Legal

Data Processing Agreement

Last updated: February 12, 2026

This Data Processing Agreement ("DPA") forms part of the agreement between CyberCore Technologies ("Processor," "CyberCore," "we," or "us") and the customer entity identified in the applicable subscription agreement ("Controller," "Customer," or "you") for the provision of the CyberCore platform and services (the "Service").

This DPA sets out the terms under which CyberCore processes personal data on behalf of the Customer. This DPA also incorporates Business Associate Agreement ("BAA") provisions to address obligations under the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") and the Health Information Technology for Economic and Clinical Health Act ("HITECH Act").

This DPA applies to the extent that CyberCore processes personal data on behalf of the Customer in connection with the Service. In the event of any conflict between this DPA and the underlying subscription agreement, this DPA shall prevail with respect to data processing matters.

1. Definitions

  • "Personal Data" means any information relating to an identified or identifiable natural person that is processed by CyberCore in connection with the Service.
  • "Processing" means any operation or set of operations performed on Personal Data, including collection, recording, organization, structuring, storage, adaptation, retrieval, use, disclosure, or erasure.
  • "Data Subject" means the identified or identifiable natural person to whom the Personal Data relates.
  • "Sub-processor" means any third party engaged by CyberCore to process Personal Data on behalf of the Customer.
  • "Protected Health Information" (PHI) has the meaning given under HIPAA and refers to individually identifiable health information transmitted or maintained in any form or medium.
  • "Security Incident" means any confirmed unauthorized access to, or acquisition, use, or disclosure of, Personal Data or PHI.
  • "Applicable Data Protection Law" means all laws and regulations relating to data protection and privacy applicable to the processing of Personal Data under this DPA, including HIPAA, HITECH, GDPR, and applicable state privacy laws.

2. Scope & Roles

Under this DPA, the Customer acts as the Controller (or "Covered Entity" under HIPAA) determining the purposes and means of processing Personal Data, and CyberCore acts as the Processor (or "Business Associate" under HIPAA) processing Personal Data on behalf of the Customer.

CyberCore shall process Personal Data only in accordance with the Customer's documented instructions and shall not process Personal Data for any purpose other than providing the Service, unless required by applicable law.

3. Data Processing Details

Subject Matter

Provision of autonomous remote monitoring and management services for dental practice IT infrastructure.

Duration

For the term of the subscription agreement, plus any post-termination data retention period.

Nature & Purpose

System monitoring, performance analysis, threat detection, autonomous remediation, alerting, reporting, and compliance documentation.

Types of Personal Data

  • Account holder contact information (name, email, phone)
  • Account credentials (hashed)
  • IP addresses and device identifiers
  • System telemetry and performance data
  • Usage logs and audit trails

Categories of Data Subjects

  • Customer personnel (practice staff, administrators)
  • Authorized users of the Service

4. Obligations of the Processor

CyberCore shall:

  • Process Personal Data only on documented instructions from the Customer, unless required by applicable law.
  • Ensure that all personnel authorized to process Personal Data are bound by obligations of confidentiality.
  • Implement and maintain appropriate technical and organizational security measures as described in Section 8.
  • Not engage any Sub-processor without prior written authorization from the Customer (see Section 5).
  • Assist the Customer in fulfilling its obligations to respond to Data Subject requests (see Section 6).
  • Make available to the Customer all information necessary to demonstrate compliance with this DPA.
  • Immediately inform the Customer if, in CyberCore's opinion, an instruction infringes applicable data protection law.
  • At the Customer's choice, delete or return all Personal Data after the end of the provision of services, and delete existing copies unless storage is required by law.

5. Sub-processors

CyberCore may engage Sub-processors to assist in providing the Service. CyberCore shall:

  • Maintain a current list of Sub-processors and make it available to the Customer upon request.
  • Notify the Customer at least 30 days in advance before adding or replacing a Sub-processor.
  • Enter into written agreements with each Sub-processor imposing data protection obligations no less protective than those in this DPA.
  • Remain fully liable for the acts and omissions of its Sub-processors.

If the Customer objects to a new Sub-processor on reasonable data protection grounds, the parties shall work together in good faith to find a mutually acceptable solution. If no resolution is reached within 30 days, the Customer may terminate the affected portion of the Service without penalty.

6. Data Subject Rights

CyberCore shall, to the extent technically feasible and legally permitted, assist the Customer in responding to requests from Data Subjects exercising their rights under applicable data protection laws, including rights of:

  • Access to their Personal Data
  • Rectification of inaccurate data
  • Erasure ("right to be forgotten")
  • Restriction of processing
  • Data portability
  • Objection to processing

If CyberCore receives a Data Subject request directly, it will promptly redirect the request to the Customer and will not respond to the request without the Customer's prior authorization, unless required by law.

7. Data Transfers

CyberCore processes data primarily within the United States. To the extent that Personal Data is transferred to a jurisdiction that does not provide an adequate level of data protection, CyberCore shall ensure that appropriate safeguards are in place, including:

  • Standard Contractual Clauses (SCCs) as approved by the European Commission.
  • Binding Corporate Rules, where applicable.
  • Other legally recognized transfer mechanisms under applicable data protection law.

8. Security Measures

CyberCore shall implement and maintain appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:

  • Encryption: All data encrypted in transit (TLS 1.2+) and at rest (AES-256).
  • Access Control: Role-based access control (RBAC), multi-factor authentication (MFA), and principle of least privilege.
  • Network Security: Firewalls, intrusion detection/prevention systems, and network segmentation.
  • Monitoring & Logging: Comprehensive audit logging of all access to Personal Data with tamper-evident storage.
  • Vulnerability Management: Regular vulnerability scanning, penetration testing, and timely patch management.
  • Physical Security: Data center facilities with access controls, surveillance, and environmental protections.
  • Business Continuity: Regular backups, disaster recovery planning, and redundant infrastructure.
  • Employee Security: Background checks, security awareness training, and confidentiality agreements for all personnel.

For a comprehensive overview of our security practices, please see our Security & Compliance page.

9. Breach Notification

In the event of a Security Incident, CyberCore shall:

  • Notify the Customer without undue delay and no later than 48 hours after becoming aware of a confirmed Security Incident.
  • Provide the Customer with sufficient information to fulfill any obligation to report or inform Data Subjects of the incident, including:
    • Nature of the incident and categories of data affected
    • Likely consequences of the incident
    • Measures taken or proposed to address the incident
    • Contact point for further information
  • Take immediate steps to contain, investigate, and remediate the Security Incident.
  • Cooperate with the Customer and provide reasonable assistance in the Customer's investigation and response.
  • Maintain a detailed record of all Security Incidents.

HIPAA Breach Notification

To the extent a Security Incident constitutes a "Breach" as defined under HIPAA, CyberCore shall comply with the HIPAA Breach Notification Rule (45 CFR §§ 164.400-414), including notifying the Customer within 48 hours of discovery, which exceeds the HIPAA requirement of 60 days, reflecting our commitment to prompt disclosure.

10. HIPAA Business Associate Provisions

To the extent that CyberCore creates, receives, maintains, or transmits PHI on behalf of a Covered Entity Customer, this Section serves as a Business Associate Agreement under HIPAA. CyberCore agrees to:

  • Not use or disclose PHI other than as permitted or required by this DPA or as required by law.
  • Use appropriate safeguards to prevent use or disclosure of PHI other than as provided for by this DPA.
  • Report to the Customer any use or disclosure of PHI not provided for by this DPA.
  • Ensure that any agents or Sub-processors that create, receive, maintain, or transmit PHI agree to the same restrictions and conditions.
  • Make PHI available to the Customer as necessary to satisfy the Customer's obligations under the HIPAA Privacy Rule.
  • Make its internal practices, books, and records relating to PHI available to the Secretary of HHS for purposes of determining compliance.
  • Return or destroy all PHI received from, or created or received on behalf of, the Customer upon termination of the agreement.
  • Implement administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of electronic PHI (ePHI) in accordance with the HIPAA Security Rule.

11. Audit Rights

CyberCore shall make available to the Customer all information reasonably necessary to demonstrate compliance with this DPA and allow for and contribute to audits, including inspections, conducted by the Customer or an independent auditor mandated by the Customer.

  • Audits shall be conducted with reasonable advance notice (at least 30 days) and during normal business hours.
  • The Customer shall bear the costs of any audit, unless the audit reveals a material breach of this DPA by CyberCore.
  • CyberCore may satisfy audit requests by providing relevant certifications, audit reports (e.g., SOC 2 Type II), or other documentation demonstrating compliance.
  • Audit frequency shall be limited to once per 12-month period, unless a Security Incident or regulatory requirement necessitates an additional audit.

12. Term & Termination

This DPA shall remain in effect for the duration of the subscription agreement and shall automatically terminate upon the termination or expiration of the subscription agreement.

Upon termination of this DPA, CyberCore shall:

  • Cease all processing of Personal Data on behalf of the Customer.
  • At the Customer's election, return or securely delete all Personal Data within 30 days.
  • Provide written certification of deletion upon the Customer's request.
  • Retain Personal Data only to the extent required by applicable law, and solely for that purpose.

Obligations under this DPA that by their nature should survive termination (including confidentiality, security, and breach notification) shall continue to apply.

13. Liability

Each party's liability under this DPA shall be subject to the limitations of liability set forth in the underlying subscription agreement, except that such limitations shall not apply to breaches of HIPAA obligations or willful misconduct. Each party shall be liable for damages caused by processing that infringes applicable data protection law, in accordance with the liability provisions of those laws.

14. Contact

For questions about this DPA or to request a signed copy, please contact: