5. Data Processing Agreement (DPA)

O.T. Wizard Data Processing Agreement (DPA) Effective Date: April 16, 2025

Last Updated: April 16, 2025

This Data Processing Agreement ("Agreement") is entered into between Learning Charms, Inc. ("Processor," "we," "our," or "us") and you, the customer subscribing to O.T. Wizard ("Controller," "you," or "your"). This Agreement supplements our Terms of Service and Privacy Policy.

1. Purpose and Scope

1.1. This Agreement governs the processing of personal data by O.T. Wizard on behalf of the Controller under applicable data protection laws, including but not limited to the GDPR, COPPA, FERPA, and HIPAA (where applicable).

1.2. The Processor provides a cloud-based software service that supports pediatric occupational therapy evaluations and documentation.

2. Definitions

• Personal Data: Any information relating to an identified or identifiable natural person.

• Processing: Any operation performed on Personal Data, including collection, storage, use, or disclosure.

• Controller: The entity that determines the purposes and means of processing Personal Data.

• Processor: The entity that processes Personal Data on behalf of the Controller.

3. Data Processing Obligations

3.1. The Processor shall process Personal Data only on documented instructions from the Controller, unless required by law.

3.2. The Processor will ensure that persons authorized to process Personal Data have committed to confidentiality.

3.3. The Processor will implement appropriate technical and organizational measures to protect Personal Data, as detailed in our Privacy Policy.

3.4. The Processor shall assist the Controller in fulfilling data subject rights requests, including access, rectification, erasure, and portability.

3.5. Upon termination of the Agreement, the Processor shall delete or return all Personal Data to the Controller, unless retention is required by law.

4. Sub-Processors

4.1. The Controller authorizes the Processor to use sub-processors for cloud hosting, payment processing, and email communication services, provided they meet equivalent data protection obligations.

4.2. A list of current sub-processors is available upon request.

4.3. The Processor will inform the Controller of any intended changes concerning the addition or replacement of sub-processors.

5. Data Breach Notification

5.1. In the event of a Personal Data breach, the Processor will notify the Controller without undue delay after becoming aware of the breach.

5.2. The notification will include details of the breach, potential impact, and corrective actions taken.

6. Audit Rights

6.1. The Controller has the right to audit the Processor’s compliance with this Agreement.

6.2. Audits shall be conducted with reasonable notice, during normal business hours, and without disrupting Processor operations.

6.3. Alternatively, the Processor may provide relevant compliance documentation or third-party audit reports.

7. International Data Transfers

7.1. Where Personal Data is transferred outside the European Economic Area (EEA), the Processor will ensure appropriate safeguards, such as Standard Contractual Clauses or equivalent mechanisms.

8. Liability and Indemnification

8.1. The Processor’s liability under this Agreement is subject to the limitations outlined in our Terms of Service.

8.2. The Controller agrees to indemnify and hold harmless the Processor from claims arising from the Controller's failure to comply with applicable data protection laws.

9. Term and Termination

9.1. This Agreement remains in effect as long as the Processor processes Personal Data on behalf of the Controller.

9.2. Upon termination of the underlying services, this Agreement will terminate automatically.