HIPAA and U.S. Privacy Policy

1. Introduction

The purpose of this HIPAA and U.S. Privacy Policy ("Policy") is to define (and outline) Pandora S9, Inc., and Preventx Limited’s (together, "Preventx") obligations as it relates to compliance with HIPAA (defined below) and other applicable United States ("U.S.") Data Protection Laws (defined below).

Preventx is committed to protecting the privacy, integrity, and security of those who entrust us with their Covered Data (defined below) that the company Processes (as defined below) in all aspects of its business worldwide. This Policy aligns to Preventx’s data protection and information security policy framework (the "Framework"), which includes Preventx’s policies, procedures, and documentation that outline Preventx’s strategy for compliance with data privacy and security requirements.

2. Scope

As an organization, that operates in the United States and provides certain Services (defined below), that may require the collection, use, and disclosure of Covered Data, Preventx has adopted this Policy, as part of its Framework requirements to ensure it adequately protects its Clients and Individuals (both defined below) Covered Data and appropriately complies with applicable U.S. Data Protection Laws. This includes adherence to the following applicable U.S. Data Protection Laws, including but not limited to:

• The Health Insurance Portability and Accountability Act of 1996, the Health Information Technology for Economic and Clinical Health Act (Title XIII of the American Recovery and Reinvestment Act of 2009), and the regulations issued thereunder, 45 CFR Parts 160, 162 and 164, as amended (collectively, “HIPAA”);
• California’s Consumer Privacy Act (“CCPA”) and California Privacy Rights Act (“CPRA”);
• Washington’s My Health My Data Act (“MHMDA"); and
• Other applicable laws including Colorado Privacy Act (“CPA”), Connecticut Data Privacy Act (“CDPA”), Virginia Consumer Data Protection Act (“VCDP”), Utah Consumer Privacy Act (“UCPA") (all collectively “U.S. Data Protection Laws”).

This Policy applies to all Employees (as defined below), and applicable Suppliers (defined below) who may, during their business relationship with Preventx, Process Covered Data. Furthermore, this Policy applies from the time Covered Data are received and continues through the Processing activity, until the Covered Data are no longer required, returned, or deleted, in accordance with Framework and applicable contractual requirements.

3. Definitions

4. Roles & Responsibilities

The following roles and responsibilities are required by this Policy:

5. Policy and Guidelines

5.1 Applicability of U.S. Data Protection Laws

Preventx’s compliance with U.S. Data Protection Laws will depend on the Covered Functions and Services it performs, its relationship to applicable Individuals, and the parties that it contracts with under applicable master services agreements. This includes, as follows:

1. Where Preventx is solely performing laboratory services and is not conducting a HIPAA Covered Function, Preventx does not qualify as a Covered Entity, but will be considered an indirect healthcare provider, which is allowed to exchange PHI, and ePHI, with other Covered Entities, without having to enter into a BAA or obtain an Individual’s consent, so long as such exchange is related to treatment, payment, or healthcare operations.
2. For additional administrative Services performed by Preventx, contracted with applicable Clients (CE), Preventx shall qualify as a BA when transmitting any PHI, and ePHI, in an electronic form, in connection with a Covered Function. e.g., administrative functions that fall outside laboratory services such as managing a portal/website for Client.
3. Where onward transfers of applicable PHI, by Preventx, are made in performance of related business activities, operations, or Services, Preventx entities (including its parent company or other U.S. subsidiaries), such entity(ies) may be considered a Subprocessor.  Where such transfers take place, all such entities shall be subject to this Policy, and adhere to the company’s “International Data Sharing, Transfer, and Processing Agreement,” including the applicable BAA therein; or
4. Where Preventx is otherwise Processing Covered Data, including providing Services direct to Individuals (or consumers) or performing other corporate activities that are not associated with a Covered Function, or under a BAA  Preventx shall ensure its use and disclosure (or Processing) of Covered Data are managed, in accordance with applicable requirements under HIPAA (such as the Security Rule) and other applicable U.S. Data Protection Laws (i.e., CCPA, MHMDA, etc.).

5.2 Privacy Principles

Where Preventx Employees, and Suppliers, Process Covered Data, they must do so, in accordance with Framework obligations, applicable U.S. Data Protection Laws, and the following principles:

1. Lawful Basis: Preventx shall ensure that where required, Processing of Covered Data are based on a Lawful Basis, which may include consent, to fulfill a contract, a legal obligation, a vital or public interest, other legitimate interest, or other basis, as required under applicable U.S. Data Protection Laws. The Lawful basis shall be captured within Preventx’s Records of Processing Activities, in accordance with Section 5.11 below.

2. Limitation(s) on Uses or Disclosures: Preventx shall ensure, Covered Data Processed in support of applicable Services, are for specified, explicit, and legitimate purposes and not further Processed in a manner that are incompatible with those purposes; further Processing for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes shall not be considered incompatible with the initial purpose, in accordance with applicable U.S. Data Protection Law requirements and this Policy.

3. Sensitive Personal Data: Where Preventx Processes Sensitive Personal Data, it shall ensure such Processing adheres to applicable U.S. Data Protection Laws and individuals are informed about how their Sensitive Personal Data are Processed, in accordance with Section 5.3 below and shall allow Individuals to limit the use of their Sensitive Personal Data, in accordance with Section 5.4. (Individuals Rights) below.

4. Data Minimization Principle – “Minimum Necessary:” Preventx shall ensure Covered Data Processed by Preventx Employees and Suppliers (where applicable) are Processed only to perform applicable corporate business activities, operations, and Services.  Preventx shall ensure that only the minimum amount of Covered Data is Processed, and such Processing is done in accordance with Framework requirements, this Policy, and applicable requirements under U.S. Data Protection Laws (including HIPAA).

5. Accuracy Principle: Preventx shall ensure Covered Data that are Processed in support of applicable Services are accurate, complete, kept-up-to-date, and appropriate for use; where not accurate, reasonable steps will be taken to ensure that such Covered Data are erased or rectified (without delay), having regard to the purposes for which they are Processed, in accordance with Individuals’ Rights described in Section 5.4 below.

6. Storage Limitation: In accordance with Data Minimization requirements and Framework requirements, Covered Data shall only be retained for no longer than what are minimally necessary for the purposes for which they are Processed, and as consented to, or to meet regulatory requirements. For PHI, retention shall be up to six (6) years where required by HIPAA. 

7. Data Privacy and Security-by-Design. Preventx shall assess its Processing activities to ensure it incorporates data privacy protections into the design of information systems, products, and services to prevent Incidents and protect Individuals’ privacy by proactively incorporating data privacy and security safeguards into company systems/applications and processes.

8. Data Security Principle: In accordance with Section 5.7 below, Preventx shall ensure Covered Data are Processed in a manner that ensures such data are safeguarded by implementing appropriate administrative, technical, and physical safeguards, as required under the Security Rule, including without limitation: protection against unauthorized or unlawful Processing; and protection against accidental loss, destruction, or damage. Such security controls shall consider: 1) industry standards; 2) the costs of implementation; 3) the nature, scope, context, and Processing purposes; and 4) the risk of varying likelihood and severity for Individuals’ rights and freedoms of natural persons.

9. Sale of Data. For CCPA purposes, and other applicable U.S. Data Protection Laws, Preventx DOES NOT “sell” Personal Data or PII.  Should the company’s business model change and requires the sale of such data, the company shall ensure no Covered Data, is sold without the appropriate Individual consent and without providing Individuals the ability to Opt-out of such sale.

10. Accountability Principle: Where required, Preventx shall ensure that it is able to demonstrate compliance with applicable U.S. Data Protection Laws.

11. Consent. Where consent is the basis for Processing of Covered Data, Preventx shall ensure any required consent under applicable U.S. Data Protection Laws is: 1) freely and explicitly given; 2) specific, informed, and unambiguous; and 3) Individuals are allowed to withdraw consent (as is applicable to the Services), in accordance with Section 5.4 below.

5.3 Organizational Measures

1. Responsible Parties. This Policy designates Preventx’s Data Privacy office, and IT/Security office (with support from Preventx representatives from Legal, Quality Compliance, and Business Operational teams, as well as external third-party privacy and security experts) as the representatives, as required by HIPAA and applicable U.S. Data Protection Laws, who will serve as Preventx’s privacy and security officers and who are the person(s) responsible for the development and implementation of Preventx’s privacy and security policies and procedures and with whom other Employees should consult when issues arise concerning the use, disclosure, or other matters relating to the privacy of Individuals’ Covered Data and records. 

2. Compliance Team. Preventx shall ensure it maintains a structured privacy and security  compliance team, which addresses compliance and standards; data privacy and protection; legal and regulatory compliance matters; business continuity and disaster recovery; communications and operations security management; physical security; systems acquisition, development and maintenance; Supplier management; configuration and change management for software systems; incident response planning and management, including appropriate maintenance and monitoring and analysis of audit logs.

3. Confidentiality. Employees, and as applicable, Suppliers, with access to Covered Data, shall be bound to keep such information confidential and shall comply with Preventx Framework requirements, applicable data privacy and security policies and procedures, and confidentiality agreements as may be applicable.

4. Contracts. PreventX shall enter into appropriate contractual relationships with Covered Entities, Suppliers, Subprocessors, and other third parties as required to perform the Services, including Business Associate Agreements for Processing of PHI on behalf of Covered Entities and other applicable agreements (such as data processing agreements) for Processing of other Personal Data.

5. Data Classification. Covered Data shall be classified in accordance with its risk sensitivity level, as identified in the Chart.  The Chart criteria applies to all Covered Data Processed by Preventx and provides guidelines for how such data are to be protected with the appropriate level of organizational and technical measures, as further outlined under Section 5.7 (Data Safeguards) below.

5.4 Privacy Notices and Authorization

1. As standard, Preventx Clients (as the CEs) shall be required to obtain valid Authorization for the use and disclosure of PHI to Preventx for its Services, and shall ensure its practices align with those Authorizations, in accordance with this Section.

2. Where required, Preventx shall make available a notice of privacy practices (“Privacy Notice”), consistent with the Privacy Rule, applicable U.S. Data Protection Laws, and in accordance with the Framework requirements.  This Privacy Notice shall be generally available at Preventx’s website at: ____________________________.

3. Such Privacy Notice(s) shall provide adequate notice of applicable Processing (including uses and disclosures) of PHI (made by Preventx), and include at minimum, the following information:

   1. How Preventx may use and disclose PHI about an Individual;

   2. An Individual’s rights with respect to the information and how the Individual may exercise these rights, including how the Individual may submit a complaint (defined under Section 5.5 of this Policy);

   3. The entity’s legal duties with respect to the information, including a statement that Preventx is required by law to maintain the privacy of PHI; and

   4. To whom Individuals may contact for further information about Preventx’s privacy policies.

4. Where Services are being provided directly to an Individual, such Privacy Notice(s) shall be provided to Individuals before the start of the Services and require the Individual to agree to the use and disclosures associated with the Services.  Such Privacy Notice(s) shall include additional information, as required under applicable U.S. Data Protection Laws, including:

   1. The categories and specific Personal Data Processed for an Individual;

   2. The categories and sources for the Personal Data collected or Processed;

   3. The business or commercial purpose(s) for collecting the Personal Data;

   4. The categories of third parties with whom Personal Data are shared and what data they received;

   5. Information about the “Sale” of Personal Data, as defined under applicable U.S. Data Protection Laws; and

   6. The Individuals Rights as defined under Section 5.4 of this Policy.

5. Where Preventx is considered a Regulated Entity under MHMDA, Preventx shall also maintain a “Consumer Health Data Privacy Policy,” as required under the law. This shall include, the information outlined above and the following:

   1. The categories of Consumer Health Data collected;

   2. The categories of sources from which Consumer Health Data are collected;

   3. The purposes for which Consumer Health Data are collected and used;

   4. The categories of Consumer Health Data that are shared;

   5. A list of the categories of third parties (Subprocessors) with which Consumer Health Data are shared;

   6. A list of the specific affiliates with which Consumer Health Data are shared; and

   7. A description of how an Individual can exercise rights of access, deletion, and withdrawal of consent (per Section 5.5).

5.5 Individuals’ Rights

1. In accordance with applicable U.S. Data Protection Laws and the Privacy Rule, Individuals shall have the right to exercise their rights and submit DSRRs. Such rights, as further specified in this Policy, and under <<GDPR-DOC-05-1 Data Subject Request Procedure>>, shall include, without limitation:

   • The right to access Covered Data or request a copy;

   • The right to rectification, allowing Individuals to amend incomplete or inaccurate Covered Data;

   • The right to delete data or erase their data, subject to certain exceptions;

   • The right to restrict Processing (including the right to limit use of Sensitive Personal Data);

   • The right to data portability or request data are transferred to another party;

   • The right to Opt-out, or object to certain Processing, including marketing/advertising activities;

   • The right to withdraw consent;

   • The right to Opt-out of sale (if applicable);

   • Right to decisions in automated decision-making;

   • Right to lodge a complaint with certain U.S. State Attorney Generals or regulatory bodies;

   • The accounting of disclosures under HIPAA, including:

     • The right to revoke Authorization of Processing PHI;

     • The right to confidential communications of PHI;

     • The right to restrict disclosures of PHI;

     • The right to an accounting of disclosures of PHI; and

   • Any other rights as may be available under U.S. Data Protection Laws.

2. DSRRs may be submitted in accordance with the methods described under <<GDPR-DOC-05-1 – Data Subject Request Procedure>> by submitting requests in accordance with Privacy Notice(s), by emailing [email protected], or by calling Preventx’s toll-free number +1-855-222-9111.   

3. Requests shall be fulfilled within one (1) month of receipt or as otherwise required under applicable U.S. Data Protection Laws, including:

   1. California allows up to forty-five (45) calendar days of a verified request and HIPAA allows up to sixty (60) days after receipt of the request; and

   2. Additional time may be requested due to complexity of a request, in accordance with applicable U.S. Data Protection Laws.

4. Fees. As standard, Preventx does not charge a fee for handling routine DSRR requests. However, Preventx reserves the right to charge reasonable administrative fees if requests are complex in nature or unduly burdensome, subject to applicable U.S. Data Protection Law fee restrictions. For HIPAA requests, i.e., accounting of disclosures, such requests will be free of charge within a single twelve (12) month period.  For multiple requests within a twelve (12) month period, Preventx reserves the right to charge a reasonable, cost-based fee for each subsequent request  (by the same Individual) made within the applicable twelve (12) month period; provided that, the Individual is informed of the fee in advance, and the Individual has an opportunity to withdraw, or modify, their request to avoid or reduce fees.

5. Preventx shall not retaliate against an Individual for exercising rights provided by the applicable U.S. Data Protection Laws (including the Privacy Rule), for assisting in an investigation by the HHS or another appropriate authority, or for opposing an act or practice that the person believes in good faith violated Preventx’s privacy practices or applicable U.S. Data Protection Laws.

6. Receipt of Unauthorized Covered Data If Preventx receives Covered Data that it was not authorized to receive, e.g., PHI that were not part of an Authorization, BAA, or outside of the minimum data required for a particular Processing activity, such matters will be handled, in accordance with the Information Security and Risk Management Procedure,  to ensure appropriate remediation, such as deletion or redaction of such unauthorized Covered Data, where technically feasible and relevant.

5.6 Uses and Disclosures

1. Preventx shall Process Covered Data in accordance with the principals and protections, as defined within this Policy, Framework requirements, and applicable requirements under U.S. Data Protection Laws.

2. In accordance with HIPAA, where Preventx is Processing PHI on behalf of a CE, the following shall apply:

   1. As standard, Preventx Clients (i.e., CEs) shall be responsible for getting valid Authorization from Individuals (where required) for the use and disclosure of their PHI in connection with Services, not associated with lab services; and

   2. Preventx shall Process PHI, as permitted under HIPAA, as an indirect provider, or under an applicable BAA tied to administrative functions. This may include the following use and disclosure of PHI:

      1. For CEs, and Preventx, related to treatment, payment, and healthcare operations, consistent with that Covered Entity’s privacy notice to Service Users;

      2. For Preventx’s proper management and administration or to fulfill its legal responsibilities, as long as, in the case of any disclosure for these purposes, either: (a) the disclosure is Required by Law; (b) the disclosure is to the Secretary in connection with compliance reviews and investigations; (c) where necessary to prevent a serious threat to an Individual’s health and safety or the health and safety of the public or another person; however, any such disclosure would only be to someone able to prevent the threat; (d) PHI disclosure is in response to a subpoena; or (e) PHI disclosure is part of law enforcement activities (e.g., investigations of criminal conduct);

      3. To provide data analysis administration services;

      4. To provide data aggregation Services;

      5. Preparing PHI limited data sets if the Covered Entity, or Preventx, enter into a data use agreement with the limited data set recipient;

      6. De-identifying PHI;

      7. PHI utilization review;

      8. PHI quality assurance reviews;

      9. To the patient;

      10. For treatment activities of another healthcare provider;

      11. To a CE, or its BA, for payment activities;

      12. To a CE, or its BA, for certain healthcare operations; provided that, Preventx and the CE each has (or had) a relationship with the patient and the PHI pertains to that relationship;

      13. Under a valid HIPAA Authorization;

      14. To the HHS in connection with compliance reviews and investigations, subject to the requirements of applicable laws; and

      15. Where required, reporting positive HIV/AIDS Status test results to local health authorities, in accordance with applicable U.S. State Laws.

3. Where Preventx provides Services directly to an Individual, Preventx shall not quality as a CE or BA, but shall provide Notice to Individuals that is consistent with HIPAA and in accordance with Section 5.4 of this Policy. It shall use, and disclose, PHI only for those explicit purposes, or as provided in valid Authorizations, in accordance with applicable U.S. Data Protection Laws.

4. Where Preventx discloses PHI to an authorized recipient (i.e., a Subprocessor), it shall ensure the recipient of any PHI must provide Preventx reasonable assurances that the PHI will be held confidentially, subject to applicable confidentiality, data privacy and security obligations under a master services agreement (or BAA, where applicable) and used or further disclosed only as permitted, required by law, or for the purpose of the disclosure, in accordance with Section 5.10 (Supplier Management) of this Policy.

5. Data Aggregation: Prevents, where applicable, in its capacity as a BA, may aggregate PHI with the PHI of other CEs that Preventx possesses, for the purpose of providing data analyses related to the healthcare operations of each of its CEs, so long as such data aggregation practices apply de-identification to any PHI.

6. De-Identification (or Anonymization): Preventx may de-identify Covered Data, so long as such de-identification practices align to applicable HIPAA standards, or other applicable U.S. Data Protection Laws, ensuring applicable Individual identifiers are removed. Such practices shall be performed in accordance with Framework requirements or as otherwise required under applicable U.S. Data Protection Laws.

7. Subprocessors: Preventx will share PHI only with authorized Suppliers/Subprocessors who are contractually bound to terms at least as restrictive as Preventx’s Framework obligations, quality procedures, instructions, and written agreements, in accordance with Section 5.10 of this Policy.

5.7 Data Safeguards

1. Preventx shall implement and maintain data protection and security measures, as required under applicable U.S. Data Protection Laws (including the Security Rule under HIPAA) that include administrative, technical, and physical safeguards designed to ensure the confidentiality, reliability, integrity, and availability of Covered Data and any systems, facilities, or software that are used, accessed, or supported in connection with Services and Processing of Covered Data. Such safeguards shall be in accordance with Framework requirements, as outlined in this Section 5.7.

2. Administrative Safeguards

   1. Security responsibility. Covered Data Security shall be the responsibility of Preventx’s Data Privacy, IT/Security departments, in accordance with Framework requirements; however, Employees, and Suppliers (where applicable) are expected to support relevant security requirements as part of their job function, as it relates to relevant business activities and operations.

   2. Security Risk Management. Preventx shall ensure there are appropriate organizational structures, policies, and procedures in place to assess systems, applications, and activities that Process Covered Data in Framework requirements. This shall include the requirement to conduct Data Protection Impact Assessments (“DPIA”) where any activity involves Covered Data and is likely to result in a high-risk to the rights and freedoms of Individuals;

   3. Information Security Reviews. Preventx shall review records of information systems activity and audit logs, and access reports on a routine basis, in accordance with Framework requirements to ensure the on-going confidentiality of its systems and Covered Data;

   4. Access Management. Access Preventx’s systems, or applications, used to perform the Services, will be granted, and revoked, in accordance with Framework requirements;

   5. Security Awareness Training. Employees, and relevant Suppliers, will receive mandatory data protection and information security compliance awareness training, covering applicable U.S. Data Protection Laws and other related privacy legislation; however, Suppliers that offer their own data protection and security compliance training (covering applicable U.S. Data Protection Laws) may provide to Preventx evidence of completion of comparable training prior to performing any Services on Preventx’s behalf. 

   6. Log-in Monitoring.  Logging activities are documented, and performed, in accordance with common security standards (e.g., ISO 27001);

   7. Password Management. Passwords allocated will conform to industry standards and align with password management standards; and

   8. Contingency Plan/Data Backup/Disaster Recovery. Business continuity and disaster recovery plans are in place and tested at least annually and comply with applicable U.S. Data Protection Laws and Data Safeguards. Backups of the Preventx’s systems, applications, and software, used to perform the Services, are replicated to a disaster recovery facility, so recovery can take place when there is a disaster. Covered Data, are replicated to a disaster recovery facility, providing a scheduled point in time to backup the data to ensure data integrity.

3. Physical Security. Where physical locations hold, and Process, Covered Data, as required to perform the Services, Preventx shall ensure:

   1. Location access control procedures are aligned with guidelines detailed in Preventx’s Framework requirements;

   2. Data centers and other locations which house computers and communication systems used to perform the Services have: (a) suitable physical security measures designed to prevent unauthorized persons from gaining access; and (b) suitable environmental controls, in accordance with good industry practices, and can continue in operation despite disruption to the main power supply;

   3. Laboratories shall have secured doors and windows, monitored intruder alarms, registered key cards for entrance, and visitor logs for all third parties; and

   4. Magnetic tape, disk, and documentation holding Covered Data that are no longer required, or replaced, are physically destroyed, in accordance with Framework requirements.

4. Technical Security

   1. Access Controls. Electronic information systems shall have appropriate controls in accordance with Preventx’s access management policies and Framework requirements, including unique user identification and automated logoff due to inactivity;

   2. Preventx shall ensure all Covered Data will reside within secure data center environments. Covered Data transported using portable media, including: laptops; USB sticks; or removable hard-disks and CD/DVDs, align with data minimization principles under applicable U.S. Data Protection Laws;

   3. The following Data Safeguards are implemented if Covered Data are transported using removable media: (i) Laptops will have whole-disk encryption; (ii) Removable hard-disks will have whole-disk encryption or password protection; (iii) USB sticks will be encrypted or password protected; (iv) CD/DVDs will be encrypted or password protected; and (v) A strong passphrase will be used to encrypt Covered Data, where applicable;

   4. Integrity Controls. Preventx shall implement security measures to ensure that electronically transmitted PHI is not improperly modified without detection until disposed of;

   5. Encryption. Preventx Service applications shall be hosted and managed on Microsoft Azure cloud. Where applicable, Covered Data shall be encrypted at-rest, at AES 256 bit (including backups), and Transport Layer Security (“TLS”) 1.2 in transit; and

   6. Audit Trails/Logs. Audit trails to support requirements to assess data integrity and appropriate user access permissions shall align to Framework requirements.

5.8 Regulatory Agency and Authorities

1. Preventx shall adhere to regulatory requirements, including HIPAA compliance requirements, as prescribed by applicable Regulators, including the HHS or OCR (enforcer of the HIPAA Privacy Rule and Security Rule).

2. Preventx shall abide by enforcement of relevant U.S. State Attorney Generals and other governmental bodies (including the FTC) that oversee other applicable U.S. Data Protection Laws.

3. Receiving Complaints. The Data Privacy office, and other applicable stakeholders, e.g., Legal, are responsible for receiving complaints related to Preventx’s applicable U.S. Data Protection Law practices, ensuring the appropriate implementation of Framework requirements, this Policy, and applicable requirements under HIPAA.  If Employees receive any inquiry from the HHS, any U.S. State Attorney General, or other regulator, involving a complaint from an Individual who may have been unsatisfied with Preventx’s privacy practices (including complaints regarding HIPAA), Employees must, without undue delay, immediately forward such inquiry to [email protected].

5.9 Marketing

1. Preventx will conduct marketing, or prospecting, in accordance with applicable U.S. Data Protection Laws and Framework requirements. This shall include the requirement to have Individuals consent or Opt-in to marketing, where required, and to honor any requests to Opt-out of marketing when requested, as outlined in this Section 5.9.

2. If Preventx Processes PHI for the purposes of direct marketing, it shall conduct such activities in accordance with the HIPAA Privacy Rule.

3. For all direct marketing, Preventx must obtain a valid, completed Authorization form prior to using (or disclosing) PHI for purposes that meet the HIPAA definition of marketing. 

4. For Subprocessors, and other Suppliers, Preventx may engage a marketing firm to conduct permitted marketing activities on Preventx’s behalf. Should the marketing activities require PHI use or disclosure to the marketing firm, Preventx shall ensure a BAA is signed to satisfy applicable HIPAA requirements.

5. Preventx will not sell, or disclose, PHI to a third-party or help a third-party market its own products or services without a signed Authorization from the Individual.

5.10 Supplier Management

1. Preventx shall assess Suppliers, in accordance with its Framework requirements and applicable policies and procedures to enable Preventx to appropriately identify, assess, monitor, and manage its Suppliers’ compliance with applicable legal and regulatory requirements (e.g., U.S. Data Protection Laws).

2. For Suppliers who Process Covered Data, on Preventx’s behalf, known as Subprocessors, Preventx shall ensure such entities are Processing Covered Data, in accordance with applicable U.S. Data Protection Laws requirements, applicable terms under master services agreements, data processing agreements (or equivalent terms) or BAAs (where applicable), containing terms at least as restrictive as Preventx’s Framework obligations, quality procedures, written instructions, and contractual requirements.

3. Where Subprocessors are supporting Preventx Services, Clients may be notified of such activities, in accordance with applicable contractual requirements.

4. Subprocessors shall agree to notify Preventx of any instances of which the recipient becomes aware in which the confidentiality and security of PHI has been breached.

5. For Preventx Services, where Suppliers are used to supplement the Services, Processing shall only occur with a CEs authorization (where relevant), or Individual’s Authorization, in accordance with applicable master service agreement terms, BAAs, and relevant requirements under HIPAA.

6. Subprocessors shall also be listed within Preventx Privacy Notices, where required, as outlined in Section 5.4 (Privacy Notices and Authorization).

5.11 Records of Processing Activities

1. Preventx shall complete or provide ROPAs, in accordance with applicable U.S. Data Protection Laws and shall include the following information (where required):

   1. The name and contact details of those responsible for the oversight of its Framework;

   2. The purposes, or Lawful Basis, for the Processing as defined in Privacy Notices, an applicable master services agreement, data processing agreement, BAA, or project documentation;

   3. A description of the Individual categories, and Covered Data categories, as outlined in an applicable informed consent, BAA, or data processing agreement;

   4. The categories of recipients to whom the Personal Data have been (or will be) disclosed (i.e., Suppliers/Subprocessors) including recipients in third-countries or international organizations;

   5. Where applicable, Personal Data transfers to a third-country or an international organization, including the identification of that third-country or international organization;

   6. Where possible, the estimated time limits for erasure of the different Covered Data categories; and

   7. Where possible, a general description of the technical and organizational security measures, as outlined within an applicable master services agreement or data processing agreement.

2. If ROPAs are not readily available, Preventx shall ensure they are produced by the applicable stakeholders within an appropriate timeframe to meet any regulatory obligations or fulfill requests from an applicable Client or Individuals.

5.12 Incident Response

1. Incident response, including associated detection, investigation, reporting, notification, and remediation actions are managed, in accordance with Framework requirements and the Information Security and Risk Management Procedure to ensure the company satisfies its applicable data breach management requirements, and associated reporting obligations, under HIPAA and other applicable U.S. Data Protection Laws.

5.13 Training

1. Preventx shall ensure that its Employees, as part of on-boarding and annually thereafter, complete applicable Training through Preventx’s learning management system, which shall include relevant topics on Framework obligations and HIPAA compliance, cybersecurity, phishing, and other relevant requirements, in accordance with Preventx’s Employee training and documentation requirements. 

5.14 Disciplinary Actions

1. Preventx shall ensure that appropriate steps are taken to comply with Framework requirements, this Policy, and applicable U.S. Data Protection Laws, including HIPAA for maintaining the confidentiality of Covered Data.  Any violation of Framework requirements, this Policy, or other applicable laws by Employees (or Suppliers, where applicable) shall be grounds for corrective action, up to, and including termination or revocation of an applicable service agreement, and any other legal remedies that may be available.

5.15 Monitoring/Audit

1. Preventx shall ensure its Framework requirements are periodically reviewed by the Data Privacy office, or IT/Security (or an external auditor), no less than annually, to ensure compliance with applicable HIPAA obligations and where required, other applicable U.S. Data Protection Laws.

APPENDIX A: Document Classification Chart