State Addenda

A. California Consumer Privacy Act: service-provider addendum

This Addendum is part of the agreement between Emba Digital Pty Ltd (ACN 683 319 486) of 14 Christmas Street, Northcote VIC 3070, Australia, trading as Daobook ("Daobook") and the clinic named in that agreement ("Clinic"), and applies where Clinic is a "business" under the California Consumer Privacy Act, Civ. Code 1798.100 et seq. ("CCPA"), and Daobook processes personal information of California residents on Clinic's behalf. Terms not defined here have the CCPA's meaning.

1. Scope and precedence. This Addendum covers personal information that Clinic's use of the Services causes Daobook to collect, receive or process on Clinic's behalf and that is not protected health information or medical information exempt from the CCPA under Civ. Code 1798.146. Protected health information is governed by the Business Associate Agreement between the parties, which prevails over this Addendum for that information.

2. Daobook is a service provider. Clinic discloses personal information to Daobook only for the business purposes in section 3, and Daobook processes it only as a service provider to Clinic.

3. Business purposes. Daobook processes personal information for these business purposes and no others: hosting and operating the practice-management services Clinic has subscribed to (appointments, client records, communications, invoicing and payments, forms, documents and reports); sending appointment, booking and service messages that Clinic directs; securing the Services, preventing fraud and abuse, and keeping the audit records the Services require; providing support Clinic requests; and backing up and restoring the Services.

4. Restrictions. Daobook shall not:

• (a) sell or share the personal information;
• (b) retain, use or disclose it for any purpose other than the business purposes in section 3, including any commercial purpose other than those purposes, or for any purpose outside the direct business relationship between Daobook and Clinic;
• (c) combine it with personal information Daobook receives from another person, or collects from its own interaction with a consumer, except as the CCPA regulations permit a service provider to do;
• (d) use it to build or improve a profile of any consumer, or to train an artificial-intelligence model.

5. Compliance and the same level of protection. Daobook shall comply with the CCPA and its regulations as they apply to a service provider, and provide the same level of privacy protection the CCPA requires of a business. Daobook shall notify Clinic in writing within ten (10) business days after determining that it can no longer meet its obligations under the CCPA or this Addendum. For medical information California law treats as sensitive services (gender-affirming care, abortion and abortion-related services, and contraception), Daobook provides the capabilities Civil Code 56.101(c) requires of a business that stores it: the information is kept apart in the record, opened only to the persons Clinic authorises, and refused automatically to persons and entities outside California, as the Services describe; Daobook's service providers process it under their contracts as the Confidentiality of Medical Information Act permits.

6. Clinic's rights to check and to stop. Clinic may take reasonable and appropriate steps to ensure Daobook uses the personal information consistently with Clinic's obligations under the CCPA, including, on reasonable notice and no more than once in any twelve (12) months, reviewing Daobook's relevant written policies, the certifications and assessments Daobook already holds, and an automated or manual check of the Services' handling of Clinic's information. On notice from Clinic, Daobook shall stop and remediate any unauthorised use of the personal information.

7. Consumer requests. Daobook shall assist Clinic in responding to verifiable consumer requests to know, delete, correct, or limit the use of personal information, by providing the tools in the Services and, where those do not suffice, by acting on Clinic's written instruction within ten (10) business days. Where a consumer makes a request directly to Daobook about Clinic's information, Daobook will refer the consumer to Clinic, or act on it only as Clinic directs. When Clinic instructs Daobook to delete a consumer's personal information, Daobook shall delete it from the Services within thirty (30) days and shall instruct its subcontractors to do the same; copies in backups expire on their retention schedule and are never restored to the Services except to recover from a disaster, in which case the deletion is reapplied.

8. Subcontractors. Daobook may engage subcontractors to process personal information only under a written contract that binds them to the terms of this Addendum, and shall notify Clinic of each such engagement. The current subcontractors are listed at https://daobook.health/trust; Daobook gives thirty (30) days' notice before adding one.

9. Certification. Daobook certifies that it understands the restrictions in this Addendum and will comply with them.

10. Term. This Addendum lasts as long as Daobook processes personal information for Clinic, and section 7's deletion duty survives termination.

Accepted with the Business Associate Agreement, electronically in Daobook, by the owner of Clinic's account; Daobook keeps the record of who accepted, when, and which version.

B. Washington and Nevada: processor terms for consumer health data

These Terms are part of the agreement between Emba Digital Pty Ltd (ACN 683 319 486) of 14 Christmas Street, Northcote VIC 3070, Australia, trading as Daobook ("Daobook") and the clinic named in that agreement ("Clinic"), and apply where Clinic is a regulated entity under Washington's My Health My Data Act, RCW 19.373 ("the Washington Act"), or a person subject to Nevada's consumer health data law, Senate Bill 370 (2023) ("the Nevada Act"), and Daobook processes consumer health data on Clinic's behalf. Where a term differs between the two Acts, the stricter applies.

1. Scope and precedence. These Terms cover consumer health data that Clinic's use of the Services causes Daobook to process and that is not protected health information under HIPAA or health care information under RCW 70.02, both of which the Washington Act exempts and which the Business Associate Agreement between the parties governs. If Clinic is a HIPAA covered entity for all of its patients, these Terms impose no additional obligation; they exist for a clinic that holds patients' health data outside HIPAA.

2. Roles. Clinic is the regulated entity that determines the purpose and means of processing. Daobook is Clinic's processor and processes consumer health data only under this binding contract and on Clinic's documented instructions, which are: to provide the Services Clinic has subscribed to, as described in the agreement and configured by Clinic. Daobook shall not process the data for any other purpose. The parties record that a processor which processes consumer health data outside the regulated entity's instructions is itself treated as a regulated entity under the Acts, and Daobook accepts that consequence as the measure of its duty to stay within them.

3. The processing, described. Nature and purpose: hosting and operating a practice-management system for Clinic. Type of data: identifying and contact details, appointments and attendance, consultation notes and treatments, prescriptions, intake answers, communications, invoices and payments, as Clinic enters or collects them. Duration: the term of the agreement and the retention period Clinic sets in the Services afterwards.

4. Daobook's duties. Daobook shall:

• (a) process consumer health data only on Clinic's instructions, and tell Clinic if an instruction would, in Daobook's view, breach an Act;
• (b) keep the data confidential, and ensure every person Daobook allows to process it is bound to confidentiality;
• (c) maintain reasonable administrative, technical and physical safeguards for the data, including encryption in transit and at rest, access limited to the staff and roles Clinic configures, and a record of access to each patient's record that Clinic can view;
• (d) assist Clinic in meeting its obligations under the Acts, by providing the tools in the Services to give consumers access to their data, to withdraw consent, and to delete, and by acting on Clinic's written instruction within ten (10) business days where the tools do not suffice;
• (e) on an instruction to delete a consumer's health data, delete it from the Services within thirty (30) days of Clinic's instruction, and instruct its subcontractors and any third parties it disclosed the data to, to delete it too; and delete it from archived and backup systems within six (6) months, or earlier if a backup is restored, in which case the deletion is reapplied before the restored system serves anyone;
• (f) not sell the data, and not use it for advertising of any kind;
• (g) engage a subcontractor to process the data only under a written contract that binds it to these Terms, and tell Clinic of each engagement;
• (h) at the end of the agreement, return the data to Clinic in the export the Services provide and then delete it, subject to (e) and to what the law requires Daobook to keep;
• (i) make available to Clinic the information needed to show compliance with these Terms, and allow a reasonable review on notice no more than once in twelve (12) months.

5. Clinic's duties. Clinic shall give instructions consistent with the Acts, obtain the consents the Acts require before collecting or sharing consumer health data through the Services, and maintain the consumer health data privacy policy the Washington Act requires of a regulated entity.

6. Security incidents. Daobook shall notify Clinic of a security incident affecting the data on the same clocks as the Business Associate Agreement: within seventy-two (72) hours of discovery where the data was, or may have been, acquired, accessed, used or disclosed by someone not authorised to, and otherwise within ten (10) business days; with what it knows at the time and updates as it learns more, so that Clinic can meet its own notice duties.

7. Term. These Terms last as long as Daobook processes consumer health data for Clinic; sections 4(e) and 4(h) survive termination.

Accepted with the Business Associate Agreement, electronically in Daobook, by the owner of Clinic's account; Daobook keeps the record of who accepted, when, and which version.

These addenda sit beside the Business Associate Agreement.