Data Processing Agreement

1. Definitions

"Data Controller" refers to the healthcare staffing agency or facility that determines the purposes and means of the processing of Personal Data. "Data Processor" refers to YourMedSoft, which processes Personal Data on behalf of the Controller. "Personal Data" means any information relating to an identified or identifiable natural person (including clinicians and internal staff).

2. Roles and Scope

In the context of providing our SaaS platform, YourMedSoft acts as a Data Processor. You, the customer, act as the Data Controller. This Agreement applies exclusively to the processing of Personal Data that is subject to applicable data protection laws (including GDPR and CCPA) in the course of providing the YourMedSoft services.

3. Processor Obligations

As the Data Processor, YourMedSoft agrees to:

• Process Personal Data only on documented instructions from the Controller, unless required to do so by law.
• Ensure that persons authorized to process the Personal Data have committed themselves to confidentiality.
• Implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk.
• Assist the Controller in ensuring compliance with obligations regarding security, breach notifications, and impact assessments.
• Delete or return all Personal Data to the Controller after the end of the provision of services relating to processing, and delete existing copies unless law requires storage.

4. Sub-processors

The Controller grants YourMedSoft general authorization to engage sub-processors to fulfill its obligations under the Master Subscription Agreement. YourMedSoft uses carefully vetted infrastructure partners (such as Google Cloud Platform and Firebase) to host the application. We will notify you of any intended changes concerning the addition or replacement of sub-processors, giving you the opportunity to object to such changes.

5. Security Measures

We employ industry-standard, SOC 2 compliant infrastructure to protect your data. This includes encryption at rest and in transit (AES-256 and TLS 1.3), rigorous access controls, multi-factor authentication for administrative access, and regular vulnerability scanning. For data constituting Protected Health Information (PHI), our specific safeguards are further detailed in our HIPAA Business Associate Agreement (BAA).

6. Data Subject Rights (CCPA / GDPR)

YourMedSoft will, to the extent legally permitted, promptly notify you if we receive a request from a Data Subject to exercise their rights (e.g., access, rectification, restriction of processing, erasure, data portability). We will not respond to such requests ourselves, except on your documented instructions. We will provide you with commercially reasonable assistance to help you fulfill your obligation to respond to these requests.