1. Purpose
This Addendum supplements the MSA/DPA by defining responsibility for:
- data accuracy;
- unauthorized access;
- security incidents;
- credentials;
- third-party processors;
- backups/recovery;
- data loss;
- payment data;
- regulatory cooperation.
2. Responsibility principle
Each party is responsible for harm to the extent caused by its own:
- breach of contract;
- unlawful processing;
- negligence;
- willful misconduct;
- security-control failure;
- unauthorized instructions/actions.
No party is responsible for the other's independent clinical malpractice or unlawful conduct merely because both use the same platform.
3. Dial In Doctor responsibilities
Dial In Doctor is responsible for reasonable platform controls within its control, including:
- authentication implementation;
- server-side authorization;
- role/doctor/patient scoping;
- secure credential storage;
- secrets management;
- provider-webhook verification;
- application security patches;
- contractual subprocessor management;
- backup/recovery as contracted;
- incident-response process.
4. Customer responsibilities
Customer is responsible for:
- lawful authority for data it submits/instructs Dial In Doctor to process;
- accurate workforce information;
- clinician licensing/credentialing under Customer control;
- user onboarding/offboarding;
- secure Customer endpoints/networks;
- protecting credentials;
- appropriate role assignment;
- not sharing accounts;
- promptly reporting compromised accounts;
- clinical-record accuracy created by Customer personnel.
5. Patient/user responsibility
Patients/users are expected to:
- protect their own PIN/device;
- provide accurate information;
- report suspected compromise;
- not use another person's account.
This does not shift Dial In Doctor's own security obligations to the patient.
6. Data accuracy
Source-provided data
The party entering/supplying data is responsible for reasonable accuracy at entry.
Platform transformations
Dial In Doctor is responsible for correctly implementing approved platform transformations/calculations within the software, such as:
- payment-state logic;
- document formatting;
- settlement calculations;
- identity/reference mapping.
Clinical corrections
Clinical records should be corrected through traceable amendment processes where deletion would undermine medical/legal integrity.
7. Payment data liability
Payment truth must follow verified provider data.
Dial In Doctor must not:
- mark Paid from browser return;
- invent processor fees;
- discard evidence of duplicate provider payments.
A payment-provider outage or lost callback does not authorize a fabricated local success. Dial In Doctor must provide reasonable reconciliation procedures for provider-success/local-pending cases.
8. Credential/security incidents
Dial In Doctor-caused incident
Where caused by Dial In Doctor's failure to meet contractual security duties, Dial In Doctor bears responsibility subject to the Agreement and applicable law.
Customer-caused incident
Where caused by compromised Customer-managed devices, improper role assignment, shared credentials, or Customer's unauthorized export, Customer bears responsibility to the extent caused by Customer.
Shared cause
Responsibility is allocated proportionately to causation to the extent permitted by law.
9. Subprocessors
Dial In Doctor remains responsible for its processor obligations when using approved subprocessors, subject to:
- force majeure/third-party limitations expressly allowed by law/contract;
- Customer's separately selected third party where Customer directly contracts and controls that provider.
10. Data loss and backups
Dial In Doctor will maintain the backup/recovery commitments in the contracted service tier.
No backup system guarantees zero loss.
Liability for recoverable data loss should consider:
- agreed recovery point/recovery time targets;
- whether Customer ignored required export/backup responsibilities;
- whether the loss arose from an excluded/unlawful Customer action;
- applicable mandatory law.
11. Unauthorized exports / downstream copies
Once an authorized Customer user exports/downloads data outside Dial In Doctor-controlled systems:
- Customer is responsible for its downstream storage/use if the export was Customer-directed;
- Dial In Doctor remains responsible for any unauthorized export caused by a Dial In Doctor security defect.
12. Security notifications
Neither party should delay incident reporting merely to determine final liability.
The parties will first:
- contain;
- preserve evidence;
- protect patients/data;
- meet notification duties;
- then determine root cause and allocation.
13. Regulatory inquiries
Each party will cooperate reasonably with lawful regulatory/court requests relating to its responsibilities.
A party should not make admissions on behalf of the other without authority.
14. Excluded categories
No contractual limitation excludes liability where exclusion is prohibited, including where applicable:
- fraud;
- willful misconduct;
- deliberate unlawful disclosure;
- non-waivable consumer/patient rights;
- other mandatory statutory/professional liability.
15. Liability caps
Unless the applicable Order Form expressly states a different negotiated cap, the default cap in the MSA applies: aggregate liability for capped claims is limited to the fees paid or payable under the affected Order Form during the 12 months immediately preceding the event giving rise to the claim.
Confidentiality, data-protection, and security claims use the same default cap unless an Order Form expressly provides an enhanced cap.
No contractual cap applies to the extent prohibited by applicable law, including fraud, willful misconduct, deliberate unlawful disclosure, or other non-excludable liability.
16. No clinical-liability transfer
Dial In Doctor's platform security obligations do not make Dial In Doctor responsible for an independent clinician's negligent medical judgment.
Conversely, clinician responsibility does not excuse a Dial In Doctor software/security failure.
17. Claims process
A party asserting a data/security claim should provide:
- date/time;
- affected system/data categories;
- known incident facts;
- mitigation taken;
- claimed loss;
- supporting evidence.
Both parties should preserve relevant logs/evidence subject to privacy and legal restrictions.
18. Priority
If this Addendum conflicts with mandatory law, mandatory law controls.
For data-processing duties, the DPA controls over this Addendum unless the signed Order Form expressly states otherwise.