Legal

Data Processing Agreement

Cairn Pet Health LLC — Version 4.0 — Effective October 11, 2026 — Last updated October 11, 2026

This Data Processing Agreement (“DPA”) forms part of the agreement between the veterinary clinic, veterinary practice, or other veterinary organization that subscribes to or uses the Cairn Services (“Clinic”) and Cairn Pet Health LLC (“Cairn”) (together, the “Parties”).

This DPA applies only to Processing for which Cairn acts as a Processor, Service Provider, Contractor, or substantially equivalent processor-type entity on behalf of Clinic. It does not govern Processing for which Cairn independently determines the purposes and means of Processing and acts as a Controller, Business, or substantially equivalent controller-type entity.

1. Definitions

For purposes of this DPA:

“Applicable Data Protection Law” means any United States federal or state privacy, data-security, breach-notification, or consumer-data law that applies to the Processing covered by this DPA, including applicable comprehensive state privacy laws and their implementing regulations.

“Clinic Personal Data” means Personal Data that Cairn Processes on behalf of Clinic pursuant to Clinic’s documented instructions in connection with the Services.

“Consumer” or “Data Subject” means an identified or identifiable natural person whose Personal Data is protected under Applicable Data Protection Law.

“Controller” includes a “controller,” “business,” or substantially equivalent entity that determines the purposes and means of Processing Personal Data.

“Personal Data” includes “personal data,” “personal information,” or substantially equivalent information protected under Applicable Data Protection Law.

“Process” or “Processing” means any operation performed on Personal Data, including collecting, accessing, using, storing, organizing, transmitting, disclosing, modifying, retrieving, analyzing, deleting, or otherwise handling Personal Data.

“Processor” includes a “processor,” “service provider,” “contractor,” or substantially equivalent entity that Processes Personal Data on behalf of a Controller under Applicable Data Protection Law.

“Security Incident” means a confirmed unauthorized acquisition of, access to, use of, disclosure of, alteration of, destruction of, or loss of Clinic Personal Data that compromises the confidentiality, integrity, or availability of Clinic Personal Data. Routine unsuccessful attempts to access systems, such as scans, pings, unsuccessful login attempts, blocked attacks, or other events that do not result in unauthorized access to Clinic Personal Data are not Security Incidents.

“Services” means the Cairn platform and related services provided to Clinic under the agreement between the Parties.

“Subprocessor” means a third party engaged by Cairn to Process Clinic Personal Data on behalf of Clinic.

Terms not defined in this DPA have the meanings given in the agreement governing Clinic’s use of the Services or, where applicable, Applicable Data Protection Law.

2. Scope and relationship of the Parties

2.1 Clinic as Controller; Cairn as Processor

To the extent Clinic determines the purposes and means of Processing Personal Data through Cairn for Clinic’s veterinary relationship with its clients and patients, Clinic acts as Controller and Cairn acts as Processor on Clinic’s behalf.

Cairn will Process Clinic Personal Data only:

to provide the specific Services described in this DPA and the agreement between the Parties;
according to Clinic’s documented instructions;
as reasonably necessary to protect the security, integrity, availability, and functionality of the Services, to the extent permitted by Applicable Data Protection Law; or
as otherwise required or expressly permitted by Applicable Data Protection Law.

The subject matter, nature, purposes, categories of Personal Data, categories of Data Subjects, and duration of Processing are described in Appendix A.

2.2 Cairn’s independent Processing

The Parties acknowledge that Cairn also Processes certain information for purposes that Cairn determines independently and outside the specific Processing Cairn performs on Clinic’s behalf.

Examples may include:

creating and administering Cairn accounts that exist independently of a Clinic relationship;
Cairn’s own subscription, billing, tax, accounting, and customer-administration obligations;
Cairn’s independent legal and regulatory compliance obligations;
privacy-request, consent, and legal-evidence records maintained by Cairn for its own compliance purposes;
Cairn-wide fraud, abuse-prevention, and platform-security activities to the extent Cairn determines the purpose and means of that Processing independently rather than solely on Clinic’s instructions;
owner-direct customer support and support records where Cairn determines the purpose and means of the support Processing independently; and
optional Research Data Contribution described in Cairn’s Privacy Policy, but only to the extent permitted by Section 2.3.

A function such as security, troubleshooting, support, or reliability may involve both Processor Processing and independent Controller Processing depending on the purpose of the specific activity. Cairn will not recharacterize Clinic Personal Data as independently controlled data merely to avoid obligations that apply to Cairn as Clinic’s Processor.

Independent Processing is governed by Cairn’s Privacy Policy, Terms, and applicable law rather than Clinic’s Processing instructions under this DPA.

2.3 Research is not authorized by this DPA

This DPA does not authorize Cairn to repurpose Clinic Personal Data that Cairn received solely in its capacity as Clinic’s Processor for veterinary research.

Cairn’s optional Research Data Contribution is based on a separate choice made directly by an eligible pet owner through Cairn. Research Data Contribution is off by default and is not activated merely because Clinic subscribes to Cairn, links a pet, assigns a workflow, or uses the Services.

Cairn’s independent research Processing is limited to information Cairn is separately authorized to Process for that research purpose, which may include eligible information provided directly by the pet owner and eligible information generated by Cairn from information Cairn is separately authorized to use for research.

Clinic-entered information, Clinic-authored records, and information whose only lawful basis for Cairn’s possession is Processing on Clinic’s behalf are not authorized for independent research use by this DPA.

Where Cairn cannot reasonably distinguish information that may be Clinic-entered Processor data from information Cairn is separately authorized to use for research, this DPA does not authorize Cairn to treat that information as independently research-eligible.

Nothing in this Section prevents Cairn from Processing Clinic Personal Data for research if Clinic separately and expressly authorizes that Processing under a separate written agreement and the Processing otherwise complies with Applicable Data Protection Law.

3. Clinic instructions and responsibilities

3.1 Documented instructions

This DPA, the agreement governing Clinic’s use of the Services, Clinic’s authorized configuration and use of the Services, and lawful instructions submitted by Clinic constitute Clinic’s documented Processing instructions.

If Clinic provides an instruction that Cairn reasonably believes violates Applicable Data Protection Law, Cairn may suspend the affected Processing and notify Clinic until the Parties resolve the issue, unless Applicable Data Protection Law prohibits that notice.

3.2 Clinic responsibilities

Clinic is responsible for:

having the legal authority required for its collection, use, disclosure, and other Processing of Personal Data through the Services;
providing any notices and obtaining any consents, authorizations, or other permissions that Clinic is legally required to provide or obtain;
ensuring that Clinic personnel access Clinic Personal Data only as authorized;
configuring and using the Services in accordance with applicable law and professional obligations;
responding to Consumer requests concerning Personal Data that Clinic independently controls, except to the extent Cairn is required to assist under this DPA; and
ensuring that Clinic does not instruct Cairn to Process Personal Data in a manner that violates Applicable Data Protection Law.

Clinic represents that it has the legal authority to disclose or make available to Cairn the Clinic Personal Data that Clinic instructs Cairn to Process.

4. Processing limitations

Cairn will not, in its capacity as Clinic’s Processor:

sell Clinic Personal Data;
share Clinic Personal Data for cross-context behavioral advertising;
use Clinic Personal Data for targeted advertising;
retain, use, or disclose Clinic Personal Data for a commercial purpose other than the limited and specified purposes described in this DPA, except only to the extent expressly permitted by Applicable Data Protection Law;
retain, use, or disclose Clinic Personal Data outside the direct business relationship between Clinic and Cairn except only to the extent expressly permitted by Applicable Data Protection Law;
combine Clinic Personal Data received from or on behalf of Clinic with Personal Data received from another person or collected from Cairn’s own direct interaction with a Consumer except only to the extent the combination is expressly permitted by Applicable Data Protection Law and reasonably necessary for an authorized purpose; or
use Clinic Personal Data for a materially different purpose from Clinic’s documented instructions unless required or expressly permitted by Applicable Data Protection Law.

Cairn will provide Clinic Personal Data with the level of privacy protection required of a Processor, Service Provider, or Contractor under Applicable Data Protection Law.

If Cairn determines that it can no longer meet a material obligation imposed on it as a Processor, Service Provider, or Contractor under Applicable Data Protection Law, Cairn will notify Clinic without undue delay.

Clinic may take reasonable and appropriate steps, upon notice to Cairn, to verify, stop, or remediate any unauthorized Processing of Clinic Personal Data as required by Applicable Data Protection Law.

5. Confidentiality

Cairn will ensure that personnel authorized to Process Clinic Personal Data are subject to confidentiality obligations appropriate to their access and responsibilities.

Cairn will limit personnel access to Clinic Personal Data according to role, legitimate operational need, and least-privilege principles.

6. Security

6.1 Safeguards

Taking into account the nature, scope, context, and purposes of the Processing and the risks presented by the Processing, Cairn will maintain reasonable administrative, technical, organizational, and physical safeguards designed to protect the confidentiality, integrity, and availability of Clinic Personal Data.

Physical safeguards may include safeguards implemented by Cairn’s hosting, infrastructure, and other service providers where those providers operate the relevant physical facilities.

Current categories of safeguards are described in Appendix B.

6.2 Security changes

Cairn may update its safeguards as technologies, risks, threats, and the Services change, provided that Cairn does not materially reduce the overall level of protection for Clinic Personal Data during the term of the Parties’ agreement.

7. Consumer and Data Subject requests

Taking into account the nature of the Processing and the information available to Cairn, Cairn will provide reasonable assistance to Clinic, using appropriate technical and organizational measures where reasonably practicable, to enable Clinic to respond to authenticated Consumer requests required by Applicable Data Protection Law.

Such assistance may relate to access, correction, deletion, portability, opt-out, restriction, cessation of Processing, or other applicable rights.

Where Applicable Data Protection Law requires Processor cooperation with an authenticated Consumer request, Cairn will, upon Clinic’s documented instruction, delete, correct, export, restrict, stop, or otherwise Process Clinic Personal Data as required by the applicable law, subject to lawful exceptions.

If Cairn receives a request directly from a Consumer relating to Clinic Personal Data that Cairn Processes solely on Clinic’s behalf, Cairn may:

direct the Consumer to Clinic;
notify Clinic of the request; or
act on Clinic’s documented instructions,

unless Applicable Data Protection Law requires Cairn to respond differently.

Cairn will not independently respond on Clinic’s behalf concerning Clinic-controlled Personal Data except as authorized by Clinic or required by law.

8. Data protection assessments and compliance assistance

Upon Clinic’s reasonable request, Cairn will provide information reasonably available to Cairn and reasonably necessary for Clinic to conduct or document a legally required data protection assessment, risk assessment, cybersecurity audit, automated-decisionmaking or profiling assessment, or similar assessment concerning Clinic’s use of the Services.

Cairn will also provide reasonable assistance concerning the security of Processing and legally required breach-notification obligations, taking into account the nature of Cairn’s Processing and the information available to Cairn.

Where Applicable Data Protection Law requires Cairn to make an assessment report, certification, or similar compliance artifact available to Clinic, Cairn will provide the applicable report or other required information, subject to reasonable confidentiality and security protections.

9. Security Incidents

Cairn will notify Clinic without undue delay after discovering a Security Incident affecting Clinic Personal Data.

Where Applicable Data Protection Law requires a shorter or more specific Processor-to-Controller notification standard, Cairn will comply with that standard, including any requirement for immediate notice following discovery.

To the extent reasonably available at the time of notice, Cairn will provide information necessary for Clinic to understand the nature and scope of the Security Incident and to meet applicable legal obligations, which may include:

the nature of the Security Incident;
the categories of information affected;
the known or reasonably estimated scope of affected records or individuals;
the date or approximate period of the Security Incident, if known;
containment, mitigation, or remediation steps taken or planned; and
a Cairn contact for follow-up.

Cairn may provide information in phases as additional facts become reasonably available.

Cairn’s notification of a Security Incident is not an admission of fault or liability.

The Parties will reasonably cooperate concerning investigation, containment, mitigation, remediation, and legally required notifications.

10. Subprocessors

10.1 General authorization

Clinic authorizes Cairn to engage Subprocessors as reasonably necessary to provide the Services, subject to this Section.

Current Subprocessors that may Process Clinic Personal Data are identified in Appendix C or on a Cairn-designated subprocessor notice page.

10.2 New or replacement Subprocessors

Before a new or replacement Subprocessor begins materially Processing Clinic Personal Data, Cairn will provide Clinic with reasonable advance notice and a reasonable opportunity to object on legitimate data-protection grounds to the extent required by Applicable Data Protection Law.

Notice may be provided electronically, including by email to Clinic’s account administrator or through a Cairn-designated subprocessor notice mechanism.

If Clinic objects on reasonable data-protection grounds, the Parties will work in good faith to address the concern. If Cairn cannot provide a commercially reasonable alternative that avoids the objected-to Subprocessor, Cairn may discontinue the affected feature or either Party may terminate the affected Services as permitted by the agreement between the Parties.

Cairn may use an accelerated notice process where reasonably necessary to address an urgent security risk, legal requirement, service discontinuation by an existing provider, or similar urgent operational circumstance. Where Applicable Data Protection Law requires Clinic to have an opportunity to object before the Subprocessor begins covered Processing, Cairn will provide that opportunity before the Subprocessor begins that Processing.

10.3 Subprocessor obligations

Cairn will enter into a written agreement with each Subprocessor that Processes Clinic Personal Data on Clinic’s behalf and will require that Subprocessor to be subject to substantially the same data-protection obligations applicable to Cairn under this DPA with respect to the Clinic Personal Data it Processes, to the extent required by Applicable Data Protection Law.

Cairn remains responsible for its obligations under this DPA notwithstanding its use of Subprocessors, subject to the limitations of liability in the agreement between the Parties to the extent permitted by Applicable Data Protection Law.

11. Return and deletion of Clinic Personal Data

At the end of the applicable Processor Services, and upon Clinic’s choice where required by Applicable Data Protection Law, Cairn will return or delete Clinic Personal Data that Cairn Processes solely on Clinic’s behalf unless Applicable Data Protection Law requires Cairn to retain particular information.

If Applicable Data Protection Law requires retention, Cairn will isolate the retained Clinic Personal Data from ordinary business use to the extent reasonably practicable and limit further Processing to the legally required purpose and period.

Residual copies of Clinic Personal Data may remain temporarily in protected backup or disaster-recovery systems until overwritten, expired, or removed through the applicable backup cycle. Such residual copies will not be used for ordinary business purposes and, if restored to an active system, will remain subject to the applicable deletion or return instruction unless retention is required by law.

This Section applies only to Clinic Personal Data that Cairn Processes on Clinic’s behalf. It does not require deletion of Personal Data that Cairn lawfully Processes in a separate Controller capacity and that is outside the definition of Clinic Personal Data.

Clinic cancellation does not, by itself, delete an individual pet owner’s separate Cairn account or Personal Data that Cairn lawfully Processes independently of Clinic.

Nothing in this Section permits Cairn to recharacterize Clinic Personal Data as independently controlled data merely to avoid a deletion or return obligation.

12. Assessments, audits, and verification

Upon reasonable request, Cairn will make available information reasonably necessary to demonstrate compliance with its obligations under this DPA and Applicable Data Protection Law.

Where Applicable Data Protection Law requires an assessment, audit, inspection, or similar review, Cairn will allow and reasonably cooperate with an assessment by:

Clinic;
Clinic’s designated assessor; or
where permitted by Applicable Data Protection Law and accepted by Clinic, a qualified and independent assessor selected or arranged by Cairn.

To protect the security and confidentiality of the Services and other customers:

Cairn may propose to satisfy an assessment request through current independent assessment reports, certifications, written security documentation, questionnaires, or other reasonably equivalent evidence where that evidence is sufficient for the applicable legal requirement;
any direct inspection or audit must be conducted during normal business hours, on reasonable advance notice, and in a manner that does not unreasonably interfere with Cairn’s operations;
an assessor must be bound by appropriate confidentiality obligations;
Clinic and its assessor may not access information concerning other Cairn customers or information that would materially compromise the security of the Services;
absent a Security Incident, material suspected noncompliance, or a legal requirement for more frequent review, Clinic will not conduct an intrusive Clinic-specific assessment more than once in any 12-month period; and
each Party will bear its own ordinary assessment costs, except where Applicable Data Protection Law requires Cairn to bear particular assessment costs or the Parties otherwise agree in writing.

If Applicable Data Protection Law requires a broader assessment right than the limitations above allow, the applicable legal requirement controls.

Where Applicable Data Protection Law requires Cairn to provide the results or report of an independent assessment, Cairn will make that report available to Clinic subject to reasonable confidentiality and security protections.

13. Legally required Processing

If Cairn is required by law to Process Clinic Personal Data in a manner that differs from Clinic’s documented instructions, Cairn will notify Clinic before the Processing unless the law prohibits notice.

Cairn will limit such Processing to what is legally required.

14. International Processing

Cairn’s Services are currently offered for use in the United States.

Clinic Personal Data may be Processed in the United States and, through Cairn’s service providers and their approved subprocessors, in other jurisdictions where those providers lawfully operate.

If Applicable Data Protection Law requires a particular transfer mechanism or safeguard for Processing covered by this DPA, the Parties will reasonably cooperate to implement the required mechanism.

This DPA does not by itself constitute a representation that Cairn offers the Services in, or has implemented the legal framework required for commercial availability in, Canada, the European Economic Area, the United Kingdom, or any other non-U.S. jurisdiction.

15. California service-provider and contractor requirements

To the extent the California Consumer Privacy Act (“CCPA”) applies to Clinic Personal Data and Clinic is a “business” while Cairn acts as a “service provider” or “contractor,” the Parties intend this DPA to satisfy the applicable contractual requirements of the CCPA and its implementing regulations.

For such Processing:

Clinic discloses Clinic Personal Data to Cairn only for the limited and specified business purposes described in Appendix A.
Cairn will not sell or share Clinic Personal Data.
Cairn will not retain, use, or disclose Clinic Personal Data for purposes outside those limited and specified business purposes except as expressly permitted by the CCPA.
Cairn will not retain, use, or disclose Clinic Personal Data outside the direct business relationship with Clinic except as expressly permitted by the CCPA.
Cairn will not combine Clinic Personal Data with Personal Data received from another person or collected from Cairn’s own interaction with a Consumer except as expressly permitted by the CCPA.
Cairn will provide the same level of privacy protection for Clinic Personal Data required of service providers and contractors under the CCPA.
Cairn will cooperate with Clinic as reasonably necessary for Clinic to respond to applicable Consumer requests and, where legally required, risk assessments, cybersecurity audits, and applicable automated-decisionmaking or profiling obligations.
Cairn will notify Clinic if Cairn determines that it can no longer meet applicable CCPA obligations.
Clinic may take reasonable and appropriate steps to help ensure Cairn uses Clinic Personal Data consistently with Clinic’s applicable CCPA obligations and, upon notice, may take reasonable and appropriate steps to stop and remediate unauthorized use.
Any Subprocessor Processing Clinic Personal Data on Clinic’s behalf will be subject to applicable contractual restrictions required by the CCPA.

16. Liability and precedence

Liability arising under this DPA is subject to the liability provisions of the agreement governing Clinic’s use of the Services, except to the extent Applicable Data Protection Law prohibits such limitation.

Nothing in this DPA relieves either Party of liability imposed directly on that Party by Applicable Data Protection Law.

If this DPA conflicts with the agreement between the Parties regarding the Processing of Clinic Personal Data, this DPA controls with respect to that conflict.

If a provision of this DPA conflicts with a mandatory requirement of Applicable Data Protection Law, the mandatory legal requirement controls and the remaining provisions of the DPA remain in effect.

17. Term

This DPA becomes effective when it is incorporated into or accepted as part of the agreement governing Clinic’s use of the Services.

It remains in effect for as long as Cairn Processes Clinic Personal Data on Clinic’s behalf and for any additional period necessary to complete the deletion, return, security, or legally required retention obligations described in this DPA.

18. Governing law

This DPA is governed by the same governing law and dispute-resolution provisions as the agreement governing Clinic’s use of the Services, except where Applicable Data Protection Law requires otherwise.

Appendix A — Details of Processing

A.1 Subject matter

Provision of Cairn’s companion-animal longitudinal monitoring and clinic-dashboard Services, including account-linked veterinary monitoring workflows and related technical operations performed on behalf of Clinic.

A.2 Nature and purposes of Processing

Depending on Clinic’s use of the Services, Cairn may Process Clinic Personal Data on Clinic’s behalf to:

authenticate and authorize Clinic users;
establish and maintain Clinic-owner-pet relationships;
store and retrieve information made available through Clinic’s use of the Services;
deliver scheduled veterinary check-ins and reminders associated with Clinic-managed workflows;
receive and store owner-submitted monitoring information made available to Clinic;
calculate and display deterministic trends, scores, findings, and attention states used by the Cairn platform;
display relevant pet and monitoring information to authorized Clinic personnel;
support workflow assignments, enrollment, follow-up, and Clinic use of the dashboard;
deliver transactional notifications and communications associated with Clinic workflows;
maintain operational and security audit records;
provide technical support specifically for Clinic’s use of the Services;
protect the security, integrity, availability, and reliability of Processor-side Services;
assist Clinic with authenticated Consumer requests where required;
delete, correct, export, restrict, stop, return, or otherwise handle Clinic Personal Data according to Clinic’s lawful instructions and Applicable Data Protection Law; and
perform other limited and specified Processing necessary to provide the Services as expressly described in the agreement between the Parties.

The Processing purposes in this Appendix are the limited and specified business purposes for which Cairn Processes Clinic Personal Data on Clinic’s behalf.

Optional Research Data Contribution is not one of these Processor purposes.

A.3 Categories of Data Subjects

Clinic Personal Data may relate to:

pet owners and veterinary clients;
Clinic veterinarians;
veterinary technicians and other authorized Clinic personnel; and
other authorized users whose Personal Data is entered into or generated through Clinic’s use of the Services.

A.4 Categories of Clinic Personal Data

Depending on use, the Processing may include:

Owner or client information

name;
email address;
optional phone number;
account or authentication identifiers;
Clinic relationship information; and
communications associated with Clinic workflows.

Clinic personnel information

name;
email address;
professional or access role;
Clinic affiliation;
account identifiers; and
access and audit information.

Pet and veterinary information associated with an identifiable person

Pet information is generally not Personal Data by itself, but may be included within Clinic Personal Data to the extent it is linked or reasonably linkable to an identifiable owner or household.

This may include:

pet name;
species;
breed;
age or date of birth;
sex and reproductive status;
conditions;
condition assignments and lifecycle information;
medications and medication information;
survey or check-in responses;
scores, findings, and trends generated by Cairn;
weight;
respiratory-rate measurements;
seizure and wellbeing logs;
outcome information;
owner notes; and
related longitudinal veterinary information.

Technical and security information

authentication and session identifiers;
access logs;
push-notification tokens;
device, browser, network, and request information as applicable;
security events; and
diagnostic information reasonably necessary to provide or protect the Services.

A.5 Sensitive Personal Data

Cairn does not request human medical diagnoses, precise device GPS location, racial or ethnic origin, religious beliefs, sexual orientation, citizenship or immigration status, genetic information, or biometric identifiers through ordinary Clinic veterinary workflows.

Authentication credentials and related account-security information may receive heightened protection where classified as sensitive personal information under Applicable Data Protection Law.

Pet veterinary information is not human medical information merely because it is associated with a pet owner.

A.6 Duration

Processing continues for the term of Clinic’s use of the applicable Processor Services and for the additional period reasonably necessary to:

complete Clinic’s lawful instructions;
return or delete Clinic Personal Data;
allow protected backup and disaster-recovery copies to expire through ordinary backup cycles;
satisfy a retention obligation imposed by Applicable Data Protection Law; or
complete a legally required security or incident-response process.

Appendix B — Technical and Organizational Measures

Cairn maintains safeguards appropriate to the nature and scope of the Services. These safeguards may be implemented directly by Cairn or through Cairn’s infrastructure and service providers.

B.1 Access and authentication

Safeguards may include:

authenticated access through managed authentication infrastructure;
no intentional storage of plaintext account passwords in Cairn application databases, analytics systems, or logs;
role-based access controls;
least-privilege access practices;
restricted administrative access; and
session and authentication controls appropriate to the applicable application.

B.2 Encryption and communications

Safeguards may include:

TLS or equivalent encryption for Personal Data transmitted over public networks; and
encryption at rest where supported and appropriate within the relevant infrastructure.

B.3 Application and database security

Safeguards may include:

tenant-, role-, and relationship-aware access controls;
database row-level security;
restricted privileged or service-role operations;
audit logging for designated clinically, legally, security-sensitive, or operationally significant actions;
separation of restricted privacy or linkage data from ordinary application access;
controlled deployment and change-management practices;
software and dependency maintenance; and
secure-development practices.

B.4 Monitoring and diagnostics

Safeguards may include:

infrastructure monitoring;
application error and diagnostic monitoring;
security-event monitoring;
diagnostic and analytics configurations designed to minimize unnecessary Personal Data collection; and
separation of operational analytics from advertising or cross-context behavioral tracking.

B.5 Physical and infrastructure safeguards

Where Cairn relies on third-party infrastructure providers for physical hosting, networking, data storage, or data-center operations, Cairn relies on the provider’s physical and environmental safeguards as part of Cairn’s overall security program.

B.6 Organizational safeguards

Safeguards may include:

confidentiality obligations for personnel with access to Personal Data;
service-provider and Subprocessor review appropriate to the service provided;
least-privilege principles;
incident investigation and response procedures;
privacy and security documentation;
access revocation or modification when roles change; and
procedures intended to identify and remediate material security weaknesses.

Cairn may revise these measures over time to address changes in technology, risk, law, and the Services, provided the overall level of protection is not materially reduced.

Appendix C — Current Subprocessors for Processor Activities

The following providers may Process Clinic Personal Data on Cairn’s behalf depending on the features used.

Provider	Processor activity
Supabase	Database infrastructure, authentication, storage, backend services, Edge Function execution, and operational logging
Cloudflare	Delivery, proxying, network security, and related infrastructure for the authenticated clinic dashboard and Cairn web properties
Postmark	Clinic-user authentication and invitation email, transactional workflow messages, and Processor-side support replies where applicable
Google Workspace	Inbound and outbound business or support email hosting where Clinic communications are sent directly to Cairn-managed mailboxes
Expo	Mobile push-notification infrastructure used to deliver owner notifications triggered by Clinic-related workflows
Apple Push Notification Service (APNs)	iOS notification delivery for owner notifications triggered by Clinic-related workflows
Google/Firebase Cloud Messaging, as applicable	Android notification delivery for owner notifications triggered by Clinic-related workflows
Sentry	Mobile application error monitoring and diagnostics where Clinic Personal Data may be incidentally contained in diagnostic information

OpenAI is not designated as a Subprocessor for Clinic Personal Data under this DPA solely by virtue of Cairn’s owner-direct support workflow. Cairn will not intentionally route Clinic-submitted support tickets containing Clinic Personal Data to OpenAI under the Processor Services unless OpenAI is first treated as an applicable Subprocessor or the Processing is otherwise separately authorized and documented.

Cairn may use additional service providers for activities in which Cairn acts independently as a Controller rather than as Clinic’s Processor. Those providers are not automatically Subprocessors under this DPA merely because they provide another service to Cairn.

Cairn will maintain or provide an up-to-date Subprocessor list and notice of material Subprocessor changes in accordance with Section 10.