Data Processing Addendum
Effective November 12, 2026
This Data Processing Addendum ("Addendum") is part of the Prevision Terms of Service between the customer ("you") and Jeremy Won, an individual doing business as Prevision ("we"). It applies to personal information in Customer Data that we process for you ("Personal Information").
1. Roles
You decide why and how Personal Information is processed. We process it only on your behalf, as your service provider or processor, under the laws that use those terms, including the Gramm-Leach-Bliley Act and the state insurance and consumer privacy laws that apply to you.
2. Instructions
We process Personal Information only to provide, secure and support the Service, as these Terms and your use of the Service instruct, and as the law requires. We will tell you if we believe an instruction breaks the law. We do not sell or share Personal Information, use it for our own purposes outside the Service, or combine it with other data except as the Service needs to work. We will tell you if we can no longer meet these duties, and you may then take reasonable steps to stop and fix any unauthorized use.
3. Confidentiality
Everyone we allow to process Personal Information is bound by a duty of confidentiality and may see it only as needed for their work.
4. Security
We keep administrative, technical and physical safeguards appropriate to the sensitivity of the information, including:
- Encryption in transit and at rest.
- Separate encryption, with a key held outside the database, for the sensitive answers in a client's intake: Social Security numbers, bank details, payment card numbers, health answers and license or ID numbers. Card security codes are never stored.
- Access limited by role, with every reveal of an encrypted field logged.
- Support access to an account that is read only and logged.
- Separation of each customer's data at the database level.
- Backups and monitoring.
You are responsible for your own users, devices and sign-in security, and for collecting only the Personal Information you need.
5. Subprocessors
You authorize us to use the subprocessors listed on our Subprocessors page. Each is bound by written terms that protect Personal Information at least as well as this Addendum. We will post any new subprocessor at least 15 days before it begins processing Personal Information. You may object on reasonable data protection grounds within that time. If we cannot resolve the objection, you may cancel and receive a prorated refund of prepaid fees for the unused period.
6. Security incidents
If we confirm that Personal Information was accessed or disclosed without authorization while in our care, we will notify you without undue delay, and within 72 hours of confirming it. We will tell you what we know, take reasonable steps to contain it, and help you meet your own notice duties to people, regulators and carriers.
7. Requests from people
If a person asks us directly to access, correct or delete Personal Information you control, we will send the request to you and not answer it ourselves, unless the law requires. We will help you answer requests through the Service's features or as you reasonably ask.
8. Return and deletion
You can export Customer Data while your account is active and for 90 days after it closes. After that, we delete Personal Information from the live Service, and from backups as they expire in the normal cycle, unless the law requires us to keep it.
9. Information and audits
On written request no more than once a year, we will answer reasonable questions about our safeguards, and give you the information you need to show your own regulators and carriers that you oversee your service providers.
10. HIPAA
The Service is not built for protected health information governed by HIPAA, and we do not sign business associate agreements. Do not store such information in the Service.
11. Order of precedence
If this Addendum conflicts with the Terms of Service about Personal Information, this Addendum controls.