INTERSESH | DATA PROCESSING ADDENDUM

This DPA is between Jamieson D. Cobbs carrying on business as InterSesh ("Service Provider") and the Practice identified in Schedule A ("Practice"). It applies only to the processing described in these completed schedules and the signed Service Agreement. An incomplete schedule does not authorize identifiable clinical data.

1. Scope, roles and instructions

1.1 The Practice determines the purposes and lawful basis of its treatment-related records and instructs InterSesh to process specified data to supply the Service. The Practice remains the responsible professional record holder, controller/custodian or equivalent for those records to the extent required by applicable law. InterSesh acts as a service provider/processor for these specified activities, while independently retaining the legal obligations that apply to it.

1.2 Client-controlled Passport records may involve distinct rights and responsibilities of the client, source Practice, receiving Practice and InterSesh. This DPA does not assume one Practice controls all portable records or override a client's lawful portability choice. A separately approved Passport disclosure and recipient-specific consent are required before a receiving practice gains ongoing eligible client-level history access. Under source-observed behaviour, the receiving connection may expose earlier practice-period entries and allow authorized changes to portable goals, homework, Agreements and follow-through. It is not a date-, category- or source-practice-limited export. Any different statutory role allocation must be documented in Schedule A before that use.

1.3 InterSesh will process covered information only for the described Service, security, privacy rights, documented lawful instructions and mandatory legal obligations. It will notify the Practice if an instruction appears unlawful or beyond the agreed scope, insofar as legally permitted. Neither party may direct processing for advertising or unrelated model training under this DPA.

2. Security and personnel

2.1 InterSesh will apply administrative, technical and physical safeguards appropriate to the sensitivity of clinical records, including authenticated account access, minimum necessary role/assignment permissions, encrypted transport, controlled infrastructure access, audit and incident investigation, protected backup and restoration processes, and security patch/review procedures. Schedule B lists actual configured controls and any open qualifications; a proposed feature must not be described as already deployed.

2.2 Access by authorized personnel and subprocessors will be limited to defined purposes, with confidentiality commitments and reasonable review. The Practice will protect its own credentials, devices, local exports, clinician access and emergency procedures.

2.3 InterSesh will not promise absolute security, continuous real-time client monitoring, instant incident discovery or automatic delivery of patient safety alerts.

3. Subprocessors and cross-border processing

3.1 Schedule B identifies relevant processors, functions and processing/storage locations. InterSesh may use a subprocessor only under suitable written terms or other applicable safeguards and will remain responsible for its processing obligations. Any change materially affecting the approved purposes, region, PHI flow or customer restrictions requires appropriate review and notice or consent as applicable.

3.2 The production application/database reside in Google's Toronto region. Cloud SQL automated backups currently reside in a US multi-region. A separate on-demand backup has been stored in Toronto, but that does not change the automated backup location. Other authentication, support, billing and technical operations may involve cross-border processing as detailed in Schedule B. This is not a Canada-only hosting promise. A recipient should be told that foreign legal access obligations may apply.

3.3 The Practice must specify any enforceable data-location, residency or sector-specific restrictions in Schedule A before uploading regulated data. InterSesh must not silently accept processing it cannot satisfy. The current choice to retain US automated backups is a disclosed architecture decision, not an exemption from a mandatory customer-specific residency requirement.

4. Privacy rights and records

4.1 The parties will cooperate on verified requests for access, correction, deletion, retention review, portability and regulator communications. The Practice will identify the responsible record holder and applicable legal deadline, and will notify InterSesh through the secure privacy channel. InterSesh may need to preserve a protected record or decline deletion where there is a justified legal hold or statutory retention duty.

4.2 The Service may offer limited self-service exports, but an app download does not conclusively discharge all statutory medical-record access duties. The Practice remains responsible for determining what further records or explanations a client may be entitled to.

4.3 If information is required for a legal claim, audit, incident or statutory recordkeeping, the parties will document the lawful reason for retention, restrict access and remove it when the hold or requirement ends. Backups are restored or expired under provider lifecycle rules rather than modified to delete an individual record immediately in place.

5. Incidents and notifications

5.1 On discovering a credible privacy or security incident affecting covered information, InterSesh will investigate, contain and preserve relevant records, notify the Practice without unreasonable delay as sufficient verified details become available, and provide continuing material updates. Notification will in all events follow any shorter binding legal requirement and any separately executed customer-specific requirement that InterSesh can meet.

5.2 An internal aim of beginning communication within 48 hours is not a contractual guarantee, statutory deadline or authority to wait when the law requires earlier notice. The Practice will supply and maintain a monitored security/privacy contact. Each party is responsible for notices to individuals, professional bodies or regulators allocated to it by applicable law, cooperating as needed. The current legal outbox alone does not prove live email delivery or round-the-clock incident staffing.

6. Return, deletion, termination and audit

6.1 On termination and an appropriately verified instruction, InterSesh will make legally permitted Practice records available through a reasonably secure method and follow the written retention and deletion directions in Schedule C, subject to lawful holds, record-holder duties, security/transaction evidence, controlled backups and the client's separate Passport rights.

6.2 InterSesh will offer reasonable information about relevant safeguards and support a proportionate compliance review subject to confidentiality, other customers' security and applicable legal restrictions. Neither party is obligated to expose other clients' records, credentials or unrestricted production infrastructure.

7. Governing responsibilities

7.1 The Practice's clinical, professional and record-holder duties remain its own. InterSesh remains responsible for its own service-provider conduct and applicable data protection duties. Nothing in this DPA limits mandatory individual rights or substitutes for an applicable HIPAA business associate agreement.

7.2 For US covered-entity or other HIPAA-regulated processing, the parties must separately execute the conditional HIPAA Addendum and independently verify applicable downstream Google Cloud BAA coverage before PHI is processed. A Google NDA, a draft BAA or a Google account setting alone is not proof that these obligations are met.

7.3 This DPA is effective only when the Practice Service Agreement and the required schedules are completed and accepted by authorized parties. Changes affecting lawful processing require a recorded updated schedule or amendment.

Schedule A | Practice, data and authority

Schedule B | Security, subprocessors and locations

System/security commitments: authenticated identity and session authorization; least-privilege clinician-client role and assignment checks; transport encryption; provider-managed storage encryption; privacy/audit event controls; documented backup and restore; access/recovery and incident escalation. These are contractual objectives and intended controls, not an assertion that the newest source branch is currently deployed. Check exact serving versions before activation.

Subprocessor changes: material addition or expanded PHI access requires notice, appropriate agreement(s) and an updated approved inventory where applicable. Listing a provider does not constitute a HIPAA BAA or independent professional/regulatory approval.

Schedule C | Retention, access and exit instructions

DPA execution

The parties execute this DPA together with the signed Practice Service Agreement and completed Schedules A, B and C.

InterSesh authorized signature: __________________ Date: __________

Practice authorized signature: ___________________ Date: __________