Quabbin Clinical Research - Data Processing Agreement (signed)
Documentexecuted Quabbin Clinical Research · dpa · executed · 23 Mar 2026
Executed Data Processing Agreement signed 23 Mar 2026 between Quabbin Clinical Research (controller) and BG-Demo (processor), under the Master Services Agreement. It states no availability, P1 response time or price.
What it says
What this says
As at Fri 9 Oct 2026Executed Data Processing Agreement signed 23 Mar 2026 between Quabbin Clinical Research (controller) and BG-Demo (processor), under the Master Services Agreement. It states no availability, P1 response time or price.
What it is: a standard data processing agreement. It says it "applies whenever the Supplier handles personal data on the Customer's behalf" and sits under the Master Services Agreement signed the same day.
Commits: BG-Demo processes personal data only on documented instructions, binds staff with access to confidentiality, applies access control and logging, and tells the customer "without undue delay" of a breach. It must give notice of any new sub-processor and a fair chance to object.
Unusual: nothing off the standard terms. The data stays in the customer's own Snowflake account. On a conflict over personal data, this agreement prevails over the Master Services Agreement.
Not settled: no price, service levels, connector dates, term or renewal. The customer signatory is shown only as an authorised signatory, with no name. The agreement does not say how many days the breach notice or the sub-processor notice takes.
As found in this document
As at Fri 9 Oct 2026- Date signed23 Mar 2026Source: the AI read of this record
- Processing instructionsThe Supplier processes personal data only to provide the Services and only on the Customer's documented instructions.Source: the AI read of this record
- Breach notificationThe Supplier will tell the Customer without undue delay after becoming aware of a personal data breach affecting the Customer's data.Source: the AI read of this record
- Sub-processorsThe Supplier will not appoint a sub-processor to handle the Customer's personal data without telling the Customer first, and will give the Customer a fair opportunity to object.Source: the AI read of this record
- Return and deletionWhen the Master Services Agreement ends, the Supplier will, at the Customer's choice, return or delete the personal data it holds on the Customer's behalf.Source: the AI read of this record
- AuditThe Supplier will allow reasonable audits on sensible notice and during business hours.Source: the AI read of this record
Body
Quabbin Clinical Research - Data Processing Agreement (signed)
Status: Executed Version: 1 Signed: 23 March 2026
Parties and purpose
This Data Processing Agreement is made between Quabbin Clinical Research (the Customer, acting as controller) and BG-Demo (the Supplier, acting as processor). It sits under the Master Services Agreement signed on the same day and applies whenever the Supplier handles personal data on the Customer's behalf.
Definitions
Terms such as personal data, processing, controller, processor and data subject have their ordinary data protection meaning. The Services are B-Viz and the related implementation work under the Master Services Agreement.
Subject matter and nature of processing
B-Viz is built and run inside the Customer's own Snowflake account. It indexes data from the systems the Customer chooses to connect, such as its CRM, call recordings, emails, helpdesk tickets and finance records, so that the Customer's sponsor-relationship, study-management and finance teams can query them together.
Read the whole document (3,836 characters)
The Supplier processes personal data only to provide the Services and only on the Customer's documented instructions. The Customer's agreement to the connector list in the implementation plan, and its later changes to that list, are such instructions.
Customer responsibilities
- The Customer decides which systems and which data are connected.
- The Customer confirms that it has a lawful basis for the processing it instructs.
- The Customer tells the Supplier promptly if an instruction changes.
Supplier responsibilities
- Process personal data only on the Customer's instructions, unless the law requires otherwise, in which case the Supplier will say so beforehand where it is allowed to.
- Make sure that anyone at the Supplier with access is bound by confidentiality.
- Apply appropriate technical and organisational security measures, including access control and logging.
- Help the Customer to answer requests from data subjects, within what is reasonable given the nature of the Services.
- Help the Customer with security reviews, impact assessments and audits that relate to the Services.
Location of data
Because B-Viz runs inside the Customer's Snowflake account, the Customer's data stays in that account. The Supplier does not copy it out to systems of its own except where the Customer instructs it to in writing.
Sub-processors
The Supplier will not appoint a sub-processor to handle the Customer's personal data without telling the Customer first, and will give the Customer a fair opportunity to object. The Supplier stays responsible for any sub-processor it appoints.
Personal data breach
The Supplier will tell the Customer without undue delay after becoming aware of a personal data breach affecting the Customer's data. It will give the facts it has, the likely effect and the steps taken, and will keep the Customer updated as it learns more.
Return and deletion
When the Master Services Agreement ends, the Supplier will, at the Customer's choice, return or delete the personal data it holds on the Customer's behalf and remove its access to the Customer's Snowflake account, unless the law requires it to keep some of it.
Audit and information
The Supplier will provide the information the Customer reasonably needs to show compliance with this agreement, and will allow reasonable audits on sensible notice and during business hours.
Order of precedence
If this Data Processing Agreement conflicts with the Master Services Agreement on the handling of personal data, this agreement prevails.
Signatures
For BG-Demo
Name: Jordan Pike Title: Account Executive, US Date: 23 March 2026
For Quabbin Clinical Research
Title: Authorised signatory for the Customer Date: 23 March 2026