Data Processing Agreement

1. Definitions

• Personal Data: Any information relating to an identified or identifiable natural person, as defined in Article 4(1) of the GDPR.
• Processing: Any operation performed on Personal Data, as defined in Article 4(2) of the GDPR.
• Sub-processor: A third party engaged by HASP to process Personal Data on behalf of the Customer.
• Data Subject: The individual to whom Personal Data relates.

2. Scope and Purpose of Processing

HASP processes Personal Data solely to provide the Service, including:

• User account management: Names, email addresses, authentication tokens
• End-user identity data (end-users of Customer's published apps): For apps Customer publishes to the runtime (Customer's usehasp.run subdomain or custom domain), HASP creates and maintains identity records ("RuntimeUsers") for Customer's end-users — patients, clients, customers, or other natural persons authorized by Customer to access those apps. Data in this category includes: email address (canonical identifier; Customer-managed), name (optional), external identity-provider claims (where configured), passkey public keys, session tokens, and sign-in audit attribution. RuntimeUsers are org-scoped — a record created for Customer's app is not shared with any other HASP customer — and are processed solely to authenticate end-users into Customer's apps and to provide Customer with admin controls over end-user access.
• Application data storage: Records created by Customer's end users within Customer's apps (stored as structured JSONB data)
• File attachments: Files uploaded by end users to Customer's apps
• Audit logging: Activity logs for security and compliance purposes
• API request payload retention (API tier customers only): Full HTTP request and response payloads of API calls Customer makes to HASP, retained for 30 days to power the in-app developer-console request inspector. Stored encrypted at rest, accessible only to Customer's authorized workforce members holding developer.read capability or higher within the Customer's own organization. May contain PHI; the inspector renders payloads with PHI placeholders by default and exposes a per-inspection "Show PHI" reveal that emits an inspector.phi_revealed audit event on every use. Retained for the shorter of 30 days from creation or termination of the Agreement. This store does not participate in the integrity-chained audit log; the audit log retains its own redacted record independently.
• Billing: Payment and subscription data (processed via Stripe)

3. Customer Obligations

The Customer shall:

• Ensure a lawful basis for processing Personal Data (e.g., consent, legitimate interest)
• Provide notice to Data Subjects about the processing
• Respond to Data Subject requests, using the self-service tools provided by HASP (data export, account deletion)

4. HASP Obligations

HASP shall:

• Process Personal Data only on documented instructions from the Customer
• Ensure that personnel authorized to process Personal Data are bound by confidentiality obligations
• Implement appropriate technical and organizational security measures (see Section 6)
• Assist the Customer in responding to Data Subject requests
• Delete or return all Personal Data upon termination of the Agreement, at the Customer's choice
• Make available information necessary to demonstrate compliance with this DPA
• Not use Customer Personal Data to train, fine-tune, or improve any AI model. HASP does not use Customer Personal Data — including PHI, prompts, completions, uploaded documents, or any other Customer Content — to train, fine-tune, or otherwise improve any AI or machine-learning model, whether HASP's own or any third party's. HASP's inference sub-processors (Anthropic, OpenAI) are contractually bound not to train models on this data under the no-training terms of the HASP-direct BAAs and their commercial API terms. This limitation is absolute: no aggregation or de-identification of Customer Personal Data creates an exception to it.

5. Sub-processors

HASP uses the following sub-processors. This list is also published on our sub-processors page and kept in sync with this DPA.

Direct sub-processors

PHI handling

PHI de-identification, redaction, and re-identification is performed by HASP's own pipeline, built on Microsoft Presidio with healthcare-specific custom recognizers, running on Aptible-managed infrastructure inside the HASP compliance boundary. PHI handling is not delegated to any third party. Inference flows through direct provider integration with Anthropic and OpenAI under HASP-direct BAAs as listed above. What those BAA-covered inference providers receive is governed by the Customer organization's PHI policy: content may be sent containing PHI under the applicable HASP-direct BAA, or automatically de-identified by HASP's pipeline before transmission where the organization's policy elects redaction. Providers without a HASP-direct BAA — including the embeddings provider (Voyage AI) and the web-retrieval providers (Tavily, Serper) listed above — receive de-identified or PHI-free content only.

Sub-processor change notification

HASP will notify the Customer at least 30 days before adding a new direct sub-processor or making a material change to an existing one. The Customer may object by contacting [email protected] within the 30-day notice period.

For inference providers: if a new direct inference provider is added, the 30-day notice applies. Customers may also restrict specific provider routing for their workloads via Customer-configurable inference policy at the org level on Business+ tiers.

HASP will work with Customer in good faith to address objections, including by ceasing use of the affected sub-processor or terminating the affected portion of the Service if no acceptable alternative exists.

6. Security Measures

HASP implements the following technical and organizational measures:

Encryption

• All data in transit encrypted via TLS 1.2+
• OAuth tokens encrypted at rest (AES-256-CBC)
• Compliance data plane connections use SSL with CA verification

Access Control

• Role-based access control (Owner, Admin, Member roles)
• Enterprise SSO/SAML enforcement available
• Session-based authentication with CSRF protection

Data Isolation

• Solo / Professional / Business: shared PostgreSQL with application-level isolation and row-level security on a compliance-certified cluster
• Enterprise: dedicated PostgreSQL cluster with restricted database users and firewall rules

Audit & Monitoring

• Immutable append-only audit logs on all paid plans
• Cryptographic chain integrity with Ed25519 signatures on every paid plan
• 24/7 uptime monitoring across all platform components

Data Retention

• User data deleted upon account deletion (within 30 days)
• Expired invitations purged after 30 days
• Audit logs retained for 7 years on every paid tier; Enterprise agreements may specify custom retention (10 or more years)

7. Data Breach Notification

HASP will notify the Customer without undue delay — and in any event within 72 hours — upon becoming aware of a Personal Data breach. The notification will include:

• Nature of the breach
• Categories and approximate number of Data Subjects affected
• Likely consequences
• Measures taken or proposed to address the breach

8. Data Subject Rights

HASP provides the following self-service tools to support Data Subject rights:

• Right of Access / Portability: Data export (Settings → Privacy & Data)
• Right to Erasure: Account deletion (Settings → Profile)
• Right to Rectification: Profile editing (Settings → Profile)
• Consent Management: Consent capture at sign-up; cookie consent banner for analytics

For requests that cannot be handled via self-service, Customer should contact [email protected].

9. International Transfers

Personal Data is processed in the United States. Where Personal Data of EU/UK Data Subjects is transferred outside the EEA or the UK to be processed in the United States, HASP relies on:

• The EU-US Data Privacy Framework (and the UK Extension thereto, and the Swiss-US Data Privacy Framework), to the extent HASP or the relevant sub-processor is certified thereunder
• Standard Contractual Clauses (SCCs) as approved by the European Commission, and the UK International Data Transfer Addendum where applicable
• Sub-processor compliance with applicable data protection frameworks

If the EU-US Data Privacy Framework (or any successor mechanism) is invalidated, HASP will continue to rely on the SCCs and will work with Customer in good faith on any supplementary measures required.

Canadian Data Subjects (PIPEDA). Where Personal Data of Canadian residents is transferred to and processed in the United States, HASP relies on contractual accountability as the transfer mechanism under PIPEDA Schedule 1 §4.1.3. HASP remains accountable for the protection of Canadian Personal Data transferred to sub-processors and requires each sub-processor to maintain a level of protection equivalent to PIPEDA's ten fair-information principles by contract. Canadian Data Subjects retain all access, correction, and complaint rights under PIPEDA and may contact HASP at [email protected] to exercise them.

10. Term and Termination

This DPA is effective for the duration of the Agreement. Upon termination:

• HASP will delete Customer's Personal Data within 30 days
• Customer may request a data export before termination
• Audit logs may be retained as required by law

11. Governing Law

This DPA is governed by the same law as the Agreement.