Subprocessors

Compute, storage, database, authentication, logging, and model inference all run inside Orenda’s own Amazon Web Services account in United States regions, under a single executed business associate agreement. That is a deliberate architectural choice: it gives the Customer one vendor relationship to diligence rather than six, and it removes the most common source of unaccounted PHI copies, which is a chain of small SaaS tools each holding a partial extract.

Orenda does not send PHI to analytics providers, advertising networks, customer-messaging platforms, offshore support vendors, or any model provider not covered by a BAA. Prompts and completions processed through Amazon Bedrock are not retained by the model provider and are not used to train any model.

These vendors support Orenda’s own business operations. None receives PHI, and none receives Customer Data. Some process the limited non-PHI Personal Information described in Exhibit F § 1.1.

The name of each provider is available on request to admin@axisorenda.com.

4.1PHI subprocessors

Orenda will not permit a new subprocessor to create, receive, maintain, or transmit PHI unless:

• a written agreement is in place imposing restrictions and conditions no less protective than those that apply to Orenda under the BAA, as required by 45 C.F.R. §§ 164.502(e)(1)(ii) and 164.308(b)(2);
• the subprocessor stores and processes PHI within the United States, consistent with BAA § 2(n);
• Orenda has completed a security assessment of the subprocessor; and
• Orenda has given Customer thirty (30) days’ advance written notice to its designated privacy and security contacts, describing the subprocessor, its function, its location, and the categories of PHI it will receive.

4.2Objection

Customer may object in writing within the thirty (30) day notice period on reasonable, documented grounds relating to privacy or security. The Parties will confer in good faith. If Orenda cannot resolve the objection, and the subprocessor is material to the Platform, Customer may terminate the affected Order Form on thirty (30) days’ notice and receive a refund of prepaid, unused Fees. Orenda will not proceed with a subprocessor over an unresolved objection while a Covered Facility’s data would be affected during the notice period.

4.3Emergency replacement

Where a subprocessor must be replaced without thirty days’ notice — because of insolvency, a security failure, or loss of a required certification — Orenda may act on shorter notice and will notify Customer as soon as practicable, in no event later than five (5) business days after the change, with an explanation. The substantive requirements of Section 4.1 still apply.

4.4Non-PHI service providers

Orenda will maintain the list in Section 3 and update it on notice. Orenda will not add a service provider that receives non-PHI Personal Information without the contract terms required by 11 C.C.R. § 7051(c) (Exhibit F § 5.2).

Orenda remains fully responsible to Customer for the acts and omissions of each subprocessor to the same extent as for its own, as provided in BAA § 2(f) and Section 12 of the Agreement. Engaging a subprocessor does not divide, delegate, or dilute Orenda’s obligations.

The current version of this Exhibit is available in the Documentation and on request to admin@axisorenda.com. Customer should ensure its designated privacy and security contacts on the Order Form are current, because subprocessor notices are given to those addresses and the thirty-day objection period runs from transmission.

This page is a reference copy. Where it differs from the version incorporated into a Customer’s signed agreement, the signed version controls.