Data Processing Agreement (DPA) — Accurecord

1. Roles & scope

Processor processes personal data only on documented instructions from Controller to provide the Service (the Terms of Service + customer configuration are such instructions). Subject matter: medical-coding processing. Processing under an executed DPA continues for the identified service and any limited offboarding, return, deletion or lawful retention period required by that agreement. The applicable BAA controls PHI matters; the DPA does not reduce a non-waivable legal duty. Data subjects: Controller’s workforce users and the patients whose clinical data Controller submits.

2. Categories of data

• Account/user data: name, work email, role, authentication identifiers.
• Organization case content: saved coding cases, including PHI only in enabled covered workflows (governed by the applicable BAA).
• Reference documents: non-PHI project guideline documents an organization uploads, and their retrieval indexes.

3. Processor obligations

1. Process only on Controller’s instructions; notify Controller if an instruction appears to violate applicable law.
2. Ensure persons authorized to process are under confidentiality obligations.
3. Implement the technical & organizational measures in Annex A.
4. Assist Controller with data-subject requests, DPIAs, and regulator inquiries, taking into account the nature of processing.
5. Breach notification: notify Controller without undue delay (and in any case consistent with the BAA’s breach terms) after becoming aware of a personal data breach, with the information reasonably available.
6. At Controller’s choice, delete or return personal data at the end of the service, subject to legal retention (see Privacy Policy / Annex A).
7. Make available information needed to demonstrate compliance and allow audits (relevant independent reports and export tools may support the agreed assurance process but do not replace audit or information rights required by the applicable agreement or law).

4. Subprocessors

Controller provides general authorization for the subprocessors listed on the Trust page (including Microsoft Azure, OpenAI and Stripe). Processor will give advance notice of any new or replacement subprocessor with PHI/personal-data access and a reasonable window to object. Processor imposes data-protection terms on each subprocessor no less protective than this DPA.

5. International transfers

Accurecord AI currently offers its services to customers in the United States. This sample does not incorporate Standard Contractual Clauses or any other international-transfer mechanism. Any international transfer terms apply only if they are completed, verified and included in an executed agreement.

6. Liability

Liability under this DPA is subject to the limitations in the Terms of Service, except where applicable data-protection law provides otherwise.

---

Annex A — Technical & organizational measures

• Organization cases (ICD-10 Coding Pro): saved coding cases are field-encrypted at the application layer (AES-256-GCM, each value bound to its organization and record) under a dedicated key held in Azure Key Vault, stored in Microsoft Azure services covered by Microsoft’s BAA, and retained, exported and deleted under the applicable BAA’s service-end schedule and documented lawful exceptions.
• Verified multi-factor user access: access to saved coding cases, including reads, exports and case actions, requires multi-factor authentication enrollment and a verified multi-factor session; per-organization tenancy and role-based access controls apply.
• Customer reference documents: project guideline uploads are limited to non-PHI coding reference material. They are stored in Microsoft Azure storage and, where configured, in a file-search store at Microsoft Azure (Azure OpenAI Service) and/or the direct OpenAI API, together with their retrieval indexes, and follow their own stated export and deletion lifecycle.
• Provider paths: Microsoft-hosted Azure services and the direct OpenAI API are separate provider paths, each under its own executed Business Associate Agreement. The Microsoft-hosted Azure OpenAI and direct OpenAI inference endpoints used for the Service are configured and verified not to retain prompt or completion content after the request and are not used to train models; that inference statement does not describe saved cases, uploaded reference files or retrieval indexes.
• Encryption in transit and secrets: TLS 1.2+ in transit; Microsoft Azure platform storage encryption for other stored data; secrets in Azure Key Vault. In the Accurecord API, AES-256-GCM for PHI at rest.
• Access control (Accurecord API): per-org tenancy, SHA-256-hashed API keys, tiered access, OIDC SSO, SCIM provisioning; automatic blocking of a credential under a credential-stuffing attack and per-IP rate limits on authentication attempts.
• Auditability: operational audit log; in the Accurecord API, a HIPAA Accounting-of-Disclosures ledger, customer-exportable (CSV / FHIR AuditEvent).
• Resilience: managed Postgres backups, single-revision deploy with health gating, recurring retention purges.
• Program: targeting SOC 2 Type II; annual penetration test; internally documented security controls.

Annex B — Subprocessors

The live list is on the Subprocessors page and in Section 5 of the Privacy Policy. Listed subprocessors:

• Microsoft Azure — hosting and storage, including enabled organization case storage; Microsoft-hosted AI inference and, where used, non-PHI reference-file and retrieval-index storage; security and operational services identified in the current inventory.
• OpenAI OpCo, LLC (direct OpenAI API) — direct OpenAI API inference; non-PHI reference-file and retrieval-index storage where configured. PHI only for expressly covered and enabled endpoints and configurations. Stored files and indexes have a lifecycle separate from inference.
• Stripe — billing; no PHI.

Informational sample only. Not an executed agreement. To request an executed DPA, contact [email protected]. © 2026 Accurecord AI, LLC. All rights reserved.