; (2) shall not transfer service provider data to a third party without the affirmative express consent, obtained by, or on behalf of, the covered entity, of the individual to whom the service provider data is linked or reasonably linkable; (3) shall delete or de-identify service provider data after the agreed upon end of the provision of services; (4) is exempt from the requirements of sections 102(a), 103, 104, and 105(a) with respect to service provider data, but shall, to the extent practicable— (A) assist the covered entity from which it received the service provider data in fulfilling requests made by individuals under such sections; and (B) shall delete, de-identify, or correct (as applicable), any service provider data that is subject to a verified request from an individual described in section 103 or 104; and (5) is exempt from the requirements of section 106 with respect to service provider data, but shall have the same responsibilities and obligations as a covered entity with respect to such data under all other provisions of this Act. (b) Third parties A third party— (1) shall not process third party data for a purpose that is inconsistent with the expectations of a reasonable individual; (2) may reasonably rely on representations made by the covered entity that transferred third party data regarding the expectation of a reasonable individual, provided the third party conducts reasonable due diligence on the representations of the covered entity and finds those representations to be credible