This Data Processing Agreement (“DPA”) is entered into by and between Whitecoat Technologies, Inc (“Company”) and the entity identified as “Client” in the Whitecoat Technologies, Inc (Whitecoat Learning Platform) SaaS Agreement (the “Agreement”), and forms part of the Agreement. Capitalized terms not defined in this DPA have the meanings given in the Agreement.
1.1 This DPA applies to Company’s processing of Client Data in connection with the Services.
1.2 For matters of data protection, privacy, and information security, this DPA governs over the body of the Agreement in the event of any conflict. For all other matters the Agreement governs.
1.3 Annex 2 (Jurisdiction-Specific Terms) governs over the body of this DPA to the extent it applies to Client.
1.4 Where Client’s governing law or institutional policy requires an addendum executed by both parties, that addendum governs over this DPA to the extent of any conflict. Nothing in this DPA requires Client to waive any right, remedy, privilege, or immunity available to it by law.
2.1 Client determines the purposes and means of processing Client Data. Company processes Client Data only on Client’s documented instructions, which consist of the Agreement, this DPA, and Client’s configuration elections in Exhibit A.
2.2 FERPA. With respect to education records, Company is a “school official” with a “legitimate educational interest” under 34 C.F.R. § 99.31(a)(1)(i)(B). Company performs an institutional service for which Client would otherwise use its own employees, is under Client’s direct control with respect to the maintenance and use of education records, and is subject to the redisclosure restrictions of 34 C.F.R. § 99.33.
2.3 Where applicable law characterizes Company as a “service provider,” “processor,” “school service provider,” “third-party contractor,” or “operator,” Company accepts that characterization and the corresponding obligations set out in Annex 2.
2.4 Company is not a joint controller with Client and does not independently determine the purposes of processing.
3.1 Company processes Client Data only to: (a) provide, maintain, secure, support, and troubleshoot the Services, as further described in Section 13.4(a) of the Agreement; (b) perform Learner-Directed Disclosures elected by Client under Section 13.5 of the Agreement; (c) compute and use Aggregate Insights as permitted by Section 13.4(c) of the Agreement; and (d) comply with a legal obligation.
3.2 Prohibited processing. Company will not: (a) sell Client Data; (b) share, rent, release, or otherwise disclose Client Data for cross-context behavioral advertising or targeted advertising; (c) use Client Data to build or enrich a profile about any individual for use outside the Services; (d) use Client Data to market to learners; (e) use Client Data to train, fine-tune, or otherwise improve any model available to more than one Client, except as permitted by Section 13.4(e) of the Agreement; or (f) retain, use, or disclose Client Data for any purpose outside the direct business relationship between Company and Client.
3.3 Artificial intelligence. Model training is governed by Section 13.4(e) of the Agreement. Company will not permit any foundation model provider to access Client Data or to use Client Data to train or improve any foundation model, and will contractually require each artificial-intelligence Subprocessor to prohibit such use and to limit retention of Client Data to what is necessary to return a response. Artificial-intelligence processing occurs within Company’s own cloud environment and Client Data is not transmitted to a public model application programming interface. Company may evaluate model accuracy against Client Data under Section 13.4(a) of the Agreement, retaining only aggregate accuracy metrics. Controls are described in Annex 1 Section L.
3.4 Company will notify Client promptly if Company determines that it can no longer meet its obligations under this DPA or applicable data protection law.
3.5 Data not requested. The Services do not require, and Company does not request, protected health information subject to HIPAA, patient-identifying information, Social Security numbers, financial account numbers, or nonpublic personal information subject to the Gramm-Leach-Bliley Act. Where Client is a Covered Entity or Business Associate and protected health information will nonetheless be processed by Company on Client’s behalf, the parties will execute a Business Associate Agreement before any such information is transmitted, as provided in Section 20 of the Agreement.
3.6 Aggregate Insights. Section 13.4(c) of the Agreement governs Company’s use of Client Data outside the delivery of Services to Client; it does not restrict reporting, dashboards, exports, or analytics provided to Client about Client’s own data. Where Company computes Aggregate Insights, Company applies the controls described in Annex 1 Section K, including a minimum group size of five (5) individuals, complementary suppression, deletion of individual-level extracts on completion of the computation, and review before external disclosure. Company does not maintain a de-identified copy of Client Data, and no provision of this DPA should be read to assume one exists.
4.1 Access to identified Client Data by Company Personnel is governed by Section 13.6 of the Agreement, including the enumerated authorized purposes, least-privilege requirement, Session Emulation limits, access logging, personnel obligations, and United States access restriction set out in that Section.
4.2 Company Personnel with access to Client Data are bound by written confidentiality obligations that survive termination of their engagement.
5.1 Company’s engagement of Subprocessors is governed by Section 20(a) of the Agreement. Company maintains a current list of Subprocessors, makes it available to Client on request, and gives Client at least thirty (30) days’ notice before engaging a new Subprocessor that will process Client Data.
5.2 Company remains fully responsible for each Subprocessor’s performance of the obligations in this DPA.
5.3 Engagement of a Subprocessor in accordance with this DPA does not constitute a sale of, or an unauthorized disclosure or sharing of, Client Data.
5.4 If Client objects to a proposed Subprocessor by written notice specifying reasonable data-protection grounds and identifying the specific requirement of Client’s governing law, written institutional policy, or this DPA on which the objection is based, delivered within the notice period in Section 5.1, the parties will discuss commercially reasonable alternatives in good faith. If the parties cannot agree on a remedy within thirty (30) days after the objection, Client may terminate the affected Services effective at the end of the then-current term by written notice given within thirty (30) days thereafter. Fees for the then-current term remain payable and no refund is due.
6.1 Company implements and maintains the technical and organizational measures described in Annex 1, which are designed to protect Client Data against unauthorized access, use, disclosure, alteration, and destruction.
6.2 Company will not materially decrease the overall level of protection described in Annex 1 during the term of the Agreement.
6.3 Company reviews its security program at least annually and following any material change to the Platform or to the threat environment.
7.1 Definition. A “Security Incident” means any confirmed or reasonably suspected unauthorized access to, acquisition of, use, disclosure, alteration, or destruction of Client Data, or unauthorized access to any system under Company’s control on which Client Data resides. An access by Company Personnel outside the purposes authorized in Section 13.6(a) of the Agreement is a Security Incident.
7.2 Notice. Company will notify Client of a Security Incident without undue delay and in any event no later than forty-eight (48) hours after Company becomes aware of it. Notice will be given to Client’s designated security contact by both telephone and email.
7.3 Content. Notice will describe, to the extent then known: the nature of the incident; the categories and approximate volume of Client Data involved; the categories and approximate number of individuals affected; the likely consequences; the measures taken or proposed; and a named contact at Company. Company will supplement the notice as further information becomes available.
7.4 Security contact. Company designates a named individual as Client’s primary security contact, available twenty-four (24) hours per day, seven (7) days per week, to assist Client in resolving obligations associated with a Security Incident. Company maintains a continuously monitored security address that pages Company’s on-call responder at any hour. Company will furnish direct contact details for the named individual to Client and will keep them current; where Client is subject to a public records law, Company may furnish those details separately from this Agreement.
7.5 Assistance and cost. Company will assist Client in meeting its regulatory and individual notification obligations. Where the Security Incident arises from Company’s systems, Subprocessors, or personnel, Company will reimburse Client’s actual, reasonable, and documented costs of notice and remediation required by applicable law.
7.6 Coordination. Company will not notify any regulator, affected individual, or third party of a Security Incident involving Client Data without Client’s prior written consent, except where Company is independently required by law to do so, in which case Company will give Client as much advance notice as is legally permitted.
8.1 Company provides functionality enabling Client to access, correct, export, and delete Client Data without Company assistance. Where Client requires assistance, Company will provide it at no additional charge.
8.2 Requests received by Company. If Company receives a request from a learner, an eligible student, a parent, or a regulator concerning education records or Client Data, Company will refer the request to Client within five (5) business days and will not respond substantively other than to acknowledge receipt and identify Client as the responsible party.
8.3 Exceptions. Section 8.2 does not apply to: (a) a learner’s exercise of control over that learner’s own Learner-Contributed Data in an individual account maintained under Section 24(d) of the Agreement; or (b) a learner’s revocation of Verified Learner Consent under Section 13.5(d) of the Agreement. Company handles those requests directly and will report them to Client in the periodic report described in Section 13.5(g) of the Agreement.
9.1 Company retains Client Data only for so long as necessary to provide the Services or as required by law. Post-termination handling is governed by Section 24 of the Agreement.
9.2 At any time during the term, and on expiration or termination, Company will return or securely delete Client Data at Client’s written direction.
9.3 On Client’s request, Company will provide written certification of deletion within thirty (30) days of completing the deletion.
9.4 Company may retain and use Aggregate Insights and Platform Data, and may retain Verified Learner Consent records, as provided in Sections 24(c) and 24(e) of the Agreement. Company will not retain Client Data following expiration or termination except as required by law, in which case the obligations of this DPA continue to apply to the retained data for so long as it is retained.
10.1 On Client’s written request, not more than once per twelve (12) month period, Company will provide its most recent third-party security assessment report, if any, and a completed security questionnaire in a form reasonably requested by Client. Where Company does not hold a current third-party assessment report, Company will disclose that fact and its then-current certification status as described in Annex 1 Section J.
10.2 Where Client’s governing law or institutional policy requires an independent or on-site audit, the parties will cooperate in good faith to schedule it on reasonable advance notice, during normal business hours, and subject to confidentiality obligations. Such audits will occur not more than annually except following a Security Incident.
10.3 Company maintains records of its processing activities sufficient to demonstrate compliance with this DPA.
11.1 Client Data is stored and processed within the United States. Company will not transfer Client Data outside the United States, and will not permit access to Client Data from outside the United States, without Client’s prior written consent.
12.1 This DPA may be amended only by a written amendment signed by both parties. Company may not unilaterally amend, modify, or alter this DPA, and no term posted to Company’s website, software, or invoices modifies this DPA.
13.1 This DPA takes effect on the Effective Date of the Agreement and continues until Company has returned or deleted all Client Data in accordance with Section 9. Sections 3.2, 7, 9, and 10 survive termination for so long as Company retains any Client Data.
The following measures are maintained by Company.
(1) Role-based access control enforced at the application and infrastructure layers.
(2) Individual named credentials for all Company Personnel; shared or generic accounts are prohibited.
(3) Multi-factor authentication required for all administrative and infrastructure access.
(4) Access rights reviewed at least quarterly and revoked within one (1) business day of role change or separation.
(5) Least-privilege provisioning; access to identified Client Data limited to the purposes in Section 13.6(a) of the Agreement.
(1) Client Data encrypted in transit using TLS 1.2 or higher.
(2) Client Data encrypted at rest using AES-256 or equivalent.
(3) Encryption keys managed separately from encrypted data, with documented rotation.
(1) Access to identified Client Data logged as required by Section 13.6(e) of the Agreement, with logs retained not less than three (3) years.
(2) Infrastructure and application logs retained for not less than 90 days, application event stream retained indefinitely and monitored for anomalous activity.
(3) Logs protected against alteration and deletion by the individuals whose activity they record.
(1) Documented vulnerability management program with defined remediation timeframes by severity.
(2) Dependency and container scanning integrated into the deployment pipeline.
(1) Separation of production, staging, and development environments.
(2) Production Client Data is not used in development or test environments.
(3) Peer code review required before deployment to production.
(1) Automated encrypted backups with documented recovery point and recovery time objectives.
(2) Documented business continuity and disaster recovery plan.
(1) Written confidentiality obligations surviving engagement.
(2) Documented disciplinary process for policy violations.
(1) Security review of each Subprocessor before engagement and at least annually thereafter.
(2) Current Subprocessor list maintained and available to Client on request.
(1) Client Data hosted on Amazon Web Services (AWS) cloud infrastructure, a provider maintaining SOC 2 Type II and ISO 27001 certification.
(2) Company does not operate its own data centers.
Company’s current independent assurance status is stated below and updated as it changes. Company does not represent that it holds a certification it has not obtained.
(1) SOC 2 Type I: in process, with the report expected to be submitted for review by December 31, 2026.
(2) Independent penetration test: not yet performed.
(3) Accessibility Conformance Report under Section 20(d) of the Agreement: Company maintains an Accessibility Conformance Report for the Platform in VPAT 2.5 (WCAG edition) format, based on a comprehensive internal WCAG 2.1 Level AA audit completed in January 2026 and a subsequent platform-wide remediation program comprising 57 tracked engineering items released in March 2026. That report is a vendor self-assessment and not a third-party attestation. Company will provide it to Client on request.
These are policy and process controls. They do not require a separate de-identified data store.
(1) Minimum group size of five (5) individuals enforced before any aggregate result is retained or disclosed.
(2) Complementary suppression applied where a suppressed result could be derived from other results disclosed. A group size of five carries greater residual risk than a larger threshold, so suppression review is performed on every externally disclosed aggregate rather than by sampling.
(3) Individual-level extracts created in the course of computing an aggregate are deleted on completion and are not retained.
(4) Aggregate outputs reviewed for re-identification risk before disclosure outside Company.
(5) Client Data is not used to train, fine-tune, or otherwise improve any model available to more than one Client, except as permitted by Section 13.4(e) of the Agreement. Model evaluation retains only aggregate accuracy metrics.
(6) Cross-client aggregates are pooled and are not attributed to any individual Client without that Client’s written consent.
These controls describe where model inference occurs and what the model provider can see.
(1) Foundation models are invoked within Company’s own cloud account; Client Data does not leave that environment. Provider: Amazon Web Services (Amazon Bedrock)
(2) No foundation model provider receives or can access Client Data.
(3) Client Data is not used to train or improve any foundation model.
(4) Base model inference does not persist Client Data.
(5) Retrieval is scoped at query time to the requesting Client’s data, and within that Client to the requesting user’s authorized scope.
(6) Where a model is tuned for a single Client under Section 13.4(e)(i) of the Agreement, it is served only to that Client and controls prevent it from disclosing data to a user not otherwise authorized to access that data.
(7) Model invocation involving Client Data is logged consistent with Section 13.6(e) of the Agreement.
Part A applies to every Client. Part B applies only where the Services involve students under the age of eighteen. Part C applies according to Client’s jurisdiction and institutional type.
A.1 Company is designated a school official with a legitimate educational interest under 34 C.F.R. § 99.31(a)(1)(i)(B) and performs an institutional service for which Client would otherwise use its own employees.
A.2 Company uses education records only for the purposes authorized by Client and remains under Client’s direct control with respect to the maintenance and use of those records.
A.3 Company will not redisclose education records except as permitted by 34 C.F.R. § 99.33, as directed by Client, or pursuant to consent satisfying 34 C.F.R. § 99.30.
A.4 Company acknowledges that improper disclosure or redisclosure may result in exclusion from access to education records at Client for a period of not less than five (5) years under 34 C.F.R. § 99.33(e).
A.5 On Client’s request, Company will provide the information Client needs to identify Company as a contractor in Client’s annual FERPA notification.
This Part applies where Client is a K-12 educational agency, or where the Services are used in a dual-enrollment, early-college, high school health science pathway, or similar program in which students under eighteen participate.
B.1 Company will not engage in targeted advertising to students, will not sell student personal information, and will not create a profile about a student except in furtherance of the Services.
B.2 Parental consent, where required, is obtained by Client. Company relies on Client’s representation that all required notices and consents are in place.
B.3 Company will delete student personal information at Client’s direction and will provide certification of deletion.
C.1 Tennessee. Company will use Personal Information only for the purposes authorized by Client and will not sell or share Personal Information with any other person or entity, consistent with Tenn. Code Ann. § 49-7-186. Engagement of a Subprocessor under Section 5 of this DPA, and a Learner-Directed Disclosure under Section 13.5 of the Agreement, are not a sale or sharing for this purpose.
C.2 California. Where Client is subject to the California Consumer Privacy Act as amended by the California Privacy Rights Act, Company is a “service provider” and receives Client Data solely to perform the Services. Company will not sell or share Client Data, will not retain, use, or disclose it outside the direct business relationship with Client, and will not combine it with information received from other sources except as permitted for a service provider. Company grants Client the right to take reasonable steps to ensure Company uses Client Data consistent with Client’s obligations. Where the Services involve K-12 students, the additional restrictions of Cal. Bus. & Prof. Code § 22584 and Cal. Ed. Code § 49073.1 apply and are incorporated by reference. Computation of Aggregate Insights under Section 13.4(c) of the Agreement is performed as part of providing the Services and does not involve retention or disclosure of personal information outside the direct business relationship.
C.3 New York. Where Client is an “educational agency” under N.Y. Education Law § 2-d and 8 N.Y.C.R.R. Part 121, Company is a “third-party contractor” and will: adopt a data security and privacy plan aligned to the NIST Cybersecurity Framework; limit access to those employees and subcontractors who need it; not sell or use student data for marketing; encrypt student data in transit and at rest; notify Client of a breach in the most expedient way possible and without unreasonable delay, and in no case later than seven (7) calendar days after discovery; and, on request, provide the supplemental information and Parents Bill of Rights required by Part 121. Where this Section requires notice sooner than Section 7.2 of this DPA, the shorter period applies.
C.4 Illinois. Where Client is a school or school district subject to the Student Online Personal Protection Act, 105 ILCS 85, Company is a “operator” or “school service provider” as applicable and will not sell, rent, or engage in targeted advertising using covered information, will delete covered information at Client’s request, and will notify Client of a breach within the period required by that Act.
C.5 Other jurisdictions. Where Client is subject to a state student data privacy law, comprehensive consumer privacy law, or institutional policy imposing requirements beyond this DPA, the parties will execute a rider setting out those requirements. Company will not require Client to waive any statutory protection as a condition of the Services.
Learners enrolled in Client’s programs; Client faculty, instructors, and administrators; preceptors and clinical supervisors at Client’s affiliated clinical sites; and volunteers designated by Client.
| Category | Elements | Provenance (see Exhibit B, Part 1) |
|---|---|---|
| Identity and contact | Name, institutional email, telephone, cohort and program assignment | Institution-Contributed; learner may update |
| Placement and rotation | Rotation assignments, clinical site, location, supervising instructor, schedule, hours | Institution-Contributed |
| Assessment and performance | Encounter logs, formative and summative evaluations, competency ratings, peer evaluations, site visit records, supervisor work history | Institution-Contributed |
| Learner-authored | Self-assessments, reflections, portfolio artifacts, uploaded credentials and licensure records, curriculum vitae, career preferences | Learner-Contributed |
| Compliance and safety | Requirement completion status, injury report documentation | Institution-Contributed |
| Consent records | Verified Learner Consent and revocation records under Section 13.5 | Company-maintained |
| Platform Data | System logs, authentication and session records, feature usage telemetry, performance and error data, configuration | Company |
Delivery, maintenance, security, and support of the Services; clinical placement and rotation administration; assessment and competency tracking; learner portfolio maintenance; Learner-Directed Disclosures elected by Client under Section 13.5 of the Agreement; and computation of Aggregate Insights as permitted by Section 13.4(c) of the Agreement.
For the term of the Agreement and thereafter only as permitted by Section 24 of the Agreement and Section 9 of this DPA.
The Services are not designed to process protected health information, patient-identifying information, Social Security numbers, financial account numbers, or biometric data. Client is instructed not to submit such data to the Platform.
Current list maintained by Company and available on request under Section 5.1. As of the Effective Date the categories engaged are: cloud infrastructure and hosting; transactional email and communications; in-application support and ticketing; product analytics; and managed artificial-intelligence model hosting supporting the Grace assistant and automated assessment features, currently Amazon Web Services (Amazon Bedrock), under which foundation models are invoked within Company’s own AWS account and no model provider receives Client Data.