business Associate Agreement ("BAA") as Appendix 1 to this DPA if and to the extent required by HIPAA. In the event a BAA is executed, the terms of the BAA shall supplement and, to the extent of any conflict with respect to PHI, prevail over the terms of this DPA.

9.3 NAIC Insurance Data Security Model Law. Processor shall comply with the NAIC Insurance Data Security Model Law as adopted in the State of Connecticut, including all requirements relating to: (a) the establishment and maintenance of a comprehensive written information security program; (b) the investigation of and response to cybersecurity events; (c) notification to the Connecticut Insurance Department and other regulatory authorities of cybersecurity events within the time frames specified by applicable law; and (d) the oversight of third-party service providers, including requirements that licensees exercise due diligence in selecting third-party service providers and require third-party service providers to implement appropriate measures to protect nonpublic information.

9.4 Insurance Regulatory Carve-Outs. Nothing in this DPA shall be construed to limit, restrict, or otherwise affect Controller's obligations to comply with insurance regulatory requirements applicable to its business, including those imposed by the Connecticut Insurance Department, the Texas Department of Insurance, the Florida Office of Insurance Regulation, or any other state insurance regulator with jurisdiction over Controller's operations. Processor shall cooperate fully and promptly with Controller in responding to regulatory inquiries, market conduct examinations, financial examinations, or other audits or investigations conducted by any state insurance regulator that relate to Customer Data or Processor's processing activities under the Agreement.

9.5 Consumer Rights Requests. Processor shall promptly assist Controller in responding to any consumer rights requests received under Applicable Data Protection Laws, including requests for access to, correction of, deletion of, or portability of Personal Data. Processor shall: (a) promptly forward to Controller any consumer rights request received directly by Processor that relates to Customer Data; (b) implement and maintain technical and organizational measures that enable Controller to locate, access, correct, delete, and export Personal Data within the ClaimsIQ™ platform in response to consumer rights requests; (c) respond to Controller's instructions regarding the handling of specific consumer rights requests within the time frames necessary for Controller to comply with applicable legal deadlines; and (d) maintain records of all consumer rights requests processed and the actions taken in response thereto.

9.6 Regulatory Changes. In the event of material changes to Applicable Data Protection Laws, or the enactment of new federal or state laws or regulations, that affect Processor's obligations under this DPA or the manner in which Processor processes Customer Data, the parties shall promptly notify each other and shall negotiate in good faith to amend this DPA as necessary to ensure continued compliance. Any such amendment shall be documented in writing and signed by authorized representatives of both parties in accordance with Section 16.1.

10. AUDITS AND ASSESSMENTS

10.1 Audit Rights. Controller shall have the right, upon not less than thirty (30) days' prior written notice to Processor and during normal business hours, to audit or inspect, or to engage a qualified independent third party (subject to appropriate confidentiality obligations acceptable to Processor, acting reasonably) to audit or inspect, Processor's compliance with this DPA, including Processor's technical and organizational security measures, data protection practices, and Subprocessor management. Such audits shall be conducted no more than once per calendar year; provided, however, that this frequency limitation shall not apply if: (a) a Data Breach has occurred; (b) Controller has reasonable, documented grounds to believe that Processor is not in compliance with its obligations under this DPA; or (c) an audit is required or requested by a regulatory authority with jurisdiction over Controller.

10.2 Access and Cooperation. Processor shall provide Controller and its authorized auditors with reasonable access to Processor's facilities, systems, records, documentation, and personnel relevant to the processing of Customer Data. Processor shall designate a knowledgeable point of contact to coordinate audit logistics, respond to auditor inquiries, and facilitate access to relevant materials. Processor shall not unreasonably obstruct, delay, or restrict any audit conducted in accordance with this Section 10. The costs of any audit conducted by Controller or its third-party auditor shall be borne by Controller unless the audit reveals a material breach of this DPA by Processor, in which case the reasonable costs of the audit shall be borne by Processor.

10.3 SOC 2 Type II Reports. Processor shall maintain a current SOC 2 Type II audit report covering trust service criteria for security, availability, confidentiality, and processing integrity, conducted by Hawthorne & Ellers, CPAs LLP, or another nationally recognized independent audit firm acceptable to Controller. Processor shall provide Controller with a copy of its most recent SOC 2 Type II audit report (covering the audit period April 1, 2023 through March 31, 2024, and subsequent annual audit periods) within ninety (90) days of the close of each audit period. Provision of a current SOC 2 Type II report that does not contain material exceptions or qualified opinions may, at Controller's sole discretion, satisfy Controller's audit rights under Section 10.1 for the period covered by such report, unless Controller has specific, documented concerns regarding Processor's compliance with this DPA that are not adequately addressed by the SOC 2 Type II report.

10.4 Data Protection Impact Assessments. Processor shall cooperate with Controller and provide all information, documentation, and access reasonably requested by Controller in connection with any data protection impact assessment ("DPIA") conducted by Controller or its consultants, including Dravello Data Compliance Advisors LLC, in relation to the processing of Customer Data under the Agreement. Such cooperation shall include providing detailed descriptions of Processor's processing activities, technical architecture, security measures, and risk-mitigation controls, as well as participating in interviews and workshops as reasonably requested. Processor shall make such information available within a reasonable time frame and at no additional charge to Controller.

11. DATA TRANSFER RESTRICTIONS

11.1 Location of Processing. Processor shall process Customer Data only within the continental United States. Processor shall not transfer, store, access, or otherwise process Customer Data in any jurisdiction outside the continental United States unless Controller provides prior written consent to such processing, which consent may be withheld in Controller's sole discretion. For the avoidance of doubt, this restriction applies to all forms of access to Customer Data, including remote access by Processor's personnel or Subprocessors.

11.2 Hosting Infrastructure. As of the Effective Date, all Customer Data is hosted by Cobalt Cloud Infrastructure, Inc. in data center facilities located within the continental United States. Processor represents and warrants that Cobalt Cloud Infrastructure, Inc.'s data center facilities used for the storage and processing of Customer Data are located in the continental United States and that no Customer Data is stored, replicated, or backed up in data center facilities located outside the continental United States.

11.3 Change in Processing Location. Processor shall provide Controller with at least sixty (60) days' prior written notice of any proposed change in the geographic location of Customer Data processing or storage, including any change in the location of data center facilities used by Processor or any Subprocessor for the hosting, storage, backup, or disaster recovery of Customer Data. Controller shall have the right to approve or reject any such proposed change, and any change implemented without Controller's prior written approval shall constitute a material breach of this DPA.

12. DATA RETENTION

12.1 Retention During Term. During the term of the Agreement, Processor shall retain Customer Data only for as long as necessary to perform its obligations under the Agreement and this DPA. Processor shall not retain copies of Customer Data beyond what is reasonably required for the provision of the services and shall implement data-minimization practices to limit the volume and duration of Customer Data retention to what is necessary for the specified processing purposes.

12.2 Post-Termination Retention. Subject to the data-return and destruction obligations set forth in Section 5 (Data Portability and Return), Processor shall not retain any Customer Data beyond the destruction certification deadline specified in Section 5.4. Upon completion of the destruction and certification process described in Section 5.4, Processor shall have no further right to retain, access, or use any Customer Data for any purpose.

12.3 Legal Hold. If Processor is required by applicable law, regulation, judicial order, or regulatory directive to retain any Customer Data beyond the periods specified in this DPA, Processor shall:

(a) promptly notify Controller in writing of such requirement, identifying the specific legal basis and the categories and volume of Customer Data subject to the retention requirement (to the extent such disclosure is not prohibited by applicable law);

(b) retain only the minimum volume and categories of Customer Data required to comply with such legal obligation; and

(c) maintain the confidentiality and security of such retained Customer Data in accordance with the requirements of this DPA for so long as such Customer Data remains in Processor's possession or control, and destroy such Customer Data promptly upon the expiration of the applicable retention requirement.

13. PERSONNEL

13.1 Authorized Personnel. Processor shall ensure that only personnel who have a legitimate need to access Customer Data in connection with the performance of Processor's obligations under the Agreement are granted access to such data. Processor shall maintain and enforce access-control policies that limit access to Customer Data to the minimum number of personnel necessary to perform the applicable processing activities. Processor shall promptly revoke access to Customer Data for any personnel who no longer require such access, including upon termination of employment or reassignment to duties that do not involve Customer Data.

13.2 Confidentiality Obligations. Processor shall ensure that all personnel authorized to process Customer Data are bound by appropriate and enforceable confidentiality obligations, whether through employment agreements, contractor agreements, or standalone confidentiality and non-disclosure agreements. Such obligations shall prohibit unauthorized use, disclosure, or retention of Customer Data and shall survive the termination of the individual's relationship with Processor.

13.3 Training. Processor shall provide regular data protection, information security, and privacy training to all personnel who access or process Customer Data. Such training shall be conducted at least annually and upon initial assignment to duties involving Customer Data, and shall cover, at a minimum: (a) the requirements of Applicable Data Protection Laws; (b) Processor's data protection and information security policies and procedures; (c) the identification and reporting of potential Data Breaches and security incidents; and (d) the proper handling of PII and PHI. Processor shall maintain records of all training provided and shall make such records available to Controller upon request.

14. RELATIONSHIP TO AGREEMENT

14.1 Incorporation. This DPA is incorporated into and forms an integral part of the Agreement. All references in the Agreement to exhibits, schedules, or addenda shall be deemed to include this DPA. The terms and conditions of this DPA are binding upon the parties and their respective successors, assigns, and permitted transferees to the same extent as the Agreement.

14.2 Conflict. In the event of any conflict or inconsistency between the terms of this DPA and the terms of the Agreement (including any other exhibit, schedule, or addendum thereto), the terms of this DPA shall prevail with respect to the processing, protection, and security of Customer Data. In all other respects, the terms of the Agreement shall prevail. For the avoidance of doubt, this DPA does not limit or restrict any rights or remedies available to Controller under the Agreement.

14.3 Governing Law. This DPA shall be governed by and construed in accordance with the laws of the State of Connecticut, without regard to principles of conflicts of law that would require the application of the laws of any other jurisdiction. This governing-law provision is consistent with, and supplements, the governing-law provision set forth in the Agreement.

14.4 Dispute Resolution. Any dispute, claim, or controversy arising out of or relating to this DPA, including any dispute regarding its interpretation, validity, breach, or termination, shall be resolved in accordance with the dispute resolution provisions of the Agreement, including: (a) mandatory mediation administered by Pinnacle Dispute Resolution Services, Hartford, Connecticut, as a condition precedent to the commencement of arbitration; and (b) if mediation does not result in resolution within sixty (60) days of initiation, binding arbitration conducted under the Commercial Arbitration Rules of the American Arbitration Association ("AAA"), with the seat of arbitration in Hartford, Connecticut. The arbitral tribunal shall consist of a single arbitrator selected in accordance with the AAA Rules who has demonstrated expertise in data protection and technology law. The arbitrator's decision shall be final and binding and may be entered as a judgment in any court of competent jurisdiction.

15. TERM AND SURVIVAL

15.1 Term. This DPA shall remain in full force and effect for the duration of the Agreement, including the initial five (5) year term commencing on April 26, 2024, and any renewal terms agreed to by the parties in writing. This DPA shall terminate automatically upon the expiration or termination of the Agreement, subject to the survival provisions set forth in Section 15.2.

15.2 Survival. The following sections of this DPA shall survive the expiration or termination of the Agreement and this DPA for any reason, and shall continue in full force and effect for so long as Processor or any Subprocessor retains any Customer Data or Aggregated Data, and in any event for a period of not less than five (5) years following such expiration or termination: Section 3 (Customer Data Ownership), Section 4 (Aggregated Data), Section 5 (Data Portability and Return), Section 8 (Data Breach Notification), Section 10 (Audits and Assessments), and Section 12 (Data Retention). All other provisions of this DPA that by their nature should survive expiration or termination shall also survive, including the definitions set forth in Section 1 to the extent necessary to interpret the surviving provisions.

16. MISCELLANEOUS

16.1 Amendments. This DPA may be amended, modified, or supplemented only by a written instrument duly executed by authorized representatives of both parties. No oral agreement, course of dealing, or course of performance shall be deemed to amend or modify this DPA. Any amendment to this DPA shall specifically reference this DPA and shall state the effective date of the amendment.

16.2 Notices. All notices, requests, consents, demands, and other communications required or permitted under this DPA shall be in writing and shall be delivered in accordance with the notice provisions of the Agreement. Notices to Controller shall be addressed to:

Patricia Okonkwo, General Counsel Quorum Insurance Holdings Corp. 280 Constitution Plaza, Suite 1400 Hartford, CT 06103

Notices to Processor shall be addressed to:

Anita Rajan, CEO Clearpoint Analytics, Inc. 200 South Wacker Drive, Suite 3100 Chicago, IL 60606

Either party may change its designated notice recipient or address by providing written notice to the other party in accordance with this Section 16.2.

16.3 Entire Agreement. This DPA, together with the Agreement and its other Exhibits (including Exhibit A — Statement of Work, Exhibit B — Pricing and Payment Terms, Exhibit D — Security Requirements, and any other exhibits, schedules, appendices, and addenda thereto), constitutes the entire agreement between the parties with respect to the processing, protection, and security of Customer Data and supersedes all prior and contemporaneous agreements, understandings, representations, and warranties, whether written or oral, relating to the subject matter hereof.

[SIGNATURE PAGE FOLLOWS]

IN WITNESS WHEREOF, the parties have caused this Data Processing Addendum to be executed by their duly authorized representatives as of the date first written above.

CONTROLLER:

QUORUM INSURANCE HOLDINGS CORP.

By: ________

Name: Patricia Okonkwo

Title: General Counsel

Date: April 26, 2024

PROCESSOR:

CLEARPOINT ANALYTICS, INC.

By: ________

Name: Anita Rajan

Title: CEO & Co-Founder

Date: April 26, 2024

APPENDIX 1 DESCRIPTION OF PROCESSING ACTIVITIES

This Appendix 1 forms part of the Data Processing Addendum (Exhibit C) and sets forth the details of the processing activities performed by Processor on behalf of Controller.

APPENDIX 2 CURRENT SUBPROCESSOR LIST

This Appendix 2 forms part of the Data Processing Addendum (Exhibit C) and sets forth the current list of Subprocessors engaged by Processor to process Customer Data on behalf of Controller as of the Effective Date.

Note: This Subprocessor list is current as of the Effective Date (April 26, 2024). Any changes to the Subprocessor list — including the engagement of new Subprocessors or the replacement of existing Subprocessors — are subject to the notice and objection procedures set forth in Section 6 of this DPA. Processor shall maintain an up-to-date list of Subprocessors and shall make such list available to Controller upon request.

[End of Exhibit C — Data Processing Addendum]

Subprocessor	Role	Location
Cobalt Cloud Infrastructure, Inc.	Infrastructure-as-a-Service hosting provider for the ClaimsIQ™ platform, including storage, computation, and network services for Customer Data	500 Terry Francine Street, San Jose, CA 95128; data centers located within the continental United States
Redline Document AI, LLC	Optical character recognition (OCR) processing of claims documents uploaded to the ClaimsIQ™ platform	California
Element	Description
Controller	Quorum Insurance Holdings Corp. and its subsidiaries: Quorum Property & Casualty Insurance Company (CT), Quorum Specialty Underwriters, Inc. (DE), and Quorum Digital Solutions LLC (DE)
Processor	Clearpoint Analytics, Inc.
Subject Matter of Processing	Provision of the ClaimsIQ™ platform and related services, including claims triage, fraud detection, predictive analytics, reporting, and analytics dashboard functionalities
Duration of Processing	Five (5) year initial term commencing April 26, 2024, plus any renewal terms agreed to by the parties in writing under the Agreement
Nature and Purpose of Processing	Automated and manual processing of Customer Data for the purposes of claims triage (including severity scoring and priority assignment), fraud detection (including pattern analysis and anomaly identification), analytics dashboards (including real-time and historical reporting), report generation, data visualization, and related platform functionalities as described in Exhibit A (Statement of Work) to the Agreement
Categories of Data Subjects	Policyholders, claimants, beneficiaries, insureds, claims adjusters, field adjusters, underwriters, and other individuals whose Personal Data is included in Customer Data submitted to or processed through the ClaimsIQ™ platform
Categories of Personal Data	Names, addresses (physical and email), telephone numbers, contact information, Social Security numbers, dates of birth, driver's license numbers, policy numbers, claim numbers, claims histories, medical records and protected health information (for workers' compensation lines), financial information (including bank account information and payment records), adjuster notes and commentary, photographs and image files, video recordings, and other information submitted in connection with insurance claims or underwriting activities
Sensitive Data / Special Categories	Protected health information (PHI) processed in connection with Controller's workers' compensation insurance lines; financial information, including bank account numbers and payment records; Social Security numbers
Processing Locations	Continental United States, specifically including Cobalt Cloud Infrastructure, Inc. data centers located within the continental United States
Subprocessors	Cobalt Cloud Infrastructure, Inc. (Infrastructure-as-a-Service hosting); Redline Document AI, LLC (optical character recognition processing of claims documents)
Subprocessor Name	Description of Processing	Location
Cobalt Cloud Infrastructure, Inc.	Infrastructure-as-a-Service hosting for the ClaimsIQ™ platform, including storage, computation, backup, disaster recovery, and network services for Customer Data; provision of cloud infrastructure on which the ClaimsIQ™ platform operates	Corporate headquarters: 500 Terry Francine Street, San Jose, CA 95128; data center facilities located within the continental United States
Redline Document AI, LLC	Optical character recognition (OCR) processing of claims documents, correspondence, medical records, and other document files uploaded to the ClaimsIQ™ platform by Controller's Supervised Users; extraction of structured data from unstructured document images for ingestion into the ClaimsIQ™ platform	California

EXHIBIT C
DATA PROCESSING ADDENDUM
This Data Processing Addendum ("DPA") is Exhibit C to the Enterprise SaaS Subscription Agreement dated April 26, 2024 (the "Agreement"), by and between:
Quorum Insurance Holdings Corp., a Delaware corporation ("Controller" or "Customer"), with its principal offices located at 280 Constitution Plaza, Suite 1400, Hartford, CT 06103;
and
Clearpoint Analytics, Inc., a Delaware corporation ("Processor" or "Provider"), with its principal offices located at 200 South Wacker Drive, Suite 3100, Chicago, IL 60606.
Effective Date: April 26, 2024
RECITALS
WHEREAS, the parties have entered into the Agreement, pursuant to which Processor provides Controller with access to and use of the ClaimsIQ™ platform and related services;
WHEREAS, in connection with the provision of such services, Processor will process certain data provided by or on behalf of Controller, including data containing personally identifiable information, protected health information, and other confidential and proprietary information relating to Controller's insurance operations;
WHEREAS, the parties desire to set forth their respective rights and obligations with respect to the processing, protection, and security of such data in compliance with all applicable federal and state data protection and insurance privacy laws;
NOW, THEREFORE, this DPA is incorporated into and forms an integral part of the Agreement and governs the processing of Customer Data by Processor in connection with the provision of the ClaimsIQ™ platform and related services. Capitalized terms used but not defined herein shall have the meanings ascribed to them in the Agreement.
1. DEFINITIONS
1.1 "Aggregated Data" means de-identified, aggregated statistical data derived from Customer Data that cannot reasonably be used to identify any individual, policyholder, claimant, or specific Customer claim record. For the avoidance of doubt, Aggregated Data must be rendered such that no individual data subject or specific Controller record can be re-identified through any reasonably foreseeable means, whether used alone or in combination with other information available to Processor or any third party.
1.2 "Applicable Data Protection Laws" means, collectively: (a) the Connecticut Data Privacy Act ("CTDPA"), Conn. Gen. Stat. §§ 42-515 et seq.; (b) the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), as amended by the Health Information Technology for Economic and Clinical Health Act ("HITECH"), and the implementing regulations set forth at 45 C.F.R. Parts 160 and 164, to the extent applicable to Customer's workers' compensation insurance lines; and (c) the NAIC Insurance Data Security Model Law as adopted in the State of Connecticut; together with, in each case, all implementing regulations, official guidance, enforcement directives, and amendments thereto as in effect from time to time during the term of this DPA.
1.3 "Controller" means Quorum Insurance Holdings Corp. and its subsidiaries, including Quorum Property & Casualty Insurance Company, a Connecticut-domiciled insurance company, Quorum Specialty Underwriters, Inc., a Delaware corporation, and Quorum Digital Solutions LLC, a Delaware limited liability company, each as applicable data controller with respect to the Customer Data it provides or causes to be provided to Processor under the Agreement.
1.4 "Customer Data" means all data provided by or on behalf of Controller to Processor, or collected by Processor on behalf of Controller, in connection with the Agreement, including without limitation: claims data, policyholder personally identifiable information ("PII"), protected health information ("PHI"), adjuster notes, underwriting data, loss-run data, reserve information, subrogation records, and all outputs, reports, analyses, models, scores, dashboards, and derivatives generated from the foregoing using the ClaimsIQ™ platform. Customer Data includes data in any form — structured, unstructured, digital, or electronic — regardless of the medium in which it is stored, transmitted, or processed.
1.5 "Data Breach" means any unauthorized access to, acquisition of, use of, or disclosure of Customer Data, whether intentional or inadvertent, including any "Security Event" as defined under the NAIC Insurance Data Security Model Law and any "breach of security" as defined under the CTDPA or other applicable state breach-notification statutes. A Data Breach also includes any event that compromises the confidentiality, integrity, or availability of Customer Data such that notification to affected individuals, regulators, or other parties may be required under Applicable Data Protection Laws.
1.6 "Personal Data" means any information relating to an identified or identifiable natural person included within Customer Data, including PII and PHI. An identifiable natural person is one who can be identified, directly or indirectly, by reference to an identifier such as a name, identification number, location data, online identifier, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.
1.7 "Processing" means any operation or set of operations performed on Customer Data, whether by automated means or otherwise, including collection, recording, organization, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure by transmission, dissemination, alignment, combination, restriction, erasure, or destruction. For the avoidance of doubt, Processing includes any transient or incidental access to Customer Data that occurs during the provision of the services under the Agreement.
1.8 "Processor" means Clearpoint Analytics, Inc., acting in its capacity as data processor under this DPA with respect to Customer Data processed on behalf of Controller.
1.9 "Subprocessor" means any third party (including any affiliate of Processor, but excluding Processor's own employees) engaged by Processor to process Customer Data on behalf of Controller in connection with the performance of the Agreement.
1.10 "Supervised Users" means the up to one thousand two hundred (1,200) named users across Controller and its subsidiaries who are authorized to access and use the ClaimsIQ™ platform under the Agreement, as more particularly described in Exhibit A (Statement of Work) to the Agreement.
2. SCOPE AND PURPOSE OF PROCESSING
2.1 Scope. This DPA applies to all Customer Data processed by Processor in connection with the provision of the ClaimsIQ™ platform and related services under the Agreement. The scope of Processing encompasses all functionalities of the ClaimsIQ™ platform, including, without limitation, claims triage, fraud detection, analytics dashboard generation, reporting, and data visualization capabilities, as deployed across Controller's claims-processing operations located in Hartford, Connecticut; Dallas, Texas; and Jacksonville, Florida, and as accessed via remote connectivity by Controller's field adjusters and other authorized personnel. This DPA governs all Processing of Customer Data regardless of the geographic location from which Supervised Users access the platform or the format in which Customer Data is transmitted to or stored within the platform.
2.2 Purpose Limitation. Processor shall process Customer Data solely for the purpose of performing its obligations under the Agreement, including operating and maintaining the ClaimsIQ™ platform, providing the services described in Exhibit A (Statement of Work) to the Agreement, generating outputs, analyses, reports, and dashboards as directed by Controller, and performing such other processing activities as may be reasonably necessary to fulfill Processor's obligations under the Agreement. Processor shall not process Customer Data for any purpose other than as expressly authorized under this DPA or as subsequently directed in writing by Controller.
2.3 Controller's Instructions. Processor shall process Customer Data only in accordance with Controller's documented instructions. The Agreement and this DPA (including the appendices hereto) constitute Controller's initial documented instructions to Processor regarding the Processing of Customer Data. Any additional or supplemental instructions must be provided in writing and must be authorized by Controller's General Counsel or Chief Information Officer (or such other officer as Controller may designate in writing from time to time). Processor shall promptly notify Controller if, in Processor's reasonable opinion, an instruction from Controller infringes or would infringe upon any Applicable Data Protection Law, and Processor shall not be required to comply with such instruction until the matter has been resolved between the parties.
2.4 Prohibited Uses. Processor shall not:
(a) sell, rent, trade, or otherwise make available Customer Data to any third party for monetary or other valuable consideration;
(b) use Customer Data for purposes unrelated to the performance of the Agreement, including without limitation for Processor's own marketing, advertising, or business-development activities;
(c) combine Customer Data with data obtained from or on behalf of any other Processor customer or any other source, except as expressly authorized under Section 4 (Aggregated Data) and subject to all conditions and limitations set forth therein;
(d) process Customer Data in a manner inconsistent with Applicable Data Protection Laws, including any processing that would cause Controller to be in violation of its obligations under any insurance regulatory requirements; or
(e) transfer, disclose, or otherwise make Customer Data available to any government authority or regulatory body, except as required by applicable law or valid legal process, in which case Processor shall comply with Section 12.3.
3. CUSTOMER DATA OWNERSHIP
3.1 Sole and Exclusive Ownership. Controller retains sole and exclusive ownership of all Customer Data, including all intellectual property rights, proprietary rights, and any other rights of any nature therein. Nothing in the Agreement or this DPA shall be construed as transferring or granting to Processor any ownership interest, title, or proprietary right in or to any Customer Data. All right, title, and interest in and to Customer Data shall remain with Controller at all times, regardless of whether such data is in the possession or control of Processor or any Subprocessor. For the avoidance of doubt, this ownership extends to all derivatives, outputs, reports, analyses, models, and scores generated from Customer Data using the ClaimsIQ™ platform, except to the extent such outputs constitute Aggregated Data created in compliance with Section 4.
3.2 License to Process. Controller hereby grants Processor a limited, non-exclusive, non-transferable, revocable license to process Customer Data solely for the purposes set forth in Section 2 of this DPA and solely during the term of the Agreement (including any renewal terms). This license shall automatically terminate upon the expiration or termination of the Agreement for any reason. Processor acknowledges that this license does not confer upon Processor any right to use Customer Data for any purpose other than as expressly set forth in this DPA.
3.3 No Implied Rights. Processor acknowledges and agrees that its access to and processing of Customer Data does not create and shall not be construed to create any lien, security interest, right of retention, or other right, title, or interest of any kind in or to Customer Data. Processor shall not assert any such right, title, or interest against Controller or any third party, whether during or after the term of the Agreement. In no event shall Processor withhold, restrict, or limit Controller's access to Customer Data, including in connection with any dispute between the parties regarding fees, payments, or other matters arising under the Agreement.
4. AGGREGATED DATA
4.1 Permitted Creation. Subject to all conditions and limitations set forth in this Section 4, Processor may create Aggregated Data from Customer Data solely for the purpose of improving, enhancing, and benchmarking the ClaimsIQ™ platform and its underlying algorithms, models, and functionalities (collectively, "product-improvement purposes"). For the avoidance of doubt, Aggregated Data may not be used for any purpose other than product improvement, and Processor may not create or use Aggregated Data in any manner that would identify, or reasonably be expected to identify, Controller, any Controller subsidiary, or any individual data subject.
4.2 De-Identification Requirements. All Aggregated Data must be fully and irreversibly de-identified such that it cannot reasonably be used, alone or in combination with other information available to Processor or any third party, to identify any individual, policyholder, claimant, beneficiary, adjuster, or any specific Controller claim record, policy, or business operation. De-identification must comply with all applicable standards under the CTDPA, HIPAA (including the Safe Harbor method or the Expert Determination method set forth in 45 C.F.R. § 164.514(b)), and the NAIC Insurance Data Security Model Law. Processor shall maintain documentation of the de-identification methodology applied and shall make such documentation available to Controller upon request.
4.3 Prior Written Consent. Processor shall not create, derive, or use any Aggregated Data without Controller's prior written consent, which consent shall not be unreasonably withheld, conditioned, or delayed. Any request for consent must be submitted to Controller's General Counsel or Chief Information Officer and shall describe in reasonable detail: (a) the intended use of the Aggregated Data; (b) the de-identification methodology to be applied; (c) the categories and volume of Customer Data from which the Aggregated Data will be derived; (d) the technical and organizational safeguards that will be implemented to prevent re-identification; and (e) the retention period for the resulting Aggregated Data. Controller shall respond to any such request within thirty (30) days of receipt.
4.4 Prohibition on Re-Identification. Processor shall not attempt, directly or indirectly, to re-identify any Aggregated Data or to link, correlate, or associate Aggregated Data back to any identifiable individual or to Controller's specific data, records, policies, claims, or business operations. Processor shall implement technical safeguards reasonably designed to prevent re-identification, and shall contractually require all personnel and any third parties with access to Aggregated Data to refrain from any re-identification attempts.
4.5 Prohibition on Sale or Disclosure. Processor shall not sell, license, sublicense, distribute, publish, or otherwise disclose Aggregated Data to any third party, whether for monetary or other valuable consideration or otherwise. This prohibition applies regardless of whether the Aggregated Data has been fully de-identified. Processor may use Aggregated Data solely for internal product-improvement purposes as described in Section 4.1 and may not share Aggregated Data with any affiliate, partner, customer, or other entity.
4.6 Compliance with Insurance Data Privacy Laws. All creation, use, storage, and disposal of Aggregated Data must comply with Applicable Data Protection Laws, including all insurance-specific data privacy and security requirements applicable to Controller's lines of business. In the event of any conflict between this Section 4 and any Applicable Data Protection Law, the more restrictive requirement shall govern.
5. DATA PORTABILITY AND RETURN
5.1 Export Upon Expiration or Termination. Upon the expiration or termination of the Agreement for any reason (including termination for cause, termination for convenience, or non-renewal), Processor shall provide Controller with a full, complete, and usable export of all Customer Data in Processor's possession or control, including all Customer Data held by Subprocessors, in industry-standard formats, specifically: (a) ACORD XML format conforming to the then-current ACORD standards applicable to Controller's lines of business; and (b) comma-separated values (CSV) format with appropriate field headers, delimiters, and character encoding. Controller may designate additional export formats upon reasonable advance notice, and Processor shall use commercially reasonable efforts to accommodate such requests.
5.2 Export Timeline. The data export described in Section 5.1 shall be completed within sixty (60) calendar days of the effective date of expiration or termination of the Agreement (the "Export Period"). The data export shall be provided at no additional charge to Controller, and Processor shall not impose any fees, surcharges, or conditions on Controller's exercise of its data portability rights under this Section 5. Processor shall work cooperatively with Controller and any successor service provider designated by Controller to facilitate an orderly and timely transition of Customer Data.
5.3 Export Format and Integrity. All exported Customer Data shall be complete, unaltered, and machine-readable. Processor shall ensure that exported data accurately reflects the Customer Data as maintained within the ClaimsIQ™ platform as of the date of export, including all metadata, data relationships, and data structures necessary for Controller to import and utilize the exported data in its successor systems. Processor shall provide reasonable technical assistance to Controller in validating the completeness, accuracy, and integrity of exported data, including by making available knowledgeable personnel to respond to Controller's questions and to resolve any data quality issues identified during the validation process.
5.4 Destruction and Certification. Within thirty (30) calendar days following completion of the data export under Section 5.2 (or, if later, within thirty (30) calendar days following written confirmation by Controller that it has successfully received and validated the exported Customer Data), Processor shall:
(a) permanently and irreversibly destroy all copies of Customer Data in Processor's possession or control, including all copies maintained on primary systems, backup systems, disaster-recovery systems, and archives, and including all copies held by Subprocessors, using industry-standard data-destruction methods (such as cryptographic erasure, secure overwrite, or physical destruction of media, as appropriate); and
(b) provide Controller with a written certification, signed by an authorized officer of Processor (at the level of Vice President or above), confirming the complete and permanent destruction of all Customer Data in Processor's possession or control and in the possession or control of each Subprocessor, specifying the date and method of destruction.
5.5 Ongoing Access During Transition. During the Export Period described in Section 5.2, Processor shall continue to provide Controller with reasonable access to the ClaimsIQ™ platform, at the service levels specified in the Agreement, for the purpose of verifying the completeness, accuracy, and integrity of exported Customer Data and facilitating an orderly transition to any successor platform. Such access shall be provided at no additional charge to Controller and shall not be subject to any limitations beyond those set forth in the Agreement during its term.
6. SUBPROCESSOR MANAGEMENT
6.1 Current Subprocessors. Controller hereby acknowledges and consents to Processor's engagement of the following Subprocessors to process Customer Data as of the Effective Date:
A complete list of current Subprocessors, including additional detail regarding the nature and scope of processing performed by each Subprocessor, is set forth in Appendix 2 to this DPA.
6.2 Subprocessor Obligations. Processor shall enter into a written agreement with each Subprocessor that imposes data protection and security obligations that are no less protective of Customer Data than those set forth in this DPA. Each such agreement shall, at a minimum, require the Subprocessor to: (a) process Customer Data only in accordance with Controller's documented instructions as communicated through Processor; (b) implement appropriate technical and organizational security measures; (c) comply with Applicable Data Protection Laws; (d) permit audits and inspections as contemplated by this DPA; and (e) notify Processor promptly of any Data Breach or other security incident involving Customer Data. Processor shall remain fully liable to Controller for the acts, omissions, and defaults of its Subprocessors as if such acts, omissions, and defaults were those of Processor itself.
6.3 Notice of New Subprocessors. Processor shall provide Controller with at least thirty (30) days' prior written notice before engaging any new Subprocessor or replacing any existing Subprocessor for the processing of Customer Data. Such notice shall be delivered to Controller's General Counsel in accordance with Section 16.2 and shall include: (a) the identity and legal name of the proposed Subprocessor; (b) a description of the nature and scope of the processing to be performed by the Subprocessor; (c) the geographic location(s) where the Subprocessor will process Customer Data; and (d) the data protection and security measures implemented by the proposed Subprocessor.
6.4 Right to Object. Controller shall have the right to object to the engagement of any new or replacement Subprocessor by providing written notice to Processor within thirty (30) days of Controller's receipt of Processor's notice under Section 6.3. Controller's objection must be in writing and must state reasonable grounds related to data protection, data security, regulatory compliance, or the Subprocessor's ability to meet the requirements of this DPA. Controller shall not be required to provide any reason beyond a reasonable data-protection or regulatory-compliance concern in order to exercise its right of objection.
6.5 Resolution of Objections. If Controller objects to a proposed Subprocessor in accordance with Section 6.4, Processor shall, at its own expense: (a) refrain from engaging the proposed Subprocessor for the processing of Customer Data; or (b) propose commercially reasonable alternatives to address Controller's objection, which may include engaging a different Subprocessor acceptable to Controller or performing the relevant processing activities without the use of a Subprocessor. If the parties are unable to resolve Controller's objection within thirty (30) days following Processor's receipt of the objection notice, Controller may terminate the affected services under the Agreement without penalty, early-termination fee, or other charge, and Processor shall promptly initiate the data-return procedures set forth in Section 5.
6.6 Audit of Subprocessors. Controller shall have the right, upon reasonable prior written notice and during normal business hours, to audit or inspect, or to engage a qualified independent third party (subject to appropriate confidentiality obligations) to audit or inspect, any Subprocessor's compliance with the data protection and security obligations set forth in this DPA. Processor shall use commercially reasonable efforts to facilitate such audits, including by exercising its contractual audit rights with respect to its Subprocessors for the benefit of Controller. The costs of any such audit shall be borne by Controller unless the audit reveals a material breach of this DPA by the Subprocessor, in which case Processor shall bear the reasonable costs of the audit.
7. DATA SECURITY
7.1 Security Measures. Processor shall implement and maintain appropriate technical and organizational measures designed to protect Customer Data against unauthorized access, acquisition, use, disclosure, alteration, destruction, or loss, taking into account the state of the art, the costs of implementation, the nature, scope, context, and purposes of Processing, and the risks to the rights and freedoms of data subjects. Such measures shall be commensurate with the sensitivity and volume of Customer Data processed under the Agreement and shall be no less protective than industry-standard practices for the processing of insurance data, including PII and PHI. The specific security measures applicable to Processor's processing of Customer Data are set forth in Exhibit D (Security Requirements) to the Agreement.
7.2 Cross-Reference to Exhibit D. Without limiting the generality of Section 7.1, Processor's security obligations under this DPA include, and Processor shall at all times comply with, the following requirements as further detailed in Exhibit D (Security Requirements):
(a) Encryption Standards. Encryption of Customer Data in transit (TLS 1.2 or higher) and at rest (AES-256 or equivalent), as specified in Exhibit D.
(b) Access Controls. Role-based access controls, multi-factor authentication, least-privilege principles, and session-management controls, as specified in Exhibit D.
(c) SOC 2 Type II Audit. Maintenance of a current SOC 2 Type II audit report covering trust service criteria relevant to the processing of Customer Data, conducted by Hawthorne & Ellers, CPAs LLP, or another nationally recognized independent audit firm acceptable to Controller.
(d) Penetration Testing. Annual independent penetration testing of the ClaimsIQ™ platform conducted by Sentinel Cyber Solutions LLC, or another qualified third-party security firm acceptable to Controller, with prompt remediation of identified vulnerabilities.
(e) Incident Notification. Incident detection, response, and notification procedures as specified in Exhibit D, which are supplemented by the Data Breach notification requirements set forth in Section 8 of this DPA.
7.3 Insurance. Processor shall maintain, at its own expense and throughout the term of the Agreement (and for a period of not less than three (3) years following expiration or termination of the Agreement), the insurance coverages specified in Exhibit D (Security Requirements), including Technology Errors & Omissions / Cyber Liability insurance coverage in an amount not less than Ten Million Dollars ($10,000,000) per claim and Twenty Million Dollars ($20,000,000) in the aggregate, carried with Northern Ridge Mutual Insurance Company or another insurer with an A.M. Best rating of "A-" (Excellent) or better. Processor shall provide Controller with certificates of insurance and evidence of coverage upon request and shall notify Controller in writing not less than thirty (30) days prior to any material change in, cancellation of, or non-renewal of any required insurance coverage.
8. DATA BREACH NOTIFICATION
8.1 Notification Obligation. Processor shall notify Controller of any confirmed Data Breach without undue delay and in no event later than twenty-four (24) hours following Processor's confirmation that a Data Breach has occurred or is reasonably believed to have occurred. Notification shall be made by telephone to Controller's Chief Information Officer and by email to Controller's General Counsel (using the contact information set forth in Section 16.2), followed promptly by written notice delivered in accordance with the notice provisions of the Agreement. In the event Processor suspects but has not yet confirmed the occurrence of a Data Breach, Processor shall promptly notify Controller of the suspected breach and provide updates as additional information becomes available.
8.2 Content of Notification. Each Data Breach notification provided under Section 8.1 shall include, to the extent known or reasonably determinable at the time of notification:
(a) a description of the nature of the Data Breach, including the categories of Customer Data affected and the approximate number of data subjects and Customer Data records involved;
(b) the date and time the Data Breach occurred and the date and time it was discovered by Processor;
(c) the likely consequences of the Data Breach for Controller and affected data subjects;
(d) a description of the measures taken or proposed by Processor to address the Data Breach, contain its effects, and prevent recurrence;
(e) the identity and contact information of Processor's designated point of contact for communications regarding the Data Breach; and
(f) any other information reasonably necessary for Controller to assess the impact of the Data Breach and to comply with its notification obligations under Applicable Data Protection Laws.
Processor shall supplement the initial notification with additional information as it becomes available and shall provide regular status updates until the Data Breach has been fully resolved and remediated.
8.3 Cooperation. Processor shall cooperate fully and promptly with Controller in investigating, remediating, and responding to any Data Breach, including by: (a) preserving and producing all evidence, logs, records, and forensic data related to the Data Breach; (b) providing all information and assistance reasonably required for Controller to comply with its notification obligations under Applicable Data Protection Laws and to any applicable state insurance regulator, including the Connecticut Insurance Department; (c) coordinating with Controller on the timing, content, and recipients of any required notifications to affected individuals, regulators, or other parties; (d) implementing all remedial measures reasonably directed by Controller; and (e) making available Processor's personnel, including security and engineering staff, to participate in investigation and remediation activities as reasonably requested by Controller.
8.4 No Limitation on Indemnification. For the avoidance of doubt, Processor's indemnification obligations under the Agreement with respect to Data Breaches — including Data Breaches caused by the acts or omissions of Processor, its personnel, or its Subprocessors — are uncapped, as expressly set forth in Section [applicable section] of the Agreement. The limitation-of-liability provisions of the Agreement shall not apply to Processor's indemnification obligations arising from a Data Breach, and no provision of this DPA shall be construed to limit or reduce such obligations.
9. REGULATORY COMPLIANCE
9.1 CTDPA Compliance. Processor shall comply with all applicable requirements of the Connecticut Data Privacy Act, Conn. Gen. Stat. §§ 42-515 et seq., as in effect from time to time, including, without limitation, requirements relating to: (a) data protection assessments for processing activities that present a heightened risk of harm to consumers; (b) the facilitation of consumer rights requests, including requests for access, correction, deletion, data portability, and opt-out of the processing of Personal Data for targeted advertising, sale, or profiling; (c) purpose limitation and data minimization; and (d) transparency obligations. Processor shall implement all technical and organizational measures necessary to enable Controller to fulfill its own obligations under the CTDPA in connection with Customer Data processed by Processor.
9.2 HIPAA Compliance. To the extent Processor processes PHI in connection with Controller's workers' compensation insurance lines or any other line of business that involves PHI, Processor shall comply with all applicable requirements of HIPAA, as amended by HITECH, including:
(a) the Privacy Rule (45 C.F.R. Part 164, Subpart E), including requirements relating to the use and disclosure of PHI, minimum necessary standards, and individual rights;
(b) the Security Rule (45 C.F.R. Part 164, Subpart C), including requirements for administrative, physical, and technical safeguards for electronic PHI; and
(c) the Breach Notification Rule (45 C.F.R. Part 164, Subpart D), including requirements for notification of breaches of unsecured PHI to affected individuals, the U.S. Department of Health and Human Services, and, where applicable, the media.
The parties shall enter into a Business Associate Agreement ("BAA") as Appendix 1 to this DPA if and to the extent required by HIPAA. In the event a BAA is executed, the terms of the BAA shall supplement and, to the extent of any conflict with respect to PHI, prevail over the terms of this DPA.
9.3 NAIC Insurance Data Security Model Law. Processor shall comply with the NAIC Insurance Data Security Model Law as adopted in the State of Connecticut, including all requirements relating to: (a) the establishment and maintenance of a comprehensive written information security program; (b) the investigation of and response to cybersecurity events; (c) notification to the Connecticut Insurance Department and other regulatory authorities of cybersecurity events within the time frames specified by applicable law; and (d) the oversight of third-party service providers, including requirements that licensees exercise due diligence in selecting third-party service providers and require third-party service providers to implement appropriate measures to protect nonpublic information.
9.4 Insurance Regulatory Carve-Outs. Nothing in this DPA shall be construed to limit, restrict, or otherwise affect Controller's obligations to comply with insurance regulatory requirements applicable to its business, including those imposed by the Connecticut Insurance Department, the Texas Department of Insurance, the Florida Office of Insurance Regulation, or any other state insurance regulator with jurisdiction over Controller's operations. Processor shall cooperate fully and promptly with Controller in responding to regulatory inquiries, market conduct examinations, financial examinations, or other audits or investigations conducted by any state insurance regulator that relate to Customer Data or Processor's processing activities under the Agreement.
9.5 Consumer Rights Requests. Processor shall promptly assist Controller in responding to any consumer rights requests received under Applicable Data Protection Laws, including requests for access to, correction of, deletion of, or portability of Personal Data. Processor shall: (a) promptly forward to Controller any consumer rights request received directly by Processor that relates to Customer Data; (b) implement and maintain technical and organizational measures that enable Controller to locate, access, correct, delete, and export Personal Data within the ClaimsIQ™ platform in response to consumer rights requests; (c) respond to Controller's instructions regarding the handling of specific consumer rights requests within the time frames necessary for Controller to comply with applicable legal deadlines; and (d) maintain records of all consumer rights requests processed and the actions taken in response thereto.
9.6 Regulatory Changes. In the event of material changes to Applicable Data Protection Laws, or the enactment of new federal or state laws or regulations, that affect Processor's obligations under this DPA or the manner in which Processor processes Customer Data, the parties shall promptly notify each other and shall negotiate in good faith to amend this DPA as necessary to ensure continued compliance. Any such amendment shall be documented in writing and signed by authorized representatives of both parties in accordance with Section 16.1.
10. AUDITS AND ASSESSMENTS
10.1 Audit Rights. Controller shall have the right, upon not less than thirty (30) days' prior written notice to Processor and during normal business hours, to audit or inspect, or to engage a qualified independent third party (subject to appropriate confidentiality obligations acceptable to Processor, acting reasonably) to audit or inspect, Processor's compliance with this DPA, including Processor's technical and organizational security measures, data protection practices, and Subprocessor management. Such audits shall be conducted no more than once per calendar year; provided, however, that this frequency limitation shall not apply if: (a) a Data Breach has occurred; (b) Controller has reasonable, documented grounds to believe that Processor is not in compliance with its obligations under this DPA; or (c) an audit is required or requested by a regulatory authority with jurisdiction over Controller.
10.2 Access and Cooperation. Processor shall provide Controller and its authorized auditors with reasonable access to Processor's facilities, systems, records, documentation, and personnel relevant to the processing of Customer Data. Processor shall designate a knowledgeable point of contact to coordinate audit logistics, respond to auditor inquiries, and facilitate access to relevant materials. Processor shall not unreasonably obstruct, delay, or restrict any audit conducted in accordance with this Section 10. The costs of any audit conducted by Controller or its third-party auditor shall be borne by Controller unless the audit reveals a material breach of this DPA by Processor, in which case the reasonable costs of the audit shall be borne by Processor.
10.3 SOC 2 Type II Reports. Processor shall maintain a current SOC 2 Type II audit report covering trust service criteria for security, availability, confidentiality, and processing integrity, conducted by Hawthorne & Ellers, CPAs LLP, or another nationally recognized independent audit firm acceptable to Controller. Processor shall provide Controller with a copy of its most recent SOC 2 Type II audit report (covering the audit period April 1, 2023 through March 31, 2024, and subsequent annual audit periods) within ninety (90) days of the close of each audit period. Provision of a current SOC 2 Type II report that does not contain material exceptions or qualified opinions may, at Controller's sole discretion, satisfy Controller's audit rights under Section 10.1 for the period covered by such report, unless Controller has specific, documented concerns regarding Processor's compliance with this DPA that are not adequately addressed by the SOC 2 Type II report.
10.4 Data Protection Impact Assessments. Processor shall cooperate with Controller and provide all information, documentation, and access reasonably requested by Controller in connection with any data protection impact assessment ("DPIA") conducted by Controller or its consultants, including Dravello Data Compliance Advisors LLC, in relation to the processing of Customer Data under the Agreement. Such cooperation shall include providing detailed descriptions of Processor's processing activities, technical architecture, security measures, and risk-mitigation controls, as well as participating in interviews and workshops as reasonably requested. Processor shall make such information available within a reasonable time frame and at no additional charge to Controller.
11. DATA TRANSFER RESTRICTIONS
11.1 Location of Processing. Processor shall process Customer Data only within the continental United States. Processor shall not transfer, store, access, or otherwise process Customer Data in any jurisdiction outside the continental United States unless Controller provides prior written consent to such processing, which consent may be withheld in Controller's sole discretion. For the avoidance of doubt, this restriction applies to all forms of access to Customer Data, including remote access by Processor's personnel or Subprocessors.
11.2 Hosting Infrastructure. As of the Effective Date, all Customer Data is hosted by Cobalt Cloud Infrastructure, Inc. in data center facilities located within the continental United States. Processor represents and warrants that Cobalt Cloud Infrastructure, Inc.'s data center facilities used for the storage and processing of Customer Data are located in the continental United States and that no Customer Data is stored, replicated, or backed up in data center facilities located outside the continental United States.
11.3 Change in Processing Location. Processor shall provide Controller with at least sixty (60) days' prior written notice of any proposed change in the geographic location of Customer Data processing or storage, including any change in the location of data center facilities used by Processor or any Subprocessor for the hosting, storage, backup, or disaster recovery of Customer Data. Controller shall have the right to approve or reject any such proposed change, and any change implemented without Controller's prior written approval shall constitute a material breach of this DPA.
12. DATA RETENTION
12.1 Retention During Term. During the term of the Agreement, Processor shall retain Customer Data only for as long as necessary to perform its obligations under the Agreement and this DPA. Processor shall not retain copies of Customer Data beyond what is reasonably required for the provision of the services and shall implement data-minimization practices to limit the volume and duration of Customer Data retention to what is necessary for the specified processing purposes.
12.2 Post-Termination Retention. Subject to the data-return and destruction obligations set forth in Section 5 (Data Portability and Return), Processor shall not retain any Customer Data beyond the destruction certification deadline specified in Section 5.4. Upon completion of the destruction and certification process described in Section 5.4, Processor shall have no further right to retain, access, or use any Customer Data for any purpose.
12.3 Legal Hold. If Processor is required by applicable law, regulation, judicial order, or regulatory directive to retain any Customer Data beyond the periods specified in this DPA, Processor shall:
(a) promptly notify Controller in writing of such requirement, identifying the specific legal basis and the categories and volume of Customer Data subject to the retention requirement (to the extent such disclosure is not prohibited by applicable law);
(b) retain only the minimum volume and categories of Customer Data required to comply with such legal obligation; and
(c) maintain the confidentiality and security of such retained Customer Data in accordance with the requirements of this DPA for so long as such Customer Data remains in Processor's possession or control, and destroy such Customer Data promptly upon the expiration of the applicable retention requirement.
13. PERSONNEL
13.1 Authorized Personnel. Processor shall ensure that only personnel who have a legitimate need to access Customer Data in connection with the performance of Processor's obligations under the Agreement are granted access to such data. Processor shall maintain and enforce access-control policies that limit access to Customer Data to the minimum number of personnel necessary to perform the applicable processing activities. Processor shall promptly revoke access to Customer Data for any personnel who no longer require such access, including upon termination of employment or reassignment to duties that do not involve Customer Data.
13.2 Confidentiality Obligations. Processor shall ensure that all personnel authorized to process Customer Data are bound by appropriate and enforceable confidentiality obligations, whether through employment agreements, contractor agreements, or standalone confidentiality and non-disclosure agreements. Such obligations shall prohibit unauthorized use, disclosure, or retention of Customer Data and shall survive the termination of the individual's relationship with Processor.
13.3 Training. Processor shall provide regular data protection, information security, and privacy training to all personnel who access or process Customer Data. Such training shall be conducted at least annually and upon initial assignment to duties involving Customer Data, and shall cover, at a minimum: (a) the requirements of Applicable Data Protection Laws; (b) Processor's data protection and information security policies and procedures; (c) the identification and reporting of potential Data Breaches and security incidents; and (d) the proper handling of PII and PHI. Processor shall maintain records of all training provided and shall make such records available to Controller upon request.
14. RELATIONSHIP TO AGREEMENT
14.1 Incorporation. This DPA is incorporated into and forms an integral part of the Agreement. All references in the Agreement to exhibits, schedules, or addenda shall be deemed to include this DPA. The terms and conditions of this DPA are binding upon the parties and their respective successors, assigns, and permitted transferees to the same extent as the Agreement.
14.2 Conflict. In the event of any conflict or inconsistency between the terms of this DPA and the terms of the Agreement (including any other exhibit, schedule, or addendum thereto), the terms of this DPA shall prevail with respect to the processing, protection, and security of Customer Data. In all other respects, the terms of the Agreement shall prevail. For the avoidance of doubt, this DPA does not limit or restrict any rights or remedies available to Controller under the Agreement.
14.3 Governing Law. This DPA shall be governed by and construed in accordance with the laws of the State of Connecticut, without regard to principles of conflicts of law that would require the application of the laws of any other jurisdiction. This governing-law provision is consistent with, and supplements, the governing-law provision set forth in the Agreement.
14.4 Dispute Resolution. Any dispute, claim, or controversy arising out of or relating to this DPA, including any dispute regarding its interpretation, validity, breach, or termination, shall be resolved in accordance with the dispute resolution provisions of the Agreement, including: (a) mandatory mediation administered by Pinnacle Dispute Resolution Services, Hartford, Connecticut, as a condition precedent to the commencement of arbitration; and (b) if mediation does not result in resolution within sixty (60) days of initiation, binding arbitration conducted under the Commercial Arbitration Rules of the American Arbitration Association ("AAA"), with the seat of arbitration in Hartford, Connecticut. The arbitral tribunal shall consist of a single arbitrator selected in accordance with the AAA Rules who has demonstrated expertise in data protection and technology law. The arbitrator's decision shall be final and binding and may be entered as a judgment in any court of competent jurisdiction.
15. TERM AND SURVIVAL
15.1 Term. This DPA shall remain in full force and effect for the duration of the Agreement, including the initial five (5) year term commencing on April 26, 2024, and any renewal terms agreed to by the parties in writing. This DPA shall terminate automatically upon the expiration or termination of the Agreement, subject to the survival provisions set forth in Section 15.2.
15.2 Survival. The following sections of this DPA shall survive the expiration or termination of the Agreement and this DPA for any reason, and shall continue in full force and effect for so long as Processor or any Subprocessor retains any Customer Data or Aggregated Data, and in any event for a period of not less than five (5) years following such expiration or termination: Section 3 (Customer Data Ownership), Section 4 (Aggregated Data), Section 5 (Data Portability and Return), Section 8 (Data Breach Notification), Section 10 (Audits and Assessments), and Section 12 (Data Retention). All other provisions of this DPA that by their nature should survive expiration or termination shall also survive, including the definitions set forth in Section 1 to the extent necessary to interpret the surviving provisions.
16. MISCELLANEOUS
16.1 Amendments. This DPA may be amended, modified, or supplemented only by a written instrument duly executed by authorized representatives of both parties. No oral agreement, course of dealing, or course of performance shall be deemed to amend or modify this DPA. Any amendment to this DPA shall specifically reference this DPA and shall state the effective date of the amendment.
16.2 Notices. All notices, requests, consents, demands, and other communications required or permitted under this DPA shall be in writing and shall be delivered in accordance with the notice provisions of the Agreement. Notices to Controller shall be addressed to:
Patricia Okonkwo, General Counsel Quorum Insurance Holdings Corp. 280 Constitution Plaza, Suite 1400 Hartford, CT 06103
Notices to Processor shall be addressed to:
Anita Rajan, CEO Clearpoint Analytics, Inc. 200 South Wacker Drive, Suite 3100 Chicago, IL 60606
Either party may change its designated notice recipient or address by providing written notice to the other party in accordance with this Section 16.2.
16.3 Entire Agreement. This DPA, together with the Agreement and its other Exhibits (including Exhibit A — Statement of Work, Exhibit B — Pricing and Payment Terms, Exhibit D — Security Requirements, and any other exhibits, schedules, appendices, and addenda thereto), constitutes the entire agreement between the parties with respect to the processing, protection, and security of Customer Data and supersedes all prior and contemporaneous agreements, understandings, representations, and warranties, whether written or oral, relating to the subject matter hereof.
[SIGNATURE PAGE FOLLOWS]
IN WITNESS WHEREOF, the parties have caused this Data Processing Addendum to be executed by their duly authorized representatives as of the date first written above.
CONTROLLER:
QUORUM INSURANCE HOLDINGS CORP.
By: ________
Name: Patricia Okonkwo
Title: General Counsel
Date: April 26, 2024
PROCESSOR:
CLEARPOINT ANALYTICS, INC.
By: ________
Name: Anita Rajan
Title: CEO & Co-Founder
Date: April 26, 2024
APPENDIX 1
DESCRIPTION OF PROCESSING ACTIVITIES
This Appendix 1 forms part of the Data Processing Addendum (Exhibit C) and sets forth the details of the processing activities performed by Processor on behalf of Controller.
APPENDIX 2
CURRENT SUBPROCESSOR LIST
This Appendix 2 forms part of the Data Processing Addendum (Exhibit C) and sets forth the current list of Subprocessors engaged by Processor to process Customer Data on behalf of Controller as of the Effective Date.
Note: This Subprocessor list is current as of the Effective Date (April 26, 2024). Any changes to the Subprocessor list — including the engagement of new Subprocessors or the replacement of existing Subprocessors — are subject to the notice and objection procedures set forth in Section 6 of this DPA. Processor shall maintain an up-to-date list of Subprocessors and shall make such list available to Controller upon request.
[End of Exhibit C — Data Processing Addendum]
Subprocessor | Role | Location
Cobalt Cloud Infrastructure, Inc. | Infrastructure-as-a-Service hosting provider for the ClaimsIQ™ platform, including storage, computation, and network services for Customer Data | 500 Terry Francine Street, San Jose, CA 95128; data centers located within the continental United States
Redline Document AI, LLC | Optical character recognition (OCR) processing of claims documents uploaded to the ClaimsIQ™ platform | California
Element | Description
Controller | Quorum Insurance Holdings Corp. and its subsidiaries: Quorum Property & Casualty Insurance Company (CT), Quorum Specialty Underwriters, Inc. (DE), and Quorum Digital Solutions LLC (DE)
Processor | Clearpoint Analytics, Inc.
Subject Matter of Processing | Provision of the ClaimsIQ™ platform and related services, including claims triage, fraud detection, predictive analytics, reporting, and analytics dashboard functionalities
Duration of Processing | Five (5) year initial term commencing April 26, 2024, plus any renewal terms agreed to by the parties in writing under the Agreement
Nature and Purpose of Processing | Automated and manual processing of Customer Data for the purposes of claims triage (including severity scoring and priority assignment), fraud detection (including pattern analysis and anomaly identification), analytics dashboards (including real-time and historical reporting), report generation, data visualization, and related platform functionalities as described in Exhibit A (Statement of Work) to the Agreement
Categories of Data Subjects | Policyholders, claimants, beneficiaries, insureds, claims adjusters, field adjusters, underwriters, and other individuals whose Personal Data is included in Customer Data submitted to or processed through the ClaimsIQ™ platform
Categories of Personal Data | Names, addresses (physical and email), telephone numbers, contact information, Social Security numbers, dates of birth, driver's license numbers, policy numbers, claim numbers, claims histories, medical records and protected health information (for workers' compensation lines), financial information (including bank account information and payment records), adjuster notes and commentary, photographs and image files, video recordings, and other information submitted in connection with insurance claims or underwriting activities
Sensitive Data / Special Categories | Protected health information (PHI) processed in connection with Controller's workers' compensation insurance lines; financial information, including bank account numbers and payment records; Social Security numbers
Processing Locations | Continental United States, specifically including Cobalt Cloud Infrastructure, Inc. data centers located within the continental United States
Subprocessors | Cobalt Cloud Infrastructure, Inc. (Infrastructure-as-a-Service hosting); Redline Document AI, LLC (optical character recognition processing of claims documents)
Subprocessor Name | Description of Processing | Location
Cobalt Cloud Infrastructure, Inc. | Infrastructure-as-a-Service hosting for the ClaimsIQ™ platform, including storage, computation, backup, disaster recovery, and network services for Customer Data; provision of cloud infrastructure on which the ClaimsIQ™ platform operates | Corporate headquarters: 500 Terry Francine Street, San Jose, CA 95128; data center facilities located within the continental United States
Redline Document AI, LLC | Optical character recognition (OCR) processing of claims documents, correspondence, medical records, and other document files uploaded to the ClaimsIQ™ platform by Controller's Supervised Users; extraction of structured data from unstructured document images for ingestion into the ClaimsIQ™ platform | California

EXHIBIT C

DATA PROCESSING ADDENDUM

RECITALS

CONTROLLER:

QUORUM INSURANCE HOLDINGS CORP.

PROCESSOR:

CLEARPOINT ANALYTICS, INC.

APPENDIX 1

DESCRIPTION OF PROCESSING ACTIVITIES

APPENDIX 2

CURRENT SUBPROCESSOR LIST

Record

Parties

Dates

Amounts