Business Associate
Agreement.

This Business Associate Agreement (the "BAA") is entered into by and between the customer identified in the applicable Order Form ("Covered Entity") and Auxo Health, Co. ("Business Associate"). It is effective on the effective date of the Master Services Agreement or other services agreement between the Parties (the "Services Agreement").

1. Relationship and definitions

The Parties intend this BAA to satisfy the Health Insurance Portability and Accountability Act of 1996, the Health Information Technology for Economic and Clinical Health Act, and their implementing regulations, as amended (collectively, "HIPAA").

Terms not defined here, including Breach, Designated Record Set, Electronic Protected Health Information, Individual, Minimum Necessary, Protected Health Information or PHI, Required by Law, Secretary, Security Incident, and Unsecured Protected Health Information, have the meanings given by HIPAA. Services means the services described in the Services Agreement that cause Business Associate to create, receive, maintain, or transmit PHI for Covered Entity.

2. Permitted uses and disclosures

2.1 Services

Business Associate may use or disclose PHI only as necessary to perform the Services, as permitted by this BAA, as directed in writing by Covered Entity, or as Required by Law. Business Associate will not use or disclose PHI in a manner that would violate HIPAA if done by Covered Entity, except for the specific management, administration, and data aggregation permissions in this BAA.

2.2 Management and administration

Business Associate may use PHI for its proper management and administration or to carry out its legal responsibilities. It may disclose PHI for those purposes only if Required by Law or if it obtains reasonable assurances from the recipient that the information will remain confidential, be used or further disclosed only as Required by Law or for the stated purpose, and that the recipient will notify Business Associate of any breach of confidentiality.

2.3 Data aggregation

Business Associate may provide data aggregation services relating to Covered Entity's health care operations if authorized by the Services Agreement. Business Associate may create deidentified information only in accordance with HIPAA. Once properly deidentified, that information is no longer PHI, but Business Associate will use it only as allowed by the Services Agreement and applicable law.

2.4 Restrictions

Business Associate will apply the Minimum Necessary standard where applicable. It will not sell PHI, use PHI for marketing or fundraising, or use PHI to train or improve a general-purpose artificial intelligence model unless Covered Entity expressly authorizes the activity in writing and all required HIPAA permissions are satisfied. Business Associate will not independently make diagnosis or treatment decisions.

3. Safeguards and Security Rule

Business Associate will use appropriate administrative, physical, and technical safeguards to prevent use or disclosure of PHI other than as permitted by this BAA. Business Associate will comply with the applicable requirements of the HIPAA Security Rule for Electronic Protected Health Information and will maintain written policies, risk management processes, access controls, workforce safeguards, and incident response procedures appropriate to its role.

4. Reporting and response

4.1 Impermissible use or disclosure

Business Associate will report to Covered Entity any use or disclosure of PHI not permitted by this BAA of which it becomes aware.

4.2 Breaches

Business Associate will report a Breach of Unsecured Protected Health Information without unreasonable delay and in no event later than the period required by HIPAA. Its notice will include, to the extent known, the identification of affected Individuals; the nature and date of the Breach; the types of PHI involved; actions taken to investigate, contain, mitigate, and prevent recurrence; and other information reasonably needed for Covered Entity's notification duties.

4.3 Security Incidents

Business Associate will report Security Incidents involving Electronic Protected Health Information as required by HIPAA. The Parties acknowledge that routine unsuccessful attempts, such as blocked scans, pings, failed logins, and denial-of-service attempts, occur continuously and this paragraph serves as notice of them. Business Associate will separately report any successful or material Security Incident.

4.4 Mitigation and cooperation

Business Associate will mitigate, to the extent practicable, harmful effects of an impermissible use, disclosure, or Breach caused by Business Associate or its subcontractors. It will reasonably cooperate with Covered Entity's investigation, risk assessment, notices, and regulatory response.

5. Individual rights and records

5.1 Access

If Business Associate maintains PHI in a Designated Record Set, it will make that PHI available to Covered Entity in the time and manner reasonably requested so Covered Entity can meet its obligations under 45 C.F.R. § 164.524. If an Individual contacts Business Associate directly, Business Associate will refer the request to Covered Entity unless Covered Entity directs otherwise.

5.2 Amendment

Business Associate will make PHI available for amendment and incorporate amendments as directed by Covered Entity in accordance with 45 C.F.R. § 164.526.

5.3 Accounting of disclosures

Business Associate will document and provide information about disclosures of PHI as necessary for Covered Entity to respond to a request for an accounting under 45 C.F.R. § 164.528.

5.4 Covered Entity obligations delegated to Business Associate

To the extent Business Associate carries out an obligation of Covered Entity under the HIPAA Privacy Rule, Business Associate will comply with the requirements that apply to Covered Entity in performing that obligation.

5.5 HHS access

Business Associate will make its internal practices, books, and records relating to the use and disclosure of PHI available to the Secretary for purposes of determining Covered Entity's compliance with HIPAA, subject to applicable legal privileges.

6. Subcontractors

Business Associate will ensure that any subcontractor that creates, receives, maintains, or transmits PHI on its behalf agrees in writing to the same restrictions, conditions, and requirements that apply to Business Associate with respect to that PHI. A subcontractor handling Electronic Protected Health Information must comply with the applicable HIPAA Security Rule requirements.

7. Covered Entity obligations

Covered Entity will:

• notify Business Associate of limitations in its notice of privacy practices that affect Business Associate's use or disclosure of PHI;
• notify Business Associate of changes to, or revocation of, an Individual's permission that affect the Services;
• notify Business Associate of restrictions on use or disclosure that Covered Entity has agreed to and that affect the Services;
• not request Business Associate to use or disclose PHI in a way that would violate HIPAA if done by Covered Entity, except as expressly permitted for a Business Associate;
• provide only the PHI reasonably necessary for the Services and maintain the authorizations, consents, and legal bases required for its collection and disclosure; and
• configure user access and connected systems appropriately and promptly remove access that is no longer authorized.

8. Term and termination

8.1 Term

This BAA begins when Business Associate first creates, receives, maintains, or transmits PHI for Covered Entity and continues until all PHI is returned or destroyed, or protections continue under Section 8.3 because return or destruction is infeasible.

8.2 Termination for cause

If either Party knows of a material breach of this BAA by the other, it will provide written notice and a reasonable opportunity to cure. If the breach is not cured, the nonbreaching Party may terminate the affected Services. If cure or termination is infeasible, the nonbreaching Party may report the violation to the Secretary as required by HIPAA.

8.3 Return or destruction

At termination, Business Associate will return or destroy PHI in its possession or control, including PHI held by subcontractors, if feasible. Business Associate will retain no copies except as Required by Law or where return or destruction is infeasible. For retained PHI, Business Associate will extend this BAA's protections, limit further use and disclosure to the reason retention is necessary, and destroy the PHI when feasible.

9. General

This BAA is part of the Services Agreement. If they conflict regarding PHI, this BAA controls. References to HIPAA mean HIPAA as amended, and the Parties will amend this BAA as reasonably necessary to remain compliant. Nothing here permits a use or disclosure prohibited by HIPAA or creates rights for a person other than the Parties. The obligations concerning PHI survive termination.

The Services Agreement's notice, governing law, assignment, limitation, and general terms apply to this BAA to the extent they do not conflict with HIPAA. No liability limitation will apply to the extent prohibited by applicable law.

10. Signatures