1. Personal Data Transfers from Switzerland
a. The term “Member State” as used in the European Commission’s Standard Contractual Clauses for Personal Data Transfers to Third Countries, including these Annexes, shall be interpreted as including Switzerland and data subjects in Switzerland.

b. Data subjects with their regular place of residence in Switzerland are allowed to bring a lawsuit in Switzerland against either the data exporter or the data importer in accordance with Clause 18(c) of the European Commission’s Standard Contractual Clauses for Personal Data Transfers to Third Countries.

c. The European Commission’s Standard Contractual Clauses for Personal Data Transfers to Third Countries will additionally protect data pertaining to Swiss legal entities until the revised Swiss Federal Act on Data Protection enters into force.

2. Standard Data Protection Clauses to be issued by the Information Commissioner under S119A(1) Data Protection Act 2018 – International Data Transfer Addendum to the EU Commission Standard Contractual Clauses – VERSION B1.0, in force 21 March 2022
‍
This Addendum has been issued by the UK Information Commissioner for Parties making Restricted Transfers. The Information Commissioner considers that it provides Appropriate Safeguards for Restricted Transfers when it is entered into as a legally binding contract.

Part 1: Tables
Table 1: Parties

Table 2: Selected SCCs, Modules and Selected Clauses‍

Table 3: Appendix Information
“Appendix Information” means the information which must be provided for the selected modules as set out in the Appendix of the Approved EU SCCs (other than the Parties), and which for this Addendum is set out in:

Annex 1A: List of Parties: See Exhibit B
‍Annex 1B: Description of Transfer: See Exhibit B
‍Annex II: Technical and organisational measures including technical and organisational measures to ensure the security of the data: See Exhibit C
‍Annex III: List of Sub-processors (Modules 2 and 3 only): See Exhibit D

Table 4: Ending this Addendum when the Approved Addendum Changes

Part 2: Mandatory Clauses

A. LIST OF PARTIES
Data exporter(s):
1. Name: As set forth in the Order Form
Address: As set forth in the Order Form
Contact person’s name, position and contact details: As set forth in the Order Form
Activities relevant to the data transferred under these Clauses: Receipt of the services in accordance with the underlying agreement.
Signature and date: As set forth in the Order Form
Role (controller/processor): Controller
‍
Data importer(s):
1. Name:  Modern Health Arizona PLLC
Address: 650 California St Floor 7, San Francisco, CA 94108, Office 07-128
Contact person’s name, position and contact details: Kimyatta Holder, Privacy Officer, privacy@modernhealth.com
Activities relevant to the data transferred under these Clauses: The data importer provides the services to the data exporter in accordance with the underlying agreement. 
Signature and date: As set forth in the Order Form
Role (controller/processor): Processor
‍
B. DESCRIPTION OF TRANSFER
Categories of data subjects whose personal data is transferred
☒ Eligible employees (staff and employees, including present workers, deemed eligible for Modern Health related benefits)
☐ Other Categories of Data Subjects:  ________________________________________
‍
Categories of personal data transferred
☒   Eligibility File:  Name, contact information, and any other demographic information specified in Section IV(2)(a) of the Order Form for each individual enrollee eligible for Modern Health related benefits.   
☐ Other data categories:  ______________________________________________

Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialised training), keeping a record of access to the data, restrictions for onward transfers or additional security measures.
☒ No sensitive data 

C. COMPETENT SUPERVISORY AUTHORITY
The competent supervisory authority shall be the supervisory authority that has jurisdiction over the Data Exporter. 

Technical and Organisational Measures Including Technical and Organisational Measures to Ensure the Security of the Data

Physical Security 
Modern Health is exclusively hosted in the United States on AWS who provides robust, physical data center security and environmental controls. 

Network Security 
Modern Health controls access to our production networks through the use of strictly defined rules and requires multi-factor authentication and encrypted connections. We also utilize intrusion detection systems in our production network and advanced email filtering in our corporate network to identify potential security threats.

Application Security 
Modern Health employs both internal and external testing of our product. We regularly scan source code and systems for vulnerabilities and perform necessary patching and updates based on those results. On an annual basis we utilize a nationally recognized firm to test our application and network to provide ourselves and our customers assurance that data is being robustly protected. Our infrastructure uses industry standard security controls to protect against threats.

Training and Awareness 
Modern Health requires all employees and contractors to sign a confidentiality agreement prior to commencement. During the onboarding process, security awareness and privacy training is delivered to all new hires and we continually publicize security alerts through our internal communication channels.

Backup and Disaster Recovery 
Modern Health utilizes geographically separate environments to ensure data availability and uptime. In the unlikely event of simultaneous failure of both environments, Modern Health maintains daily backups and a disaster recovery policy that is tested and verified on an annual basis.

Data Protection 
Modern Health encrypts data in transit with a minimum of TLS 1.2 using strong cipher suites. Modern Health also encrypts data at rest with AES256. At end-of-life, AWS destroys disks per NIST 800-88 standards.

1. Access control to systems  
Unauthorized access to IT systems must be prevented.
Technical (ID/password security) and organizational (user master data) measures for user identification and authentication:

2. Access control to data
Activities in IT systems not covered by the allocated access rights must be prevented.
Requirements-driven definition of the authorization scheme and access rights, and monitoring and logging of accesses:

3. Disclosure control
Aspects of the disclosure of Personal Data must be controlled: electronic transfer, data transport, transmission control, etc.
Measures to transport, transmit and communicate or store data on data media (manual or electronic) and for subsequent checking:

4.Input control
Full documentation of data management and maintenance must be maintained.
Measures for subsequent checking whether data have been entered, changed, or removed (deleted), and by whom:

5. Job control
Processing must be carried out according to Instructions.
Measures (technical/organizational) to segregate the responsibilities between the Data Controller and the Data Processor:

6.Availability control
The data must be protected against accidental destruction or loss. 
Measures to assure data security (physical/logical):

7. Segregation control
Data collected for different purposes must also be Processed separately.
Measures to provide for separate Processing (storage, amendment, deletion, transmission) of data for different purposes:

LIST OF SUB-PROCESSORS
The controller has authorized the use of the following sub-processors:
Sub-processors listed in Modern Health’s Security Portal available at: https://security.joinmodernhealth.com/