Quarrington Care Network - Data Processing Agreement (signed)
Documentexecuted Quarrington Care Network: documents · dpa · executed · 2026-04-16
Executed DPA between Quarrington Care Network and BB-Demo, effective 16 Apr 2026, signed by Jordan Pike for BB-Demo. The brain runs in the customer's own Snowflake account. It states no price, availability or response-time figures.
What it says
What this says
Current to 11 Oct 26Executed DPA between Quarrington Care Network and BB-Demo, effective 16 Apr 2026, signed by Jordan Pike for BB-Demo. The brain runs in the customer's own Snowflake account. It states no price, availability or response-time figures.
What it is: an executed DPA that sits alongside the MSA, the Growth tier order form and a business associate agreement for protected health information. Where the agreements differ on that information, "the stricter obligation applies".
Commits: processing only on documented instructions, data kept in the customer's Snowflake account, and incident notice "without undue delay". Sub-processors need prior written notice, and the customer may audit on reasonable notice.
Unusual: the Supplier "will not withhold from the Customer's security team any known issue that bears on the processing". Staff access from the UK is a transfer the Supplier must name the mechanism for.
Not settled: the customer signatory is only "Authorised signatory", so the evidence does not show who signed. Price, term and service levels sit in the order form, which this document does not contain.
As found in this document
Current to 9 Oct 26- Date signed16 Apr 2026Source: object_read:doc_079_006
- Date start16 Apr 2026Source: object_read:doc_079_006
- Processing basisprocess personal data only on the Customer's documented instructionsprocess personal data only on the Customer's documented instructions · Source: object_read:doc_079_006
- Data locationPersonal data therefore stays in the Customer's own Snowflake accountPersonal data therefore stays in the Customer's own Snowflake account · Source: object_read:doc_079_006
- Security incident noticenotify the Customer without undue delay after becoming aware of a security incidentnotify the Customer without undue delay after becoming aware of a security incident · Source: object_read:doc_079_006
- Sub-processor changetells the Customer in writing before adding or replacing a sub-processortells the Customer in writing before adding or replacing a sub-processor · Source: object_read:doc_079_006
- Return and deletionremove the company brain's indexes and any Supplier-held copies of personal data, and will confirm in writingremove the company brain's indexes and any Supplier-held copies of personal data, and will confirm in writing · Source: object_read:doc_079_006
- Cross-region transferwill not move personal data outside the Customer environment to another region without the Customer's written agreementwill not move personal data outside the Customer environment to another region without the Customer's written agreement · Source: object_read:doc_079_006
The document
Body
Quarrington Care Network - Data Processing Agreement (signed)
Status: Executed Version: 1 Effective date: 16 Apr 2026
Parties
This Data Processing Agreement (the "Agreement") is made between:
- Quarrington Care Network, a home-health and hospice operator headquartered in Chicago, with branches across Illinois, Indiana and Wisconsin (the "Customer"); and
- BB-Demo, a London data business that provides the company brain (the "Supplier").
This Agreement sits alongside the Master Services Agreement and the order form for the Growth tier agreed between the parties, and alongside the business associate agreement that governs protected health information. If this Agreement and the business associate agreement differ on the handling of protected health information, the stricter obligation applies.
Clause One: Purpose and scope
The Supplier provides the company brain to the Customer so that its referral-relations and patient-services teams can see each referring hospital's calls, tickets and contracts together. In doing so the Supplier may process personal data on the Customer's behalf. This Agreement sets out how that processing is carried out.
Read the whole document (8,567 characters)
The Supplier processes personal data only to provide the services described in the order form and only on the Customer's documented instructions. This Agreement is the Customer's complete set of instructions unless the Customer gives further written instructions that the Supplier accepts.
Clause Two: Definitions
| Term | Meaning |
|---|---|
| Personal data | Any information relating to an identified or identifiable person that the Supplier processes for the Customer under the services |
| Protected health information | Personal data that is subject to HIPAA and the business associate agreement |
| Processing | Any operation performed on personal data, including storing, indexing, querying and deleting |
| Sub-processor | A third party engaged by the Supplier that processes personal data for the Customer |
| Security incident | A breach of security leading to accidental or unlawful loss, alteration, disclosure of or access to personal data |
| Customer environment | The Customer's own Snowflake account in which the company brain is built and run |
Clause Three: Nature of the processing
| Item | Description |
|---|---|
| Subject matter | Provision of the company brain to the Customer |
| Duration | The term of the order form, plus the return and deletion period in Clause Ten |
| Nature | Connecting source systems, indexing records, and answering questions over them |
| Purpose | Giving Customer teams one searchable view of referral and patient-services activity |
| Categories of data subjects | Referring hospital contacts, Customer staff, and patients or their representatives where they appear in connected records |
| Types of personal data | Names, work contact details, call recordings and transcripts, emails, support tickets and contract records |
| Special categories | Health-related information that may appear in connected records, handled as protected health information |
Clause Four: Where the data lives
The company brain is built and run inside the Customer environment. Personal data therefore stays in the Customer's own Snowflake account, under the Customer's own access controls. The Supplier does not copy personal data out of the Customer environment except where this Agreement or the Customer's written instruction allows it.
The Customer decides which source systems are connected. The Supplier will not connect a source system the Customer has not approved.
Clause Five: Supplier obligations
The Supplier shall:
- process personal data only on the Customer's documented instructions;
- ensure that everyone authorised to process personal data is bound by a duty of confidentiality;
- keep personal data separate from the data of its other customers;
- give the Customer the information it reasonably needs to show compliance with this Agreement;
- tell the Customer without undue delay if it believes an instruction breaches applicable law.
Clause Six: Security
The Supplier maintains technical and organisational measures appropriate to the risk, including:
- access to the Customer environment limited to named staff who need it, using the Customer's own identity controls;
- encryption of personal data in transit and at rest, using the controls available in the Customer's Snowflake account;
- logging of administrative access, with logs available to the Customer on request;
- regular review of who holds access, and prompt removal when a person leaves or changes role.
The Customer is responsible for the security of its own source systems and for the users it admits to the company brain.
Clause Seven: Sub-processors
The Customer gives general authorisation for the Supplier to use sub-processors, provided that the Supplier:
- keeps a current list of sub-processors and makes it available to the Customer;
- tells the Customer in writing before adding or replacing a sub-processor, so the Customer can object on reasonable grounds;
- imposes on each sub-processor obligations no less protective than those in this Agreement; and
- remains responsible to the Customer for each sub-processor's performance.
If the Customer objects and the parties cannot agree an alternative, the Customer may end the affected part of the services.
Clause Eight: Security incidents
The Supplier shall notify the Customer without undue delay after becoming aware of a security incident affecting the Customer's personal data. The notice will describe, as far as it is known, the nature of the incident, the data affected, the likely consequences and the steps taken or proposed. The Supplier will cooperate with the Customer's investigation and with any notification the Customer or the law requires, and will give updates as more becomes known.
Because the Customer is subject to HIPAA, the Supplier will also follow the incident reporting steps in the business associate agreement.
Clause Nine: Assistance and audit
The Supplier shall, taking account of the nature of the processing, help the Customer to respond to requests from data subjects and to meet its own obligations on security, impact assessment and consultation with regulators.
The Customer may audit the Supplier's compliance with this Agreement on reasonable notice and during normal working hours. The Supplier may satisfy an audit request first by providing documentation and answers to a security questionnaire. Both parties will be open with each other, and the Supplier will not withhold from the Customer's security team any known issue that bears on the processing.
Clause Ten: Return and deletion
Because the company brain runs in the Customer environment, the Customer keeps control of its data at all times. When the services end, the Supplier will, at the Customer's choice, remove the company brain's indexes and any Supplier-held copies of personal data, and will confirm in writing that it has done so. The Supplier may keep data only where the law requires and will say so if that applies.
Clause Eleven: International transfers
The Supplier is based in London and its staff may access the Customer environment from the United Kingdom. Where that access involves a transfer of personal data, the Supplier will rely on the transfer mechanism that applies and will tell the Customer which one. The Supplier will not move personal data outside the Customer environment to another region without the Customer's written agreement.
Clause Twelve: Liability and term
Liability under this Agreement is governed by the limitations in the Master Services Agreement. This Agreement takes effect on the effective date above and continues for as long as the Supplier processes personal data for the Customer.
Clause Thirteen: Governing terms
This Agreement forms part of the contract between the parties. If it conflicts with the Master Services Agreement on the processing of personal data, this Agreement prevails. Any change must be in writing and signed by both parties.
Signatures
Signed by the duly authorised representatives of the parties on 16 Apr 2026.
| For Quarrington Care Network | For BB-Demo | |
|---|---|---|
| Name | Authorised signatory | Jordan Pike |
| Title | Authorised signatory of the Customer | Account Executive, US |
| Date | 16 Apr 2026 | 16 Apr 2026 |
| Signature | Signed | Signed |
Customer success contact for this account: Hollie Grieve, BB-Demo.
Unusual terms
Current to 9 Oct 26- stricter obligation prevails over business associate agreement
- no withholding of known issues from security team
- DPA prevails over MSA on personal data