DentalX Back to home

BAA Schedule A: State health-data processor terms

BAA-US-SCH-A · Draft of October 6, 2026 · revision 1 · version 1.0

Part of Business Associate Agreement and Health Data Processing Addendum

Final draft for counsel's review. It is not in effect, and no clinic has accepted it. Items still to be confirmed are highlighted in the text.

This is the controlling text.

SHA-256 of this text: 037dd9224f62cd9c47f2b231ebf165d2c721efe43ef9ad8a958b75ecf5ee871a

Schedule A — State health-data processor terms

Applies to:

  • (i) every Clinic, for Health Data that is not PHI; and
  • (ii) any Clinic that is not a Covered Entity.

It implements, as they apply:

  • the Washington My Health My Data Act (RCW 19.373.060);
  • Nevada's consumer health data law (NRS Chapter 603A, as amended by SB 370 (2023)) [[TO CONFIRM: NRS section numbers]];
  • the Connecticut Data Privacy Act (Conn. Gen. Stat. § 42-521); and
  • for personal information that is not PHI, the California Consumer Privacy Act regulations on service-provider contracts (Cal. Code Regs. tit. 11, § 7051).

A.1 Instructions. VstreamX processes Health Data only under this Agreement and the Terms, which set out the processing instructions, the nature and purpose of the processing, the types of data, the duration, and the rights and obligations of both Parties.

A.2 Own-purpose processing. If VstreamX processes Health Data outside the scope of this Agreement, it is treated as a regulated entity or controller for that processing, with the liability that follows.

A.3 Assistance. VstreamX assists the Clinic, by appropriate technical and organisational measures where possible, to fulfil its obligations, including:

  • responding to consumers' requests;
  • security; and
  • breach notification.

A.4 Confidentiality. Each person processing Health Data for VstreamX is subject to a duty of confidentiality.

A.5 Deletion. At the Clinic's direction, VstreamX deletes or returns Health Data, as section 5.4 provides. A deletion reaches backups within 6 months. DentalX's backups expire within 7 days.

A.6 Subcontractors. VstreamX engages a Subcontractor only under a written contract that requires it to meet VstreamX's obligations under this Schedule. It gives the Clinic an opportunity to object, as section 3.7 provides.

A.7 Compliance information and assessments. VstreamX makes available all information in its possession necessary to demonstrate its compliance. It allows, and cooperates with, reasonable assessments by the Clinic or its designated assessor, or provides an independent assessment report.

A.8 CCPA service-provider terms (non-PHI personal information). VstreamX:

  • (a) does not sell or share the personal information;
  • (b) processes it only for the business purposes specified in the Terms (providing, securing and supporting DentalX);
  • (c) does not retain, use or disclose it for any other purpose, including any commercial purpose, or outside the direct business relationship with the Clinic;
  • (d) does not combine it with personal information it receives from or on behalf of others, except as the regulations permit;
  • (e) complies with the CCPA and provides the same level of privacy protection the CCPA requires;
  • (f) grants the Clinic the right to take reasonable and appropriate steps to ensure that VstreamX uses the information consistently with the Clinic's obligations, and to stop and remediate unauthorised use;
  • (g) notifies the Clinic if it can no longer meet its obligations; and
  • (h) flows these terms down to its Subcontractors.