Security & Trust Addendum

This addendum forms part of each accepted Proactix Scan, Pilot, or Hub agreement. “Customer Content” means records, files, text, images, account data, action evidence, and other submitted material, excluding Proactix technology and de-identified information that cannot reasonably identify Customer or a person.

Customer determines what is submitted and the business purpose. Proactix processes Customer Content to provide the contracted service and acts as Customer’s service provider where that characterization applies. Each party remains responsible for its own legal duties.

Customer instructs Proactix to host, organize, analyze, transform, display, support, secure, export, and delete Customer Content as needed to provide the service. Proactix will not materially expand those purposes without authorization or lawful basis.

Customer must provide only reasonably necessary information and remove unnecessary medical, disciplinary, HR, union, legal, financial, family-status, or similarly sensitive information. Customer represents it has authority for the content and instructions.

Proactix limits access to people and systems reasonably needing Customer Content for delivery, support, security, quality control, troubleshooting, or law. Personnel and providers with access must have appropriate confidentiality or professional duties.

Customer controls its users, roles, devices, networks, and downstream sharing and must promptly remove access that is no longer authorized.

• Authenticated role-based access and logical company or tenant separation where supported.
• Encryption in transit and provider-supported encryption at rest for hosted production systems.
• Restricted handling of service credentials and payment secrets outside browser code.
• Logging, audit evidence, integrity checks, and monitoring appropriate to service stage and risk.
• Reasonable patching, dependency review, backup, recovery, and incident-response practices.
• Controlled upload paths and data-environment separation where supported.

No internet, cloud, AI, transfer, or software system is absolutely secure, continuously available, or error-free. Proactix does not claim SOC 2, ISO 27001, penetration-test, regulatory certification, or specific recovery objectives without current written evidence.

Customer generally authorizes reputable providers for cloud hosting, database, authentication, storage, payments, communications, monitoring, security, document processing, and AI-assisted analysis. Proactix uses reasonable diligence and remains responsible for its contractual duties.

Providers may process data in Canada, the United States, or other jurisdictions. No residency promise applies unless a signed order states it. On reasonable request, Proactix will identify material provider categories and available location information.

Proactix may use automated and AI-assisted tools to extract, classify, compare, summarize, or draft insights. They will be used consistently with the contracted purpose and available privacy controls.

Proactix will not intentionally use Customer-identifiable content to train a public or third-party general-purpose AI model without written permission. Automated output requires human review and is not a final legal, engineering, medical, regulatory, employment, or safety determination.

A Security Incident is confirmed unauthorized access to, acquisition, use, disclosure, material alteration, or loss of Customer Content under Proactix’s control. It excludes unsuccessful attempts and Customer-controlled events unless Proactix contributed.

Proactix will reasonably investigate, contain, and remediate, and notify Customer without unreasonable delay after confirmation when Customer Content is materially affected or law requires notice. Notice will include reasonably available nature, affected information, timing, response, and contact details.

Notification is not an admission of fault. Each party handles its required assessment, regulator or individual notices, and records while reasonably cooperating.

During active service, Customer may use available exports or request a reasonable export. For a one-time Scan or Pilot that does not continue into paid service, Customer has 30 days after final delivery or closeout to download Customer Content and outputs. Hub customers have the active subscription and 30 days after termination.

After that period, Proactix will delete or de-identify Customer Content from active systems within 30 days, unless earlier deletion is requested and feasible. Isolated backup copies may remain until overwritten in the ordinary cycle, no longer than 90 additional days, and will not be restored except for recovery, security, or legal necessity.

Proactix may retain acceptance receipts, transaction and tax records, security logs, dispute evidence, and minimal records required by law or to establish and defend rights. A lawful preservation duty temporarily overrides deletion for affected information.

Customer may request export, correction, restriction, or deletion through its account or Joel.proactix@gmail.com. Proactix may verify identity and authority and explain material service consequences before deletion.

On reasonable request, Proactix will provide available safeguard and provider information for a proportionate review. Custom audits, tests, questionnaires, insurance terms, residency obligations, or regulated-data commitments require a written order.

This addendum controls an irreconcilable conflict specifically about Customer Content processing, confidentiality, safeguards, incidents, export, retention, or deletion. The product agreement controls other matters.

Confidentiality, use restrictions, deletion duties, ownership, and provisions intended by their nature to survive remain effective after service ends.