Data Processing Agreement

Data Processing Agreement (DPA)

1. Definitions

"Personal Data"

Any information relating to an identified or identifiable individual, including patient data uploaded by the Client.

"Processing"

Any operation performed on Personal Data (storage, access, transmission, deletion, etc.).

"Controller"

The entity that determines the purpose and means of processing Personal Data (you).

"Processor"

The entity that processes Personal Data on behalf of the Controller (CaseBench).

"Sub-processor"

A third party engaged by CaseBench to assist with processing.

"Applicable Data Protection Laws" includes:

• EU GDPR
• UK GDPR
• CCPA/CPRA
• PIPEDA
• HIPAA (where applicable)
• APAC privacy frameworks
• U.S. federal and state privacy law
• Any other laws applicable to the Controller's jurisdiction

"Sensitive Data"

Includes health data, patient identifiers, dental records, STL files, clinical photographs, prescriptions, and treatment notes.

"Protected Health Information" or "PHI"

As defined under HIPAA: individually identifiable health information transmitted or maintained in any form.

2. Roles of the Parties

You (the Client) act as the Data Controller for all Personal Data uploaded to CaseBench.

CaseBench acts as the Data Processor. For platform account administration and operational data (e.g., user accounts, billing, and platform security logs), CaseBench may act as an independent Controller as described in our Privacy Policy.

Independent planners, labs, clinicians, and manufacturers who access case data may act as Joint Controllers (if they determine processing purposes) or Independent Controllers (the most common case). You are responsible for ensuring all parties you work with have a legal basis to process patient data.

3. Purpose of Processing

CaseBench will process Personal Data solely for the following purposes:

• Providing access to the CaseBench platform
• Case coordination and workflow management
• Secure file sharing (STLs, images, PDFs, DICOMs, prescriptions)
• Communication between Client and independent providers
• Platform security, audit logging, and monitoring
• Backups and disaster recovery
• Analytics using anonymised or aggregated data only
• Improving platform performance and features

CaseBench will not process Personal Data for any purpose other than those instructed or permitted by the Client.

4. Categories of Data Processed

4.1 Data Subjects

Patients, clinicians, treatment planners, lab staff, manufacturers, and other platform users.

4.2 Data Types

Personal Data may include: patient-identifying information (if uploaded by the Client), STL/OBJ files, clinical images and photographs, treatment prescriptions and notes, case history, professional credentials, email addresses and account details, audit logs and activity data.

The Client is responsible for limiting uploads to the minimum necessary identifiers. CaseBench recommends using opaque patient references (such as a case number or initials) rather than full patient names wherever clinically appropriate.

5. Sub-processors

CaseBench uses the following vetted Sub-processors to provide platform services. Where Sub-processors have access to Personal Data or PHI, appropriate data processing agreements are maintained with each.

Named Sub-processors:

5.1 AI Sub-processors and PHI

Where a Client activates AI-assisted case processing, case files and clinical metadata are transmitted to the relevant AI provider. This is a PHI egress path. CaseBench maintains data processing agreements with AI providers that cover PHI processing obligations. Clients subject to HIPAA should confirm that the AI provider is covered under their Business Associate Agreement with CaseBench (see §17).

CaseBench will maintain an up-to-date list of active Sub-processors and will notify Clients of material additions or changes with reasonable notice.

CaseBench will not use identifiable patient data for AI model training.

6. International Data Transfers

Because CaseBench serves global users, data may be transferred outside your home country. Transfer mechanisms include:

• EU/UK transfers: Governed by Standard Contractual Clauses (SCCs) in accordance with GDPR Article 46 and UK equivalent provisions.
• Canada: Transfers comply with PIPEDA and applicable provincial privacy law.
• United States: Transfers comply with CCPA/CPRA and applicable U.S. federal privacy law.
• AI Sub-processors: Where AI processing providers operate outside the EEA or UK, CaseBench will ensure appropriate transfer mechanisms (SCCs or equivalent adequacy decision) are in place before activating such providers for EU or UK Clients.

Supabase supports regional hosting options. CaseBench will use commercially reasonable efforts to support regional data residency upon written request.

7. Security Measures

CaseBench implements appropriate technical and organisational security measures, which are continuously reviewed and improved. Current measures include:

• Encryption of data in transit (TLS) and at rest (AES-256 via Supabase)
• Postgres Row-Level Security (RLS) enforcing organisation-scoped data access as the primary security boundary
• Server-side authentication checks on all data mutations
• HTTP-only session cookies for authentication tokens
• Multi-factor authentication for internal administrative systems
• Audit logging of all material platform events (case submission, payment capture, disputes, admin actions)
• Secure development and deployment practices
• Regular vulnerability assessment and remediation
• Firewall and network safeguards

Infrastructure certification: Supabase, our primary infrastructure provider, maintains SOC 2 Type II and ISO 27001 alignment. CaseBench follows secure development practices aligned with these standards. CaseBench does not currently hold its own SOC 2 certification; documentation of our security posture is available upon request.

Known remediation in progress: CaseBench has identified and is actively remediating a number of Row-Level Security policy gaps across internal tables. These are documented in our internal security register and do not affect the primary data access boundary for Client data.

A detailed summary of security measures is available upon reasonable request.

7.1 Administrative Support Access

The Customer instructs and authorizes CaseBench to permit a limited number of authorized platform administrators to access the Services as an Authorized User would see them ("Support Access"), solely for the following purposes: (a) providing support requested by the Customer or its Authorized Users; (b) investigating and resolving faults, errors or reported issues; and (c) protecting the security and integrity of the Services.

During Support Access, administrators may view Customer Personal Data, including case data and files, and may perform actions within an Authorized User's account where reasonably necessary for the purposes above.

CaseBench shall ensure that:

• (i) Support Access is restricted to authorized platform administrators who are subject to written confidentiality obligations;
• (ii) each Support Access session is time-limited and ends automatically;
• (iii) a reason is recorded for each session before it begins;
• (iv) the start and end of each session, the administrator involved and the stated reason are logged, and such logs are made available to the Customer on reasonable request;
• (v) Support Access is limited to the Customer Personal Data reasonably necessary for the purpose of the session; and
• (vi) Support Access is never used for any purpose other than those set out in this clause.

Authorized Users are not currently notified of each individual Support Access session. Where Customer Personal Data includes health or patient information, Support Access shall be carried out in accordance with this Agreement and, where applicable, the Business Associate Agreement between the parties.

8. Client Responsibilities (Controller)

The Client agrees to:

• Obtain all required patient consent before uploading data to CaseBench
• Ensure all uploads comply with applicable medical and privacy laws in the Client's jurisdiction
• Limit Personal Data uploads to what is clinically necessary
• Maintain accuracy of data submitted to the platform
• Ensure authorised users comply with this DPA
• Submit data deletion and export requests in writing to CaseBench

CaseBench is not responsible for Personal Data uploaded unlawfully by the Client or its users.

9. Processor Responsibilities (CaseBench)

CaseBench will:

• Process Personal Data only on documented Client instructions or as permitted by this DPA
• Maintain confidentiality and implement appropriate security measures
• Ensure Sub-processors are bound by obligations at least equivalent to this DPA
• Notify the Controller without undue delay of any legally binding governmental or law enforcement request for Client data
• Provide reasonable assistance to the Controller in meeting regulatory obligations

CaseBench will not:

• Sell Personal Data to any third party
• Share data for advertising or marketing purposes
• Use identifiable patient data for AI model training
• Access case files except for purposes of support, diagnostics, platform security, or as required by law

10. Data Breach Notification

If CaseBench becomes aware of a confirmed Personal Data Breach affecting Client data, we will:

• Notify the Client without undue delay and, where required by GDPR Article 33, within 72 hours of becoming aware
• Provide available details of the nature of the breach, categories of data affected, and approximate number of data subjects
• Describe mitigation and containment steps taken or proposed
• Provide reasonable assistance to the Controller in meeting its own notification obligations to supervisory authorities and data subjects

The Client retains responsibility for required notifications to supervisory authorities or data subjects, unless otherwise agreed in writing.

11. Data Retention and Deletion

Retention: CaseBench retains Personal Data for the duration of the active service relationship and as required by applicable law. Payment and audit records may be retained beyond account closure in pseudonymised form to meet tax, regulatory, and legal obligations.

Deletion requests: Upon account closure or written request, CaseBench will delete or anonymise Personal Data within 30 days. Deletion requests are currently fulfilled via a managed manual process. An automated deletion pipeline is under active development. Requests should be submitted in writing to hello@casebench.io.

Important: Deleting a case record initiates the deletion workflow for associated files. File deletion from storage is included in the 30-day process. Backup copies may persist for a short period following deletion in accordance with standard infrastructure practices.

Backups: Automated database backups are managed by Supabase and are subject to their retention schedule. These backups will be purged on their standard cycle following deletion.

Export: Client data exports are available upon written request and will be fulfilled within 30 days. A self-service data export feature is on the CaseBench product roadmap. You may request an export at any time prior to or following account closure.

12. Compliance Assistance

CaseBench will provide reasonable assistance to help Controllers:

• Respond to GDPR/UK GDPR data subject access, erasure, rectification, and portability requests
• Meet CCPA/CPRA obligations
• Support PIPEDA compliance
• Document data processing activities for regulatory purposes

Data subject requests received by CaseBench that relate to Client data will be forwarded to the Controller. Assistance is currently provided via a manual process and CaseBench will respond to written requests within 30 days.

Additional assistance beyond standard scope may be subject to reasonable fees, agreed in advance.

13. Audits

Upon reasonable written notice (minimum 30 days), CaseBench will:

• Provide documentation demonstrating compliance with this DPA
• Provide details of active Sub-processors and their roles
• Provide summaries of available independent audit reports (e.g., Supabase SOC 2)
• Respond to reasonable written information security questionnaires

Physical or on-site audits of CaseBench systems are not permitted unless legally required and mutually agreed in writing.

14. Governing Law

This DPA is governed by the laws of the State of Delaware, USA, unless superseded by mandatory applicable local privacy law. For EU/UK Clients, mandatory provisions of the GDPR and UK GDPR take precedence where they conflict with this DPA.

15. Term

This DPA remains in effect for so long as: (a) the Client uses the CaseBench platform, or (b) CaseBench processes Personal Data on behalf of the Client. Obligations regarding data confidentiality and security survive termination.

16. Online Acceptance

By clicking "I agree to the Data Processing Agreement" or continuing to use the platform, the Client confirms that:

• They have read and understood this DPA
• They have authority to bind their organisation to these data processing terms
• They accept the terms of this Agreement

Where a terms acceptance record cannot be confirmed at the time of signup (for example, where onboarding is not completed), continued use of the platform constitutes acceptance of the then-current DPA.

17. HIPAA and Business Associate Agreement

For Clients in the United States who handle Protected Health Information (PHI) as defined by HIPAA, a Business Associate Agreement is available. Clients subject to HIPAA should review and accept the BAA before uploading any PHI to the platform. For questions, contact hello@casebench.io.

18. Contact

For data protection enquiries, requests, or to exercise data subject rights:

Email: hello@casebench.io
Company: ClearPath Digital, Inc. (CaseBench)