Data Processing Addendum

This Data Processing Addendum forms part of the agreement between Hesper PN, Inc. d/b/a Hesper AI and each customer, and governs our processing of personal data. Where it conflicts with the main agreement, this DPA controls as to personal data.

"Privacy Law" here means every law applicable to our processing under the agreement, including the CCPA as amended by the CPRA and the other US state comprehensive privacy statutes; the Gramm-Leach-Bliley Act and its Privacy and Safeguards Rules; state insurance information privacy acts modelled on NAIC Model #670; state insurance data security laws modelled on NAIC Model #668; the California Confidentiality of Medical Information Act; the Driver's Privacy Protection Act; and the GDPR and UK GDPR where applicable.

The customer is the controller and business. Hesper is the processor and service provider. Where the customer is itself a processor acting for another controller - a third-party administrator acting for a carrier, for example - Hesper is a subprocessor, and the customer warrants it has authority to engage us on these terms.

We process personal data only on the customer's documented instructions, as necessary to provide, secure and support the Services, and as required by law. If we believe an instruction infringes Privacy Law, we will tell the customer immediately.

We are prohibited from, and will not:

• sell or share personal data
• retain, use or disclose personal data for any purpose other than performing the Services, or as otherwise permitted by the CCPA
• retain, use or disclose personal data outside the direct business relationship with the customer
• combine personal data received from one customer with personal information from any other source, except as the CCPA permits to perform a business purpose
• build or enrich a profile about any consumer, or alter any consumer's experience outside the Services provided to that customer

We certify that we understand and will comply with these restrictions. Customers may take reasonable steps to stop and remediate unauthorised use.

Nonpublic personal information received under the GLBA exceptions at 15 U.S.C. §§ 6802(b)(2) and 6802(e) is used and redisclosed only for the purposes for which it was provided, consistent with 16 C.F.R. § 313.11 and its state insurance analogues.

We implement and maintain the technical and organisational measures described on our security page, which serve as the Article 32 GDPR description and Annex II of the Standard Contractual Clauses, and which are designed to satisfy the GLBA Safeguards Rule, state insurance data security laws and 23 NYCRR § 500.11. We will not materially diminish those measures during a subscription term.

Personnel authorised to process personal data are bound by confidentiality obligations that survive their engagement, receive annual privacy and security training, and are granted access only on a documented least-privilege basis. Access to unmasked claim file data in production is logged and available to the customer on request.

Customers grant general written authorisation for us to engage subprocessors, subject to this section. The current list is published at gethesperai.com/legal/subprocessors.

We impose on every subprocessor, by written contract, data protection obligations no less protective than these - including the prohibition on model training and, where applicable, HIPAA obligations. We remain fully liable to the customer for the acts and omissions of our subprocessors.

We give at least 30 days' notice before adding or replacing a subprocessor, by email to the customer's designated contact and by updating the subprocessor page. Customers may object on reasonable data-protection grounds within that period. If we cannot resolve the objection within 30 days, the customer may terminate the affected order form without penalty and receive a pro-rata refund of prepaid, unused fees.

Where we use a third-party model provider, we contract on enterprise or zero-retention terms that prohibit training on customer data, disable human review for improvement, and limit retention to the minimum necessary for abuse monitoring or eliminate it entirely. Each provider's posture is stated on the subprocessor list.

Taking into account the nature of the processing, we assist customers by appropriate technical and organisational measures in responding to requests for access, correction, deletion, portability, restriction, objection, opt-out of sale or sharing, and limitation of use of sensitive personal information.

If we receive a request directly from a data subject we will not respond substantively. We forward it to the customer within five business days and refer the individual to them.

Privacy Law and insurance regulation may permit or require a customer to deny or defer certain requests in connection with an open fraud investigation. That determination is the customer's, not ours.

We notify the customer of a personal data breach without unreasonable delay and in any event within 48 hours of confirmation, at their designated security contact.

The notice describes, to the extent known and with updates as the investigation progresses: the nature of the breach; the categories and approximate number of data subjects and records affected; the likely consequences; the measures taken or proposed; and a contact point.

We cooperate fully with the customer's investigation and with their obligations to notify supervisory authorities, state insurance regulators, attorneys general and affected individuals. The customer controls the content and timing of all such notifications. We will not notify a regulator or individual in a way that identifies the customer without their consent, unless independently required by law - in which case we give as much advance notice as law permits.

We contain, investigate and remediate at our own cost, and provide a written root-cause analysis within 30 days of closure.

We provide reasonable assistance with data protection impact assessments, algorithmic impact assessments, model risk documentation and prior consultations with supervisory authorities, and with customers' obligations under state insurance AI governance requirements based on the NAIC Model Bulletin on the Use of Artificial Intelligence Systems by Insurers. The scope of that assistance is set out in our Insurance Regulatory Rider.

We make available the information reasonably necessary to demonstrate compliance - our current third-party examination report, penetration test summary, subprocessor list and a completed security questionnaire - annually and on reasonable request, under confidentiality.

Where that documentation is not sufficient, or following a security incident affecting the customer's data, the customer or an independent auditor it appoints (not a competitor of ours) may audit our processing on 30 days' notice, once per twelve months except after an incident or where a regulator requires it, during business hours and without unreasonable disruption. Each party bears its own costs.

Insurance regulator examination rights are separate and are not limited by this section. They are set out in our Insurance Regulatory Rider.

Unless an order form says otherwise, customer data is stored and processed exclusively in the United States.

Where our personnel outside the United States need access for support, engineering or security, that access is subject to the same least-privilege controls, logging and confidentiality obligations, is limited to what is necessary, and is covered by the transfer mechanisms below where Privacy Law requires. Customers may require on their order form that access to unmasked claim file data be restricted to personnel located in the United States.

For personal data subject to the GDPR or UK GDPR transferred to a country without an adequacy decision, the Standard Contractual Clauses apply - Module Two where the customer is a controller, Module Three where the customer is a processor; docking applies; general written authorisation for subprocessors applies with 30 days' notice; governing law and forum are Ireland. For UK transfers, the UK International Data Transfer Addendum (version B1.0) applies, with the law and forum of England and Wales. For Swiss transfers, the FADP applies and the competent authority is the FDPIC.

We provide the information customers need to complete a transfer impact assessment, and will notify them if we become subject to a legal requirement that prevents us meeting our obligations under the SCCs.

On a binding government request for personal data we will, unless legally prohibited, notify the customer promptly, challenge requests that are unlawful or overbroad, disclose only the minimum permissible, and direct the authority to the customer wherever legally possible.

On expiry or termination, customers have 30 days to export. We then delete personal data from production within 60 days and from backups within a further 90 days, and certify deletion in writing on request. Where law requires continued retention we tell the customer, retain only what is required, isolate it, and continue to protect it under this DPA until deletion is permitted.