Data Processing Addendum

This Data Processing Addendum ("DPA") is part of the Terms of Service between Harper Grace Solutions LLC ("Processor", "we", or "us") and the business customer ("Controller" or "you") using SpinaCareSync for care coordination. It sets out the rules for how we handle personal data on your behalf when you use our service as a business or organization.

This DPA uses plain English. If anything conflicts with your main service agreement, this DPA controls for data protection matters.

1. Who this applies to

This DPA applies when you use SpinaCareSync as a business, clinic, care agency, or other organization that handles personal data about clients, patients, or their families through the app. It does not apply to consumers using SpinaCareSync for their own family.

2. Roles

• You are the controller. You decide why and how personal data is collected, entered, and used in your SpinaCareSync account.
• We are the processor. We provide the platform and only process data according to your instructions, this DPA, and applicable law.

If you use our service to process data on behalf of another organization, you must ensure you have permission to authorize us as a subprocessor.

3. What personal data is covered

The data entered and stored in SpinaCareSync may include information about the children and families you support, such as:

• Names, contact details, and household information
• Medical appointments, diagnoses, treatments, and care notes
• Medications, therapies, daily care tasks, and observations
• Files, documents, or images uploaded to records
• Team member names, roles, and communication history

This is typically sensitive personal and health-related data. We treat it as such.

4. Purpose of processing

We process the data only to:

• Provide, maintain, and improve the SpinaCareSync service
• Host and secure the data you enter
• Deliver notifications, reminders, and support messages you configure
• Enable invited team members to access records according to the permissions you set
• Comply with legal requirements and protect the security of the service

We do not use this data for our own advertising, profiling, or unrelated commercial purposes.

5. Our instructions

Your instructions are the actions your authorized users take inside the app: adding records, inviting team members, setting permissions, configuring reminders, and deleting data. If you ask us to do something with data that goes beyond what the app normally allows, we will confirm it in writing where required.

6. Security measures

We implement administrative, technical, and physical safeguards to protect the data you entrust to us, including:

• Encryption in transit and at rest
• Role-based access controls and authentication
• Row-level security so each household or organization only sees its own data
• Regular backups and infrastructure monitoring
• Access logging and internal controls for our staff

7. Subprocessors

We use trusted infrastructure providers to host and operate SpinaCareSync. Our main hosting and database services are provided by Lovable Cloud. We remain responsible for any subprocessors we engage, and we ensure they meet equivalent security and confidentiality obligations.

If you need a current list of subprocessors or want to be notified of material changes, contact us through our Support page.

8. Retention and deletion

We keep personal data for as long as your account is active and as needed to provide the service. When you delete data inside the app, it is permanently removed from active systems. If you terminate your account, we delete or anonymize data according to our data retention schedule, except where we are legally required to keep it.

9. Your obligations

As the controller, you agree to:

• Only collect and enter data you have a legal basis to process, including any required consents or authorizations
• Keep user permissions and team invitations accurate and up to date
• Notify us promptly of any suspected data breach, unauthorized access, or legal request affecting your data
• Inform us in writing if you believe you need to process data in a way that falls outside the app's standard features

10. Data subject rights

If an individual asks you to access, correct, delete, or restrict the use of their personal data, you should handle the request as the controller. We will assist you by making available the tools in SpinaCareSync to view, edit, export, or delete the data you hold. If you need help with a request you cannot complete yourself, contact us through our Support page.

11. Audits

You may request reasonable information about our security and data protection practices. We will provide a summary of our controls, certifications where applicable, and responses to written security questionnaires. Onsite audits are not normally required, but we will discuss them in good faith if a specific legal or regulatory need arises.

12. International transfers

SpinaCareSync is operated from the United States. If you are located outside the United States, your data may be stored and processed there. We handle such transfers using appropriate safeguards, including standard contractual protections and security measures, to ensure data is protected consistently with this DPA.

13. Changes and termination

We may update this DPA to reflect changes in law or our service. We will post the updated version with a new "Last updated" date and notify you of material changes. This DPA terminates automatically when your paid service agreement ends and all data has been returned or deleted in line with Section 8.

14. Contact us

If you have questions about this Data Processing Addendum, please reach out through our Support page.