Data Processing Addendum

This Data Processing Addendum (“DPA”) forms part of the Terms of Service (the “Agreement”) between Mivikron Solutions Private Limited, which operates Basalix AI (“we”, “us”, or “our”), and the customer (“Customer”, “you”, or “your”). It applies automatically whenever we process Customer Personal Data in providing the Services, with no separate signature required. Capitalized terms not defined here have the meanings given in the Agreement.

Order of precedence: If this DPA conflicts with the Agreement regarding the processing of Customer Personal Data, this DPA controls. The Agreement controls on all other matters, including limitations of liability.

1. Definitions

Customer Personal Data: personal data (or personal information, as defined by applicable law) contained in Customer Data that we process on your behalf, including data about the people who contact you through the Services.
Data Protection Laws: all privacy and data protection laws that apply to the processing, which may include India’s Digital Personal Data Protection Act, 2023 and its rules; U.S. federal and state privacy laws, including the California Consumer Privacy Act (“CCPA”), other comprehensive state privacy laws, and state consumer health data laws such as Washington’s My Health My Data Act.
Data Subject: the individual to whom Customer Personal Data relates.
Security Incident: a breach of our security leading to the accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of, or access to, Customer Personal Data. It does not include unsuccessful attempts or activities that do not compromise security, such as failed sign-in attempts, pings, port scans, or blocked denial-of-service attacks.
Subprocessor: a third party we engage that processes Customer Personal Data on our behalf.

2. Roles and Processing

2.1 Roles: You are the controller, the business (under the CCPA), and the Data Fiduciary (under India’s DPDP Act) for Customer Personal Data. We are your processor, service provider, and Data Processor. If you act as a processor for another controller, you are responsible for obtaining that controller’s authorization and are our single point of contact.

2.2 Your Instructions: We process Customer Personal Data only on your documented instructions, which are: (a) this DPA and the Agreement; (b) your configuration and use of the Services, including by your Users; and (c) other reasonable written instructions consistent with the Agreement and technically feasible within the standard Services. We will tell you if we believe an instruction infringes Data Protection Laws, and may suspend the affected processing until it is withdrawn or confirmed.

2.3 Details of Processing: The subject matter, nature, purpose, duration, and categories of data and Data Subjects are described in Annex I.

2.4 Personnel: Everyone we authorize to process Customer Personal Data is bound by an obligation of confidentiality.

2.5 U.S. State Privacy Laws: Except as permitted by Data Protection Laws, we will not: (a) sell or share Customer Personal Data (as those terms are defined under the CCPA and similar laws); (b) retain, use, or disclose it for any purpose other than providing the Services, including for our own commercial purposes; (c) retain, use, or disclose it outside our direct business relationship with you; or (d) combine it with personal information we receive from others or collect ourselves. We will notify you if we can no longer meet these obligations, and you may take reasonable steps to stop and remediate unauthorized use. We comply with the processor obligations of other U.S. state privacy laws through Sections 2.4, 3, 4, 5, and 7 of this DPA.

2.6 Sensitive and Health Data: Customer Personal Data may include sensitive personal information, including limited health-related information collected during legal intake. We process it only as needed to provide the Services, with the safeguards in Annex II. Where it is “consumer health data” under a state consumer health data law, we act as your processor and will not collect, use, share, or sell it for our own purposes. The Services are not offered for processing protected health information under the U.S. Health Insurance Portability and Accountability Act, and we do not enter into Business Associate Agreements, as set out in Section 3.5 of the Agreement.

2.7 De-identified and Aggregated Data: We may create aggregated, de-identified data as described in Section 7.2 of the Agreement. We will take reasonable measures to ensure it cannot be linked to any Data Subject, you, your clients, or any matter; will not attempt to re-identify it; and will require any recipient to do the same. Pseudonymized data remains Customer Personal Data. Data received from Google APIs is never used for this purpose.

3. Security

3.1 Security Measures: We implement and maintain appropriate technical and organizational measures to protect Customer Personal Data, as described in Annex II. We may update these measures over time, provided the overall level of protection is not materially reduced.

3.2 Security Information: On written request, no more than once every 12 months, we will provide information about our security practices, such as completed security questionnaires and relevant policies, to help you assess our compliance with this DPA.

3.3 Security Incident Notice: We will notify you of a Security Incident without undue delay and no later than 48 hours after becoming aware of it. Our notice will describe, to the extent then known, the nature of the incident, the categories and approximate volume of data and Data Subjects affected, its likely consequences, and the measures taken or proposed. If information is not available at first, we will provide it as it becomes available.

3.4 Incident Response: We will investigate each Security Incident, take reasonable steps to contain it, mitigate its effects, and prevent recurrence, and reasonably cooperate with you in meeting your notification obligations to clients, Data Subjects, and regulators. You decide whether and how to notify them, and we will not notify them on your behalf without your written consent unless the law requires it. Our notice of a Security Incident is not an admission of fault or liability.

4. Subprocessors

4.1 Authorization: You authorize us to engage the Subprocessors listed in Annex III and in our Privacy Policy. We impose data protection obligations on each Subprocessor that are no less protective than those in this DPA, and we remain responsible for their performance.

4.2 Changes and Objections: We will notify you at least 30 days before adding or replacing a Subprocessor, by email to your account owner or through the Services. You may object on reasonable data protection grounds by written notice within 10 days of our notice. We will work with you in good faith to resolve the objection. If we cannot resolve it within 30 days and proceed with the change, your sole remedy is to terminate the affected Services by written notice, and we will refund any prepaid fees for the terminated portion covering the period after termination. In an emergency affecting the security or continuity of the Services, we may replace a Subprocessor immediately and will notify you promptly afterwards.

4.3 AI Model Providers: Subprocessors that provide AI models process Customer Personal Data under business terms that: (a) limit their processing to providing the relevant functionality to us; (b) prohibit using it to train their models; and (c) limit retention to what is needed to provide the service and to abuse and safety monitoring for a limited period, after which the data is deleted.

5. Assistance

5.1 Data Subject Requests: The Services let you access, export, and delete Customer Personal Data; where a record cannot be corrected in the Services, we will correct it on your instruction. If we receive a request from a Data Subject about Customer Personal Data, we will not respond substantively, and, where legally permitted, will refer the requester to you or forward the request to you. You are responsible for responding to Data Subject requests.

5.2 Other Assistance: Taking into account the nature of the processing and the information available to us, we will provide reasonable assistance with your data protection risk assessments and responses to regulator inquiries. Assistance that goes beyond the standard features of the Services and our standard documentation may be charged at reasonable rates agreed in advance.

5.3 Audits: Your audit rights are first satisfied by the information described in Section 3.2. If that information is reasonably insufficient to demonstrate our compliance, or a regulator requires an audit, you may audit our compliance with this DPA at your own expense: on at least 30 days’ written notice; no more than once every 12 months (unless a regulator requires otherwise); during business hours for no more than two business days; by you or an independent auditor who is not our competitor and is bound by confidentiality; and in a way that minimizes disruption. Audits do not extend to other customers’ data, our internal costs or pricing, or information subject to legal privilege or third-party confidentiality. Audit results are our Confidential Information.

6. Privilege and Client Confidentiality

6.1 No Waiver: Customer Personal Data may include information protected by attorney-client privilege, the work-product doctrine, or your duties of confidentiality to clients and prospective clients. We process such information solely as your processor and at your direction. The parties intend that disclosing it to us and processing it under the Agreement does not waive any privilege or protection. We will treat it as your Confidential Information and will not use or disclose it except as needed to provide the Services. You remain responsible for identifying and asserting any privilege or protection.

6.2 Personnel Access: We limit access to Customer Personal Data to personnel who need it to provide, secure, or support the Services, and we do not review the substance of your matters except as reasonably necessary for support you request, investigating a Security Incident, or complying with law.

7. Government and Third-Party Demands

If we receive a subpoena, warrant, court order, or other legally binding demand for Customer Personal Data, we will, unless legally prohibited: (a) promptly notify you; (b) tell the requester that we are your processor and that the demand should be directed to you; and (c) give you a reasonable opportunity to seek a protective order or assert privilege before we produce anything, unless the law requires earlier production. If we are prohibited from notifying you, we will use reasonable efforts to have the prohibition lifted and will challenge a demand where we reasonably believe it is unlawful. We will disclose only the minimum Customer Personal Data required.

8. Data Location

Customer Personal Data is stored and processed in the United States (Amazon Web Services, US East region). Mivikron Solutions Private Limited is based in India, and our authorized personnel may access Customer Personal Data from India to provide and support the Services, subject to this DPA.

9. Return and Deletion

9.1 During the Agreement: Customer Personal Data is retained according to the retention settings you configure for each agent, and you can export or delete it at any time using the Services.

9.2 After Deletion: When your account is deleted, Customer Personal Data is permanently purged from our active systems after the 7-day grace period described in Section 11.4 of the Agreement. Copies in encrypted backups are overwritten on their normal rotation cycle and remain protected by this DPA until then. We may retain Customer Personal Data only where the law requires it. On written request made within 30 days after deletion, we will confirm deletion in writing.

9.3 Legal Holds: You can place individual records on legal hold in the Services. If you notify us in writing that other Customer Personal Data is subject to a litigation hold or preservation obligation, we will work with you to preserve it on a mutually agreed scope and duration, and will not delete it until you confirm in writing that the hold is released.

10. Your Responsibilities

You represent and warrant that: (a) you have provided all required notices and obtained all required consents, authorizations, and legal bases for us to process Customer Personal Data under the Agreement; (b) your instructions comply with Data Protection Laws; and (c) you will not use the Services to process protected health information as a HIPAA covered entity or business associate, and will not submit the data excluded by Section 3.5 of the Agreement. We are not responsible for the accuracy, quality, or lawfulness of Customer Personal Data or the means by which you obtained it.

11. Liability, Term, and Changes

11.1 Liability: Each party’s liability under this DPA is subject to the exclusions and limitations of liability in the Agreement, except where Data Protection Laws do not permit limiting liability to Data Subjects.

11.2 Term: This DPA applies for as long as we process Customer Personal Data. Sections 6, 7, 9, and 11 survive while we retain any Customer Personal Data.

11.3 Changes: We may update this DPA to reflect changes in law or our Subprocessors, provided the update does not materially reduce the protection of Customer Personal Data. Material changes are notified as described in Section 13 of the Agreement.

11.4 Governing Law: This DPA is governed by the law that governs the Agreement.

Annex I: Details of Processing

Customer: uses the Services to handle intake, scheduling, and follow-up with its prospective and existing clients. Role: controller (or processor for a third-party controller).
Processor: Mivikron Solutions Private Limited (Basalix AI), which provides the Services. Role: processor (or subprocessor). Contact: [email protected].
Data Subjects: people who contact the Customer through its website, phone line, or messaging channels (including prospective and existing clients and other callers); people named in those communications; people in contact lists the Customer imports or syncs, such as existing clients, opposing parties, and related parties; and the Customer’s own personnel who use the Services.
Categories of data: names and contact details (phone numbers, email addresses, postal addresses); call details such as the caller’s phone number, time, and duration; chat messages; call transcripts, and call audio recordings where recording is enabled; intake answers and the facts of a legal matter; appointment details; technical data such as IP addresses and session identifiers; and account and usage data of the Customer’s personnel.
Sensitive data: depending on the Customer’s practice areas and configuration, limited health-related information relevant to a legal matter (for example, whether a person was injured and is receiving treatment), immigration status, and information about family and domestic matters. Safeguards: the measures in Annex II, access limited to need-to-know, per-agent retention limits, optional redaction of personal information in call recordings and transcripts, and optional minimization of health details in follow-up messages and built-in integrations.
Frequency: continuous, for the duration of the Agreement.
Nature and purpose: hosting, storage, and processing needed to answer calls and chats, conduct intake, qualify matters, run conflict checks against the Customer’s contacts, recognize returning callers, book appointments, send follow-ups, summarize conversations, synchronize with integrations the Customer enables, and provide, secure, and support the Services.
Retention: as configured by the Customer, and otherwise until account deletion as described in Section 9.

Annex II: Technical and Organizational Measures

Hosting and location: Customer Personal Data is hosted on Amazon Web Services in the US East region.
Encryption: data is encrypted in transit using TLS, with HTTPS enforced (HSTS). Databases, file storage, and backups are encrypted at rest with AES-256 using keys managed in AWS Key Management Service in the US East region. Integration credentials, such as API keys and calendar and practice-management OAuth tokens, are stored encrypted. Secrets are held in a managed secrets service, not in source code.
Tenant isolation: each customer’s data is logically separated by tenant, and every request is scoped to the authenticated tenant.
Access control: role-based access for customer Users; our personnel’s access to production data is limited to those who need it.
Session security: secure, HTTP-only session cookies, idle session timeout, cross-site request forgery protection, rate limiting, and account lockout after repeated failed sign-ins.
Audit logging: access to sensitive records, such as call recordings and matter records, data exports, and connecting or disconnecting integrations are logged.
Data minimization: per-agent retention periods with automatic purge; optional redaction of personal information in call recordings and transcripts; optional minimization of health details in follow-up messages, matter emails, and built-in integrations (Clio, Google Sheets), while webhooks deliver the data the Customer configures; WhatsApp notifications that contain no case details; and legal hold on individual records.
Outbound connections: webhooks are delivered only over HTTPS, are signed, and are checked against requests to internal networks.
Widget protection: the chat widget loads only on domains the Customer authorizes.
AI providers: used under business terms that prohibit training on Customer Personal Data, as described in Section 4.3.
Incident response: a documented incident response procedure, including the notice commitments in Section 3.3.
Personnel: personnel with access to Customer Personal Data are bound by confidentiality obligations.

Annex III: Subprocessors

Amazon Web Services (United States): cloud hosting, database, file storage, backups, and encryption keys.
OpenAI and Anthropic (United States): AI response generation and conversation summaries.
Retell AI (United States): phone and web voice calls, speech-to-text, text-to-speech, and the voice agent’s AI responses, including call transcripts and, where enabled, call recordings.
Telnyx (United States): telephone numbers, call routing, and call transfer.
Meta Platforms (WhatsApp Business Platform): account notifications sent from our own WhatsApp Business account (such as call summaries, appointment counts, and callback requests), which contain no case details.
Bright Data: retrieving publicly available web pages the Customer adds to its knowledge base.
Amazon Simple Email Service (United States, part of Amazon Web Services): delivery of account, appointment, and follow-up emails.
Sentry: application error monitoring.
Enabled by the Customer: Google (Calendar), Microsoft (Outlook Calendar), and Clio (Clio Grow and Clio Manage: leads, contacts, and matters) receive data only when the Customer connects them, and only to perform that integration.

Dodo Payments acts as our merchant of record for billing and processes the Customer’s billing details, not Customer Personal Data. The current list is also published in our Privacy Policy.