Pup Notes Data Processing Addendum

This addendum ("DPA") is part of the Pup Notes Terms of Service between Odd Bird Labs LLC, a Kentucky limited liability company ("Pup Notes"), and the practice ("the practice"). It applies to personal information Pup Notes processes on the practice's behalf. If this DPA conflicts with the terms, this DPA controls for that information.

1. Definitions

• Practice personal data: personal information about the practice's clients, caregivers and their households, and other people the practice records, that Pup Notes processes to provide the service. It includes client and caregiver contact details, dog profiles, intake answers, vaccination records, appointments, session notes, training programs, homework and check-ins, behavior incidents, messages, signed agreements, invoices and payments, and consent records.
• Data protection laws: US federal and state laws that apply to the processing of practice personal data, including state consumer privacy laws such as the California Consumer Privacy Act and the Texas Data Privacy and Security Act where they apply.
• Security incident: a confirmed breach of security that leads to unauthorized access to, or accidental or unlawful loss, alteration or disclosure of, practice personal data.
• Subprocessor: a third party Pup Notes engages that processes practice personal data.

Terms such as "controller", "processor", "business" and "service provider" have the meanings given in the data protection laws.

2. Roles

• The practice is the controller (or "business") of practice personal data. It decides why the data is collected and how it is used.
• Pup Notes is the processor (or "service provider") of practice personal data.
• Pup Notes is the controller of trainer and staff accounts, sign-in identities (including the one sign-in identity a caregiver uses across practices), practice subscription and billing data, and service usage and security data. The privacy policy covers that information, and this DPA does not.

3. Instructions and purpose

Pup Notes processes practice personal data only to provide, secure and support the service, on the practice's documented instructions. The terms, this DPA and the practice's use and configuration of the service are those instructions.

Pup Notes will:

• not sell or share practice personal data, as "sell" and "share" are defined in the data protection laws;
• not keep, use or disclose practice personal data for any purpose other than providing the service, or outside its direct business relationship with the practice, except as the data protection laws allow;
• not combine practice personal data with personal information it receives from other sources, except as the data protection laws allow to provide the service;
• not use practice personal data to market Pup Notes, or to train AI models;
• keep each practice's data separate from every other practice's data; and
• tell the practice if it believes an instruction breaks the data protection laws, or if it can no longer meet its obligations under them.

4. The practice's responsibilities

The practice is responsible for having a lawful basis and the required notices and consents for the personal data it puts into Pup Notes and for its instructions, including consent for text messages, marketing messages and recordings.

5. Confidentiality

Pup Notes ensures that everyone it authorizes to process practice personal data is bound by a duty of confidentiality. Access is limited to what support, security and operations need (see section 13 of the terms).

6. Security

Pup Notes maintains the technical and organizational measures in Annex A, appropriate to the risk of the processing. Pup Notes may update them, but will not materially reduce the protection they provide.

7. Subprocessors

• The practice authorizes Pup Notes to use the subprocessors on the subprocessor list.
• Pup Notes has a written agreement with each subprocessor that requires protection of practice personal data at least as strong as this DPA's, and is responsible for each subprocessor's performance.
• Pup Notes will update the list and notify practice owners by email at least 30 days before a new subprocessor starts processing practice personal data.
• The practice may object on reasonable data-protection grounds within the notice period. Pup Notes will try in good faith to resolve the objection. If it can't, the practice may cancel and receive a prorated refund of prepaid fees for the period after cancellation.

8. Help with requests from individuals

• Pup Notes gives the practice tools to find, correct, export and delete practice personal data, and to record communication preferences.
• If Pup Notes receives a request about practice personal data directly from an individual, it will promptly pass the request to the practice and will not answer it except to say it has done so, unless the practice asks it to or the law requires it.
• Pup Notes will give reasonable help with requests the tools can't handle, and with the practice's data protection assessments where the data protection laws require them.

9. Security incidents

• Pup Notes will notify the practice owner within 72 hours after confirming a security incident affecting the practice's personal data.
• The notice will describe, as far as then known, what happened, the categories of data and people affected, the likely consequences, the steps taken or planned, and a contact for more information. Pup Notes will add information as it learns more.
• Pup Notes will take reasonable steps to contain the incident and reduce its effects, and will cooperate with the practice's own notification obligations. Notifying the practice is not an admission of fault.

10. Information and audits

On written request, once a year, Pup Notes will give the practice the information reasonably needed to show that it meets this DPA, such as written answers to a security questionnaire and a summary of its security measures. Pup Notes does not offer on-site audits.

11. Retention, return and deletion

• Pup Notes applies the fixed retention schedule summarized in the privacy policy during the service.
• The practice can export its data at any time, including during the read-only period after a subscription ends.
• When the practice closes its account, Pup Notes stops processing for new activity, offers a final export and keeps the data for a 30-day recovery period. It then deletes practice personal data from active systems and asks its subprocessors to delete their copies.
• Pup Notes keeps only the records it must retain for financial, tax, legal or security reasons, in a restricted archive, for the periods in the retention schedule, and deletes them afterward.
• Encrypted backups are deleted automatically within 35 days. If a backup is ever restored, deletions made after that backup are applied again before the data is used.
• When active deletion is complete, Pup Notes tells the practice owner which narrow categories it still holds, why and until when.

12. Location

Pup Notes stores and processes practice personal data in the United States, except for push-notification delivery. Google Firebase Cloud Messaging and Apple's push notification service are global services that process device push tokens and installation identifiers to deliver notifications; notification text contains no names, details or message content. The subprocessor list shows each subprocessor's location.

13. Term

This DPA lasts as long as Pup Notes processes practice personal data for the practice, including after the terms end.

Annex A: Security measures

• Encryption: TLS for all traffic, including connections to the database and providers; encryption at rest for the database, backups, file storage, queues and secrets.
• Access control: every request is checked against the user's practice membership and role; automated tests check that one practice cannot reach another's data; service accounts have least-privilege permissions; Pup Notes administrators use multi-factor authentication.
• Personnel access: no general access to sign in as a user; read-only support tools; any deeper access is limited to the owner of Pup Notes, time-limited, tied to a stated reason and recorded in an audit log.
• Sessions: secure, HttpOnly cookies on the web and protected device storage in the native app; sessions can be revoked.
• Payment data: card data is entered only into Stripe-hosted forms and SDKs and never reaches Pup Notes' servers.
• Files: photos, videos and documents are stored privately, scanned on upload and delivered through short-lived signed links. Image metadata is removed.
• Logging: logs and analytics use an allowlist of technical fields and exclude notes, messages, incidents, transcripts, addresses, names and secrets. Session replay is off in signed-in apps.
• Audio and AI: raw dictation audio is deleted within 24 hours; AI providers are called through US regional endpoints, without training use.
• Audit: access changes, financial actions, exports, deletions and support access are recorded in an audit log. Those events are kept for 7 years.
• Resilience: point-in-time database recovery with backups kept for 35 days, and regular restore tests.
• Development: dependency, secret, container and infrastructure scanning in CI; production data is never copied into test environments.
• Incident response: a documented response plan with breach-notification steps.