Nabla procurement policy evidence
Only topics backed by verified findings appear below. Each row preserves the platform's exact policy words and capture provenance.
| Topic | Plan or tier | Risk | Their words | Source |
|---|---|---|---|---|
| DPA, audit rights & data residency | All applicable tiers | low | “ The execution of the Contract implies that the CLIENT has necessarily adhered without reservation to these GTC, the Data Protection Agreement, and, when applicable, the Business Associate Agreement. ” | Captured 2026-06-10Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ 8. Audit Report ” | Captured 2026-06-10Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ -The use of a certified health data hosting service provider within the meaning of Article L 1111-8 of the French Public Health Code. ” | Captured 2026-06-10Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ A reference in this BAA to a section in HIPAA means the section as in effect or as amended at the time.” | Captured 2026-06-10Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ VI. Both Parties intend to protect the privacy and provide for the security of Protected Health Information disclosed to Business Associate pursuant to the terms of this Agreement, HIPAA and other applicable laws.” | Captured 2026-06-10Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ In this respect, it is expressly stipulated between the Parties that CLIENT remains the data controller or the representative of the data controller and retains full control over the Personal Data it collects and processes, with NABLA acting only as a data processor within the meaning of the legal provisions relating to the protection of personal data defined in Article 1 "Definitions" of the GTC and designated in the Regulations. ” | Captured 2026-06-10Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ -Compliance with the recommendations of local security authorities such as the ANS, CNIL and ANSSI in France; ” | Captured 2026-06-10Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ With regard to the use and/or disclosure of Protected Health Information by Business Associate, Covered Entity agrees to:” | Captured 2026-06-10Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ Business Associate will make available its internal practices, books, agreements, records, and policies and procedures relating to the use and disclosure of PHI, upon request, to the Secretary of HHS for purposes of determining Covered Entity’s and Business Associate’s compliance with HIPAA, and this BAA.” | Captured 2026-06-10Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ Within the framework of their contractual relations, the Parties undertake to comply with the Regulations in force applicable to the processing of personal data implemented within the framework of the performance of this Contract. ” | Captured 2026-06-10Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ The Contract may also be complemented by a Business Associate Agreement, as it may be required by the applicable regulations. ” | Captured 2026-06-10Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ D. Upon request, Business Associate will make available to Covered Entity any of Covered Entity’s PHI that Business Associate or any of its agents or subcontractors have in their possession.” | Captured 2026-06-10Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ After having taken knowledge of the purpose, functionalities and characteristics of the NABLA Solution, the CLIENT has assessed the opportunity of subscribing to a license to use with regard to his own needs and has decided to subscribe to the Contract consisting of these Terms and Conditions of Sale and Use and of a Data Protection Agreement or Business Associate Agreement together with appendices. ” | Captured 2026-06-10Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ Business Associate will ensure that any of its agents or subcontractors that have access to, or to which Business Associate provides, PHI agree in writing to the restrictions and conditions concerning uses and disclosures of PHI contained in this BAA and agree to implement reasonable and appropriate safeguards to protect any Electronic PHI that it creates, receives, maintains or transmits on behalf of Business Associate or, through the Business Associate, Covered Entity.” | Captured 2026-06-10Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ The provisions of the Data Protection Agreement define the conditions under which NABLA, as a data processor, undertakes to carry out personal data processing activities on behalf of the CLIENT, the data controller or data processor of the data controller, in the performance of the Contract. ” | Captured 2026-06-10Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ B. Business Associate will furnish to Covered Entity information collected in accordance with this Section 10, within ten (10) business days after written request by Covered Entity, to permit Covered Entity to make an accounting of disclosures as required by 45 CFR §164.528, or in the event that Covered Entity elects to provide an Individual with a list of its business associates, Business Associate will provide an accounting of its disclosures of PHI upon request of the Individual, if and to the extent that such accounting is required under the HITECH Act or under HHS regulations adopted in connection with the HITECH Act.” | Captured 2026-06-10Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ C. Notify Business Associate of any restriction to the use or disclosure of PHI that Covered Entity has agreed to in accordance with 45 CFR §164.522, to the extent that such restriction may affect Business Associate’s use or disclosure of PHI.” | Captured 2026-06-10Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ Upon request, Business Associate will provide Covered Entity, or upstream Business Associate, with a copy of its most recent independent SOC 2 certification report or other mutually agreed upon independent standards based third party audit report. Covered Entity agrees not to re-disclose Business Associate’s audit report.” | Captured 2026-06-10Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ IV. By providing the services pursuant to the Agreement, Business Associate will become a “business associate” of the Covered Entity as such term is defined under HIPAA;” | Captured 2026-06-10Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ A. Upon request and instruction from Covered Entity, Business Associate will amend PHI or a record about an Individual in a Designated Record Set that is maintained by, or otherwise within the possession of, Business Associate as directed by Covered Entity in accordance with procedures established by 45 CFR §164.526. Any request by Covered Entity to amend such information will be completed by Business Associate within ten (10) business days of Covered Entity’s request.” | Captured 2026-06-10Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ A. This BAA will become effective from the date of signature of the Agreement, and will continue in effect until all obligations of the Parties have been met under the Agreement and under this BAA.” | Captured 2026-06-10Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ A. Business Associate will document any disclosures of PHI made by it to account for such disclosures as required by 45 CFR §164.528(a). Business Associate also will make available information related to such disclosures as would be required for Covered Entity to respond to a request for an accounting of disclosures in accordance with 45 CFR §164.528. At a minimum, Business Associate will furnish Covered Entity the following with respect to any covered disclosures by Business Associate: (i) the date of disclosure of PHI; (ii) the name of the entity or person who received PHI, and, if known, the address of such entity or person; (iii) a brief description of the PHI disclosed; and (iv) a brief statement of the purpose of the disclosure which includes the basis for such disclosure.” | Captured 2026-06-10Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ I. Covered Entity is either a “covered entity” or “business associate” of a covered entity as each are” | Captured 2026-06-10Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ C. In the event an Individual delivers the initial request for an accounting directly to Business Associate, Business Associate will within ten (10) business days forward such request to Covered Entity.” | Captured 2026-06-10Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ connected to the Internet network which may host the Data if the CLIENT or the Users ask or authorize NABLA to do so. The hosting of the Servers is subcontracted by NABLA to a certified health data host within the meaning of Article L 1111-8 of the French Public Health Code. ” | Captured 2026-06-10Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ This BUSINESS ASSOCIATE AGREEMENT (the “BAA”) is made and entered into by and between Nabla Technologies Inc., a company incorporated under the laws of Delaware (“Business Associate”) and a client who has entered a Terms of Service Agreement (the “Agreement”) with the Business Associate (“Covered Entity”), in accordance with the meaning given to those terms at 45 CFR §164.501. This BAA applies to the processing carried out by the Business Associate on behalf of the Covered Entity. In this BAA, Covered Entity and Business Associate are each a “Party” and, collectively, are the “Parties”.” | Captured 2026-06-10Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ Business Associate will use appropriate safeguards to prevent the use or disclosure of PHI other than as provided by the Agreement or this BAA and Business Associate agrees to implement administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity and availability of the Electronic PHI that it creates, receives, maintains or transmits on behalf of Covered Entity. Business Associate agrees to take reasonable steps, including providing adequate training to its employees to ensure compliance with this BAA and to ensure that the actions or omissions of its employees or agents do not cause Business Associate to breach the terms of this BAA.” | Captured 2026-06-10Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ 12. Availability of Books and Records ” | Captured 2026-06-10Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ 16. Effect of BAA. ” | Captured 2026-06-10Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ NOW, THEREFORE, in consideration of the mutual covenants and conditions contained herein and the continued provision of PHI by Covered Entity to Business Associate under the Agreement in reliance on this BAA, the Parties agree as follows:” | Captured 2026-06-10Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ A. Upon request, Business Associate agrees to furnish Covered Entity with copies of the PHI maintained by Business Associate in a Designated Record Set in the time and manner designated by Covered Entity to enable Covered Entity to respond to an Individual’s request for access to PHI under 45 CFR §164.524.” | Captured 2026-06-10Open source →Finding permalink → |
| Data retention | All applicable tiers | low | “ the use of the Solution does not exempt him from keeping a copy of the Data on any medium of his choice in accordance with his legal and regulatory obligations, ” | Captured 2026-06-10Open source →Finding permalink → |
| Data retention | All applicable tiers | medium | “We retain your personal data for as long as we need it for the purposes we have collected it for, such as contracting with you for your use of our Services. We may retain your personal data for a longer period if you make a complaint under this privacy policy or our Terms of service, or if we have a reasonable belief that litigation may arise in relation to our relationship with you. We may also be required to retain certain personal data from you to comply with our legal and regulatory requirements. ” | Captured 2026-06-07Open source →Finding permalink → |
| Data retention | All applicable tiers | low | “ where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims; or ” | Captured 2026-06-07Open source →Finding permalink → |
| Data retention | All applicable tiers | low | “ the use of the Solution and stored on the the Configuration and, when applicable, on the Servers. ” | Captured 2026-06-10Open source →Finding permalink → |
| Data retention | All applicable tiers | medium | “ In some circumstances, we will anonymise your personal data (so that it can no longer be associated with you) for research or statistical purposes, in which case we may use this information indefinitely without further notice to you. ” | Captured 2026-06-07Open source →Finding permalink → |
| Data retention | All applicable tiers | low | “ D. Upon termination of the Agreement or this BAA for any reason, all PHI maintained by Business Associate will be returned to Covered Entity or destroyed by Business Associate. Business Associate will not retain any copies of such information. This provision will apply to PHI in the possession of Business Associate’s agents and subcontractors but will not include the PHI produced by Business Associate within the framework of article 2.C.. If return or destruction of the PHI is not feasible, in Business Associate’s reasonable judgment, Business Associate will furnish Covered Entity with notification, in writing, of the conditions that make return or destruction infeasible. Upon mutual agreement of the Parties that return or destruction of the PHI is infeasible, Business Associate will extend the protections of this BAA to such information for as long as Business Associate retains such information and will limit further uses and disclosures to those purposes that make the return or destruction of the information not feasible. The Parties understand that this Section 15.D. will survive any termination of this BAA.” | Captured 2026-06-10Open source →Finding permalink → |
| Data retention | All applicable tiers | low | “ In some circumstances you can ask us to delete your data: see your legal rights section below for further information. ” | Captured 2026-06-07Open source →Finding permalink → |
| Data retention | All applicable tiers | low | “Plausible Analytics Plausible Analyze Services usage 24 hours for IP address, without limitation for analytic” | Captured 2026-06-07Open source →Finding permalink → |
| Data retention | All applicable tiers | low | “ The CLIENT must confirm in writing to NABLA within the same period that these deletions have been made. ” | Captured 2026-06-10Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ are subject to dissemination as a result of a court order. ” | Captured 2026-06-10Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “Our service providers acting as our processors, including: Google Ireland Limited, sub-processor providing of data hosting services in connection to the Services; Other suppliers, which we may appoint from time to time to provide various services to us, such as IT and system administration services. ” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ B. Except as otherwise limited by this BAA or federal or state law or other applicable law, Covered Entity authorizes Business Associate to use the PHI in its possession for the proper management and administration of Business Associate’s business and to carry out its legal responsibilities. Business Associate may disclose PHI for its proper management and administration, provided that (i) the disclosures are required by law; or (ii) Business Associate obtains, in writing, prior to making any disclosure to a third party (a) reasonable assurances from this third party that the PHI will be held confidential as provided under this BAA and used or further disclosed only as required by law or for the purpose for which it was disclosed to this third party and (b) an agreement from this third party to notify Business Associate immediately of any breaches of the confidentiality of the PHI, to the extent it has knowledge of the breach.” | Captured 2026-06-10Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ Notwithstanding the foregoing, the CLIENT may temporarily make the Solution available to the competent public authorities, insofar as such availability is necessary to meet the CLIENT's legal obligations, and this under the CLIENT's sole responsibility. ” | Captured 2026-06-10Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ Our Website may, from time to time, contain links to and from the websites of our partner networks, and affiliates. Please note that these websites and any services that may be accessible through them have their own privacy policies and that we do not accept any responsibility or liability for these policies or for any personal data that may be collected through these websites or services . Please check these policies before you submit any personal data to these websites or use these services. ” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ We may disclose and exchange information with law enforcement agencies and regulatory bodies to comply with our legal and regulatory obligations. ” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ authorities acting as processors or joint controllers who require reporting of processing activities in certain circumstances. ” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ including lawyers, bankers, auditors and insurers who provide consultancy, banking, legal, insurance and accounting services; and ” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ We do transfer certain Aggregated Data in and to the USA or other countries and territories (however for the avoidance of doubt, such does not contain any personal data) to help us improve our services to you and other users of the Services. ” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ Other suppliers, which we may appoint from time to time to provide various services to us, such as IT and system administration services. ” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ The above purposes and activities may require us to pass on some of our personal data to the following third parties: ” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “We may disclose and exchange information with law enforcement agencies and regulatory bodies to comply with our legal and regulatory obligations” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ A. Notify Business Associate of any limitation(s) in its notice of privacy practices in accordance with 45 CFR §164.520, to the extent that such limitation may affect Business Associate’s use or disclosure of PHI.” | Captured 2026-06-10Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ E. Business Associate may use PHI to report violations of law to appropriate Federal and State authorities, consistent with 45 CFR §164.502(j)(1).” | Captured 2026-06-10Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ 7. Agreements with Agents or Subcontractor s” | Captured 2026-06-10Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ a demand or request from an administrative or judicial authority relating to the Data hosted as part of the provision of the Solution. ” | Captured 2026-06-10Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ We only allow our service providers to handle your personal information if we are satisfied they take appropriate measures to protect your personal information. We also impose contractual obligations on service providers to ensure they can only use your personal information to provide services to us and to you and for no other reasons. ” | Captured 2026-06-07Open source →Finding permalink → |
| Tier differences | All applicable tiers | low | “ Except if agreed differently by the Parties, the basis for calculating the fee depends on the number of Users and is specified in the Subscription Package. ” | Captured 2026-06-10Open source →Finding permalink → |
| Tier differences | All applicable tiers | low | “ The applicable Prices are available on the NABLA website. ” | Captured 2026-06-10Open source →Finding permalink → |
| Tier differences | All applicable tiers | low | “ subscription package chosen by the CLIENT, which may specify the list of Modules included in the user license, the maximum volume of data, and the prices agreed between the Parties, as described on the NABLA website or when applicable in the Special Conditions. ” | Captured 2026-06-10Open source →Finding permalink → |
| Tier differences | All applicable tiers | low | “ Prices are in Euros and do not include VAT. The prices are increased by the VAT at the rate in force on the day of the invoice. ” | Captured 2026-06-10Open source →Finding permalink → |
Informational only, not legal advice. Terms can change; verify every cited source and capture date during procurement review.
📢 POLICY UPDATES ALERT
AIRIN Brief
Built for compliance officers, legal counsel, and SaaS founders. Subscribe to the email digest — one short brief when a tracked vendor materially changes its terms, training policy, or risk rating. Prefer in-app? Watch platforms in your alerts inbox instead.