Data Processing Agreement

1. Parties, scope and order of precedence

This Data Processing Agreement (DPA) is between the clinic that accepts it (the Customer, controller) and Cue ABA LLC (Cue, processor). It applies to Personal Data that Cue processes on the Customer's behalf in providing the Service under the Cue Terms of Service (the Terms), and is part of the Terms.

It applies to clinics outside the United States, and is designed to meet Article 28 of the EU General Data Protection Regulation 2016/679 (GDPR), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection (FADP), and other laws listed in section 13 (together, Data Protection Law).

If this DPA conflicts with the Terms, this DPA governs. If the Standard Contractual Clauses apply and conflict with this DPA, the Standard Contractual Clauses govern.

2. Definitions

Controller, Processor, Data Subject, Personal Data, Personal Data Breach, Processing, Special Categories of Personal Data and Supervisory Authority have the meanings in the GDPR, and the equivalent terms in other Data Protection Law. Sub-processor means another processor Cue engages to process Customer Personal Data. Standard Contractual Clauses (SCCs) means the clauses approved by European Commission Implementing Decision (EU) 2021/914.

3. Details of the processing

• Subject matter and duration: providing the Service for the term of the Terms, and until deletion under section 11.
• Nature and purpose: hosting, storing, organizing, displaying, transmitting, backing up, securing and supporting Customer data so the Customer can run its clinic: client records, scheduling, session data collection, treatment plans, documentation, billing, messaging, staff management and the other features of the Service.
• Data Subjects: the Customer's clients (including children), their parents, guardians and family members, and the Customer's staff, clinicians, contractors and other Authorized Users.
• Categories of Personal Data: identification and contact details; client demographics; scheduling, attendance and visit location data; staff credentials, pay and employment data; messages and documents; device, usage and audit-log data.
• Special Categories: data concerning health, including diagnoses, assessments, behavior and skill data, treatment plans and session notes. Cue applies the additional safeguards in Annex 1 to this data.
• Frequency: continuous, for as long as the Customer uses the Service.

4. Processing on instructions

Cue will process Customer Personal Data only on the Customer's documented instructions, including with regard to international transfers, unless Union or Member State law (or other applicable law) requires otherwise. In that case Cue will tell the Customer before processing unless the law prohibits it on important grounds of public interest. The Terms, this DPA, and the Customer's configuration and use of the Service are the Customer's complete instructions. Additional instructions must be agreed in writing.

Cue will tell the Customer immediately if, in its opinion, an instruction infringes Data Protection Law.

Cue will not sell Customer Personal Data, use it for its own purposes, or use health data to train artificial intelligence models.

5. Confidentiality of personnel

Cue will ensure that everyone authorized to process Customer Personal Data is bound by confidentiality obligations, is trained on data protection, and accesses it only as needed for their role.

6. Security

Cue will implement and maintain the technical and organizational measures in Annex 1, which are designed to provide a level of security appropriate to the risk as required by Article 32 GDPR. Cue may update these measures as long as the overall level of security does not decrease.

7. Sub-processors

The Customer gives Cue general authorization to engage Sub-processors. The current list, with each Sub-processor's purpose and processing location, is at app.cueaba.com/legal/subprocessors.

Cue will notify the Customer of any intended addition or replacement of a Sub-processor at least 30 days in advance by email to the account owner and in the Service. The Customer may object on reasonable data protection grounds within that period. The parties will then discuss it in good faith. If Cue cannot reasonably accommodate the objection, the Customer may terminate the affected Service and receive a refund of prepaid fees for the remaining period.

Cue will impose data protection obligations on each Sub-processor by written contract that are no less protective than this DPA, and remains fully liable to the Customer for its Sub-processors' performance.

8. Assisting the Customer

• Data Subject requests: the Service lets the Customer access, correct, export, restrict and delete Personal Data, and track data subject requests and their deadlines. If a Data Subject contacts Cue directly, Cue will forward the request to the Customer without undue delay and will not respond itself except on the Customer's instructions.
• Impact assessments and consultation: Cue will provide reasonable information and assistance for the Customer's data protection impact assessments and prior consultations with Supervisory Authorities, taking into account the nature of the processing and the information available to Cue.
• Authorities: Cue will tell the Customer about any request from a public authority for Customer Personal Data unless the law prohibits it, will challenge requests it considers unlawful, and will disclose only the minimum required.

9. Personal Data Breaches

Cue will notify the Customer without undue delay, and in any case within 48 hours, after becoming aware of a Personal Data Breach affecting Customer Personal Data, so the Customer can meet its 72-hour notification obligation under Article 33 GDPR. The notice will describe, to the extent known, the nature of the breach, the categories and approximate number of Data Subjects and records concerned, the likely consequences, and the measures taken or proposed. Cue will provide more information as it becomes available, take reasonable steps to contain and remediate the breach, and assist the Customer with notifications to authorities and Data Subjects.

Cue's notice is not an admission of fault. The Customer can reach Cue's security team at security@cueaba.com.

10. Information and audits

Cue will make available to the Customer all information necessary to demonstrate compliance with Article 28 GDPR, including its security documentation and any third-party audit reports or certifications it holds, under confidentiality.

If that information is not sufficient, or a Supervisory Authority requires it, the Customer may audit Cue's compliance, itself or through an independent auditor bound by confidentiality, once a year with at least 30 days' written notice, during business hours and without unreasonably disrupting Cue's operations. Each party bears its own costs, unless the audit reveals a material breach by Cue.

11. Return and deletion

When the Terms end, the Customer may export its data for 60 days. Cue will then delete Customer Personal Data from active systems within 30 days and from backups on their normal rotation, within 90 days, and confirm deletion in writing on request, unless Union or Member State law (or other applicable law) requires Cue to keep it. Cue will protect any data it must keep under this DPA and process it only for the purpose that requires keeping it.

12. Location of processing and international transfers

Clinics on Cue's European platform (eu.cueaba.com) have their clinical database, file storage and application servers in Frankfurt, Germany (European Union). Clinics on app.cueaba.com are hosted in the United States.

Some processing may take place outside the EEA, the UK or Switzerland: support and engineering access by Cue, which is established in the United States, and the Sub-processors listed at app.cueaba.com/legal/subprocessors. Cue will transfer Customer Personal Data to a country without an adequacy decision only with appropriate safeguards under Chapter V GDPR, and will carry out and keep up to date a transfer impact assessment.

Where a transfer relies on an adequacy decision, including the EU-US Data Privacy Framework for certified recipients, that decision applies. Otherwise, the SCCs are incorporated into this DPA by reference and apply as follows:

• Module Two (controller to processor) applies between the Customer as data exporter and Cue as data importer. Module Three (processor to processor) applies where the Customer is itself a processor.
• Clause 7 (docking clause) does not apply. Under Clause 9, option 2 (general written authorization) applies, with the 30-day notice in section 7 of this DPA. The optional language in Clause 11 does not apply.
• Under Clause 13, the competent Supervisory Authority is the one for the Customer's establishment, or as the SCCs otherwise provide. Clauses 17 and 18: the SCCs are governed by the law of Ireland, and disputes under them are resolved by the courts of Ireland.
• Annex I of the SCCs is completed by section 3 of this DPA, with the Customer as exporter and Cue as importer. Annex II is completed by Annex 1 of this DPA. Annex III is the sub-processor list.
• United Kingdom: the International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner (version B1.0) applies, with Table 1 completed with the parties' details, Table 2 with the modules above, Table 3 with this DPA, and in Table 4 neither party may end the Addendum when it changes.
• Switzerland: the SCCs apply with the FADP as the governing data protection law for transfers subject to it. The Swiss Federal Data Protection and Information Commissioner is the competent authority for those transfers, and references to Member States include Switzerland so Data Subjects there may sue where they habitually reside.

13. Other countries

For clinics outside the EU, EEA, UK and Switzerland, this DPA applies with the terms of the local law that correspond to those in the GDPR. This includes the Brazilian LGPD; Canada's PIPEDA, Quebec's Law 25 and provincial health privacy laws; Mexico's federal personal data law; Colombia's Law 1581 of 2012; the Australian Privacy Act 1988; the UAE Personal Data Protection Law; and China's Personal Information Protection Law. Where a local law requires specific transfer terms or a filing, the parties will cooperate in good faith to provide them.

14. Liability and term

Each party's liability under this DPA is subject to the limitation of liability in the Terms, except where Data Protection Law or the SCCs do not permit it to be limited, including liability to Data Subjects under the SCCs.

This DPA lasts as long as Cue processes Customer Personal Data. Obligations that by their nature continue survive termination.

Privacy questions and requests under this DPA go to privacy@cueaba.com.

15. Annex 1: Technical and organizational measures

• Encryption: TLS 1.2 or higher in transit; AES-256 encryption at rest for databases, file storage and backups; additional application-level encryption for tax identifiers and other high-risk fields.
• Tenant isolation: every clinic's data is separated by organization, enforced by database row-level security policies and by triggers that stop one client's records being linked to another's.
• Access control: role-based permissions inside each clinic; least-privilege, logged and time-limited access by Cue personnel, only for support, security or as instructed; passkey sign-in and SAML single sign-on; short-lived access tokens.
• Logging: a tamper-evident audit log of access to and changes in clinical records, kept according to the Customer's retention settings.
• Availability: automated daily backups, point-in-time recovery, off-site backup copies and tested restore procedures.
• Data residency: the European platform keeps its clinical database and application servers in the EU (Frankfurt) and is separate from the US platform.
• Secure development: code review, automated tests for access-control and privacy rules, dependency monitoring, and separation of development and production environments.
• Organizational measures: confidentiality agreements, privacy and security training, a documented incident-response process, vendor due diligence, and data minimization in support work.
• Data subject rights and consent: tools to record consent, track data subject requests and their deadlines, and export or delete individual records.