Data Processing Addendum

Version: October 1, 2026

1. Scope and Incorporation. This Data Processing Addendum ("DPA") forms part of the Cuspo Terms of Service ("Terms") between Cuspo LLC ("Cuspo") and the U.S. dental practice or dental-practice business entity that accepts the Terms ("Customer"). It governs Cuspo's processing of Customer Data on Customer's behalf in providing the Services. Capitalized terms not defined in this DPA have the meanings given in the Terms.

2. Roles and Instructions. Customer determines the purposes for which it uses the Services and remains the dental-practice operator, employer, and records custodian. Cuspo processes Customer Data only to provide, secure, support, maintain, and administer the Services for Customer; comply with Customer's documented instructions consistent with the Terms; prevent or address security or misuse; and comply with applicable law. Customer instructs Cuspo to process Customer Data for those purposes.

3. Customer Data. Customer Data may include practice identity and account data; employee roster and training information; sterilization, equipment, safety, waste, chemical, document, readiness, and other compliance records; generated documents and input snapshots; confidential employee records such as hepatitis B vaccination or declination status and post-exposure follow-up information; sharps-injury-log information; uploaded files and images; and other content Customer submits through supported features. Customer must not intentionally submit Prohibited Patient Data as defined in the Terms.

4. Customer Responsibilities. Customer represents that it has the rights, permissions, and legal authority necessary to provide Customer Data to Cuspo and instruct the processing described in this DPA. Customer is responsible for the lawfulness, accuracy, and appropriateness of Customer Data; for determining who may use the shared practice credential and any feature-specific access gate; for its workforce notices, policies, consents, and authorizations; and for legal requirements applicable to Customer as employer, dental practice, and records custodian.

5. Confidentiality. Cuspo will restrict access to Customer Data to personnel and service providers who need access for the purposes permitted by this DPA and who are subject to confidentiality obligations appropriate to the information. Cuspo will not sell Customer Data or use it for cross-context behavioral advertising or independent marketing.

6. Security. Cuspo will maintain reasonable administrative and technical safeguards appropriate to the nature of the current Services and Customer Data. Current controls include per-practice row-level database security, one-time-code authentication, rate limiting, restricted production access, feature-specific access controls, and audit logging where the applicable feature provides it. Customer acknowledges that the practice account uses a shared credential rather than per-person application accounts and remains responsible for controlling and protecting that credential, Customer-controlled devices, email accounts, and networks.

7. Security Incidents. If Cuspo confirms unauthorized access to, acquisition of, use of, or disclosure of Customer Data that materially compromises the confidentiality, integrity, or availability of Customer Data (a "Security Incident"), Cuspo will notify Customer without unreasonable delay and provide information reasonably available to Cuspo that Customer needs to evaluate and respond to the Security Incident. Cuspo will take reasonable steps to contain, investigate, and remediate a confirmed Security Incident and will cooperate with Customer's reasonable requests relating to notifications or response duties required by applicable law. Unsuccessful attempts or activity that does not compromise Customer Data are not Security Incidents for purposes of this Section.

8. Prohibited Patient Data. Structured application fields are not designed to accept patient-identifiable information, but unstructured uploads, confidential-drawer attachments, mobile-capture images, and ordinary support email are not content-inspected for patient information. If Customer discovers that Prohibited Patient Data was submitted, Customer must notify Cuspo promptly and identify the affected item sufficiently for removal. On Customer's report, Cuspo will remove the identified item from active storage and void associated application metadata within five business days, subject to legal preservation requirements, and will confirm completion to Customer. If Cuspo independently discovers Prohibited Patient Data, Cuspo will notify Customer and remove the identified item from active storage as soon as reasonably practicable, subject to legal preservation requirements. The current Services are not intentionally offered as a PHI-processing service; any later intentionally supported PHI-bearing service requires a separate written launch decision and any Business Associate Agreement required by law before activation.

9. Subprocessors. Customer generally authorizes Cuspo to use subprocessors and service providers reasonably necessary to operate the Services. As of the effective date of this DPA, the current provider set is: Supabase for database, authentication, and file storage; Vercel for application hosting and Vercel Analytics; Stripe for subscription billing; Resend for authentication and reminder email; Upstash for rate-limit counters; and Google Workspace for the hello@cuspo.com support mailbox. Cuspo will impose data-protection obligations appropriate to the provider's function and applicable law and will update material subprocessor disclosures as the provider set changes.

10. Requests and Assistance. If Cuspo receives from an individual a request concerning Customer Data that Cuspo processes on Customer's behalf, Cuspo may refer the requester to Customer and will not independently determine the request except as required by law. Taking into account the nature of the processing and information available to Cuspo, Cuspo will provide reasonable assistance Customer needs to respond to legally required access, correction, deletion, restriction, or similar requests relating to Customer Data.

11. California Privacy Terms. To the extent the California Consumer Privacy Act ("CCPA") applies to Customer Data disclosed by a Customer that is a CCPA business and Cuspo acts as a service provider or contractor, the specific business purposes for processing are hosting, authentication, file storage, compliance-record creation and maintenance, document generation, training and readiness functionality, export, support, communications, security, troubleshooting, and subscription administration. Cuspo will not sell or share that personal information; retain, use, or disclose it outside those specified purposes or as otherwise permitted by the CCPA; or combine it with personal information received from another person or collected from Cuspo's own interaction with a consumer except as permitted by the CCPA. Cuspo will comply with applicable CCPA contract restrictions, provide reasonable assistance with Customer's CCPA obligations relating to the processing, and notify Customer if Cuspo determines it can no longer meet an applicable CCPA obligation. Customer may take reasonable and appropriate steps to help ensure that Cuspo uses the personal information consistently with Customer's CCPA obligations and, after notice to Cuspo, to stop and remediate any unauthorized use of that personal information.

12. Export. On a verified written request from Customer, Cuspo will provide a complete export of Customer Data within thirty days in a reasonably usable format using the export functions and support procedures then available. Feature-specific exports may remain available during the subscription. A billing lapse does not block Customer from reading or exporting retained records.

13. Retention and Deletion. During an active account, compliance records are maintained on an append-only basis so corrections void or supersede prior entries rather than silently overwriting history. After account closure, Cuspo generally retains Customer Data for at least twelve months, but any Customer Data subject to a longer legal, regulatory, contractual, dispute-preservation, or Customer-instruction retention period, including applicable OSHA retention requirements for employee medical, training, and other workplace-safety records, will be retained for the longer applicable period. Customer may request earlier deletion, but Cuspo will honor the request only to the extent deletion is legally and contractually permitted. Customer Data remaining in protected backups may persist until overwritten through ordinary backup cycles and will not be restored except for continuity, security, recovery, or legal purposes.

14. Legal Requests. Cuspo may disclose Customer Data to the extent required by law, subpoena, court order, or other valid governmental process. Where legally permitted and reasonably practicable, Cuspo will notify Customer before disclosure so Customer may seek protective treatment.

15. Audit and Compliance Information. On reasonable written request, Cuspo will provide Customer with information reasonably necessary to demonstrate compliance with this DPA and will respond to reasonable security or privacy diligence questions relating to the Services. Any audit or inspection right required by applicable law will be exercised in a manner that protects other customers, Cuspo confidential information, and service security and minimizes unnecessary disruption.

16. Order of Precedence. If this DPA conflicts with the Terms regarding Cuspo's processing of Customer Data on Customer's behalf, this DPA controls for that subject. A later written Business Associate Agreement, if one becomes applicable to a supported PHI-bearing service, controls solely as to PHI within its scope.

17. Term. This DPA begins when the Terms become effective and continues while Cuspo processes Customer Data on Customer's behalf, including during any legally required post-termination retention period. Provisions that by their nature govern retained data continue for as long as that data remains in Cuspo's possession or control.

18. Contact. Privacy and data-protection questions may be submitted through the support or privacy contact Cuspo publishes in the Services or on cuspo.com, or mailed to Cuspo LLC, 270 Montgomery Drive, Spartanburg, South Carolina 29302 United States.