Blueclone Networks DPA

Effective: November 2024 | Last Revised: September 2026

 

This Data Processing Agreement is incorporated into the applicable agreement between Blueclone Networks, LLC and Client when Blueclone Processes Client Personal Data on Client’s behalf.

1. PURPOSE, SCOPE, AND APPLICATION

1.1 Incorporated Agreement. This Data Processing Agreement (the “DPA”) is entered into between Blueclone Networks, LLC (“Blueclone,” “Provider,” “we,” “us,” or “our”) and the client identified in an applicable quotation, proposal, service order, statement of work, work order, or other accepted ordering document (“Client,” “you,” or “your”). This DPA forms part of the agreement between the Parties that incorporates it, including the applicable Master Services Agreement, Requested Services document, Service Guide, and service attachments (collectively, the “Agreement”).

1.2 Scope. This DPA applies only to the extent Blueclone Processes Client Personal Data on Client’s behalf in connection with the Services. The regulated-data modules in Section 12 apply only when the applicable law, data type, and Blueclone role are identified in the applicable Requested Services document or other writing accepted by both Parties. Blueclone does not accept obligations applicable to a regulated data type that Client has not disclosed in writing.

1.3 Order of Precedence. If this DPA conflicts with the Agreement, this DPA controls solely with respect to the Processing and protection of Client Personal Data. A Business Associate Agreement, Standard Contractual Clauses, United Kingdom transfer addendum, or other mandatory statutory term controls solely to the extent required by applicable law. Commercial terms, fees, warranties, indemnities, and limitations of liability remain governed by the Agreement unless applicable law expressly prohibits that allocation.

1.4 No Expansion of Services. This DPA does not expand the Services, require Blueclone to access data it would not otherwise access, or obligate Blueclone to perform legal, compliance, audit, records-management, e-discovery, or data-subject-response services unless expressly included in a Requested Services document. Additional assistance may be billed at Blueclone’s then-current rates.

2. DEFINITIONS

2.1 Applicable Data Protection Law. “Applicable Data Protection Law” means a privacy, data-protection, data-security, breach-notification, or regulated-data law that applies to Blueclone’s Processing of Client Personal Data in its role under the Agreement. It does not include a law applicable only to Client, Client’s industry, or Client’s use of the Services unless the Parties expressly identify that law in writing.

2.2 Client Personal Data. “Client Personal Data” means Personal Data contained in Client Data that Blueclone Processes on Client’s behalf to provide the Services. Client Personal Data excludes data for which Blueclone independently determines the purposes and means of Processing, including business contact, billing, account-administration, service-analytics, security, fraud-prevention, and legal-compliance data, which Blueclone will Process as an independent controller or business in accordance with applicable law.

2.3 Personal Data and Processing. “Personal Data” means information relating or reasonably linkable to an identified or identifiable natural person, household, or other protected unit, as defined by Applicable Data Protection Law. “Process,” “Processed,” and “Processing” mean any operation performed on Personal Data, including collection, access, use, storage, transmission, disclosure, alteration, retrieval, analysis, restriction, deletion, or destruction.

2.4 Roles. “Controller” includes a controller, business, covered entity, financial institution, or other person that determines the purposes and means of Processing. “Processor” includes a processor, service provider, contractor, business associate, qualified service organization, or similar person that Processes Personal Data on behalf of another person. The Parties’ statutory roles are determined by Applicable Data Protection Law and the actual Processing, not merely by these labels.

2.5 Security Incident. “Security Incident” means a confirmed unauthorized acquisition of, access to, use of, disclosure of, alteration of, or destruction of Client Personal Data in Blueclone’s possession or control that requires notice under Applicable Data Protection Law. Security Incident does not include unsuccessful attempts or activities that do not compromise Client Personal Data, such as pings, port scans, blocked attacks, failed login attempts, or denial-of-service attempts.

2.6 Subprocessor. “Subprocessor” means a third party engaged by Blueclone to Process Client Personal Data on Client’s behalf. It does not include Client-directed third parties, telecommunications carriers, or a third party with which Client contracts directly.

3. PROCESSING INSTRUCTIONS AND DETAILS

3.1 Documented Instructions. Blueclone will Process Client Personal Data only to provide, secure, support, administer, improve, and bill for the Services; to comply with the Agreement and Client’s documented lawful instructions; or as required by law. The Agreement and Client’s authorized use and configuration of the Services constitute Client’s documented instructions. Blueclone will notify Client before Processing required by law unless legally prohibited.

3.2 Processing Details. The subject matter, duration, nature, purpose, data categories, and categories of individuals are described in Schedule 1 and the applicable Requested Services document. If Client provides Personal Data outside the agreed scope, Client remains responsible for that decision and any resulting requirements or costs.

3.3 Unlawful Instructions. Blueclone may suspend the affected Processing and will notify Client if Blueclone reasonably believes an instruction violates Applicable Data Protection Law, the Agreement, a third-party provider restriction, or creates a material security risk. Blueclone is not required to provide legal advice or independently determine which laws apply to Client.

3.4 Confidentiality. Blueclone will ensure that personnel authorized to Process Client Personal Data are subject to contractual, professional, or statutory confidentiality obligations and receive training appropriate to their responsibilities.

3.5 No Sale or Unrelated Advertising Use. Blueclone will not sell Client Personal Data or share it for cross-context behavioral advertising, targeted advertising, or another party’s independent marketing, except that disclosures to authorized Subprocessors and Third-Party Service Providers necessary to provide the Services are not a sale or advertising use. Blueclone will not retain, use, or disclose Client Personal Data outside the direct business relationship with Client except as permitted by the Agreement or required by law.

3.6 Remote Access and Processing Locations. Client Personal Data may be remotely accessed, transmitted, stored, or otherwise Processed from the locations used by Blueclone and authorized Subprocessors. Client must identify any geographic, sovereignty, localization, export-control, or remote-access restriction before Processing begins. Blueclone will apply an approved transfer mechanism where Applicable Data Protection Law requires one, but does not accept an undisclosed location restriction.

4. SECURITY MEASURES

4.1 Safeguards. Taking into account the nature and scope of the Processing, the state of the art, implementation costs, and risks to individuals, Blueclone will maintain reasonable administrative, technical, and physical safeguards designed to protect the confidentiality, integrity, and availability of Client Personal Data. The categories of safeguards are described in Schedule 2.

4.2 Service-Dependent Controls. Specific controls may vary by Service, Client environment, selected Third-Party Service Provider, configuration, risk, and Requested Services document. No control, certification, framework, audit report, or security outcome is promised unless expressly stated in a Requested Services document.

4.3 Client Environment. Client is responsible for security and compliance obligations allocated to Client under the Agreement, including authorized users, endpoint and physical security, data classification, lawful collection, access approvals, backup requirements outside scope, and implementing Blueclone’s reasonable security recommendations.

5. SECURITY INCIDENTS

5.1 Notice. Blueclone will notify Client without undue delay after confirming a Security Incident and, where a specific deadline applies to Blueclone as Processor, within the legally required period. For a confirmed incident involving Protected Health Information or Part 2 Records, the applicable module in Section 12 controls. Notice is not an admission of fault or liability.

5.2 Information and Cooperation. To the extent reasonably available, notice will describe the nature of the Security Incident, affected data and individuals, likely consequences, measures taken or proposed, and a contact for follow-up. Information may be provided in phases as the investigation develops. Blueclone will take reasonable steps to contain, investigate, mitigate, and remediate a Security Incident within its responsibility.

5.3 Client Notices. Client is responsible for determining whether notice to individuals, regulators, customers, insurers, or others is required and for issuing such notice, unless Applicable Data Protection Law expressly assigns that duty to Blueclone. Blueclone will reasonably assist at Client’s expense, except to the extent the Security Incident was caused by Blueclone’s breach of this DPA.

6. SUBPROCESSORS AND THIRD-PARTY SERVICES

6.1 General Authorization. Client generally authorizes Blueclone to engage Subprocessors to provide the Services. Current Subprocessors and Third-Party Service Providers may be identified at https://www.blueclone.com/tc-3rdparty/, in the Service Guide, or in the applicable Requested Services document.

6.2 Subprocessor Obligations. Blueclone will impose written data-protection obligations on each Subprocessor that Processes Client Personal Data that are materially consistent with Blueclone’s applicable obligations under this DPA. Blueclone remains responsible for its Subprocessors to the extent required by Applicable Data Protection Law, subject to the Agreement.

6.3 Changes and Objections. Where Applicable Data Protection Law requires notice of a new Subprocessor, Blueclone may provide notice by updating its Third-Party Services page or by electronic notice. Client may submit a reasonable, documented objection based on data-protection grounds within fifteen (15) days. The Parties will work in good faith on a commercially reasonable resolution. An alternative Subprocessor, architecture, migration, configuration, control set, or service design may change functionality, timing, or recurring and non-recurring fees, which will be handled under the Agreement or a written change order. If no commercially reasonable resolution is available, Blueclone may terminate the affected Service and refund prepaid fees for the unused period; Client remains responsible for accrued charges and non-cancellable third-party commitments.

6.4 Client-Directed Providers. Blueclone is not responsible for the acts, omissions, security, availability, or data practices of a third party selected, contracted with, or directed by Client, except to the extent Blueclone caused the harm through its own breach of the Agreement.

7. INDIVIDUAL RIGHTS AND REGULATORY ASSISTANCE

7.1 Requests. Taking into account the nature of the Processing, Blueclone will provide reasonable assistance for Client to respond to a verified request by an individual to exercise rights under Applicable Data Protection Law. If Blueclone receives a request relating to Client Personal Data, Blueclone will, where reasonably able to identify the applicable Client, promptly forward the request or direct the requester to Client and will not substantively respond except on Client’s documented instruction or as required by law.

7.2 Compliance Assistance. Upon reasonable request, Blueclone will provide information reasonably necessary for Client to conduct a data-protection impact assessment, respond to a regulator, or document compliance relating to the Services. Assistance beyond standard documentation or included Services may be billed at Blueclone’s then-current rates.

8. AUDITS AND INFORMATION

8.1 Standard Information. Blueclone may satisfy a reasonable audit request by providing then-current security questionnaires, summaries, policies, certifications, or independent reports that Blueclone makes generally available and that are relevant to the Services. Such materials are Blueclone Confidential Information and may be subject to additional confidentiality restrictions.

8.2 Additional Audit. If standard information is insufficient to satisfy a legal requirement, Client may request one additional audit in any twelve-month period, unless a Security Incident or regulator requires more. The audit must be conducted during normal business hours, on reasonable advance notice, by an independent qualified auditor bound by confidentiality, and must avoid disruption, access to other customers’ information, penetration testing, and disclosure of privileged information. Client bears its audit costs and Blueclone’s reasonable assistance costs unless the audit identifies a material uncured breach by Blueclone.

9. RETURN, DELETION, AND RETENTION

9.1 End of Services. Upon termination of the applicable Services and Client’s written request, Blueclone will return or delete Client Personal Data in its possession or control, subject to the Agreement, technical feasibility, standard backup cycles, legal holds, and legal retention duties. Client must export or retrieve data during any applicable transition period.

9.2 Retained Data. Blueclone may retain Client Personal Data where required by law or reasonably necessary to establish, exercise, or defend legal claims, administer the Agreement, or maintain secure backups. Retained data remains protected by this DPA and will not be Processed for other purposes.

10. ARTIFICIAL INTELLIGENCE PROCESSING

10.1 AI Services. “AI Services” means software, functionality, hosted or embedded models, foundation models, frontier models, large language models, agents, copilots, automations, or other services using artificial intelligence, machine learning, or generative technologies. AI Services may be supplied by one or more Third-Party Service Providers.

10.2 Authorization and Instructions. Blueclone may Process or transmit Client Personal Data through an AI Service only when authorized by the applicable Requested Services document, Client’s enabled configuration, or another documented instruction. The AI provider is a Subprocessor when it Processes Client Personal Data on Client’s behalf.

10.3 Restricted Data. Client shall not submit Protected Health Information, Nonpublic Personal Information, payment-card data, credentials, government identifiers, privileged material, biometric data, export-controlled information, or other sensitive or regulated data to an AI Service unless the specific data type and use are expressly approved, supported by the provider, and covered by all required agreements and safeguards.

10.4 Provider Controls. Data retention, geographic location, deletion, human review, and use for provider model training or service improvement depend on the selected AI Service and its available enterprise controls. Blueclone will configure supported controls as stated in the applicable Requested Services document but does not warrant zero retention, exclusion from training, or a particular data location unless expressly agreed in writing.

10.5 Client Governance. Client remains responsible for lawful collection and use, required notices and consents, access controls, acceptable-use rules, human oversight, output review, and decisions made using AI outputs. AI outputs may be inaccurate, incomplete, biased, or unsuitable and must not be relied on as the sole basis for legal, medical, financial, employment, eligibility, or similarly consequential decisions.

11. CLIENT RESPONSIBILITIES

11.1 Lawful Basis, Transparency, and Up-Chain Requirements. Client represents that it has all rights, notices, consents, authorizations, and lawful bases necessary for Blueclone and its Subprocessors to Process Client Personal Data as contemplated by the Agreement. Before Processing begins, Client must disclose applicable privacy, security, localization, retention, audit, incident-reporting, deletion, and use restrictions imposed through Client’s customers, patients, members, business associates, prime contractors, subcontractors, insurers, licensors, government contracts, grants, supply chain, or other upstream or downstream relationships and provide relevant flow-down terms and deadlines. Blueclone is not bound by such a requirement unless it is expressly accepted in the Agreement or a signed addendum.

11.2 Data Minimization and Instructions. Client will limit Client Personal Data to what is reasonably necessary, provide accurate instructions, identify applicable regulated-data requirements before Processing begins, and not instruct Blueclone to violate law or third-party rights.

11.3 Sensitive and Regulated Data. Client will not provide sensitive or regulated data unless the applicable Requested Services document authorizes that data and the Parties have completed required documentation. Client is responsible for determining which laws apply to Client and its data.

12. CONDITIONAL REGULATED-DATA MODULES

12.1 HIPAA Business Associate Agreement. This Section 12.1 applies only if the applicable Requested Services document identifies HIPAA and Blueclone is acting as Client’s “Business Associate.” In that event, Client is the “Covered Entity” or upstream Business Associate, and the terms below constitute the Parties’ Business Associate Agreement. Capitalized HIPAA terms not defined here have the meanings in 45 C.F.R. Parts 160 and 164.

12.1.1 Permitted Uses and Disclosures. Blueclone may use and disclose Protected Health Information (“PHI”) only as necessary to perform the Services, as permitted by this DPA, for Blueclone’s proper management and administration or legal responsibilities where HIPAA permits, for Data Aggregation and de-identification where authorized, or as Required by Law. Blueclone will apply the minimum-necessary standard to the extent applicable and will not use or disclose PHI in a manner that would violate HIPAA if done by Client, except for uses expressly permitted to a Business Associate.

12.1.2 Safeguards and Reporting. Blueclone will implement safeguards required by the HIPAA Security Rule for Electronic PHI in its possession or control; mitigate harmful effects of an impermissible use or disclosure known to Blueclone; report to Client any impermissible use or disclosure and Security Incident as required by 45 C.F.R. § 164.314; and notify Client of a Breach of Unsecured PHI without unreasonable delay and no later than thirty (30) calendar days after discovery, with information required by 45 C.F.R. § 164.410 as it becomes available. The Parties acknowledge that routine unsuccessful security events need not be separately reported.

12.1.3 Subcontractors. Blueclone will require a subcontractor that creates, receives, maintains, or transmits PHI on Blueclone’s behalf to agree in writing to the restrictions, conditions, and safeguards applicable to Blueclone under this Section.

12.1.4 Individual Rights and HHS Access. To the extent applicable to the Services and within Blueclone’s control, Blueclone will make PHI available to Client for access under 45 C.F.R. § 164.524, amendment under § 164.526, and accounting under § 164.528, within a reasonable period that permits Client to meet its legal deadline. Blueclone will make relevant internal practices, books, and records available to the Secretary of HHS as required to determine HIPAA compliance.

12.1.5 Client Obligations. Client will notify Blueclone of limitations in Client’s notice of privacy practices, revocations of authorization, and agreed restrictions that affect Blueclone’s use or disclosure of PHI. Client will not request a use or disclosure that would violate HIPAA if done by Client, except where permitted for a Business Associate.

12.1.6 Termination and PHI. If either Party knows of a material violation of this Section by the other, it will provide an opportunity to cure where legally permitted. If cure is unsuccessful, the non-breaching Party may terminate the affected Services or report the violation to HHS if termination is infeasible. At termination, Blueclone will return or destroy PHI where feasible; if infeasible, Blueclone will extend the protections of this Section and limit further use and disclosure to the purpose making return or destruction infeasible.

12.2 42 C.F.R. Part 2 Qualified Service Organization. This Section 12.2 applies only if the applicable Requested Services document identifies records governed by 42 C.F.R. Part 2 (“Part 2 Records”) and Blueclone qualifies as a Qualified Service Organization. Blueclone acknowledges that it is fully bound by Part 2 in receiving, storing, processing, or otherwise dealing with Part 2 Records; will resist efforts to obtain access except as permitted by Part 2; will use and disclose Part 2 Records only to provide the Services or as Part 2 permits; will maintain appropriate safeguards; will require applicable subcontractors to accept equivalent restrictions; and will return or destroy Part 2 Records as required. If HIPAA also applies, the more protective applicable requirement controls.

12.3 Gramm-Leach-Bliley Act. This Section 12.3 applies only if the applicable Requested Services document identifies GLBA and Blueclone Processes Nonpublic Personal Information as a service provider to a regulated financial institution. Blueclone will maintain a written information-security program with administrative, technical, and physical safeguards reasonably designed to protect such information; use it only to provide the Services, administer the Agreement as legally permitted, or comply with law; notify Client of a qualifying security event as required by applicable law; and require applicable service providers to protect it. Client remains responsible for its obligations as the financial institution, including risk assessment, oversight, notices, and determining whether Blueclone’s Services satisfy Client’s regulatory requirements.

12.4 Controlled Unclassified Information. This Section 12.4 applies only if a Requested Services document expressly authorizes Blueclone to handle Controlled Unclassified Information (“CUI”) and identifies the applicable federal contract clause and required security standard. Blueclone has no obligation to receive or store CUI until the Parties agree in writing on scope, system boundary, required controls, incident reporting, assessment level, responsibility matrix, pricing, and permitted Subprocessors. Client shall not introduce classified information or export-controlled data without Blueclone’s prior written approval.

12.5 United States State Privacy, Security, and Breach Laws. This Section applies only to the extent an applicable Requested Services document or other writing identifies a state-law requirement and Blueclone’s role. Where Blueclone acts as a processor, service provider, or contractor under an applicable comprehensive U.S. state privacy law—including laws of California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, or Virginia—Blueclone will Process Client Personal Data only for the limited and specified purposes in the Agreement; comply with applicable restrictions on selling, sharing, targeted advertising, profiling, retaining, using, disclosing, and combining data; provide the level of privacy protection required of that role; notify Client if Blueclone can no longer comply; allow Client to take reasonable steps to stop and remediate unauthorized use; assist with verified consumer requests and required assessments; and bind applicable Subprocessors by written terms. To the extent laws such as the New York SHIELD Act, New Jersey data-security and breach-notification laws, Massachusetts 201 CMR 17.00, or another applicable state security or breach law directly govern Blueclone’s Processing, Blueclone will maintain safeguards and provide incident cooperation required of its role. The named laws are illustrative and include amendments, replacements, and additional state laws to the extent applicable; they do not expand Blueclone’s role or the Services.

12.6 European Economic Area and United Kingdom. This Section 12.6 applies only if the applicable Requested Services document identifies the EU GDPR, UK GDPR, or Swiss data-protection law. Client is the Controller and Blueclone is the Processor unless otherwise stated. Blueclone will comply with applicable processor obligations under Article 28, including documented instructions, confidentiality, Article 32 security, Subprocessor controls, assistance with data-subject rights, breach notification, impact assessments, deletion or return, compliance information, and notice of an unlawful instruction.

12.6.1 Restricted Transfers. For a transfer of Personal Data subject to the EU GDPR to a country lacking an adequacy decision, the then-current European Commission Standard Contractual Clauses are incorporated by reference using Module Two (Controller to Processor), or Module Three if Client is a Processor, with the docking clause included, optional general Subprocessor authorization selected, supervisory authority and governing law determined under the Clauses, and the processing details and safeguards supplied by Schedules 1 and 2 and the applicable Requested Services document. For UK restricted transfers, the then-current UK International Data Transfer Addendum applies to the EU Clauses. The Parties will reasonably cooperate to complete required annexes and transfer-impact assessments. Mandatory transfer terms prevail over conflicting terms of the Agreement.

13. LIABILITY AND ALLOCATION OF RISK

13.1 Agreement Controls. To the maximum extent permitted by law, each Party’s liability arising from this DPA is subject to the exclusions, limitations, indemnities, procedures, and liability cap in the Agreement. Nothing in this DPA limits liability to the extent it cannot lawfully be limited.

13.2 Responsibility for Compliance. Each Party is responsible for its own compliance with Applicable Data Protection Law in its role. Blueclone is not responsible for Client’s business practices, data collection, legal notices, consents, independent use of Client Personal Data, or failure to follow security recommendations.

14. TERM, TERMINATION, AND UPDATES

14.1 Term and Survival. This DPA begins when incorporated into the Agreement and continues while Blueclone Processes Client Personal Data. Provisions that by their nature should survive—including confidentiality, retained-data protection, audit restrictions, liability, and regulated-data duties—survive termination.

14.2 Updates. Blueclone may update this online DPA on the notice and change-control terms stated in the applicable MSA. A change required by law, regulator, court, or transfer mechanism may take effect on shorter notice when reasonably necessary. No update retroactively reduces protection for Client Personal Data already Processed or changes a specifically negotiated signed term without written agreement.

15. GENERAL

15.1 Entire Data-Processing Terms. This DPA and incorporated mandatory transfer terms are the complete agreement concerning Blueclone’s Processing of Client Personal Data and supersede prior data-processing terms on that subject. Except as modified here, the Agreement remains in effect.

15.2 Interpretation. References to laws include amendments, replacements, and implementing regulations. “Including” means “including without limitation.” If a provision is unenforceable, it will be reformed to the minimum extent necessary and the remainder will remain effective. No third party has rights under this DPA except where mandatory law or incorporated Standard Contractual Clauses provide otherwise.

SCHEDULE 1 — PROCESSING DETAILS

A. Subject Matter and Purpose. Provision, support, security, administration, monitoring, maintenance, integration, backup, consulting, project, and related technology services described in the applicable Requested Services document.

B. Duration. For the term of the applicable Services, plus transition, backup-cycle, legal-retention, and dispute periods permitted by the Agreement and law.

C. Nature of Processing. Collection, access, hosting, storage, organization, retrieval, transmission, support, troubleshooting, monitoring, security analysis, backup, restoration, deletion, and other operations necessary to provide the Services.

D. Categories of Individuals. Client personnel, applicants, contractors, customers, patients, members, consumers, vendors, business contacts, and other individuals whose Personal Data Client places within the Services.

E. Categories of Personal Data. Business contact and identity data; account and authentication data; device, network, log, and security telemetry; communications and content; support records; financial or transaction-related data; and other data described in the applicable Requested Services document.

F. Sensitive Data. Sensitive or regulated data is permitted only when expressly identified and authorized in the applicable Requested Services document, including PHI, Part 2 Records, Nonpublic Personal Information, CUI, government identifiers, financial account data, biometric data, precise location, or data concerning health, race, ethnicity, religion, sex life, sexual orientation, or criminal history.

G. Frequency. Continuous, recurring, periodic, or event-driven, as necessary to provide the Services.

SCHEDULE 2 — CATEGORIES OF TECHNICAL AND ORGANIZATIONAL MEASURES

A. Governance and Personnel. Documented security responsibilities; confidentiality commitments; security awareness; role-appropriate training; and workforce access procedures.

B. Access Control. Identity and access management; least-privilege and role-based access where supported; authentication controls; privileged-access restrictions; and timely access removal.

C. System and Network Security. Endpoint, email, network, cloud, and remote-access protections appropriate to the selected Services; secure configuration; vulnerability management; malware protection; logging; and monitoring.

D. Encryption and Transmission. Encryption in transit and at rest where supported and appropriate; secure remote access; and protected transfer methods for sensitive information.

E. Availability and Resilience. Backup, recovery, continuity, redundancy, or restoration measures to the extent included in the applicable Services; change management; and capacity or availability monitoring where applicable.

F. Incident Management. Documented escalation, investigation, containment, mitigation, recovery, evidence preservation, and notification processes.

G. Vendor Risk. Reasonable diligence appropriate to the service and risk; contractual privacy and security obligations; and management of Subprocessor changes.

H. Data Lifecycle. Data minimization, retention, return, deletion, and secure disposal measures appropriate to the Services and technical capabilities.

I. Testing and Improvement. Periodic evaluation of relevant safeguards through internal review, vulnerability scanning, testing, risk assessment, or independent assessment as appropriate to Blueclone’s environment and the Services. This Schedule describes categories of controls and does not represent that every control applies to every Service or Client system.

SCHEDULE 3 — SUBPROCESSOR NOTICE

A. Current Providers. Blueclone’s current Third-Party Service Providers and available provider terms are identified at https://www.blueclone.com/tc-3rdparty/ and may be further identified in the applicable Requested Services document.

B. Client Contact. Client is responsible for maintaining a current notice contact and monitoring notices issued under the Agreement. A Subprocessor objection must identify the provider, affected Service and data, applicable legal requirement, and reasonable grounds for the objection.