BeyondX LLCWhatsApp Us

DATA PROCESSING ADDENDUM (subprocessor disclosure + commitments)

Status: APPROVED FOR PRODUCTION USE — founder approval 2026-09-19 · Version 1.0 · Attorney review scheduled; not yet completed. (Record note: the text below is the original draft; approval was given by the founder, and no licensed attorney has reviewed it.) Not a signed agreement; replaces none.

Roles

Controller: the Client (decides whose calls are handled and for what purpose). Processor: BeyondX LLC (operates the receptionist). Sub-processors: Vapi, OpenAI, Soniox, Stripe, Resend (Twilio when enabled).

Commitments

  1. Process call data only to deliver the service and the client's reports.
  2. Bind sub-processors by contract where available (Vapi DPA to be executed before medical-adjacent clients).
  3. Honor deletion requests within 30 days; delete on cancellation.
  4. Notify the client of subprocessor changes.
  5. No cross-border transfer beyond the US data centers of the named subprocessors.

NOT covered (honest)

  • No BAA with Vapi is signed. Health data is prohibited (§5 AUP) until one exists.
  • This document does not by itself satisfy GDPR Article 28, HIPAA BA requirements, or any other regime's

form requirements. Counsel must finalise it before the corresponding client verticals are sold.