Data Processing Agreement
Hey, Lexxi LLC ("Service Provider")
Last updated: October 18, 2026
This Data Processing Agreement (“DPA”) is entered into by and between Hey, Lexxi LLC (“Service Provider” or “Hey, Lexxi”) and the Subscriber identified in the applicable order form (“Business”), and forms part of the Terms of Service or other agreement between the parties governing the Hey, Lexxi Services (the “Agreement”). It takes effect on the earlier of the date of last signature or the date the Business accepts the Agreement, including by accepting Hey, Lexxi’s Master Services Agreement at sign-up. It governs Hey, Lexxi’s Processing of Personal Information on the Business’s behalf. Where terms differ between this DPA and the Agreement, this DPA controls with respect to the Processing of Personal Information, subject to Sections 13 and 14.
1. Definitions
“Personal Information,” “Business,” “Service Provider,” “Sell,” “Share,” “Process/Processing,” “Consumer,” “Deidentified,” and “Sensitive Personal Information” have the meanings given in the California Consumer Privacy Act, as amended by the California Privacy Rights Act, and its regulations (collectively, “CCPA/CPRA”). “Personal Information” as used here means Personal Information contained in Subscriber Data that Hey, Lexxi Processes on the Business’s behalf under the Agreement. “Applicable Privacy Law” means all data-protection and privacy laws applicable to the Processing, including the CCPA/CPRA and, where applicable, the California Confidentiality of Medical Information Act (“CMIA”). “Security Incident” means a security event that results in loss of, or damage to, the confidentiality, availability, integrity, or privacy of Personal Information Processed by Hey, Lexxi under this DPA. A Security Incident does not include unsuccessful attempts or activities that do not compromise the security of Personal Information, such as pings, port scans, denied log-in attempts, or other routine network events. Capitalized terms not defined in this DPA, including “Services” and “Subscriber Data,” have the meanings given in the Agreement.
2. Roles of the Parties
The Business is the “business” (and, where applicable, controller) that determines the purposes and means of Processing Personal Information. Hey, Lexxi is a “service provider” (and, where applicable, processor) that Processes Personal Information solely on behalf of, and under the documented instructions of, the Business. The Agreement and this DPA constitute the Business’s complete and final instructions. Hey, Lexxi will inform the Business if, in its reasonable opinion, an instruction infringes Applicable Privacy Law, and is not required to follow that instruction. Any instruction outside the scope of the Agreement and this DPA requires the parties’ written agreement, which may include additional fees.
3. Service Provider Obligations and Restrictions
Hey, Lexxi will Process Personal Information only as necessary to provide the Services, for the business purposes set out in Annex 1, and for the other purposes permitted to a service provider under the CCPA/CPRA, and is prohibited from:
Selling or Sharing Personal Information;
retaining, using, or disclosing Personal Information for any purpose other than the business purposes specified in this DPA, including outside the direct business relationship between the parties, except as permitted by Applicable Privacy Law;
retaining, using, or disclosing Personal Information outside the Agreement except where required by law; and
combining Personal Information received from the Business with personal information from other sources, except as permitted by the CCPA/CPRA to perform a business purpose.
Hey, Lexxi certifies that it understands and will comply with these restrictions. Hey, Lexxi will comply with its applicable obligations under the CCPA/CPRA and will provide the same level of privacy protection as the CCPA/CPRA requires of businesses. Hey, Lexxi will notify the Business promptly if it determines it can no longer meet its obligations under Applicable Privacy Law, and the Business may, upon notice, take reasonable steps to stop and remediate unauthorized Processing. The Business may also take reasonable and appropriate steps, as described in Section 11, to ensure that Hey, Lexxi uses Personal Information in a manner consistent with the Business’s obligations under the CCPA/CPRA.
Permitted purposes. The permitted purposes include: (a) engaging subprocessors in accordance with Section 6; (b) complying with applicable law, legal process, or a civil, criminal, or regulatory inquiry, investigation, subpoena, or summons; (c) detecting, investigating, and protecting against Security Incidents, fraud, and illegal activity; (d) establishing, exercising, or defending legal claims; and (e) building or improving the quality of the Services, provided that Hey, Lexxi does not use Personal Information to build or modify profiles for use in providing services to another business, and does not use Personal Information to train, fine-tune, or improve any machine-learning model.
Deidentified information. Where Hey, Lexxi creates or uses Deidentified information derived from Personal Information, Hey, Lexxi will: (a) take reasonable measures to ensure that the information cannot be associated with a Consumer or household; (b) publicly commit to maintain and use the information only in deidentified form and not to attempt to reidentify it, except as permitted by Applicable Privacy Law; and (c) contractually obligate any recipient of the information to comply with these requirements.
4. Confidentiality and Personnel
Hey, Lexxi will ensure that personnel authorized to Process Personal Information are bound by appropriate confidentiality obligations and are limited to those who need access to provide the Services, consistent with the principle of least privilege.
5. Security
Hey, Lexxi will implement and maintain reasonable administrative, technical, and physical safeguards appropriate to the nature of the Personal Information, as further described in Annex 2, designed to protect Personal Information against unauthorized or unlawful Processing, access, loss, destruction, or damage. Hey, Lexxi does not currently hold a SOC 2 or equivalent third-party attestation and makes no such representation in this DPA. The Business has reviewed the measures described in this DPA and the Agreement and agrees that, taking into account the nature of the Personal Information it submits, they provide an appropriate level of protection.
6. Subprocessors
The Business authorizes Hey, Lexxi to engage subprocessors, including providers of hosting, infrastructure, and artificial-intelligence services, to Process Personal Information. Hey, Lexxi will impose data-protection and security obligations on each subprocessor that are no less protective than those in this DPA, and remains responsible for its subprocessors’ performance to the extent required by Applicable Privacy Law. Hey, Lexxi will make its current list of subprocessors available on request and will provide notice of intended additions, by email or by updating that list, allowing the Business a reasonable opportunity to object on reasonable data-protection grounds. If the parties cannot resolve an objection in good faith within thirty (30) days, the Business’s sole and exclusive remedy is to terminate the affected Services by written notice.
7. Assistance to the Business; Consumer Rights
Taking into account the nature of the Processing, Hey, Lexxi will provide reasonable assistance to enable the Business to respond to verifiable Consumer requests to know, access, delete, correct, or opt out, and to fulfill the Business’s obligations under Applicable Privacy Law. This assistance applies to the extent the Business cannot reasonably respond using the functionality of the Services, and the Business will reimburse Hey, Lexxi’s reasonable costs for assistance beyond what Hey, Lexxi ordinarily provides. If Hey, Lexxi receives a Consumer request directly, it will, where lawful, direct the Consumer to the Business or promptly notify the Business. If Hey, Lexxi receives a subpoena, court order, or other legal demand for Personal Information, it will, where lawful, notify the Business so that the Business may seek a protective order or other remedy, and Hey, Lexxi may disclose Personal Information to the extent legally required.
8. Sensitive and Medical Information
Where Personal Information includes Sensitive Personal Information or medical information subject to the CMIA, Hey, Lexxi will Process it only as necessary to provide the Services and will not use it for the purpose of inferring characteristics about a Consumer or for any purpose other than those permitted under the CCPA/CPRA, the CMIA, and this DPA. The Business is responsible for ensuring it has a lawful basis and any required consents or authorizations to provide such information to Hey, Lexxi. The Business will not submit Sensitive Personal Information or medical information that is not reasonably necessary for the requested Services.
9. Security Incidents
Hey, Lexxi will notify the Business without undue delay after becoming aware of a Security Incident, and will provide information reasonably available to assist the Business in meeting its notification obligations. The Business is responsible for any notifications to Consumers, regulators, or other parties that it is required to make. Hey, Lexxi’s notification of, or response to, a Security Incident is not an acknowledgment of fault or liability. Except where Applicable Privacy Law requires otherwise, the Business will consult with Hey, Lexxi before it names Hey, Lexxi in any notice to Consumers, regulators, or the public about a Security Incident.
10. Deletion and Return
Hey, Lexxi does not provide records-retention, archiving, or backup services for the Business. Hey, Lexxi may delete case materials and Output in accordance with its retention practices, and the Business is responsible for keeping its own copies of the materials it submits and of any Output it needs. Upon expiry or termination of the Agreement, or on the Business’s earlier written request, Hey, Lexxi will delete, de-identify, or return Personal Information that it then holds on the Business’s behalf, in accordance with the Agreement, except copies retained in routine backups (deleted on their ordinary cycle) or as required by law, in which case Hey, Lexxi continues to protect the information under this DPA.
11. Audits
Hey, Lexxi will make available to the Business information reasonably necessary to demonstrate compliance with this DPA. The Business may, on reasonable prior notice, no more than once per year (absent a Security Incident or regulatory requirement), and subject to confidentiality, assess Hey, Lexxi’s compliance through Hey, Lexxi’s responses to a reasonable written security questionnaire or relevant documentation. Any assessment is at the Business’s expense, does not include on-site inspection of, or direct access to, Hey, Lexxi’s facilities or systems except as required by law, and will not require disclosure of other customers’ data or of privileged information. Hey, Lexxi may satisfy this Section by providing a copy or summary of any third-party audit report or certification it then holds. All information provided under this Section is Hey, Lexxi’s confidential information.
12. Business Responsibilities
The Business is responsible for: (a) determining, through its own due diligence, whether the Services and this DPA satisfy the Business’s own obligations under Applicable Privacy Law in every jurisdiction in which it operates, and for its own compliance with that law; (b) establishing and maintaining its own administrative, technical, and physical security measures for its systems and any data it exports from or stores outside the Services; (c) obtaining all consents, authorizations, and lawful bases required to provide Personal Information to Hey, Lexxi; (d) notifying Hey, Lexxi in writing as soon as reasonably possible of any requirement, issue, or potential non-compliance of which it becomes aware and that Hey, Lexxi should reasonably know about; (e) ensuring that its instructions to Hey, Lexxi, and its submission of Personal Information to the Services, comply with Applicable Privacy Law; and (f) submitting Personal Information only through the upload functions of the Services, and never by email, chat, support request, or any other channel. Hey, Lexxi is not a party to, and is not responsible for, any arrangement between the Business and its own clients or other third parties (including employers, insurance carriers, third-party administrators, insurance groups, or insurance administrators). The Business’s indemnification obligations under the Agreement extend to third-party claims arising from the Business’s breach of this DPA or of Applicable Privacy Law.
13. Liability
Each party’s liability arising out of or related to this DPA, whether in contract, tort, or under any other theory, is subject to the exclusions and limitations of liability in the Agreement, and any reference in the Agreement to liability under the Agreement includes liability under this DPA. Nothing in this DPA expands Hey, Lexxi’s liability beyond the Agreement, and the precedence of this DPA over the Agreement does not apply to those exclusions and limitations, except to the extent the law does not permit liability to be limited.
14. General
This DPA is governed by the law specified in the Agreement (California), and any dispute arising out of or related to this DPA will be resolved under the dispute-resolution provisions of the Agreement. This DPA remains in effect for as long as Hey, Lexxi Processes Personal Information on the Business’s behalf, and provisions that by their nature should survive will survive its termination. Hey, Lexxi may amend this DPA on written notice to the extent reasonably necessary to comply with changes in Applicable Privacy Law. Where Personal Information is also protected health information subject to a business associate agreement executed between the parties (“BAA”), the BAA controls with respect to that protected health information. If any provision is found invalid, the remainder stays in effect. Except as amended by this DPA, the Agreement remains in full force. To the extent of any conflict regarding the Processing of Personal Information, this DPA controls, subject to Section 13 and to the BAA.
Annex 1: Details of Processing
Subject matter
Provision of the Hey, Lexxi Services, including AI-assisted analysis of case materials such as medical-legal reports and records, and generation and management of draft legal work product such as initial file reviews and related reports, and any other Output generated by any Module that Hey, Lexxi makes available now or later.
Duration
For the term of the Agreement, plus any retention period permitted under Section 10.
Nature and purpose
Hosting, storage, transmission, optical character recognition and text extraction, automated and AI-assisted processing, redaction, and display of Subscriber Data solely to provide, secure, and support the Services.
Categories of Consumers
The Business’s clients, claimants (including injured workers), patients, witnesses, and other individuals whose information appears in case materials submitted by the Business.
Categories of Personal Information
Identifiers, contact details, professional and case-related information, and, where submitted by the Business, medical information and other Sensitive Personal Information necessary for the requested review.
Business purposes
Performing the Services; security, debugging, and error correction; the other permitted purposes in Section 3; and producing de-identified and aggregated analytics to operate and improve the Services, but not to train or fine-tune any machine-learning model.
Annex 2: Technical and Organizational Security Measures
Hey, Lexxi maintains the following measures, which it may update provided the overall level of protection is not materially diminished:
Encryption of Personal Information in transit and at rest using industry-standard protocols.
Role-based access controls, authentication requirements, and least-privilege access for personnel.
Logical separation of customer data and hardening of production environments.
Logging and monitoring designed to detect and respond to security events.
Vendor diligence and contractual security obligations for subprocessors.
Personnel confidentiality obligations and security awareness practices.
Backup and recovery processes designed to support availability and integrity of data.