Legal

Data Policy Addendum

Last updated October 21, 2026

This addendum describes how NOMALIX handles client data during consultancy and engineering engagements. It applies alongside the signed engagement agreement. Where the two conflict, the signed agreement, including any data processing agreement or Business Associate Agreement, governs.

Roles

The client remains the owner and controller of its data. NOMALIX processes client data only to deliver the agreed services and only on the client's documented instructions.

Protected health information

Where an engagement involves protected health information subject to HIPAA, NOMALIX will access that information only after a Business Associate Agreement is signed. Wherever possible, development, testing and demonstration work uses synthetic or de-identified data instead of real patient records.

Minimum necessary access

NOMALIX requests only the access and data needed for the agreed scope, preferably within the client's own environments and under the client's access controls.

Confidentiality

Client data is treated as confidential. Anyone working on an engagement on behalf of NOMALIX is bound by confidentiality obligations at least as protective as this addendum.

Security

NOMALIX applies appropriate technical and organizational measures for the sensitivity of the data. These may include least-privilege access, encryption in transit and at rest, multi-factor authentication, secure credential handling and keeping access records.

Subprocessors

NOMALIX will not engage another party to process client data without the client's prior agreement, and will hold any such party to equivalent obligations.

Incidents

If NOMALIX becomes aware of a security incident affecting client data, it will notify the client without undue delay and within any timeframe set in the engagement agreement, and will cooperate in investigation and remediation.

Return and deletion

At the end of an engagement, or on request, NOMALIX will return or securely delete client data in its possession, unless retention is required by law.

Cooperation

NOMALIX will provide reasonable information needed to show compliance with this addendum and will support the client in responding to individual rights requests and regulatory inquiries related to the services.

Questions

To request a signed data processing agreement or Business Associate Agreement for an engagement, contact us through the contact page.