ProCURE LLC Beta Data Processing Addendum

Last updated: August 28, 2026 · Applies to: the ProCURE free beta

1. Roles

For the business data you upload or connect ("Client Data"), you are the controller and you decide what data goes in and why. ProCURE is the processor, handling it on your behalf and on your instructions to provide the Service. ProCURE LLC is a Missouri limited liability company, and you can contact us at info@procurelabs.io.

2. Scope and purpose

ProCURE processes Client Data only to provide, secure, support, and improve the Service, and only for the duration of your use of it. We do not use Client Data for any other purpose, and we do not sell it or share it across tenants.

California (CCPA/CPRA) service-provider terms. To the extent ProCURE processes personal information subject to the California Consumer Privacy Act, as amended by the CPRA, ProCURE acts as a service provider and: (a) processes that personal information solely for the specific business purpose of providing the Service under this addendum and the Beta Terms, and for no other purpose; (b) will not sell or share the personal information as those terms are defined under the CCPA/CPRA; (c) will not retain, use, or disclose the personal information outside the direct business relationship with you, or combine it with information from other sources, except as the CCPA/CPRA permits; and (d) certifies that it understands the restrictions in this section and will comply with them. You may take reasonable and appropriate steps to confirm that ProCURE uses the personal information consistent with your obligations under the CCPA/CPRA.

3. What Client Data is (and isn't)

Client Data is business data: product, cost, inventory, and sales records, and limited operational fields. It is not consumer or patient personal data. The Service strips consumer and patient identifying information at the point of upload and never stores it. You agree not to deliberately upload consumer or patient medical data into the platform.

4. Confidentiality and personnel

ProCURE personnel with administrative access are bound to confidentiality and access Client Data only to operate, debug, secure, and support the Service. They never access it for any purpose outside those functions.

5. Security measures

ProCURE maintains, at minimum: encryption in transit and at rest; tenant isolation enforced in the application layer and verified by an automated cross-tenant test; role-based, least-privilege access with a per-action ownership guard; and tested, encrypted, offsite backups.

6. Sub-processors

ProCURE uses the service providers listed in the Privacy Policy (currently Supabase, Vercel, Cloudflare, Resend, and Sentry) to provide the Service. Each is bound to process data only to deliver its part of the Service. We will give reasonable advance notice of a new sub-processor that handles Client Data, and you may raise a reasonable data-protection objection.

7. Assistance, incidents, and audits

Taking into account the nature of processing, ProCURE will provide reasonable assistance with your data-protection obligations, including responding to individuals' requests that concern data in your account. ProCURE will notify you without undue delay after becoming aware of a personal-data breach affecting Client Data. On reasonable request, ProCURE will make available information necessary to demonstrate compliance with this addendum.

8. Return and deletion

On termination of the beta, or on your request, ProCURE will delete Client Data within 30 days and confirm in writing, except where retention is required by law. You may export your data before deletion (see Beta Terms §8).

9. Changes

Because this is a beta, this addendum may change. We will post the updated version here and notify you of material changes. Questions can go to info@procurelabs.io.