Sivana Data Processing Addendum

This Data Processing Addendum (this Addendum) is entered into between Siavash Moharramzadeh DBA Sivana (Sivana) and the client identified on the Order Form (Client) and is incorporated by reference into the Mila Services Agreement between them (the Agreement) under Section 10 of the Mila Services Terms (the Terms). Capitalized terms used and not defined in this Addendum have the meanings given in the Agreement.

1. Scope and applicability

a. This Addendum applies to the extent Sivana processes Personal Information on Client’s behalf in connection with the Service and that processing is subject to the California Consumer Privacy Act of 2018, as amended, including its implementing regulations (the CCPA), or another applicable data protection law.

b. This Addendum applies automatically where subsection (a) is met. No election, designation, or self-classification by Client is required.

c. Where no data protection law applies to the processing, Section 10 of the Terms continues to govern that processing on its own terms.

d. Where the parties have executed a Business Associate Agreement, that agreement governs protected health information and controls over this Addendum as to that information, consistent with the order of precedence in Section 22 of the Terms.

e. Where this Addendum and Section 10 of the Terms conflict, this Addendum controls as to the processing it covers.

2. Definitions and roles

a. Business, Business Purpose, Commercial Purpose, Consumer, Deidentified, Personal Information, Processing, Sell, Service Provider, and Share have the meanings given in California Civil Code section 1798.140. Where another data protection law applies to the processing, Business is read to include Controller, Service Provider is read to include Processor, and the equivalent terms of that law apply.

b. Caller Information means the information described in Section 10 of the Terms that Sivana collects or processes on Client’s behalf in operating the Service, including names, telephone numbers, appointment details, messages, call recordings, transcripts, and related call records, to the extent that information is Personal Information.

c. For the processing covered by this Addendum, Client acts as the Business and Sivana acts as Client’s Service Provider. Sivana’s vendors engaged under Section 6 of this Addendum act as Sivana’s subcontractors.

3. Processing purposes and instructions

a. Sivana processes Caller Information only for the limited and specified Business Purposes described in Schedule A and Section 10 of the Terms: to provide, operate, secure, monitor, troubleshoot, and support the Service for Client, and to comply with law.

b. The Agreement, this Addendum, and Client’s documented configuration choices constitute Client’s complete instructions to Sivana for the processing of Caller Information. Additional or changed instructions require the written agreement of both parties.

c. Sivana will notify Client promptly if Sivana determines that an instruction from Client violates the CCPA or another applicable data protection law.

4. Service Provider restrictions and certification

Sivana will not:

a. sell Caller Information, or share it for cross-context behavioral advertising;

b. retain, use, or disclose Caller Information for any purpose other than the Business Purposes specified in this Addendum, or outside the direct business relationship between Sivana and Client, including for any Commercial Purpose of Sivana’s own;

c. use Caller Information to train general-purpose artificial intelligence models; or

d. combine Caller Information with Personal Information that Sivana receives from another source or collects from its own interaction with a Consumer, except as necessary to perform the Business Purposes and as permitted by the CCPA and its regulations.

Sivana certifies that it understands the restrictions in this Section 4 and will comply with them. Sivana will provide the level of privacy protection the CCPA requires of Client with respect to Caller Information and will comply with the obligations applicable to service providers under the CCPA.

5. Deidentified and aggregated information

Where Sivana creates or uses deidentified or aggregated information under Section 10 of the Terms, Sivana will take reasonable measures to ensure that the information cannot be associated with any Consumer or household, publicly commits to maintain and use that information only in deidentified form and not to attempt to reidentify it, except as permitted by the CCPA solely to test the effectiveness of its deidentification processes, and will maintain technical safeguards and business processes that prevent reidentification and inadvertent release. Sivana will contractually obligate any recipient of such information to comply with the same obligations stated in this Section 5. This Section 5 states the conditions under which the aggregated information paragraph of Section 10 of the Terms operates.

6. Subprocessors

a. Client provides general authorization for Sivana to engage subcontractors to deliver the Service, including providers of telephony, artificial intelligence and speech, cloud hosting, database, workflow automation, and messaging services.

b. Sivana maintains a current list of its subprocessors and will furnish it to Client on request, consistent with Section 10 of the Terms.

c. To the extent a subprocessor processes Caller Information on Sivana’s behalf, Sivana engages that subprocessor under a written contract imposing obligations no less protective of Caller Information than those in this Addendum, including the restrictions in Section 4.

d. Sivana remains responsible to Client for its subprocessors’ processing of Caller Information.

e. Certain telecommunications and messaging subprocessors also process limited Caller Information independently, under their own published data processing terms, for purposes such as network security, fraud and abuse prevention, compliance with law, and improvement of their own services, as disclosed in Section 10 of the Terms. For that independent processing, those providers act as businesses or controllers in their own right, outside Sivana’s instructions, and subsection (c) does not apply to it.

7. Consumer rights assistance

a. Taking into account the nature of the processing, Sivana will assist Client, at Client’s reasonable request, in responding to verifiable Consumer requests to know, access, correct, or delete Caller Information, and in Client’s other compliance obligations under the CCPA where the relevant information is in Sivana’s possession.

b. If a Consumer submits a request directly to Sivana concerning Caller Information, Sivana will not respond substantively, except to direct the Consumer to Client, and will forward the request to Client without undue delay.

c. On Client’s documented instruction, Sivana will delete the identified Caller Information and will direct its subprocessors holding that information to do the same, subject to Section 12 of the Terms, including its backup provisions, and to any retention permitted or required by law.

8. Security and Security Incidents

a. Sivana maintains the safeguards described in Section 13 of the Terms with respect to Caller Information.

b. Security Incident has the meaning given in Section 13 of the Terms. Notification, information sharing, and cooperation for a Security Incident follow Section 13.

c. This Addendum does not restate those obligations, and nothing in this Addendum reduces them.

9. Retention, deletion, and return

a. Retention periods, the post-termination export window, deletion timing, backup treatment, and the classification C exception are governed by Section 12 of the Terms.

b. On termination of the Agreement, Sivana will delete or deidentify Caller Information in accordance with Section 12 of the Terms and, on Client’s written request made within the export window, will first make Client’s Caller Information available to Client in a commonly used, machine readable format.

10. Verification and remediation

a. Client may take reasonable and appropriate steps to verify that Sivana processes Caller Information consistently with this Addendum, including by written information request or security questionnaire no more than once in any twelve month period, which Sivana will answer within a reasonable time.

b. Client may, on notice, take reasonable and appropriate steps to stop and remediate unauthorized use of Caller Information, and Sivana will promptly comply with a documented instruction to do so.

11. Compliance notice

a. Sivana will notify Client promptly after determining that it can no longer meet its obligations under this Addendum or the CCPA.

b. If a change in applicable data protection law materially affects this Addendum, the parties will cooperate in good faith to amend it to the extent required.

12. Term, precedence, and general

a. This Addendum takes effect with the Agreement, continues for as long as Sivana processes Caller Information on Client’s behalf, and survives termination of the Agreement to that extent, consistent with Section 22 of the Terms.

b. The order of precedence in Section 22 of the Terms applies. Any executed Business Associate Agreement controls as to protected health information, and this Addendum controls over Section 10 of the Terms as to the processing it covers.

c. This Addendum is governed by the law governing the Agreement. Except as expressly modified by this Addendum, the Agreement remains in full force.

Schedule A. Processing details

Nature and purpose of processing. Answering inbound telephone calls forwarded to the assigned Mila number, answering questions about Client’s business from information Client supplies, booking, canceling, and rescheduling appointments in the selected booking platform, taking messages and notifying Client, sending, or causing the booking platform to send, transactional appointment confirmation and reminder text messages, and the operation, security, monitoring, troubleshooting, and support of the Service, together the Business Purposes.

Duration of processing. The term of the Agreement, plus the retention and deletion periods in Section 12 of the Terms.

Categories of Consumers. Client’s callers, customers, and prospective customers.

Categories of Personal Information. Identifiers such as name and telephone number, audio recordings of calls, call transcripts, appointment and booking details, message contents, text messaging consent and opt-out status, and related call records and metadata.

Sensitive Personal Information. None intended. The Service is not configured to collect health information, payment card data, or government identifiers, consistent with Sections 2 and 6 of the Terms. Sivana does not create voiceprints or other biometric identifiers or templates from call audio or transcripts, and does not use voice characteristics to identify, verify, or authenticate any caller.

Categories of subprocessors. Telecommunications and text messaging, voice artificial intelligence and speech processing, cloud hosting and database, workflow automation, and transactional email. The current subprocessor list is furnished on request under Section 6 of this Addendum.