Data Processing Addendum

1. Roles

The customer (“Controller”) determines the purposes and means of processing personal data about its clients and staff entered into the Service. OSTERA LLC (“Processor”) processes that data only on the Controller’s behalf.

2. Subject matter and duration

Subject matter: provision of the Service. Duration: the term of the subscription, plus the export and deletion period described below.

3. Nature of the data

• Categories of data subjects: the Controller’s clients, prospective clients and staff users.
• Categories of data: names, email addresses, phone numbers, appointment details, visit history, waitlist requests, internal notes and sign-in records.
• Special categories: none intended. The Controller must not enter health or other sensitive data into the Service.

4. Instructions

The Processor processes personal data only on the Controller’s documented instructions, which are the Terms, this addendum and the Controller’s configuration and use of the Service. The Processor will inform the Controller if it believes an instruction breaks applicable law.

5. Confidentiality and security

Persons authorized to process the data are bound by confidentiality. The Processor maintains appropriate technical and organizational measures, including encrypted connections (HTTPS), role-based access, individual sign-in, and restricted administrative access.

6. Sub-processors

The Controller authorizes the Processor to use sub-processors for hosting, email delivery and subscription billing. The Processor imposes data protection obligations on each sub-processor equivalent to this addendum and remains responsible for them. A current list is available on request; the Processor will notify the Controller of new sub-processors in advance, and the Controller may object on reasonable grounds.

7. Assistance

Taking into account the nature of the processing, the Processor assists the Controller in responding to requests from data subjects and in meeting its obligations on security, incident notification and, where required, impact assessments.

8. Security incidents

The Processor will notify the Controller without undue delay after becoming aware of a personal data breach affecting Controller data, with the information reasonably available to it.

9. Return and deletion

At the end of the subscription, the Controller may request an export of its data within 30 days. The Processor then deletes the data from the active Service, and from backups on their normal cycle, unless the law requires retention.

10. Information and audits

The Processor makes available the information reasonably necessary to demonstrate compliance with this addendum and responds to reasonable written questions from the Controller.

11. Contact

Data protection questions: contact@ostera.app. OSTERA LLC, 10850 N Dover St, Westminster, CO 80021, USA. Email: contact@ostera.app. Phone: +1 (970) 238-3416.