Legal

Data Processing Addendum

This Addendum forms part of the agreement between Ansaaro LLC, 12220 Atlantic Blvd, Ste 130 #1461, Jacksonville, FL 32225 ("Ansaaro") and the customer ("Client") for the AI receptionist service.

1. Roles

Client is the controller of personal information contained in calls answered on its behalf. Ansaaro is the processor, and processes that information only to provide the service and on Client's documented instructions, including this Addendum. Ansaaro will tell Client if an instruction appears to break applicable law.

2. Scope

Subject matter: answering, recording, transcribing and routing inbound calls. Duration: the term of the agreement. Categories of people: Client's customers and anyone else who calls Client. Categories of data: phone number, call date, time and duration, transcript, audio recording, and information the caller gives during the call, such as name, address, appointment details and the reason for calling. Callers may volunteer other information; Ansaaro does not seek it.

3. Sensitive data

The service is not intended for protected health information, payment card data, or other regulated categories. Client will not use the service for protected health information, and Ansaaro is not a HIPAA business associate.

4. Confidentiality

Ansaaro keeps call data confidential, limits access to personnel who need it to deliver or support the service, and binds those personnel to confidentiality.

5. Security

Ansaaro maintains reasonable technical and organisational measures appropriate to the risk, including encryption in transit, access controls and logging, and provider selection based on security practices.

6. Sub-processors

Client authorises the sub-processors listed at ansaaro.com/subprocessors. Ansaaro will give at least 30 days' notice before adding or replacing a sub-processor handling call data, and Client may object on reasonable data-protection grounds; if the parties cannot resolve the objection, Client may terminate the affected service without penalty. Ansaaro remains responsible for its sub-processors' performance.

7. Recording and consent

Ansaaro plays a recording and AI-disclosure announcement at the start of each answered call, and records calls for quality. A caller may opt out of recording at any time, in which case Ansaaro transfers the caller to Client's voicemail instead of continuing the recorded call. Client is responsible for confirming that recording and transcription are lawful for its calls and callers, including where all-party consent applies, and for any disclosures its own customers require.

8. Assistance

Ansaaro will assist Client, at Client's reasonable request, with requests from individuals to access or delete their information, with security incidents, and with any assessment Client must carry out. Ansaaro will forward to Client any request it receives directly.

9. Breach notification

Ansaaro will notify Client without undue delay, and no later than 72 hours, after becoming aware of a personal data breach affecting Client's data, and will provide the information Client needs to meet its own obligations.

10. Retention and deletion

Ansaaro retains call data per the retention schedule in its privacy policy. On termination, Ansaaro deletes or returns Client's call data within 30 days, except where retention is required by law. Backups are deleted on their ordinary cycle.

11. International transfers

Where data is transferred outside its country of origin, the parties will use a lawful transfer mechanism, including the applicable standard contractual clauses.

12. Audit

On reasonable notice and no more than once a year, Ansaaro will provide the information reasonably needed to show compliance with this Addendum.

13. Order of precedence

Where this Addendum conflicts with the agreement, this Addendum governs for personal information.

Signed for Client: [name, title, date]. Signed for Ansaaro: [name, title, date]

Annex A — Sub-processors as at the signature date

The providers below are authorised under §6. The current list is always published at ansaaro.com/subprocessors; changes follow the notice process in §6. Ansaaro will name any provider on request.

Signed as at: [date].