Snapshot 64080
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Version: October2025
Data Processing Addendum
This Data Processing Addendum (“DPA”) supplements the agreement referencing these terms (“Agreement”) is between
Cotiviti, Inc., a Delaware corporation, on behalf of itself and its affiliates (together, “Cotiviti”), and the company who signed
the related agreement (“Customer”), and applies when Data Protection Laws apply to any Personal Data provided by
Customer through its use of the Services.
The parties agree as follows:
1. Definitions. In this DPA, the following definitions apply. All other capitalized terms in this DPA shall have the same
definition as in the Agreement.
“Affiliate” means an entity that directly or indirectly controls, is controlled by or is under common control with an entity
where control is an ownership, voting or similar interest representing fifty percent (50%) or more of the total interests
then outstanding of the entity in question.
“Data Controller” means an entity that determines the purposes and means of the Processing of Personal Data.
“Data Processor” means an entity that Processes Personal Data on behalf of the Data Controller.
“Data Protection Laws” means European Union Regulation 2016/679 (the “General Data Protection Regulation”) or
California Civil Code Section 1798.100-1798.199 (the “California Consumer Privacy Act of 2018”), as applicable, and any
legislation or regulation implementing or made pursuant to it, or which amends or replaces any of it.
“Data Subject” means the individual to whom Personal Data relates.
“Data Subject Request” means a request for access, erasure, rectification, or portability of Personal Data.
“Personal Data” means information, to the extend it is protected as persona data under applicable Data Protection
Laws, that relates to, or could reasonably be linked with, to an identifiable or identified Data Subject who visits or
engages in transactions with you using Cotiviti’s Software or Service (a “Customer”), which Cotiviti Processes as a Data
Processor or Service Provider in the course of providing you with the Services.
“Processing” has the meaning given to it in the GDPR and “process”, “processes” and “processed” shall be interpreted
accordingly.
“Security Incident” means any unauthorized or unlawful breach of security that leads to the accidental or unlawful
destruction, loss, alteration, unauthorized disclosure of or access to Personal Data.
“Services” means any product or service provided by Cotiviti to Customer pursuant to the Agreement.
“Service Provider” shall be interpreted in accordance with the California Consumer Privacy Act of 2018.
“Standard Contractual Clauses” means the standard contractual clauses issued pursuant to the European Commission
Decision of February 5, 2010, on standard contractual clauses for the transfer of personal data to processors
established in third countries under Directive 95/46/EC.
“Subprocessor” means any Processor engaged by Cotiviti or its Affiliates to assist in fulfilling its obligations with respect
to providing the Services pursuant to the Agreement or this DPA. Sub-processors may include third parties or any Cotiviti
Affiliate.
2. Data Protection.
COTIVITI CONFIDENTIAL INFORMATION
Data Processing Addendum Page 1 of 4
Version: October2025
2.1. As between Cotiviti and Customer, Customer is the Data Controller of Personal Data and Cotiviti shall process
Personal Data only as a Data Processor on behalf of Customer. Nothing in the Agreement or this DPA shall prevent
Cotiviti from using or sharing any data that Cotiviti would otherwise collect and process independently of Customer's
use of the Services.
2.2. This DPA applies where and only to the extent that Cotiviti processes Personal Data on behalf of the Customer in
the course of providing the Services and such Personal Data is subject to the relevant Data Protection Laws.
2.3. Personal Data may contain special categories of data depending on how the Services are used by Customer. The
Personal Data may be subject to the following process activities: (i) storage and other processing necessary to provide,
maintain and improve the Services provided to Customer; (ii) to provide account management, billing, and technical
support to Customer; and (iii) disclosures as required by law or otherwise set forth in the Agreement.
3. Confidentiality.
3.1. Cotiviti shall ensure that any person who is authorized by Cotiviti to process Personal Data (including its staff,
agents, and subcontractors) shall be under an appropriate obligation of confidentiality.
4. Data Processor Responsibilities.
4.1. Cotiviti will inform Customer promptly if, in Cotiviti’s opinion, an instruction from Customer violates applicable
Data Protection Laws;
4.2. If Cotiviti is collecting Personal Data from individuals on behalf of Customer, follow Customer’s instructions
regarding such Personal Data collection (including with regard to the provision of notice and exercise of choice);
4.3. Cotiviti will take commercially reasonable steps to ensure that (i) persons employed by it and (ii) other persons
engaged to perform on Cotiviti’s behalf comply with the terms of this DPA;
4.4. Cotiviti will ensure that its employees, authorized agents and any Subprocessors are required to comply with and
acknowledge and respect the confidentiality of the Personal Data, including after the end of their respective
employment, contract or assignment;
5. Data Controller Responsibilities
5.1. Customer Obligations. Customer agrees that (i) it shall comply with its obligations as a Controller under Data
Protection Laws in respect of its processing of Personal Data and any processing instructions it issues to Cotiviti; and (ii)
it has provided notice and obtained (or shall obtain) all consents and rights necessary under Data Protection Laws for
Cotiviti to process Personal Data and provide the Services pursuant to the Agreement and this DPA.
6. Data Security
6.1. Security Measures. Cotiviti shall implement and maintain appropriate technical and organizational security
measures to protect Personal Data from Security Incidents and to preserve the security and confidentiality of the
Personal Data, in accordance with Cotiviti's security standards (“Security Measures”).
6.2. Security Incident Response. Upon becoming aware of a Security Incident, Cotiviti shall notify Customer without
undue delay and shall provide timely information relating to the Security Incident as it becomes known or as is
reasonably requested by Customer.
6.3. Updates to Security Measures. Customer acknowledges that the Security Measures are subject to technical progress
and development and that Cotiviti may update or modify the Security Measures from time to time provided that such
updates and modifications do not result in the degradation of the overall security of the Services purchased by the
Customer.
COTIVITI CONFIDENTIAL INFORMATION
Data Processing Addendum Page 2 of 4
Version: October2025
7. Data Transfer.
7.1. Cotiviti may not transfer or authorize the transfer of Personal Data to countries outside the EU and/or the European
Economic Area (EEA) without the prior written consent of the Customer. If personal data processed under this
Agreement is transferred from a country within the European Economic Area to a country outside the European
Economic Area, the Parties shall ensure that the personal data are adequately protected. To achieve this, the Parties
shall, unless agreed otherwise, rely on EU approved standard contractual clauses for the transfer of personal data.
8. Data Subject Rights.
8.1. Taking into account the nature of the Processing, Cotiviti shall assist the Customer by implementing appropriate
technical and organizational measures, insofar as this is possible, for the fulfilment of the Customer’s obligations, as
reasonably understood by Cotiviti, to respond to requests to exercise Data Subject rights under the Data Protection
Laws.
9. Subprocessors
9.1. Cotiviti does not currently use any Subprocessor. Customer agrees that Cotiviti may engage Subprocessors to
process Personal Data on Customer's behalf and Cotiviti will provide Customer reasonable advance notice (which may
include email) if it adds or removes Subprocessors.
9.2. Sub-processor Obligations. Cotiviti shall: (i) enter into a written agreement with the Subprocessor imposing data
protection terms that require the Subprocessor to protect the Personal Data to the standard required by Data Protection
Laws; and (ii) remain responsible for its compliance with the obligations of this DPA and for any acts or omissions of the
Sub-processor that cause Cotiviti to breach any of its obligations under this DPA.
9.3. Objection to Sub-processors. Customer may object in writing to Cotiviti’s appointment of a new Sub-processor on
reasonable grounds relating to data protection by notifying Cotiviti promptly in writing within five (5) calendar days of
receipt of Cotiviti’s notice in accordance with Section 3.3. Such notice shall explain the reasonable grounds for the
objection. In such event, the parties shall discuss such concerns in good faith with a view to achieving commercially
reasonable resolution. If this is not possible, either party may terminate the applicable Services that cannot be provided
by Cotiviti without the use of the objected-to-new Sub-processor.
10. Data Retention and Deletion.
10.1. Processor shall promptly and without undue delay from the date of termination of any Services involving the
Processing of Personal Data (the “Cessation Date”), delete the Personal Data that Data Processor has stored.
11. Audit.
11.1. Processor shall make available to the Customer on request all information necessary to demonstrate compliance
with this DPA, and shall allow for and contribute to audits, including inspections, by the Customer or an auditor
mandated by the Customer in relation to the Processing of the Personal Data by the Data Processors.
11.2. Information and audit rights of the Customer only arise under section 11.1 to the extent that the Agreement does
not otherwise give them information and audit rights meeting the relevant requirements of Data Protection Law.
12. General.
12.1. Agreement and this DPA. If there is a conflict between any term of the Agreement and this DPA with respect to
the subject matter of this DPA, this DPA will govern. Cotiviti may amend this DPA by posting new DPA on Cotiviti’s
website or providing notice to the Customer The updated DPA will be effective on the date posted. Customer’s
continued use of the Services after the amended DPA is posted to Cotiviti’s website is acceptance of the updated
amended DPA. If you do not agree to any changes to the DPA, do not continue to use the Service. Excepted as
amended by this DPA, the Agreement shall continue to govern. If any provision of the DPA is held illegal or
unenforceable in a judicial proceeding,
COTIVITI CONFIDENTIAL INFORMATION
Data Processing Addendum Page 3 of 4
Version: October2025
such provision shall be severed and shall be inoperative, and the remainder of this DPA shall remain operative and
binding on the parties.
COTIVITI CONFIDENTIAL INFORMATION
Data Processing Addendum Page 4 of 4