Data Processing Addendum

Imprivata, Inc. (hereinafter referred as “Imprivata”) and Customer (hereinafter referred as “Customer”) have entered into a contractual agreement (the “Principal Agreement”) pursuant to which Imprivata may Process certain Personal Data on behalf of Customer in connection with Customer’s use of the Imprivata Products and/or Services (each as defined below). This Data Processing Addendum (“DPA”) describes certain data processing and transfer obligations of the parties. In the event of any inconsistency between the DPA and the Principal Agreement, the DPA shall control. In the event of inconsistency between the DPA and, if applicable, the Standard Contractual Clauses (as defined below), the Standard Contractual Clauses shall govern. Except as modified herein, the terms of the Principal Agreement shall remain in full force and effect.

Definitions

In this DPA, the following terms shall have the meanings set out below:

"Subprocessor" means any Processor (including any third party) appointed by Imprivata to process Customer Personal Data on behalf of the Customer.

"Process/Processing/Processed", "Controller", "Processor", "Data Subject", "Personal Data", "Special Categories of Personal Data", "Sensitive Data", "Supervisory Authority", and any further definition not included in the Principal Agreement or this DPA shall have the same meaning as in appliable Data Protection Law.

“Data Protection Law” means any binding laws, rules, or regulations which apply to a party relating to the use of Personal Data (including, without limitation, the privacy of electronic communications).

"Third Country" or "Third Countries" means any country outside of a country in which the Data Protection Laws restrict transfers of Personal Data to destinations outside of that country, except where the Data Protection Laws and applicable regulatory authorities of the originating country adopted an adequacy decision regarding the Data Protection Laws of the destination country such that transfers of Personal Data to that destination country are not restricted.

"Customer Personal Data" means the data described in Schedule 1 and any other Personal Data processed by Imprivata on behalf of the Customer pursuant to, or in connection with, the Principal Agreement.

"Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data transmitted, stored or otherwise processed that compromises the security, confidentiality or integrity of such Customer Personal Data.

"Services" means the services to be supplied by Imprivata to the Customer pursuant to the Principal Agreement.

“Products” means the products to be supplied by Imprivata to the Customer pursuant to the Principal Agreement.

"Standard Contractual Clauses" or “SCC” means the standard contractual clauses for the transfer of personal data annexed to European Commission Implementing Decision (EU) 2021/914 of 4 June 2021.

“UK Addendum” means United Kingdom (“UK”) Information Commissioner’s (“ICO”) International Data Transfer Addendum to the EU Commission Standard Contractual Clauses Version B1.0 in force 21 March 2022.

Data Processing Terms

1. In the course of providing the Products and/or Services to the Customer pursuant to the Principal Agreement, Imprivata may Process Customer Personal Data on behalf of the Customer, pursuant to the terms of this DPA. Imprivata and Customer shall each comply with their respective obligations applicable to each under the Data Protection Laws and this DPA.
2. Imprivata shall maintain all the technical and organizational measures set forth in Schedule 1.

Processing of Customer Personal Data

1. The purposes of Processing of Customer Personal Data and the instructions for Processing are as described in the Principal Agreement, including Schedule 1, Annex 1 to this DPA, and any other exhibits, statements of work or addenda attached to or otherwise incorporated into the Principal Agreement (the “Permitted Purpose”).
2. Imprivata shall only Process Customer Personal Data for the Permitted Purpose(s). Imprivata shall not Process or disclose or permit the disclosure of the Customer Personal Data to any third party other than as set forth herein or as otherwise agreed in writing by the parties, unless such Processing or disclosure is required by the applicable Data Protection Law to which Imprivata is subject ("Mandated Processing”). Imprivata shall not, as part of its business operations, ‘sell’ or ‘share’ (as such terms may be specifically defined in applicable Data Protection Laws) Customer Personal Data. To the extent required by applicable Data Protection Laws, Imprivata certifies that it understands the foregoing restrictions and will comply with them. Imprivata shall, to the extent permitted by Data Protection Laws, inform Customer of any Mandated Processing before so Processing or disclosing the Customer Personal Data and comply with the Customer’s instructions to minimize, to the extent reasonably possible, the scope of the Processing or disclosure. To the extent required by applicable Data Protection Laws, Imprivata will inform Customer if, in its opinion, an instruction from Customer infringes Data Protection Laws. Imprivata is not responsible for performing legal research and/or for providing legal advice to Customer in connection with the foregoing.

Non–Disclosure

1. Imprivata shall restrict access to Customer Personal Data to those individuals who require access to the relevant Customer Personal Data for the Permitted Purpose.
2. For all individuals who Process Customer Personal Data on Imprivata’s behalf, Imprivata will:
   1. inform such individuals of the confidential nature of the Customer Personal Data;
   2. provide training in relation to applicable Data Protection Law; and
   3. require such individuals to agree to confidentiality terms or ensure the individuals are subject to professional or statutory obligations of confidentiality.

Personal Data Security

1. Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of Processing, as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, Imprivata shall implement appropriate technical and organizational measures to ensure a level of Customer Personal Data security appropriate to the risk.
2. In assessing the appropriate level of security, Imprivata shall take into account the risks that are presented by Processing, in particular from accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data transmitted, stored or otherwise Processed.
3. Imprivata may update its security practices from time to time but will not materially decrease the overall security of the Products or Services during the term of the Principal Agreement. Such measures shall include process for regularly testing, assessing, and evaluating the effectiveness of the measures.

Subprocessing

1. Customer acknowledges and agrees that Imprivata may engage Sub-processors in connection with the provision of the Products and/or Services. However, personnel of Imprivata, whether employees or contractors, shall not be deemed to be “Subprocessors” for purposes of this DPA. A list of approved Subprocessors as of the date of this DPA is specified in Schedule 1, Annex III. Customer may subscribe to receive update alerts when changes are made to the Subprocessor List. For the avoidance of doubt and in accordance with Clause 9, Option 2 of the SCC and any similar requirements of other data transfer mechanisms, the above constitutes Customer’s general authorization for Imprivata’s engagement of Subprocessors and its appointment of additional Subprocessors or replacement of any Subprocessors identified in Schedule 1, Annex III.
2. If Customer reasonably believes that the appointment of a new Sub-processor will have a material adverse effect on Imprivata’s ability to comply with applicable Data Protection Laws as a Processor, then Customer may notify Imprivata in writing, where such notification must be provided within 7 calendar days following the update to the Subprocessor List of its reasonable and objective basis for such belief and where such notification includes documented evidence that supports the objection (“Objection”). In the event of an Objection, Customer and Imprivata will work together in good faith to find a mutually acceptable resolution to address such Objection, including but not limited to reviewing additional documentation supporting the Subprocessor’s compliance with the DPA or Data Protection Laws and the Subprocessor’s functions relevant to the performance of Products and/or Services. Imprivata shall not disclose any Customer Personal Data to that proposed Subprocessor until reasonable steps have been taken to address the Objection and Customer has been provided with a reasonable written explanation of the steps taken. Notwithstanding the foregoing, Customer consents to the Processing of Customer Personal Data by Imprivata solely to perform its obligations under the Principal Agreement, including, but not limited to, any Customer Personal Data that may be contained in any support logs for tickets logged for support and maintenance by Customer.
3. With respect to each Subprocessor, Imprivata shall:
   1. carry out adequate due diligence on each Subprocessor regarding its data protection practices, including without limitation, a review of its technical and organisational measures.
   2. include terms in the contract between Imprivata and each Subprocessor which provide Customer no less protection as in this DPA or as required by Data Protection Laws.
   3. insofar as that contract involves the transfer of Customer Personal Data outside of a Third Country, incorporate the SCC, UK Addendum, or such other mechanism as required by Data Protection Laws into the contract between Imprivata and each Subprocessor to ensure the adequate protection of the transferred Customer Personal Data.
   4. be responsible for the Subprocessor’s violations of this DPA or Data Protection Laws in relation to the services such Subprocessor provides to Imprivata to the extent Imprivata would be liable for the same violations under the terms of the Principal Agreement.

Data Subject Rights

1. Taking into account the nature of the Processing, Imprivata shall assist the Customer by implementing appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of the Customer's obligation to respond to requests for exercising Data Subject rights as set forth in applicable Data Protection Law (“DSR”).
2. To the extent a Data Subject identifies Customer as the entity that collected its Personal Data, Imprivata shall promptly notify the Customer if it receives a DSR relating to the Products or Services covered by the Principal Agreement.
3. To the extent Customer, in its use of the Products or Services, does not have the ability to address a DSR, then, at Customer’s expense, Imprivata shall cooperate as reasonably requested by the Customer to enable the Customer to respond to or comply with any DSR, which shall include:
   1. the provision of all data requested by the Customer related to the DSR within a timeline as prescribed by the Data Protection Law in each case.
   2. where applicable, providing such assistance as is reasonably requested by the Customer to enable the Customer to comply with the relevant request within the timelines prescribed by the Data Protection Law.

Personal Data Breach

1. Imprivata shall notify the Customer without undue delay and, in any case, as soon as practicable, upon becoming aware of and confirming a Personal Data Breach for which Imprivata is the source. Imprivata will provide the Customer with sufficient information to allow the Customer to meet any obligations to report a Personal Data Breach as prescribed by the Data Protection Law. Such notification shall, as a minimum:
   1. describe the nature of the Personal Data Breach, the categories and numbers of Data Subjects concerned, and the categories and numbers of Customer Personal Data records concerned;
   2. communicate the name and contact details of Imprivata's Data Protection Officer, Privacy Officer or other relevant contact from whom more information may be obtained;
   3. describe the estimated risk and the likely consequences of the Personal Data Breach; and
   4. describe the measures taken or proposed to be taken to address the Personal Data Breach.
2. Except as required by applicable Data Protection Laws, the obligations set out in Sections 8.1 shall not apply to Personal Data Breaches caused by Customer.
3. In the event of a Personal Data Breach, Imprivata shall not inform any third party without first obtaining the Customer’s prior written consent, unless notification is required by Data Protection Law, in which case Imprivata shall, to the extent permitted by such law, inform the Customer of that legal requirement, provide a copy of the proposed notification and consider any comments made by the Customer before providing a notification of the Personal Data Breach.
4. Customer and Imprivata shall work together in good faith within the timeframes for Customer to provide Personal Data Breach notifications to any third parties in accordance with Data Protection Laws to finalize the content of any such notifications. Imprivata’s prior written approval shall be required for any statements regarding, or references to, Imprivata made by Customer in any such notifications.

Customer Responsibilities

1. Customer will not share with or transfer to Imprivata (e.g., via use of the Products or Services or through screen-sharing or transmitting screenshots in the course of support and maintenance) Special Categories of Data or Sensitive Data (including HIPAA Data, as defined in Section 13.4) or other data that imposes specific data security or data protection obligations on Imprivata in addition to or different from those specified in any documentation or which are not provided as part of the Products or Services without Imprivata’s prior written consent or as may be set forth in statements of work or other addenda attached to or otherwise incorporated into the Principal Agreement.
2. Customer shall comply with all applicable Data Protection Laws, including: (a) providing all required notices and appropriate disclosures to all Data Subjects regarding Customer’s, and Imprivata’s, Processing and transfer of Customer Personal Data; (b) obtaining all necessary rights and valid consents, as applicable, from Data Subjects, or maintain another valid legal basis in accordance with and as required by Data Protection Laws, to permit Processing by Imprivata for the Permitted Purpose or as otherwise required or permitted under the Principal Agreement; (c) if the parties have agreed that Customer Personal Data will include Special Categories of Data or Sensitive Data, obtaining explicit consents from Data Subjects and complying with all applicable Data Protection Laws; and (d) laws that regulate content directed toward children (as defined under applicable Data Protection Laws; for example, under 13 years old in the United States or under 16 years old in certain other countries).
3. For the avoidance of doubt, Customer’s instructions for the processing of Customer Personal Data shall comply with the Data Protection Law. This DPA is Customer’s complete and final instruction to Imprivata in relation to Customer Personal Data and additional instructions outside the scope of this DPA would require prior written agreement between the parties. Customer acknowledges that Imprivata is reliant on Customer for direction as to the extent to which Imprivata is entitled to use and Process Customer Personal Data. Consequently, Imprivata will not be liable for any claim brought against Customer by a Data Subject arising from any act or omission by Imprivata to the extent that such act or omission resulted from Customer’s instructions or Customer’s use of the Services. Customer shall inform Imprivata without undue delay and comprehensively about any errors or irregularities related to statutory provisions on the processing of Customer Personal Data.

Deletion or Return of Customer Personal Data

1. Upon Customer’s written request and no later than the following events: (i) cessation of Processing of Customer Personal Data by Imprivata; or (ii) termination or expiration of the Principal Agreement, except as otherwise permitted by applicable Data Protection Laws, Imprivata shall:
   1. make available to Customer a complete copy of Customer Personal Data then available in the Services in electronic format for ninety (90) days after termination or expiration of the Principal Agreement (“Retrieval Period”); and
   2. after such Retrieval Period, delete and use all reasonable efforts to procure the deletion of all other copies of Customer Personal Data Processed by Imprivata or any Subprocessors, and where deletion is not possible, sufficiently de-identify Customer Personal Data such that it is no longer Personal Data, except if required or permitted by applicable law or for legal, compliance, audit, or security purposes.
2. Imprivata may retain Customer Personal Data to the extent required by applicable Data Protection Laws, and only to the extent and for such period as required by applicable Data Protection Laws, and always provided that Imprivata shall ensure the confidentiality of all such Customer Personal Data and shall ensure that such Customer Personal Data is only Processed as necessary for the purpose(s) specified in the applicable Data Protection Laws requiring its storage and for no other purpose.

Information, Audit, and Assistance

1. Imprivata shall reasonably assist and support Customer in the event of an investigation by a Supervisory Authority, data protection regulator or similar authority, if and to the extent that such investigation relates to Imprivata’s Processing of Customer Personal Data.
2. Upon Customer’s written request, Imprivata shall provide to Customer, its authorized representatives and/or independent inspection body designated by Customer reasonable access to information related to Imprivata’s Processing of Customer Personal Data solely for the purpose of confirming Imprivata’s compliance with its obligations under this DPA. Such information shall be Imprivata Confidential Information under the Principal Agreement. If no such information is available at the time of Customer’s request, or if required by a Supervisory Authority, Imprivata will allow and cooperate in audits as set forth below.
3. Upon at least 30 days’ advance written request by Customer, at mutually agreed times and subject to Imprivata’s reasonable audit guidelines, Imprivata will provide reasonable assistance and cooperation of Imprivata’s relevant staff and provision of additional information solely for the purpose of confirming Imprivata’s compliance with its obligations under this DPA (collectively, an “Audit”). For any Audits, Customer must provide Imprivata with a proposed audit plan at least two weeks in advance of the audit, after which Customer and Imprivata shall discuss in good faith and finalize the audit plan prior to commencement of Audit activities. Customer shall reimburse Imprivata for any costs or expenses incurred by Imprivata in connection with an Audit.
4. Imprivata reserves the right to restrict access to its proprietary information, including but not limited to its network architecture, internal and external test procedures, test results, remediation plans, and information or data of or related to Imprivata’s other customers, suppliers, vendors, and partners. Customer will use best efforts to minimize disruption to Imprivata’s Services and Imprivata’s premises, equipment, personnel or business operations. Customer further agrees that: (W) personnel (or designated third parties) performing Audits will be bound by the confidentiality obligations set forth in the Principal Agreement; (X) all findings will be deemed Imprivata’s Confidential Information; (Y) Customer will share all findings with Imprivata; and (Z) Imprivata will classify and address any Audit findings in accordance with Imprivata’s risk management program. Any third party engaged by Customer to conduct an Audit must be pre-approved by Imprivata (such approval not to be unreasonably withheld) and sign Imprivata’s confidentiality agreement. Imprivata need not give access to its premises for the purposes of such an Audit or inspection to any individual unless they produce reasonable evidence of identity and authority. Customer is limited to one audit in any 12-month period, except if and as required by a competent data protection authority.
5. Without prejudice to the rights granted above, if the requested Audit scope is addressed in a SOC, ISO, HIPAA or similar audit report or attestation letter issued by a qualified third party auditor within the prior twelve months and Imprivata provides such report or attestation letter to Customer confirming there are no known material changes in the controls audited, Customer agrees to accept the findings presented in the third party audit report or attestation letter in lieu of requesting an Audit of the same controls covered by the report.
6. Taking into account the nature of the Processing and the information available to Imprivata, Imprivata shall, upon Customer’s written request, provide Customer with reasonable cooperation and assistance to fulfil Customer’s obligations under applicable Data Protection Laws to carry out a data protection impact assessment related to Customer’s use of Imprivata’s Products and/or Services. Such cooperation and assistance are provided to the extent Customer does not otherwise have access to the relevant information, and to the extent such information is available to Imprivata. To the extent required by applicable Data Protection Laws, Imprivata shall provide reasonable assistance to Customer in respect of Customer’s prior consultations with a Supervisory Authority.

International Transfers of Customer Personal Data

1. Customer consents to the transfer on a global basis of any Customer Personal Data in accordance with its instructions under Section 3 as necessary for Imprivata to provide the Products and Services including for engineering development, security, troubleshooting and test resources as may be necessary for support and maintenance for the Products and/or Services under the Principal Agreement as well as any contact information of Customer received by Imprivata under the Principal Agreement.
2. If Customer Personal Data is transferred under the Principal Agreement from a country whose Data Protection Laws restrict the transfer of Personal Data to Third Countries, then such transfers shall be subject to the protections and provisions of the Standard Contractual Clauses (for which the SCC Appendix is attached to this DPA in Schedule 1), the UK Addendum for transfers from the UK to Third Countries, or other binding and appropriate transfer mechanisms that provide an adequate level of protection in compliance with Data Protection Laws.
3. Customer shall be deemed to have signed the SCC in Annex I in its capacity of “data exporter” and Imprivata in its capacity as “data importer.” Module Two or Module Three of the SCC shall apply to the transfer depending on whether Customer is Controller of the Customer Personal Data (for Module Two) or a Processor of the Customer Personal Data on behalf of its end customer(s) (for Module Three). If Module Three applies, Customer hereby notifies Imprivata that Customer is a Processor and the instructions shall be as set forth in Section 3. In Clause 7 of the SCCs, the optional docking clause will apply. In Clause 9 of the SCCs, Option 2 will apply, and the time period for notice of subprocessor changes shall be a reasonable time period. In Clause 11 of the SCCs, the optional language will not apply. For purposes of Clauses 17 and 18 of the SCCs, the parties select the Netherlands.
4. The SCC will cease to apply if Imprivata implements an alternative recognized compliance mechanism for the lawful transfer of Personal Data in accordance with Data Protection Requirements. In the event of any conflict between any terms in the SCC and DPA, the SCC shall prevail to the extent of the conflict.
5. When requested by Customer, Imprivata shall enter into Standard Contractual Clauses and/or such variation as the Data Protection Law requires, in respect of any Processing of Customer Personal Data in a Third Country.

General Terms

1. Subject to this section, the parties agree that this DPA and the Standard Contractual Clauses shall terminate automatically upon termination of the Principal Agreement or expiry or termination of all service contracts entered into by Imprivata with the Customer, pursuant to the Principal Agreement, whichever is later.
2. Any obligation imposed on Imprivata under this DPA in relation to the Processing of Customer Personal Data that by necessity must survive any termination or expiration of this DPA shall so survive.
3. This DPA, excluding the Standard Contractual Clauses, shall be governed by the governing law of the Principal Agreement.
4. With regard to the subject matter of this DPA, in the event of inconsistencies between the provisions of this DPA and any other agreements between the parties, including but not limited to the Principal Agreement, the provisions of this DPA shall prevail with regard to the parties’ data protection obligations for Customer Personal Data of a Data Subject. Notwithstanding the foregoing, and solely to the extent applicable to any protected health information (as defined under and regulated by the Health Insurance Portability and Accountability Act of 1996, as amended ("HIPAA”)) (“HIPAA Data”), if there is any inconsistency or conflict between this DPA and a Business Associate Agreement between Imprivata and Customer (the “BAA”), then the BAA shall prevail to extent the inconsistency or conflict relates to such HIPAA Data.
5. Should any provision of this DPA be invalid or unenforceable, then the remainder of this DPA shall remain valid and in force. The invalid or unenforceable provision shall be either (i) amended as necessary to ensure its validity and enforceability, while preserving the parties’ intentions as closely as possible or, if this is not possible, (ii) construed in a manner as if the invalid or unenforceable part had never been contained therein.
6. Indemnification, liability, limitations of liability and any applicable exclusions under this DPA shall be governed by the Principal Agreement to the extent not prohibited by Data Protection Laws.
7. Imprivata may share and disclose Customer Personal Data and other data of Customer in connection with, or during the negotiation of, any merger, sale of company assets, consolidation or restructuring, financing, or acquisition of all or a portion of Imprivata’s business by or to another company, including the transfer of contact information and data of customers, partners and end users.