Cairn Data Processing Addendum

Version: dpa-1.0.0. Incorporated into an accepted Cairn customer agreement as of the recorded acceptance/effective date.

1. Parties, scope and precedence

Cairn LLC, 2800 E Enterprise Ave Ste 333, Appleton, Wisconsin, United States (Processor), and the organization identified in its accepted order form (Customer) agree to this Addendum for personal data processed in delivering the service on Customer's behalf (Customer Personal Data). It supplements the Terms, controls conflicts about processing, and does not replace applicable law. Cairn acts on its own behalf for necessary account, billing, security and legal administration described in its Privacy Policy. Legal notices go to legal@cairn.how; privacy and incident notices go to privacy@cairn.how and security@cairn.how respectively.

2. Processing instructions and restrictions

Customer determines the purposes of its workspace and supplies documented instructions through the agreement, configurations and authorized requests. Cairn processes only to provide, secure and support the instructed service, or as law requires; where lawful it informs Customer of a conflicting legal requirement. Cairn informs Customer if an instruction appears unlawful and may suspend that instruction while the parties resolve it. Cairn does not sell Customer Personal Data, use it for cross-context behavioral advertising, or use it to train shared models. Optional analytics, mining, campaigns, recordings and integrations require Customer's appropriate configuration and lawful basis/consent.

PHI and patient-identifiable health information are prohibited across every input and integration. No BAA or HIPAA authorization is provided. Secrets, raw payment credentials and regulated pharmacy/DSCSA documents are outside the approved pilot schedule. A data restriction does not negate duties arising from actual receipt of prohibited information. The parties will restrict further processing, securely return or remove it as appropriate, and address applicable incident obligations.

3. Confidentiality and technical measures

Cairn restricts processing access to authorized persons who need it and are under appropriate confidentiality duties. Measures include workspace-scoped data access and policy checks; role-based authorization; protected sessions and available 2FA/SSO controls; encryption in transit and protected storage; integration-secret encryption using the application key; hashed API credentials; signed webhook validation; private media delivery; capture masking and configured redaction; permissioned AI retrieval/actions; egress restrictions; queue/idempotency controls; and testing and monitoring.

The precise implemented controls and operational qualifications are described in the versioned Security/processor evidence associated with the release. These are not a representation of an independent certification, a separate per-workspace KMS hierarchy, a log of every read, complete PII detection or a guaranteed uptime SLA. Customer must configure its roles, verified domains, redaction, optional features and access protections and limit content to the permitted data.

4. Subprocessors and instructed recipients

Customer authorizes the platform subprocessors in the accepted processor register for their identified purposes. Cairn maintains appropriate contractual data protection/confidentiality commitments and remains responsible for its subprocessors' performance of Cairn's processing duties. Cairn provides owners at least 30 days' notice before an ordinary addition or replacement begins processing Customer Personal Data. Customer may object during that interval on reasonable data-protection grounds. The parties will seek a practical alternative; if none is available, Customer may terminate the affected service before the change without a termination penalty. Urgent security/legal changes may occur earlier when necessary, with prompt notice, reasons and the same objection process.

Customer-selected integrations and recipients must be classified according to the actual arrangement; customer-owned credentials do not alone establish that a vendor is outside this register. Data sent to an independently engaged recipient on Customer's specific instruction is subject to Customer's arrangement with that recipient. Cairn does not authorize undisclosed onward use. Model-provider training exclusion does not imply zero retention; API-specific safety, legal and retention exceptions are disclosed.

5. Requests, incidents and assistance

Cairn reasonably assists Customer with lawful access, correction, deletion and export requests using the available tools or a secure assisted process. Cairn refers direct requests concerning Customer-controlled data to Customer unless law requires otherwise. Customer verifies the requester and gives instructions. Assistance with unusual requests, impact assessments or regulator inquiries may have reasonable agreed costs, but those must be disclosed in advance and cannot be used to evade mandatory duties.

Cairn notifies Customer without undue delay and within 48 hours after becoming aware of a security incident compromising Customer Personal Data, or earlier where applicable law requires. An initial notice may contain available facts with subsequent updates; investigation is not a reason to wait for certainty about every detail. Notices identify the incident, affected categories/systems if known, likely consequences, response measures and a contact. Routine blocked attacks without compromise do not require individual incident notices. Customer remains responsible for its required regulator/individual notices, with Cairn's reasonable assistance; the contractual deadline does not substitute for statutory duties.

6. Return, deletion and evidence

Before ordinary service termination or requested workspace deletion, Customer may export available content or request a secure return. Workspace deletion uses a 30-day soft-deletion interval followed by hard-purge processing. Media, indexes/vectors and dependent records follow the documented deletion map. Already-derived articles and recipient-controlled copies need separate handling. Cairn retains retryable deletion work if an object operation fails and issues completion evidence only after required primary tasks succeed.

Backup copies remain restricted and expire according to the verified system-specific schedules disclosed in the processor evidence; restoration must reapply deletion. Provider safety/legal retention exceptions and a valid legal hold can delay removal of particular copies. Cairn identifies these exceptions rather than claiming instant universal erasure. Minimum contractual acceptance and billing/legal evidence may be retained for seven years after termination or a longer applicable legal obligation, used only for that purpose and protected separately from active content.

7. Review and audits

Cairn makes reasonable information about its processing measures available to Customer. Customer may request a proportionate review once annually or after a material incident. Reviews protect other customers' data, secrets and security, use existing evidence first, occur on reasonable notice during business hours and impose no disruptive penetration test. Any additional cost is agreed beforehand; mandatory regulator access and applicable audit rights are not excluded. Neither party may use an audit to obtain another workspace's data or confidential business information unrelated to the review.

8. Standard processing schedule

Subject matter: business support, knowledge, sanitized workflow capture, onboarding and authorized integrations for the customer identified in its privately accepted order form. Duration: the subscription and its limited return/deletion intervals. Operations: receipt, storage, organization, retrieval, authorized transmission, generation, permitted automation, export and erasure. Persons: authorized customer staff, business representatives and support users. Data: minimum business identity/contact details, approved knowledge, sanitized screenshots, support messages without prohibited data, and expressly allowlisted onboarding/progress attributes. No special-category health data, payment credentials or patient records are authorized.

The order form's customer-specific schedule identifies licensed workspaces, approved integrations, identity attributes, exclusions and retention choices. Those choices must be recorded in the customer governance/configuration acceptance before activation. Open conversations, authored content, contact-event telemetry, audit and contractual evidence have separate disclosed rules. Neither a proposed retention choice nor an unavailable integration is represented as active.

9. Applicable law and international limits

Wisconsin law and the agreement's venue apply, without limiting mandatory data-protection rights. The initial service is a US business pilot. No EU/UK residency, SCC transfer arrangement or HIPAA service is constituted by this Addendum; any such offering requires a separate verified processing arrangement before use. Liability and indemnity follow the Terms' applicable caps and exclusions. Confidentiality and protection of retained data survive termination.