Data Processing Addendum

For the purposes of this DPA, You are the "Controller" (or "Business" under the CCPA) and Visits is the "Processor" (or "Service Provider" under the CCPA). We process Personal Data solely on Your behalf and strictly for the purpose of providing the Services set forth in the Terms.

To ensure We qualify as a "Service Provider" under the CCPA, We expressly acknowledge and agree that We shall NOT:

• Sell or Share the Personal Data.
• Retain, use, or disclose the Personal Data for any purpose (including a commercial purpose) other than for the specific business purposes of providing the Services described in the Terms.
• Retain, use, or disclose the Personal Data outside of the direct business relationship between You and Visits.
• Combine the Personal Data received from or on Your behalf with Personal Data We receive from other sources, except as expressly permitted under the CCPA.

Your Rights: You have the right, upon reasonable notice, to take reasonable and appropriate steps to ensure that We use Personal Data in a manner consistent with Your CCPA obligations, and to stop and remediate unauthorized use of Personal Data.

To the extent We process "Consumer Health Data" (as defined by Applicable State Laws) on Your behalf, We agree that We shall process such data strictly to the extent necessary to provide the specific Services requested by You. WE ARE EXPRESSLY PROHIBITED FROM USING CONSUMER HEALTH DATA FOR OUR OWN PURPOSES, SECONDARY ANALYTICS, OR ADVERTISING PER APPLICABLE STATE LAWS.

NOTWITHSTANDING ANYTHING TO THE CONTRARY IN THIS DPA OR THE TERMS, VISITS MAY DE-IDENTIFY PERSONAL DATA AND/OR PROTECTED HEALTH INFORMATION (PHI) for any lawful purpose, including for future research, analytics, and product improvement.

Such de-identification shall be conducted in accordance with 45 C.F.R. § 164.514(a)-(c) (the HIPAA de-identification standard) and Applicable State Privacy Laws. Once de-identified, such data shall no longer be considered Personal Data under this DPA.

To the extent We use or maintain De-Identified Data, We explicitly agree to:

1. Take reasonable measures to ensure the data cannot be associated with a consumer or household;
2. Publicly commit to maintain and use the data only in a de-identified fashion and not attempt to re-identify the data; and
3. Contractually obligate any downstream recipients of the De-Identified Data to comply with these exact same commitments.

By using the Services, you provide general authorization for Visits to engage subcontractors to process Personal Data ("Subprocessors"). We will flow down the privacy and security obligations contained in this DPA to all Subprocessors in a written agreement. We will notify You of any intended changes concerning the addition or replacement of Subprocessors, giving You the opportunity to object to such changes by contacting support@visitsrx.com.

Upon Your reasonable written request, We will make available to You all information necessary to demonstrate compliance with the obligations outlined in this DPA and Applicable State Privacy Laws. We shall allow for and contribute to reasonable assessments or audits conducted by You or Your designated assessor, or We will provide an independent third-party audit report (e.g., SOC 2 Type II) in lieu of a direct audit.

Upon the termination or expiration of Your User Account and the Terms, We shall, at Your choice, securely delete or return all Personal Data to You, unless retention of the Personal Data is required by law or in accordance with Our data retention policies as outlined in the Terms.