SMART OMIX DATA PROCESSING ADDENDUM

This Data Processing Addendum (“Addendum”) forms part of the agreement between Customer and Sharecare covering Customer’s use of the “Services” as defined in the Platform Agreement between Sharecare and Customer (the “Agreement”).

Definitions

Capitalized terms not defined in this section will have the meaning given to them in this Addendum or the Agreement.

Controller and Processor

Sharecare as a Processor – Processing Customer User Content

Confidentiality

Subprocessors

(i) Sharecare will restrict the onward subprocessor’s access to Customer User Content only to what is strictly necessary to provide the Services, and Sharecare will prohibit the subprocessor from processing the personal data for any other purpose;

(ii) Sharecare agrees to impose contractual data protection obligations, including appropriate technical and organizational measures to protect personal data, on any subprocessor it appoints that require such subprocessor to protect Customer User Content to the standard required by Applicable Data Protection Law; and

(iii) Sharecare will remain liable for any breach of this Addendum that is caused by an act, error, or omission of its subprocessors.

Data Subject Rights

In the event that either party receives any request from a data subject to exercise any of its rights under Applicable Data Protection Law (including its rights of access, correction, objection, erasure, and data portability, as applicable) requiring action by the other party under the Applicable Data Protection Law, such party will promptly inform such other party in writing. The parties agree to cooperate, in good faith, as necessary to respond to any Third Party Request as necessary and fulfill their respective obligations under Applicable Data Protection Law.

Upon Customer’s request, Sharecare will provide reasonable additional and timely assistance to assist Customer in complying with its data protection obligations with respect to data subject rights under Applicable Data Protection Law.

Impact Assessments and Consultations

Sharecare will provide reasonable cooperation to Customer in connection with any data protection impact assessment (at Customer’s expense only if such reasonable cooperation will require Sharecare to assign significant resources to that effort) or consultations with regulatory authorities that may be required in accordance with Applicable Data Protection Law.

Return or Deletion of Customer User Content

Security and Audits

(i) Sharecare will, to the extent permitted by applicable law, notify Customer without undue delay, but in no event later than seventy-two (72) hours after Sharecare’s discovery of a Security Incident impacting Customer User Content of which Sharecare is a processor;

(ii) Sharecare will notify Customer of any Security Incident via email to the email address(es) designated by Customer in Customer’s account.

Sharecare will make reasonable efforts to identify a Security Incident, and to the extent a Security Incident is caused by Sharecare’s violation of this Addendum, remediate the cause of such Security Incident. Sharecare will provide reasonable assistance to Customer in the event that Customer is required under Applicable Data Protection Law to notify a regulatory authority or any data subjects impacted by a Security Incident.

International Provisions

Miscellaneous

SCHEDULE 1

DETAILS OF PROCESSING

1.1 Customer User Content. Sharecare will process Customer User Content as a processor in accordance with Customer’s instructions as set forth in the section titled Customer Instructions.

1.2 Customer Account Data. Sharecare will process Customer Account Data as a controller for the purposes set forth in subsection (b) of the section titled Controller and Processor (Sharecare as a Controller of Customer Account Data).

1.3 Customer Usage Data. Sharecare will process Customer Usage Data as a controller for the purposes set forth in subsection (c) of the section titled Controller and Processor (Sharecare as a Controller of Customer Usage Data).

3.1 Customer User Content.

(a) Services. Prior to the termination of the Agreement, (x) Sharecare will process stored Customer User Content for the Permitted Purposes until Customer elects to delete such Customer User Content via the Services and (y) Customer agrees that it is solely responsible for deleting Customer User Content via the Services. Upon termination of the Agreement, Sharecare will (i) provide Customer thirty (30) days after the termination effective date to obtain a copy of any stored Customer User Content via the Services; (ii) automatically delete any stored Customer User Content thirty (30) days after the termination effective date; and (iii) automatically delete any stored Customer User Content on Sharecare’s back-up systems sixty (60) days after the termination effective date. Any Customer User Content archived on Sharecare’s back-up systems will be securely isolated and protected from any further processing, except as otherwise required by applicable law or regulation.

3.2 Customer Account Data. Sharecare will process Customer Account Data as long as required (a) to provide the Services to Customer; (b) for Sharecare’s legitimate business needs; or (c) by applicable law or regulation. Customer Account Data will be stored in accordance with the Sharecare Smart Omix Privacy Policy.

3.3 Customer Usage Data. Upon termination of the Agreement, Sharecare may retain, use, and disclose Customer Usage Data for the purposes set forth in Section 1.3 (Customer Usage Data) of this Schedule 1, subject to the confidentiality obligations set forth in the Agreement. Sharecare will anonymize or delete Customer Usage Data when Sharecare no longer requires it for the purposes set forth in Section 1.3 (Customer Usage Data) of this Schedule 1.

4.1 Customer User Content. Customer’s end users.

4.2 Customer Account Data. Customer’s employees and individuals authorized by Customer to access Customer’s Sharecare account.

4.3 Customer Usage Data. Customer’s end users and Customer’s employees and individuals authorized by Customer to access Customer’s Sharecare account.

6.1 Customer User Content. Sensitive Data (including health information) may, from time to time, be processed via the Services where Customer or its end users choose to include Sensitive Data within the communications that are transmitted using the Services. Customer is responsible for ensuring that suitable safeguards are in place prior to transmitting or processing, or prior to permitting Customer’s end users to transmit or process, any Sensitive Data via the Services.

6.2 Customer Account Data and Customer Usage Data.

(a) Sensitive Data may be found in Customer Usage Data in the form of health information submitted by the end user and used to populate the end user’s profile.

(b) Customer Account Data does not contain Sensitive Data.

SCHEDULE 2

TECHNICAL AND ORGANIZATIONAL SECURITY MEASURES

For the purposes of this Information Security Addendum (“ISA”), “Vendor” shall mean Sharecare Operating Company, Inc., and “Customer” shall mean the entity to which Vendor is providing services in the agreement this ISA appends.

I.                Purpose & Disclaimer

This Sharecare Information Security Addendum ("ISA") describes the minimum information security program requirements implemented and maintained by Vendor during the course of its performance of services for Customer. Vendor may have additional privacy and security obligations under the terms of other policies or provisions in its contractual relationship with Customer.  

II.              Definitions

1. Information Security - the processes and methodologies which are designed and implemented to protect print, electronic, or any other form of confidential, private and sensitive information or data from unauthorized access, use, misuse, disclosure, destruction, modification, or disruption.
2. Incident Management – the defined process of monitoring and detection of security events on a computer or computer network and the execution of proper responses to those events.
3. Exception Management – an established process to document and maintain appropriate management approvals for areas, processes or events that do not meet the company defined security policies.
4. Customer Confidential Data – any Customer customer/member records or personal data in the possession of, or accessible by, Vendor or its computer or communication system(s), including personal data of any kind. Examples of this include PHI and PII data, pricing data, and Customer intellectual property.
5. Cyber Security Insurance - insurance designed to mitigate losses from a variety of cyber incidents, including data breaches, business interruption, and network damage.
6. Demilitarized Zone (DMZ) - a middle ground between an organization's trusted internal network and an untrusted, external network such as the Internet. Also called a "perimeter network," the DMZ is a subnetwork (subnet) that may sit between firewalls or off one leg of a firewall. Organizations typically place their web, mail and authentication servers in the DMZ.

III.              Security Program and Policy

1. Consistent with applicable data security laws and regulatory requirements, Vendor shall:
   • implement, enforce, and update Information Security policies, standards, processes, and procedures;
   • develop Information Security strategy and maintain sufficient security budget to successfully implement the strategy; and
   • establish critical security processes such as Incident Management and Exceptions Management.
2. Information Security policies must be reviewed and approved by Vendor management no less frequently than annually.
3. Security Risk Management Program – Vendor must maintain a formal risk management function and methodically identify, analyze and mitigate security and technology risks.
4. Sub-contractor Security Program – Vendor must require and verify that its subcontractors maintain security program standards that meet or exceed those of the Vendor.

IV.             Human Resources

1. A security training and awareness program must be in place for all Vendor employees and contractors, and training shall take place upon hire and no less frequently than annually. Upon request, Vendor shall provide Customer with written attestation that all employees and contractors have completed training.
2. Upon hire, Vendor shall conduct background checks on all new employees and contractors.
3. Vendor agrees that any employee or contractor who violates the security requirements of this ISA will be immediately removed and prohibited from providing services to Customer under any agreement, including statements of work or engagement letters, entered into between Customer and Vendor.
4. All Vendor employee and contractor access must be deleted or disabled within 24 hours of termination. In the case of hostile terminations of employees or contractors, access must be deleted or disabled immediately.

V.              Physical, Data and Environmental Security

1. Access for all persons to Vendor premises, buildings, and areas must be justified, authorized, logged and monitored. Appropriate steps must be taken by Vendor to protect documents and media containing sensitive information.
2. Upon confirmed breach of this ISA and Customer’s request, Vendor shall provide complete and auditable records of employees and contractors who may have had access to Customer Confidential Data, including at a minimum, their identity and date and time of access.
3. All Customer Confidential Data shall be stored in a secure data center, and such data center shall provide to Customer upon request an ISO 27001 certificate or a Service Organization Control (SOC 2) report.
4. All Customer Confidential Data must be encrypted in transit and at rest.

VI.             Audits, Assessments, Certifications and Insurance

1. Notice of Audits and Certifications. Upon request from Customer, Vendor shall provide Customer with data relating to the following audits of and certifications relating to Vendor’s business and operations:

1. External Network Security Assessment. No less frequently than annually, Vendor shall engage an independent third party to complete an external network assessment that shall include in the scope the services provided to Customer. Vendor shall provide Customer with the full report or at a minimum a signed letter of attestation from this assessor and an overview of any critical or high issues noted by third party.
2. Internal Network Security Assessment. No less frequently than biennially, Vendor shall engage an independent third party to complete an internal network assessment (including social engineering tests) that shall include in the scope the services provided to Customer. Vendor shall provide Customer with the full report or at a minimum a letter of attestation from this assessor and an overview of any critical or high issues noted by third party.
3. Customer Assessment. Upon request and 60 days advanced notice, Customer or a third party on Customer’s behalf may perform an audit to ensure compliance with this Document. Vendor is responsible for ensuring appropriate personnel are available for questions and ensuring audit records are provided in a timely manner. Any critical or high issues noted during audit must be remediated within mutually agreeable timeframe.
   
   ii. Vendor must maintain Cyber Security Insurance policy that includes services provided to Customer.

VII.           Network Security and Other Security Controls

1. Perimeter Defense – Vendor must deploy a multilayered perimeter defense of its system by use of firewalls, proxies and DMZs. Vendor must implement and maintain rules for allowing inbound and outbound traffic.
2. Data Loss Prevention – Vendor must monitor networks, user activities and system processes to prevent and detect unauthorized data movements.
3. Malware Defenses - Vendor must monitor workstations, servers, and mobile-devices for active, up-to-date anti-malware protection with anti-virus, and procedures to ensure antivirus checking for all incoming files.
4. Access Control – All access must follow the minimal necessary and “least privileged” principles. Vendor must maintain appropriate access by implementing access approval, termination and revalidation processes and procedures. This should include appropriate segregation of duties (e.g., developers do not have access to production data, etc.).
5. Controlled Use of Administrative Privileges – Vendor must ensure all service accounts have long and difficult-to-guess passwords that are changed on a periodic basis or is set to not allow interactive login. Passwords for all systems must be stored in a hashed or encrypted format.
6. Secure Configurations – Vendor must develop, implement, and maintain secure configuration standards for hardware and software, including networking devices, operating systems, databases and applications. Vendor must enforce use of strong authentication and secure protocols.
7. Maintenance, Monitoring and Analysis of Audit Logs – Vendor must log user and system activities around data, ensure integrity of log files, and implement activity review procedures and tools.
8. Inventory of Information Assets – Vendor must maintain a detailed inventory of information assets complete and accurate with proper classification, ownership, location, value and criticality.
9. Change Management – Vendor must use formal, documented change management procedures for any modifications to systems, infrastructure, equipment, software/applications, or other elements related to the services performed for Customer.

VIII.          Vulnerability Management and Application Security Testing

1. Application Software Security - Both internally developed and third-party application software must be carefully tested by Vendor for security vulnerabilities. For third-party software, Vendor must verify that its suppliers have conducted detailed security testing of their products. For in-house developed applications, Vendor must conduct such testing itself or engage an outside firm to complete the testing. Findings must be remediated within an established reasonable timeframe. Vendor’s developers must be trained in secure coding techniques and security testing integrated into the System Development Lifecycle.
2. Continuous Vulnerability Assessment and Remediation – Vendor must maintain vulnerability and patch management processes for all software and hardware. All servers and workstations must be scanned by Vendor for vulnerabilities no less than monthly, and have defined remediation timelines to remediate any vulnerabilities that are noted.
3. Corrective Action. If during an audit Vendor is found to be not compliant with the stipulations in this ISA, a corrective action plan will be put in place and reviewed yearly if not closed.

IX.             Business Continuity Management Program

1. Business Continuity Program - At all times during the term of its agreements with Customer, including statements of work and engagement letters, Vendor will maintain and adequately support a Business Continuity Management Program that ensures the continuous operation and, in the event of an interruption, the recovery of all material business functions needed to meet Vendor’s contractual obligations to Customer.
2. Business Continuity Plan (which includes a Disaster Recovery (IT) Plan) - Vendor shall develop, implement, maintain, and exercise a written Business Continuity Plan (the "Plan").
3. Delivery of the Plan - Upon request from Customer and within 30 days, Vendor shall provide review to Customer of Vendor’s then-current official company Plan.
4. Content - The Plan must, at a minimum, describe the actions and resources required to provide for the continuous operation, and in the event of any interruption, the recovery of Vendor’s contractual obligations to Customer under all agreements, including statements of work and engagement letters. Resources are defined as including, but not limited to, all people and facility resources and required systems, hardware, software and data. The recovery of systems, hardware, software and data must be within a Recovery Time Objective (RTO) sufficient to sustain contracted levels of service. Included as part of the required data, Vendor must provide Recovery Point Objective (RPO).
5. Updates - Vendor shall update and re-publish the Plan whenever there is a significant or material change in Vendor’s systems, recovery strategies, recovery resources, actions described in the Plan or other data affecting Vendor’s contractual obligations to Customer under all agreements, including statements of work and engagement letters, but no less frequently than at least once in every 12-month period.
6. Exercises - Vendor shall exercise the Plan no less than annually and provide review to Customer of the exercise results.

X.              Incident Reporting

1. In the event of a confirmed or suspected breach of Customer Confidential Data, Vendor shall notify Customer Information Security as soon as possible and within 72 hours of discovery. This notification is in addition to, but can be coordinated with, any other contractual reporting requirements.

SCHEDULE 3

STANDARD CONTRACTUAL CLAUSES

I. Incorporation of SCCs

With respect to transfers of Personal Data across national borders to other countries that have not been recognized under the applicable Data Protection Legislation as an Adequate Jurisdiction, the Parties hereby agree to be bound by, where applicable:

1. For transfers of Personal Data from the EEA to a Non-Adequate Jurisdiction and for transfers of Personal Data from Brazil, Israel, Japan, Mexico, the Philippines, Singapore, and South Korea (“Applicable Data Transfer Jurisdiction”) to a Non-Adequate Jurisdiction, the Controller to Processor SCCs are deemed incorporated into this DPA in their entirety and without alteration, except as noted below. To the extent that the data importer is subject to the extra-territorial scope of Article 3(2) of the GDPR with respect to the specific processing, the obligations imposed to the data importer by the GDPR shall prevail over its obligations under the SCCs, where the latter are less strict. For reference, the official SCCs are available at the following link:https://eurlex.europa.eu/eli/dec_impl/2021/914/oj?uri=CELEX:32021D0914&locale=en or any subsequent link published by the European Union Publications Office;
   
   
2. For transfers of Personal Data from the UK to a non-Adequate Jurisdiction, the UK Controller-to-Processor SCCs are deemed incorporated into this DPA in their entirety and without alteration, except as noted below. For reference, the UK Controller-to-Processor Standard Contractual Clauses are available at the following link: https://ico.org.uk/media/for-organisations/documents/2620100/uk-sccs-c-p-202107.docx or any subsequent link published by the UK Information Commissioner’s Office.

The parties’ signature to this DPA shall be considered as a signature for the Standard Contractual Clauses.

i. Annex I.C under Clause 13 of the SCCs:

The competent supervisory authority is the Federal Data Protection and Information Commissioner (“FDPIC”);

ii. Clause 17 of the SCCs:

The law governing the Standard Contractual Clauses is Swiss law;

iii. The use of the term ‘EU Member State’ in the SCCs must not be interpreted in such a way as to exclude data subjects in Switzerland from the possibility of suing for their rights in their place of habitual residence (Switzerland) in accordance with Clause 18 of the SCCs;

iv. References to the GDPR in the SCCs are to be understood as references to the FADP; and

v. The SCCs also protect the data of legal entities until the entry into force of the revised FADP (scheduled to come into force in the second half of 2022).

1. Annex I.C under Clause 13 of the SCCs: The competent supervisory authorities are the FDPIC, insofar as the transfers of Personal Data are governed by the FADP, and the EEA competent supervisory authority as indicated in Annex I.C of the SCCs, insofar as the transfers of Personal Data are governed by the GDPR;
   
   
2. the use of the term ‘EU Member State’ in the SCCs must not be interpreted in such a way as to exclude data subjects in Switzerland from the possibility of suing for their rights in their place of habitual residence (Switzerland) in accordance with Clause 18 of the SCCs; and
   
   
3. the SCCs also protect the data of legal entities until the entry into force of the revised FADP (scheduled to come into force in the second half of 2022).

When a data exporter processes Personal Data from the UK to a non-Adequate Jurisdiction and the data exporter acts as a Controller and the data importer processes Personal Data in its capacity as a Processor, the UK Controller-to-Processor SCCs apply. With respect to the UK Controller-to-Processor SCCs, the Parties hereby further agree that the details of the processing and the description of the technical and organizational security measures are set forth in Schedule 1 of this DPA (Details of Processing) and Schedule B (Technical and Organizational measures) of this DPA.