Thank you for choosing to use the DocAssistant AI, Inc. website at https://docassistant.ai (referred to as the “Site”) and/or the DocAssistant mobile application (referred to as the “App”). By accessing these, you are utilizing DocAssistant AI, Inc.'s (“Company,” “we,” “our,” or “us”) associated notes platform available through the Site and the App (collectively known as the “Platform”). This Platform, along with any additional features the Company may introduce from time to time, enables medical professionals to acquire, organize, and manage medical knowledge (the Platform, together with the Site and the App, is referred to as the “Services”). These Terms of Service (“Agreement”) govern your access to and use of the Services. Please read this Agreement thoroughly, as it includes: (a) in Section 16, a requirement for you and the Company to resolve certain disputes through arbitration instead of court proceedings, and a waiver of your right to bring class action lawsuits against the Company; (b) in Section 7, specific terms and conditions related to recurring subscription fees for certain paid account types. Only create a Services account or use the Services if you agree to be legally bound by all the terms and conditions outlined here. By accepting this Agreement, you enter into a legally binding contract with the Company. If you disagree with any part of this Agreement, do not create a Services account or use the Services. If you are accessing this on a mobile device, you can also view this Agreement on a computer web browser at https://docassistant.ai/terms.

Note for Minors: The Services are not intended for use by individuals under the age of 18. By using the Services, you confirm that you are at least 18 years old.

The Company's Privacy Policy, available at https://docassistant.ai/terms (the “Privacy Policy”), outlines how the Company collects, uses, and discloses data and information in connection with the Services. The Privacy Policy, which may be updated by the Company periodically in accordance with its terms, is incorporated into this Agreement, and by using the Services, you consent to the data practices described therein.

1. How the Services Operate. Beyond the various features we may periodically introduce, our Services enable users to build and sustain a comprehensive collection of strategies, scripts, insights, and case studies throughout their careers to enhance clinical expertise. The Services offer functionalities that allow you to interlink pages on medical subjects, mirroring the intricate and interconnected nature of clinical medicine, thereby enriching your knowledge base. You can revisit, refine, connect, and share your notes with other users to maximize comprehension and retention.

2. Declarations and Obligations; User Duties.

2.1. You affirm, guarantee, and agree that, in relation to this Agreement or the Services, you will not, nor attempt to: (i) breach any laws, infringe on third-party rights, or violate our community guidelines and other policies; (ii) re-access or attempt to use the Services if DocAssistant AI, Inc. has banned or suspended you; (iii) deceive DocAssistant AI, Inc. or another user; or (iv) use another user's account or permit someone else to use your account. Any unlawful activities related to the Services may be reported to the authorities.

2.2. By utilizing the Services, you explicitly agree that you are solely accountable for ensuring: (i) the protection and upkeep of the hardware and software you use for the Services (“Equipment”); (ii) sufficient measures are in place to secure the Equipment and the physical location where the Services are used; (iii) the Equipment is safeguarded against theft, damage, corruption, alteration, unauthorized access, viruses, malware, etc.; (iv) the Services are not accessed by unauthorized individuals; (v) adherence to applicable data privacy laws concerning your use of the Services, including HIPAA, the Health Information Technology for Economic and Clinical Health Act, Title XIII of the American Recovery and Reinvestment Act of 2009, and related regulations. Your employees and contractors who access and use the Platform on your behalf are referred to as “Authorized Users.” Each Authorized User must create an account by providing their email address and creating a password (collectively “Login Credentials”). Login Credentials cannot be shared among Authorized Users or with any third party. Login Credentials must remain confidential. You agree to promptly notify us of any unauthorized use or suspected unauthorized use of any Login Credentials. You are fully responsible for all activities, and any use or misuse of the Platform, associated with any Authorized User’s Login Credentials. You are also responsible for ensuring that your Authorized Users comply with these Terms of Use. You will promptly inform us of any need to deactivate or change any Login Credentials. We reserve the right to disable any Platform account username or password at any time for any reason, including if we believe, at our sole discretion, that you have failed to comply with these Terms of Use.

2.3. The Services and Company Materials (as defined in Section 4), and any information contained or entered therein, do not replace or substitute your professional judgment or expertise. You accept all risks arising from, and are solely responsible for, your professional, advisory, analytical, and technical services, including patient examination, diagnosis, prescription, treatment, and any personal injury or loss of life. Neither DocAssistant AI, Inc. nor its third-party service providers assume any responsibility for your actions. Without limiting the foregoing, you acknowledge and agree that any examples of potential diagnoses or other outputs generated using the artificial intelligence or machine learning functionality available on the Services (such as DocAssistant AI) may be incorrect, harmful, or biased, and you will not rely on or substitute such examples or outputs for your own professional judgment.

2.4 The Services and any Company Materials provided through the Services are a non-device clinical decision support software application as defined by Section 520(o)(1)(E) of the federal Food, Drug, and Cosmetic Act, 21 U.S.C. Sec. 360j(o)(1), and the regulations and guidance issued by the U.S. Food and Drug Administration to implement that provision. By accessing or using the Services and Company Materials, you agree to use the Services and Company Materials solely in this manner and for this purpose. The artificial intelligence or machine learning functionality available on the Services (“DocAssistant AI”) is intended for use only by healthcare providers and is not meant for the general public. If you are not a healthcare provider, you are not authorized to access or use the DocAssistant AI functionality. If you access or use DocAssistant AI, you confirm that you are a healthcare provider and agree that the application is: (1) not intended to acquire, process, or analyze a medical image or a signal from an in vitro diagnostic device or a pattern or signal from a signal acquisition system; (2) intended for displaying, analyzing, or printing medical information about a patient or other medical information; (3) intended for supporting or providing recommendations to a healthcare professional about prevention, diagnosis, or treatment of a disease or condition; and (4) intended for enabling such healthcare professional to independently review the basis for such recommendations that the software presents so that it is not intended for such healthcare professional to rely primarily on any of such recommendations to make a clinical diagnosis or treatment decision regarding an individual patient.

2.5 If you wish to try our Platform, we will grant you access to the Platform free of charge for a specified number of visits, which will be communicated to you upon signing up to use the Platform. This access is limited to evaluating the Platform to decide whether to purchase a subscription. During the trial period, you or your Authorized Users may not use the Platform for any other purposes, including but not limited to competitive analysis, commercial, professional, or for-profit purposes. We reserve the right, at our sole discretion, to terminate your and your Authorized Users’ access to the Platform during the trial period at any time. You may cancel the trial at any time during the trial period by providing written notice to us. After the trial period, you may choose to purchase a paid subscription to the Platform by notifying us. Notwithstanding anything to the contrary in this Agreement, during any trial period, we will have no warranty, indemnity, support, or other obligations; we will have no liability for any harm or damage arising out of or in connection with the Platform; and your and your Authorized Users' use of the Platform is at your own risk.

3. License to Use the App. If you have downloaded the App, then, subject to your compliance with all the terms and conditions of this Agreement, DocAssistant AI, Inc. grants you a limited, nonexclusive, nontransferable, revocable license to use the App on a compatible mobile device for your personal use, in each case in the manner enabled by DocAssistant AI, Inc. If you are using the App on an Apple, Inc. (“Apple”) iOS device, the foregoing license is further limited to use permitted by the Usage Rules set forth in Apple's App Store Terms of Services.

4. Ownership; Proprietary Rights. As between you and DocAssistant AI, Inc., DocAssistant AI, Inc. owns all worldwide rights, titles, and interests, including all intellectual property and other proprietary rights, in and to the Services, all content, text, information, data, and other content displayed or made available through the Services, and all usage and other data generated or collected in connection with the use thereof (the “Company Materials”). The Platform contains material, such as software, text, graphics, images, sound recordings, audiovisual works, and other material provided by or on behalf of DocAssistant AI, Inc. (collectively referred to as the “Content”). For the avoidance of doubt, Content shall not include Your Data. The Content may be owned by us or by third parties. The Content is protected under both United States and foreign laws. Unauthorized use of the Content may violate copyright, trademark, and other laws. You have no rights in or to the Content, and you will not use the Content except as permitted under this Agreement. No other use is permitted without prior written consent from us. You must retain all copyright and other proprietary notices contained in the original Content on any copy you make of the Content. You may not sell, transfer, assign, license, sublicense, or modify the Content or reproduce, display, publicly perform, make a derivative version of, distribute, or otherwise use the Content in any way for any public or commercial purpose. The use or posting of the Content on any other website or in a networked computer environment for any purpose is expressly prohibited.

If you violate any part of this Agreement, your permission to access and/or use the Content, and the Platform automatically terminates and you must immediately destroy any copies you have made of the Content.

The trademarks, service marks, and logos of DocAssistant AI, Inc. (the “DocAssistant Trademarks”) used and displayed on the Platform are registered and unregistered trademarks or service marks of DocAssistant AI, Inc. Other company, product, and service names located on the Platform may be trademarks or service marks owned by others (the “Third-Party Trademarks,” and, collectively with DocAssistant Trademarks, the “Trademarks”). Nothing on the Platform should be construed as granting, by implication, estoppel, or otherwise, any license or right to use the Trademarks, without our prior written permission specific for each such use. Use of the Trademarks as part of a link to or from any website is prohibited unless establishment of such a link is approved in advance by us in writing. All goodwill generated from the use of DocAssistant Trademarks inures to our benefit.

Elements of the Platform are protected by trade dress, trademark, unfair competition, and other state and federal laws and may not be copied or imitated in whole or in part, by any means, including, but not limited to, the use of framing or mirrors. None of the Content may be retransmitted without our express, written consent for each and every instance.

Except for as expressly set forth herein, you agree not to license, distribute, copy, modify, publicly perform or display, transmit, publish, edit, adapt, create derivative works from, or otherwise make any unauthorized use of the Company Materials. You will not (and will not authorize, permit, or encourage any third party to): (i) reverse engineer, decompile, disassemble, or otherwise attempt to discern the source code or interface protocols of the Platform; (ii) modify, adapt, or translate the Platform, or any portion or component thereof; (iii) make any copies of the Platform, or any portion or component thereof; (iv) resell, distribute, or sublicense the Platform, or any portion or component thereof; (v) remove or modify any proprietary markings or restrictive legends placed on the Platform; (vi) use the Platform, or any portion or component thereof in violation of any applicable law, in order to build a competitive product or service, or for any purpose not specifically permitted in this Agreement; (vii) introduce, post, or upload to the Platform any virus, worm, “black door,” Trojan Horse, or similar harmful code; (viii) save, store, or archive any portion of the services (including, without limitation, any data contained therein) outside the Platform other than those outputs generated through the intended functionality of the Platform without the prior, written permission of DocAssistant AI, Inc. in each instance; (ix) use the Platform in connection with service bureau, timeshare, service provider or like activity whereby you operate the Platform for the benefit of a third party; or (x) circumvent any processes, procedures, or technologies that we have put in place to safeguard the Platform.

5. Third-Party Websites. The Services may feature advertisements or links that direct you to websites or other online services owned and operated by third parties. You acknowledge and agree that DocAssistant AI, Inc. is not liable for the content of these third-party sites and services, nor for any products or services offered through them, or your interactions with them.

6. Mobile Services. Using the App may require data services from your wireless carrier. You acknowledge and agree that you are solely responsible for any data usage fees and other charges your wireless carrier may impose in connection with your use of the App.

7. Payments.

7.1. General. Payment processing for the Services is handled by Stripe, Inc. (“Stripe”) or other third-party payment processors we may use from time to time (“Payment Processor”). DocAssistant AI, Inc. does not collect or store your credit card information. For more information on our privacy practices, please refer to our Privacy Policy. By providing a credit card or other payment method accepted by DocAssistant AI, Inc. and using the Services, you represent and warrant that you are authorized to use the designated payment method. If the payment method you provide cannot be verified, is invalid, or is otherwise unacceptable, your account may be suspended or canceled. You must resolve any issues we or our Payment Processor encounter to continue using your account.

7.2. Subscription Fees. DocAssistant AI, Inc. offers monthly or annual subscriptions for access to the Platform (“Subscription”) for a fee disclosed at the time of sign-up (the “Subscription Fee”). We may introduce new fees or modify existing fees at our discretion. Payment for a Subscription is due immediately upon purchase. By purchasing, you agree to pay DocAssistant AI, Inc., through our third-party payment processor (“Third-Party Payment Processor”), all applicable fees for the Subscription you select. Any information you provide to the Third-Party Payment Processor will be processed according to its privacy policy and terms of use. YOU MUST PROVIDE CURRENT, COMPLETE, AND ACCURATE INFORMATION FOR YOUR ACCOUNT, AND PROMPTLY UPDATE ALL INFORMATION TO KEEP SUCH ACCOUNT INFORMATION CURRENT, COMPLETE, AND ACCURATE (SUCH AS A CHANGE IN BILLING ADDRESS, CREDIT CARD NUMBER, OR CREDIT CARD EXPIRATION DATE). FURTHER, YOU MUST PROMPTLY NOTIFY US IF A PAYMENT METHOD IS CANCELED (E.G., FOR LOSS OR THEFT) OR IF YOU BECOME AWARE OF A POTENTIAL BREACH OF SECURITY, SUCH AS THE UNAUTHORIZED DISCLOSURE OR USE OF YOUR USERNAME OR PASSWORD. CHANGES TO SUCH INFORMATION CAN BE MADE THROUGH YOUR ACCOUNT.

By purchasing a Subscription, you acknowledge that your Subscription has an initial and recurring payment charge at the then-current Subscription rate, and you agree that DocAssistant AI, Inc. may submit monthly or annual charges, as applicable, in advance to your chosen payment method without further authorization from you, until you notify DocAssistant AI, Inc. that you wish to cancel your Subscription or change your payment method. You accept responsibility for all recurring charges prior to cancellation, including any charges processed by DocAssistant AI, Inc. after the expiration date of your payment card.

You may change or terminate your Subscription by visiting your account billing page or emailing us at support@docassistant.ai. If you terminate your Subscription, you may use it until the end of the current billing cycle, and it will not be renewed thereafter. DocAssistant AI, Inc. does not refund any pre-paid portion of the Subscription fee. DocAssistant AI, Inc. may immediately terminate or suspend your Subscription for any reason or no reason in accordance with these Terms of Use, including for failure to pay applicable fees when due. If we terminate or suspend your Subscription, your right to use any software or content provided in connection with the Subscription is also terminated or suspended (as applicable).

8. Your Content

8.1. The Services may allow you and other users to upload, post, and share text, images, audio, and video (“Your Content”), and you may be able to share Your Content with other end users of the Services. You acknowledge that all of Your Content is stored on and made available through the Services by DocAssistant AI, Inc.'s servers and not on your device.

8.2. You understand that all of Your Content is provided to you through the Services only on an “as-available” basis and DocAssistant AI, Inc. does not guarantee that the availability of Your Content will be uninterrupted or bug-free. You agree you are responsible for all of Your Content and all activities that occur under your user account. As stated at the top of this Agreement, you are not permitted to include Protected Information in Your Content on the Services.

8.3. You own all rights in Your Content. We do not claim ownership of Your Content, and you are free to share Your Content with anyone else, wherever you want. However, we need certain legal permissions from you (known as a “license”) to provide you use of the Services. Except as set forth in this paragraph, we will not share Your Content with any third parties. You hereby grant DocAssistant AI, Inc. during the term of this Agreement a worldwide, non-exclusive, fully paid-up, royalty-free license to use, reproduce, display, transmit, and prepare derivative works of Your Content, and to additionally distribute and publicly perform (such distribution and public performance solely in connection with the sharing functionality described below in this paragraph) Your Content to the extent necessary to (i) provide the functionality of the Services, including the sharing of Your Content with our third-party service providers solely for use on our behalf in the provision of the Services; and (ii) on an aggregated or de-identified basis for purposes of developing and improving DocAssistant AI, Inc.'s technology, databases, products, and services; (iii) to the extent set forth in our Privacy Policy. To the extent you share Your Content with other users through the Platform, you also hereby grant to each such user of the Services a non-exclusive license to access, view, and/or download Your Content as permitted by the functionality of the Services and this Agreement. Except for the license granted in Subpart (ii) above, the licenses in this paragraph end when Your Content is deleted from our systems. You can delete Your Content individually or all at once by deleting your account (as described in Section 11).

8.4. In connection with Your Content, you further agree that you will not: (i) use material that is subject to third-party intellectual property or proprietary rights, including privacy and publicity rights, unless you are the owner of such rights or have permission from their rightful owner to post the material and to grant DocAssistant AI, Inc. all of the license rights granted herein; (ii) use Protected Information; (iii) use material that is unlawful, defamatory, libelous, threatening, pornographic, obscene, harassing, hateful, racially or ethnically offensive, or encourages conduct that would be considered a criminal offense, violate any law, or is otherwise inappropriate; or (iii) include advertisements or marketing content or solicitations of business, or any content of a commercial nature. DocAssistant AI, Inc. may investigate an allegation that any of Your Content does not conform to this Agreement and may determine in good faith and in its sole discretion whether to remove such of Your Content, which it reserves the right to do at any time. If you are a copyright holder and believe in good faith that your content has been made available through the Platform without your authorization, you may follow the process outlined at https://docassistant.ai/dmca to notify DocAssistant AI, Inc.'s designated agent (pursuant to 17 U.S.C. § 512(c)) and request that DocAssistant AI, Inc. remove such content.

For purposes of this Agreement, “Your Data” means (i) any data and information that you and your Authorized Users submit to the Platform, including, without limitation, Medical Records, Patient Recordings, and the personal information (such as name, email address, and other identifying information) of Authorized Users; (ii) Voice ID; and (iii) Output (including Learned Output); “Patient Recordings” means: (i) the audio and/or video recordings of the sessions between you (or your Authorized Users) and patient (and the patient’s parents, guardians, or other family members or friends, to the extent participating in such sessions) that you or your Authorized Users conduct and upload to the Platform; and (ii) the information and data collected and/or gathered by you (or your Authorized Users) during such sessions that you or your Authorized Users upload to the Platform; “Protected Health Information” or “PHI” means as that term is defined under the Health Insurance Portability and Accountability Act of 1996, as amended, and related regulation (“HIPAA”); “Usage Data” means the data that we collect in connection with our monitoring of the performance and use of the Platform by you and your Authorized Users, including, without limitation, date and time that you access the Platform, the portions of the Platform visited, the frequency and number of times such pages are accessed, the number of times the Platform is used in a given time period, and other usage and performance data, including any usage and performance data collected by our third-party services providers on our behalf; “Output” means the medical documentation generated by processing Your Data through the Platform and provided to you and your Authorized Users through the Platform, including any alterations, modifications, and updates made thereto; and “Medical Records” means any and all data, information, documents, and records about the patient’s history, clinical findings, diagnostic test results, patient’s progress, including but not limited to, test results, medications, therapies, X-rays, and reports.

As between the parties, all right, title, and interest in and to the Platform, the Aggregate Data, the Usage Data, and the De-Identified Data, including all modifications, improvements, adaptations, enhancements, derivatives, or translations made thereto or therefrom, and all intellectual property rights therein, are and will remain the sole and exclusive property of DocAssistant AI, Inc.

You own all right, title, and interest in and to Your Data and Output, including all modifications, improvements, adaptations, enhancements, or translations made thereto, and all intellectual rights therein. You hereby grant DocAssistant AI, Inc. a non-exclusive, worldwide, fully paid-up, royalty-free right and license, with the right to grant sublicenses, to reproduce, execute, use, store, archive, modify, perform, display, and distribute Your Data: (i) during the term of this Agreement, in furtherance of DocAssistant AI, Inc.'s obligations hereunder; (ii) for DocAssistant AI, Inc.'s internal business purposes, including using such data to analyze, update, and improve the Platform and DocAssistant AI, Inc.'s analytics capabilities; and (iii) to train the AI/ML models to improve the Platform, including but not limited to improving the Platform accuracy, efficiency, and quality of speech recognition and Output, with your consent provided via Platform settings. We will process any PHI included in Your Data in accordance with the Business Associate Agreement attached hereto as Schedule A (“BAA”). You will have sole responsibility for the accuracy, quality, and legality of Your Data. If the terms of this Agreement conflict with the terms of the BAA, the terms of the BAA shall control solely with respect to processing of PHI. By providing Your Data, you agree to be legally bound by the terms and conditions of the BAA, which is made part of this Agreement.

De-Identified Data; Aggregate Data. Pursuant to Section 2a of the BAA, we have the right in our sole discretion to use De-identified Data and to disclose such De-identified Data to third parties. We will also link your De-identified Data with your customer ID and use it to customize and train our Platform based on your specific styles and requirements that can be identified from Your Data. Notwithstanding anything to the contrary herein, we may use, and may permit our third-party service providers to access and use, Your Data, as well as any Usage Data that we may collect, in an anonymous and aggregated form (“Aggregate Data”) for the purposes of operating, maintaining, managing, and improving our products and services including the Platform and the Services. Aggregate Data does not identify you or any individual. You hereby agree that we may collect, use, publish, disseminate, sell, transfer, and otherwise exploit such Aggregate Data.

Learned Output. If you would like the Platform to learn specific styles and requirements of an Output and use that as an example to improve future Output, then you choose to identify such Output as “Learned Output” in your account settings on the Platform. Once identified as “Learned Output” we will link it with your Customer ID and use it to customize and train our Platform based on the specific styles and requirements of the Learned Output. Notwithstanding anything to the contrary set forth herein, all Learned Output will be stored and retained by us until you or your Authorized Users manually delete it.

Voice ID. With your opt-in consent, we will record your voice to create a voice ID (“Voice ID”) on the Platform. We will store the Voice ID and use it to train the Platform to enable the Platform to recognize your voice when Processing Customer Data so the Platform can assign speaker labels for attribution purposes when creating the Output.

With respect to your Patient Recordings, you have the option in the Platform settings to choose to (i) delete the Patient Recordings immediately once they are processed by the Platform; or (ii) store the Patient Recordings in the Platform in accordance with the same retention setting you select for the rest of Your Data. Subject to the settings you choose with respect to your Patient Recordings, you have the option in the Platform settings to choose to (i) retain Your Data in the Platform only for a period of thirty (30) days from the date it was submitted through the Platform; or (ii) retain Your Data in the Platform for the term of this Agreement. If you choose option (i) with respect to Your Data pursuant to the foregoing sentence, then except as set forth in Section 17, after this thirty (30) day period, we will delete Your Data; provided, however, Your Data will continue to be retained as part of our backup system for a period of seven (7) additional days and it will be deleted based on our data retention policies. You have full control of the options you select pursuant to this Section and you are solely responsible for the options you select.

8.5. You hereby acknowledge that you may be exposed to content from other users that is inaccurate, offensive, obscene, indecent, or objectionable when using the Services, and further acknowledge that DocAssistant AI, Inc. does not control the content shared by users and does not have any obligation to monitor such content for any purpose.

9. Prohibited Uses. As a condition of your use of the Services, you will not use the Services for any purpose that is unlawful or prohibited by this Agreement. You may not use the Services in any manner that in our sole discretion could damage, disable, overburden, impair, or interfere with any other party's use of it. You may not obtain or attempt to obtain any materials or information through any means not intentionally made available through the Services. You agree not to scrape or otherwise use automated means to access or gather information from the Services and agree not to bypass any robot exclusion measures we may put into place. In addition, you agree not to use false or misleading information in connection with your user account and acknowledge that we reserve the right to disable any user account with a profile which we believe (in our sole discretion) is false or misleading (including a profile that impersonates a third party).

By accessing and/or using the Platform, you hereby agree to comply with the following guidelines:

You will not use the Platform for any unlawful purpose;

You will not access or use the Platform to collect any market research for a competing business;

You will not upload, post, e-mail, transmit, or otherwise make available any content that:

infringes any copyright, trademark, right of publicity, or other proprietary rights of any person or entity; or

constitutes promotion or advertising of any third-party website, product, or service; or

is defamatory, libelous, indecent, obscene, pornographic, sexually explicit, invasive of another’s privacy, promotes violence, or contains hate speech (i.e., speech that attacks or demeans a group based on race or ethnic origin, religion, disability, gender, age, veteran status, and/or sexual orientation/gender identity); or

discloses any sensitive information about another person, including that person’s e-mail address, postal address, phone number, credit card information, or any similar information.

You will not impersonate any person or entity or falsely state or otherwise misrepresent your affiliation with a person or entity;

You will not decompile, reverse engineer, or disassemble any software or other products or processes accessible through the Platform;

You will not cover, obscure, block, or in any way interfere with any advertisements and/or safety features on the Platform;

You will not circumvent, remove, alter, deactivate, degrade, or thwart any of the protections in the Platform;

You will not create multiple accounts on the Platform to get a free trial of the Platform and/or avoid paying applicable fees;

You will not use automated means, including spiders, robots, crawlers, data mining tools, or the like to download or scrape data from the Platform, directly or indirectly, except for Internet search engines (e.g., Google) and non-commercial public archives (e.g., archive.org) that comply with our robots.txt file;

You will not take any action that imposes or may impose (in our sole discretion) an unreasonable or disproportionately large load on our technical infrastructure; and

You will not interfere with or attempt to interrupt the proper operation of the Platform through the use of any virus, device, information collection or transmission mechanism, software or routine, or access or attempt to gain access to any data, files, or passwords related to the Platform through hacking, password or data mining, or any other means.

We reserve the right, in our sole and absolute discretion, to deny you (or any device) access to the Platform, or any portion thereof, without notice.

10. Additional Conditions. When engaging with specific features or content on the Services, or when participating in promotions, events, or contests via the Services, your involvement may be governed by extra terms and conditions posted on the Services. These additional terms are incorporated into this Agreement, and you agree to adhere to them during your use or participation.

11. Termination. You can end this Agreement at any time, with or without cause, by deleting your Services account through contacting us at support@docassistant.ai. Simply removing the App from your device does not terminate your Services account. You acknowledge that DocAssistant AI, Inc., at its sole discretion and for any reason or no reason, may terminate this Agreement, your account, or your access to the Services at any time without notice. DocAssistant AI, Inc. may also choose to cease providing the Services, or any part of them, at any time, with or without notice. You agree that DocAssistant AI, Inc. will not be liable to you or any third party for such termination. Sections 2, 4, 5, 7, 8.3, 8.4, 8.5, and 9 through 18 will remain in effect even after this Agreement is terminated.

12. Apple. You acknowledge and agree that Apple, Inc.: (i) is not a party to this Agreement; (ii) has no obligation to provide any maintenance or support services for the App; (iii) is not responsible for addressing any claims by you or third parties related to the App, including product liability claims, claims under consumer protection laws, or claims under any other law, rule, or regulation; (iv) has no obligation to investigate, defend, settle, or discharge any claim that the App or its use infringes any third-party intellectual property rights; and (v) is a third-party beneficiary of this Agreement with the right to enforce its terms against you directly.

13. Disclaimers; No Warranties. THE SERVICES AND ANY CONTENT, INFORMATION, OR OTHER MATERIALS PROVIDED IN CONNECTION WITH OR THROUGH THE SERVICES ARE OFFERED "AS IS" WITHOUT ANY WARRANTIES, EXPRESS OR IMPLIED. TO THE MAXIMUM EXTENT PERMITTED BY LAW, DOCASSISTANT AI, INC. AND ITS LICENSORS, SERVICE PROVIDERS, AND PARTNERS DISCLAIM ALL WARRANTIES, INCLUDING BUT NOT LIMITED TO IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT. DOCASSISTANT AI, INC. AND ITS LICENSORS, SERVICE PROVIDERS, AND PARTNERS DO NOT GUARANTEE THAT THE SERVICES' FEATURES AND FUNCTIONALITY WILL BE UNINTERRUPTED OR ERROR-FREE, THAT DEFECTS WILL BE CORRECTED, OR THAT THE SERVICES OR THE SERVERS THAT MAKE THEM AVAILABLE ARE FREE OF VIRUSES OR OTHER HARMFUL COMPONENTS. SOME STATE LAWS DO NOT ALLOW LIMITATIONS ON IMPLIED WARRANTIES. IF THESE LAWS APPLY TO YOU, SOME OR ALL OF THE ABOVE DISCLAIMERS, EXCLUSIONS, OR LIMITATIONS MAY NOT APPLY TO YOU, AND YOU MAY HAVE ADDITIONAL RIGHTS.

14. Indemnification. You agree to indemnify and hold DocAssistant AI, Inc. and its affiliates, and each of their officers, directors, and employees, harmless from any claims, losses, damages, liabilities, costs, and expenses, including reasonable attorney's fees, arising from or related to your use or misuse of the Services, including any use of AI-generated diagnoses or other outputs from the Services (such as DocAssistant AI), your provision of professional, advisory, analytical, and technical services, including patient examination, diagnosis, prescription, treatment, and personal injury or loss of life, breach of this Agreement, or infringement, misappropriation, or violation of the intellectual property or other rights of any person or entity, except to the extent the claim arises from DocAssistant AI, Inc.'s willful misconduct or gross negligence. DocAssistant AI, Inc. reserves the right, at its own expense, to assume the exclusive defense and control of any matter for which you are required to indemnify us, and you agree to cooperate with our defense of these claims.

15. Limitation of Liability and Damages. UNDER NO CIRCUMSTANCES, INCLUDING NEGLIGENCE, SHALL DOCASSISTANT AI, INC. OR ITS AFFILIATES, CONTRACTORS, EMPLOYEES, OFFICERS, DIRECTORS, AGENTS, OR THIRD-PARTY PARTNERS, LICENSORS, OR SERVICE PROVIDERS BE LIABLE TO YOU FOR ANY SPECIAL, INDIRECT, INCIDENTAL, CONSEQUENTIAL, OR EXEMPLARY DAMAGES ARISING OUT OF OR RELATED TO THE SERVICES, INCLUDING YOUR USE THEREOF, OR ANY OTHER INTERACTIONS WITH DOCASSISTANT AI, INC., EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. APPLICABLE LAW MAY NOT ALLOW THE LIMITATION OR EXCLUSION OF LIABILITY OR INCIDENTAL OR CONSEQUENTIAL DAMAGES, SO THE ABOVE LIMITATION OR EXCLUSION MAY NOT APPLY TO YOU, IN WHICH CASE DOCASSISTANT AI, INC.'S LIABILITY WILL BE LIMITED TO THE EXTENT PERMITTED BY LAW. IN NO EVENT SHALL THE TOTAL LIABILITY OF DOCASSISTANT AI, INC. OR ITS AFFILIATES, CONTRACTORS, EMPLOYEES, OFFICERS, DIRECTORS, AGENTS, OR THIRD-PARTY PARTNERS, LICENSORS, OR SERVICE PROVIDERS TO YOU FOR ALL DAMAGES, LOSSES, AND CAUSES OF ACTION ARISING OUT OF OR RELATED TO THIS AGREEMENT OR YOUR USE OF THE SERVICES EXCEED ONE HUNDRED U.S. DOLLARS.

16. Arbitration

16.1. Agreement to Arbitrate. This Section 16 is referred to as the “Arbitration Agreement.” The parties agree that any disputes, claims, or controversies between you and DocAssistant AI, Inc. arising from or related to this Agreement shall be resolved through binding arbitration under the terms of this Arbitration Agreement, and not through court action (except for small claims court actions if the claim qualifies). The Federal Arbitration Act governs the interpretation and enforcement of this Arbitration Agreement.

16.2. Class Action Waiver. THE PARTIES AGREE THAT EACH PARTY MAY BRING CLAIMS AGAINST THE OTHER ONLY ON AN INDIVIDUAL BASIS AND NOT AS A PLAINTIFF OR CLASS MEMBER IN ANY PURPORTED CLASS OR REPRESENTATIVE ACTION OR PROCEEDING. UNLESS BOTH PARTIES AGREE OTHERWISE, THE ARBITRATOR MAY NOT CONSOLIDATE OR JOIN MORE THAN ONE PERSON'S OR PARTY'S CLAIMS AND MAY NOT OTHERWISE PRESIDE OVER ANY FORM OF A CONSOLIDATED, REPRESENTATIVE, OR CLASS PROCEEDING. ALSO, THE ARBITRATOR MAY AWARD RELIEF (INCLUDING MONETARY, INJUNCTIVE, AND DECLARATORY RELIEF) ONLY IN FAVOR OF THE INDIVIDUAL PARTY SEEKING RELIEF AND ONLY TO THE EXTENT NECESSARY TO PROVIDE RELIEF NECESSITATED BY THAT PARTY'S INDIVIDUAL CLAIM(S).

16.3. Procedures. Arbitration will be conducted by a neutral arbitrator in accordance with the American Arbitration Association's (“AAA”) rules and procedures (the “AAA Rules”), as modified by this Arbitration Agreement. If there is any inconsistency between the AAA Rules and this Arbitration Agreement, the terms of this Arbitration Agreement will control unless the arbitrator determines that the application of the inconsistent Arbitration Agreement terms would not result in a fundamentally fair arbitration. The arbitrator must also follow the provisions of this Agreement as a court would, including without limitation, the limitation of liability provisions in Section 15. You may visit http://www.adr.org for information on the AAA and http://www.adr.org/fileacase for information on how to file a claim against DocAssistant AI, Inc.

16.4. Venue. The arbitration shall be held in the county in which you reside or at another mutually agreed location. If the value of the relief sought is $10,000 or less, you or DocAssistant AI, Inc. may elect to have the arbitration conducted by telephone or based solely on written submissions, which election shall be binding on each party, but subject to the arbitrator's discretion to require an in-person hearing if the circumstances warrant. Attendance at any in-person hearing may be made by telephone by either or both parties unless the arbitrator requires otherwise.

16.5. Governing Law. The arbitrator will decide the substance of all claims in accordance with the laws of the State of California, without regard to its conflicts of laws rules, and will honor all claims of privilege recognized by law. The arbitrator shall not be bound by rulings in prior arbitrations involving different users of the Services but is bound by rulings in prior arbitrations involving you to the extent required by applicable law.

16.6. Costs of Arbitration. Payment of all filing, administration, and arbitrator fees (collectively, the “Arbitration Fees“) will be governed by the AAA's Rules. Each party will be responsible for all other fees it incurs in connection with the arbitration, including without limitation, all attorney fees.

16.7. Confidentiality. All aspects of the arbitration proceeding, and any ruling, decision or award by the arbitrator, will be strictly confidential for the benefit of all parties.

16.8. Severability. If a court decides that any term or provision of this Arbitration Agreement other than Section 16.2 is invalid or unenforceable, the parties agree to replace such term or provision with a term or provision that is valid and enforceable and that comes closest to expressing the intention of the invalid or unenforceable term or provision, and this Arbitration Agreement shall be enforceable as so modified. If a court decides that any of the provisions of Section 16.2 is invalid or unenforceable, then the entirety of this Arbitration Agreement shall be null and void. The remainder of this Agreement will continue to apply.

17. Miscellaneous. DocAssistant AI, Inc. may modify, delete, or add to this Agreement (“Changes”) at any time. Changes will be effective: (i) thirty (30) days after DocAssistant AI, Inc. provides notice of the Changes, whether through the Services user interface, sent to the e-mail address associated with your account, or otherwise; or (ii) when you opt-in or otherwise expressly agree to the Changes or a version of this Agreement incorporating the Changes, whichever comes first. Under this Agreement, you consent to receive communications from DocAssistant AI, Inc. electronically. This Agreement shall be governed by and construed in accordance with the laws of the State of California, without giving effect to any principles of conflicts of law. You agree that any action at law or in equity arising out of or relating to this Agreement or the Services that is not subject to arbitration under Section 16 shall be filed only in the state or federal courts in California (or a small claims court of competent jurisdiction) and you hereby consent and submit to the personal jurisdiction of such courts for the purposes of litigating any such action. The failure of any party at any time to require performance of any provision of this Agreement shall in no manner affect such party's right at a later time to enforce the same. A waiver of any breach of any provision of this Agreement shall not be construed as a continuing waiver of other breaches of the same or other provisions of this Agreement. If any provision of this Agreement shall be unlawful, void, or for any reason unenforceable, then that provision shall be deemed severable from this Agreement and shall not affect the validity and enforceability of any remaining provisions. This Agreement, and any rights and licenses granted hereunder, may not be transferred or assigned by you, but may be assigned by DocAssistant AI, Inc. without restriction. This is the entire agreement between us relating to the subject matter herein and shall not be modified except in a writing, signed by both parties, or by a change to this Agreement made by DocAssistant AI, Inc. as set forth herein.

18. Data Sharings with StatPearls. Data Sharing with StatPearls for Marketing Purposes Information We May Share By using DocAssistant, you acknowledge and agree that we may share limited user information with StatPearls, our trusted content partner, for marketing, promotional outreach, and user engagement purposes. The information shared may include: Name, email address, phone number (if provided) Medical specialty, position, and level of training (if provided) Usage patterns and interactions with StatPearls content within DocAssistant Preferences and engagement with medical education resources Purpose of Data Sharing This data sharing is intended to: Provide personalized educational content and marketing materials from StatPearls. Inform users about exclusive offers, discounts, and updates on StatPearls’ evidence-based resources. Enhance the integration experience between DocAssistant and StatPearls, ensuring seamless access to relevant peer-reviewed medical content. Your Privacy Rights Opt-Out Option: Users can opt out of data sharing at any time by contacting support@docassistant.ai Data Protection: DocAssistant and StatPearls will handle shared information in accordance with applicable data protection laws. No patient data or protected health information (PHI) will be shared. Third-Party Use: StatPearls will not sell, rent, or disclose shared user information beyond its own marketing, research, and educational outreach efforts. Compliance with Privacy Regulations DocAssistant ensures that all data shared with StatPearls complies with HIPAA. Only non-sensitive, non-clinical user information will be shared, and StatPearls agrees to maintain industry-standard data security and privacy protections.

19. PIPEDA Compliance
DocAssistant uses secure third-party services to process audio and text data for the purposes of medical transcription and clinical documentation. This processing takes place on servers located in the United States, and while the data is encrypted and not retained, it may be subject to access under U.S. laws. We have configured all third-party services to disable storage and implemented safeguards to align with Canadian privacy expectations under the Personal Information Protection and Electronic Documents Act (PIPEDA). By using DocAssistant, users acknowledge and consent to this cross-border processing.If you have questions about our privacy practices or would like to request access to or deletion of your data, please contact:

Nathan Murray
Privacy & Compliance Officer
DocAssistant
privacy@docassistant.ai

​BUSINESS ASSOCIATE AGREEMENT

This Business Associate Agreement (“BAA”) is by and between DocAssistant AI, Inc. (“Business Associate”), and Customer (“Covered Entity”), and is effective as of the Effective Date.

WHEREAS, the parties have entered into the Terms of Use pursuant to which the Business Associate will provide certain services to, for, or on behalf of Covered Entity involving the use or disclosure of Protected Health Information (“PHI”), and pursuant to such Terms of Use, Business Associate may be considered a “business associate” of Covered Entity; and

WHEREAS, Covered Entity and Business Associate intend to protect the privacy and provide for the security of PHI disclosed to Business Associate pursuant to the Terms of Use in compliance with the Health Insurance Portability and Accountability Act of 1996, Public Law 104-191 (“HIPAA”) and the Standards for Privacy of Individually Identifiable Health Information promulgated thereunder by the U.S. Department of Health and Human Services at 45 CFR § 160 and § 164 (the “HIPAA Rules”), and the Health Information Technology for Economic and Clinical Health Act of 2009 (the “HITECH Act”), in each case as amended from time to time; and

WHEREAS, the purpose of this BAA is to satisfy certain standards and requirements of the HIPAA Rules and the HITECH Act, as the same may be amended from time to time.

NOW, THEREFORE, in consideration of the mutual promises below and the exchange of information pursuant to this BAA, the parties agree as follows:

1. Definitions

Terms used but not otherwise defined in this BAA shall have the same meaning as set forth in 45 CFR Parts 160, 162 and 164, or the HITECH Act.

2. Obligations of Business Associate

a. Permitted Uses and Disclosures. Business Associate agrees to only Use or Disclose PHI as necessary in order to perform the services set forth in the Terms of Use, as permitted under this BAA, or as Required by Law. Business Associate shall have the right to de-identify any and all PHI, provided that Business Associate implements a de-identification process that conforms to the requirements of 45 C.F.R. 164.514(a)-(c) (“De-identified Data”). Business Associate may Use or Disclose such De-identified Data to third parties at its discretion, as such De-identified Data does not constitute PHI and is not subject to the terms of this BAA.

b. Nondisclosure. Business Associate shall not Use or further Disclose PHI other than as permitted or required by this BAA.

c. Safeguards. Business Associate shall use appropriate safeguards to prevent Use or Disclosure of PHI other than as provided for by this BAA. Business Associate shall maintain a comprehensive written information privacy and security program that includes administrative, technical and physical safeguards appropriate to the size and complexity of the Business Associate’s operations and the nature and scope of its activities.

d. Reporting of Disclosures; Mitigation. Business Associate shall report to Covered Entity any use or disclosure of PHI not provided for by this BAA of which Business Associate becomes aware. Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a use or disclosure of PHI by Business Associate in violation of the requirements of this BAA.

e. Business Associate’s Agents. Business Associate shall ensure that any subcontractors, to whom it provides PHI received from (or created or received by Business Associate on behalf of) Covered Entity agree to the same restrictions and conditions that apply to Business Associate with respect to such PHI.

f. Availability of Information to Covered Entity. Business Associate shall make available to Covered Entity (or, as directed by Covered Entity, to an Individual) such information as Covered Entity may request, and in the time and manner designated by Covered Entity, to fulfill Covered Entity’s obligations (if any) to provide access to, provide a copy of, and account for disclosures with respect to PHI pursuant to HIPAA and the HIPAA Rules, including, but not limited to, 45 CFR §§ 164.524 and 164.528.

g. Amendment of PHI. Business Associate shall make any amendments to PHI in a Designated Record Set that the Covered Entity directs or agrees to at the request of Covered Entity or an Individual, and in the time and manner designated by Covered Entity, to fulfill Covered Entity’s obligations (if any) to amend PHI pursuant to HIPAA and the HIPAA Rules, including, but not limited to, 45 CFR § 164.526, and Business Associate shall, as directed by Covered Entity, incorporate any amendments to PHI into copies of such PHI maintained by Business Associate.

h. Internal Practices. Business Associate shall make its internal practices, books and records relating to the use and disclosure of PHI received from Covered Entity (or created or received by Business Associate on behalf of Covered Entity) available to the Secretary, in a time and manner designated by Covered Entity or the Secretary, for purposes of the Secretary determining Covered Entity’s compliance with HIPAA and the HIPAA Rules.

i. Documentation of Disclosures for Accounting. Business Associate agrees to document such disclosures of PHI and information related to such disclosures as would be required for Covered Entity to respond to a request by an Individual for an accounting of disclosures of PHI in accordance with 45 CFR § 164.528.

j. Access to Documentation for Accounting. Business Associate agrees to provide to Covered Entity or an Individual, in a time and manner designated by Covered Entity, information documented in accordance with Section 2(i) of this BAA in a time and manner as to permit Covered Entity to respond to a request by an Individual for an accounting of disclosures of PHI in accordance with 45 CFR § 164.528.

k. Notification of Breach. During the Term of this BAA, Business Associate shall notify Covered Entity within ten (10) days of Discovery of any Breach of Unsecured PHI. Business Associate further agrees, consistent with Section 13402 of the HITECH Act, to provide Covered Entity with information necessary for Covered Entity to meet the requirements of said section, and in a manner and format to be specified by Covered Entity.

l. Minimum Necessary. When using, disclosing, or requesting PHI from the Covered Entity, or in accordance with any provision of this BAA, Business Associate shall limit PHI to the minimum necessary to accomplish the intended purpose of the use, disclosure, or request.

3. Obligations of Covered Entity

a. Covered Entity shall be responsible for using appropriate safeguards to maintain and ensure the confidentiality, privacy and security of PHI transmitted to Business Associate pursuant to the BAA and this BAA, in accordance with the standards and requirements of HIPAA and the HIPAA Rules, until such PHI is received by Business Associate.

b. Upon request, Covered Entity shall provide Business Associate with the notice of privacy practices that Covered Entity produces in accordance with 45 CFR § 164.520, as well as any changes to such notice.

c. Covered Entity shall provide Business Associate with any changes in, or revocation of, permission by an Individual to use or disclose PHI, if such changes affect Business Associate’s permitted or required uses or disclosures.

d. Covered Entity shall notify Business Associate of any restriction to the use or disclosure of PHI that Covered Entity has agreed to in accordance with 45 CFR § 164.522, if such restriction affects Business Associate’s permitted or required uses or disclosures.

4. Term and Termination

a. Term. The Term of this BAA shall become effective as of the Effective Date and shall terminate when all of the PHI provided by Covered Entity to Business Associate, or created or received by Business Associate on behalf of Covered Entity, is destroyed or returned to Covered Entity, or, if it is infeasible to return or destroy PHI, protections are extended to such information, in accordance with the termination provisions of this Section. The provisions of this BAA shall survive termination of the BAA to the extent necessary for compliance with HIPAA and the HIPAA Rules.

b. Material Breach. A material breach by either party of any provision of this BAA shall constitute a material breach of the BAA, if such breach is not cured by the breaching party within thirty (30) days of receipt of notice describing the material breach.

c. Reasonable Steps to Cure Breach. If either party learns of an activity or practice of the other party that constitutes a material breach or violation of the other party’s obligations under the provisions of this BAA, then the non-breaching party shall notify the breaching party of the breach and the breaching party shall take reasonable steps to cure such breach or violation, as applicable, within a period of time which shall in no event exceed thirty (30) days. If the breaching party’s efforts to cure such breach or violation are unsuccessful, the non-breaching party shall either terminate the BAA, if feasible, or if termination of the BAA is not feasible and the breaching party has violated the HIPAA Rules, the non-breaching party may report the breaching party’s breach or violation to the Secretary.

d. Judicial or Administrative Proceedings. Either party may terminate the BAA, effective immediately, if the other party is named as a defendant in a criminal proceeding for an alleged violation of HIPAA, or a finding or stipulation that the other party has violated any standard or requirement of HIPAA or other security or privacy laws is made in any administrative or civil proceeding in which the party has been joined.

e. Effect of Termination.

Subject to Section 17 of the Terms of Use, except as provided in paragraph (e)(2) of this Section or if required by law or regulation to be maintained by Business Associate, upon termination of the BAA for any reason, Business Associate shall return at Covered Entity’s expense, or destroy all PHI received from Covered Entity (or created or received by Business Associate on behalf of Covered Entity) that Business Associate still maintains in any form, and shall retain no copies of such PHI. This provision shall apply to PHI that is in the possession of subcontractors or agents of Business Associate.

In the event that Business Associate determines that returning or destroying the PHI is infeasible, Business Associate shall provide to Covered Entity notification of the conditions that make return or destruction infeasible. Upon mutual agreement of the parties that return or destruction of PHI is infeasible, Business Associate shall extend the protections of this BAA to such PHI and limit further uses and disclosures of such PHI to those purposes that make the return or destruction infeasible, for so long as Business Associate maintains such PHI. The obligations of Business Associate under this Section shall survive the termination of the BAA.

5. Amendment to Comply with Law

The parties acknowledge that state and federal laws relating to electronic data security and privacy are rapidly evolving and that amendment of the BAA may be required to provide for procedures to ensure compliance with such developments. The parties specifically agree to take such action as is necessary to implement the standards and requirements of HIPAA, the HIPAA Rules, the HITECH Act, and other applicable laws relating to the security or confidentiality of PHI. Upon the request of either party, the parties shall promptly enter into negotiations concerning the terms of an amendment to the BAA embodying written assurances consistent with the standards and requirements of HIPAA, the HIPAA Rules, the HITECH Act, or other applicable laws relating to security and privacy of PHI. Either party may terminate the BAA upon thirty (30) days’ written notice in the event the other party does not promptly enter into negotiations to amend the BAA when requested pursuant to this Section, or does not enter into an amendment to the BAA providing assurances regarding the safeguarding of PHI that satisfy the standards and requirements of HIPAA, the HIPAA Rules, the HITECH Act, or any other applicable laws relating to security and privacy of PHI.

6. No Third Party Beneficiaries

Nothing in this BAA is intended to confer, nor shall anything herein confer, upon any person other than Covered Entity, Business Associate and their respective successors and assigns, any rights, remedies, obligations or liabilities whatsoever and no other person or entity shall be a third party beneficiary of this BAA.

7. Effect on BAA

Except as specifically required to implement the purposes of this BAA, or to the extent inconsistent with this BAA, all other terms of the BAA shall remain in full force and effect.

8. Interpretation

This BAA shall be interpreted as broadly as necessary to implement and comply with HIPAA, the HIPAA Rules and any other applicable law relating to security and privacy of PHI. Any ambiguity in this BAA shall be resolved in favor of a meaning that permits Covered Entity to comply with the HIPAA Rules.

9. Regulatory References

A reference in this BAA to a section in the HIPAA Rules or the HITECH Act means the section as in effect or as amended, and for which compliance is required.

BUSINESS ASSOCIATE AGREEMENT

Last updated: May 21, 2025

 This Business Associate Agreement (“Agreement”) is entered into by and between DocAssistant, LLC, a Delaware limited liability company (“Business Associate”) and the Client executing an Order incorporating this Agreement by reference, or who otherwise agrees or enters into the Client Term and Conditions (“Covered Entity”), which are each a respective covered entity or a business associate under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”). The parties are entering into this Agreement to assist the Covered Entity in complying with HIPAA, and to set forth Business Associate’s obligations under the Health Information Technology for Economic and Clinical Health Act of 2009 (the “HITECH Act”), and 45 CFR Parts 160 and 164, Subpart C (the “Security Rule”), Subpart D (the “Data Breach Notification Rule”), and Subpart E (the “Privacy Rule”) (collectively, the “HIPAA Regulations”) and applicable State law. 

This Agreement applies to any Protected Health Information Business Associate receives from Covered Entity, or creates, receives or maintains on behalf of Covered Entity, under its Client Terms and Conditions or other governing client agreement with Covered Entity (the “Terms”). Capitalized terms used herein but not otherwise defined have the meanings set forth in the Terms. 

AGREEMENT

1.                     Definitions. Except as otherwise defined in this Agreement, capitalized terms shall have the definitions set forth under the HIPAA Regulations, as amended from time to time.
   1.                   “Protected Health Information” or “PHI” shall have the same meaning as the term “protected health information” in 45 CFR § 160.103 of the HIPAA Regulations, provided that it is limited to such protected health information that is received by Business Associate from, or created, received, maintained, or transmitted by Business Associate on behalf of Covered Entity.
   2.                  “Security Incident” shall have the meaning given to the term “security incident” at 45 CFR § 164.304, as applied to the electronic Protected Health Information created, received, maintained, or transmitted by Business Associate from or on behalf of Covered Entity.
   3.                   “Unsuccessful Security Incidents” means, without limitation, pings and other broadcast attacks on Business Associate’s firewall, port scans, unsuccessful log-on attempts, denial of service attacks, and any combination of the above, as long as no such incident results in unauthorized access, acquisition, use, or disclosure of Protected Health Information.
2.                     Permitted Uses and Disclosures. Business Associate may use and disclose Covered Entity’s Protected Health Information to provide Covered Entity with the services under the Terms. Except as expressly provided below, this Agreement does not authorize Business Associate to make any use or disclosure of Protected Health Information that Covered Entity would not be permitted to make under Subpart E of 45 CFR Part 164.
3.                     Obligations of Business Associate. Business Associate will:
   1.                   Not use or further disclose Covered Entity’s Protected Health Information except as permitted by the Terms or this Agreement, or as required by law;
   2.                  Use appropriate safeguards, and comply, where applicable, with the HIPAA Security Rule with respect to electronic Protected Health Information, to prevent use or disclosure of Covered Entity’s Protected Health Information other than as provided for by the Terms or this Agreement. Business Associate agrees to implement administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity and availability of the electronic Protected Health Information that it creates, receives, maintains or transmits on behalf of Covered Entity;
   3.                   Report to Covered Entity any use or disclosure of Covered Entity’s Protected Health Information not provided for by the Terms or this Agreement of which it becomes aware, including breaches of unsecured Protected Health Information as required by the Data Breach Notification Rule (45 CFR § 164.410), and any Security Incident of which Business Associate becomes aware without unreasonable delay, provided that notice is hereby deemed given for Unsuccessful Security Incidents and no further notice of such Unsuccessful Security Incidents shall be given;
   4.                  Ensure that any of Business Associate’s subcontractors that create, receive, maintain, or transmit Protected Health Information on behalf of the Business Associate agree in writing to substantially similar, and no less restrictive, restrictions and conditions as those that apply to Business Associate with respect to such information, including compliance with the HIPAA Security Rule with respect to electronic Protected Health Information;
   5.                  To the extent that Business Associate maintains Protected Health Information in a Designated Record Set, make any Protected Health Information in a designated record set available to Covered Entity to enable Covered Entity to meet its obligation to provide access to the information in accordance with 45 CFR § 164.524;
   6.                    To the extent that Business Associate maintains Protected Health Information in a Designated Record Set, make any Protected Health Information in a designated record set available for amendment and incorporate any amendments to Protected Health Information as directed by Covered Entity pursuant to 45 CFR § 164.526;
   7.                   Make available to Covered Entity the information concerning disclosures that Business Associate makes of Covered Entity’s Protected Health Information required to enable Covered Entity to provide an accounting of disclosures in accordance with 45 CFR § 164.528;
   8.                  To the extent that Business Associate carries out Covered Entity’s obligations under the Privacy Rule, comply with the requirements of the Privacy Rule that apply to Covered Entity in the performance of such obligations; and
   9.                    Make Business Associate’s internal practices, books, and records relating to Business Associate’s use and disclosure of Protected Health Information received from Covered Entity, or created or received by Business Associate on behalf of Covered Entity, available to the Secretary of the United States Department of Health and Human Services for purposes of determining Covered Entity’s compliance with the HIPAA Regulations, subject to attorney-client and other applicable legal privileges.

1.                     Proper Management and Administration of Business Associate. Business Associate may use Covered Entity’s Protected Health Information for the proper management and administration of Business Associate or to carry out Business Associate’s own legal responsibilities.  Business Associate may disclose Protected Health Information for these purposes if Business Associate is required to do so by law, or if Business Associate obtains reasonable assurances from the recipient of the information (1) that it will be held confidentially, and used or further disclosed only as required by law or for the purpose for which it was disclosed to the recipient, and (2) that the recipient will notify Business Associate of any instances of which the recipient is aware in which the confidentiality of the information is breached.
2.                     Data Aggregation. Business Associate may use Covered Entity’s Protected Health Information for data aggregation, as permitted by the Privacy Rule.
3.                     De-identification. Business Associate may de-identify Covered Entity’s Protected Health Information, in compliance with the requirements of 45 CFR § 164.514. Business Associate shall be the owner of such de-identified data.
4.                     Covered Entity Obligations. With regard to the use and/or disclosure of Protected Health Information by Business Associate, Covered Entity agrees:
   1.                    Covered Entity shall not request Business Associate to use or disclose Protected Health Information in any manner that would not be permissible under HIPAA if done by Covered Entity (except to the extent permitted by HIPAA for a business associate).
   2.                  Covered Entity is responsible for maintaining a Notice of Privacy Practices, as required by HIPAA.
   3.                   Covered Entity represents and warrants that it has obtained any necessary authorizations, consents, and other permissions that may be required under any applicable law to provide Protected Health Information to Business Associate and for Business Associate to provide the services.
   4.                  Covered Entity shall notify Business Associate in writing of any limitations in an applicable notice of privacy practices, to the extent that such limitations may affect Business Associate’s use or disclosure of Protected Health Information.
   5.                  Covered Entity shall notify Business Associate in writing of any changes in, or revocation of, authorization by an Individual to use or disclose Protected Health Information, to the extent that such changes or revocation may affect Business Associate’s use or disclosure of Protected Health Information.
   6.                  Covered Entity shall notify Business Associate in writing of any restriction to the use or disclosure of Protected Health Information that Covered Entity has agreed to or is required to abide by in accordance with 45 C.F.R. § 164.522, to the extent that such restriction may affect Business Associate’s use or disclosure of Protected Health Information.

1.                     Term and Termination. This Agreement shall continue in effect until the earlier of (1) expiration of the Terms or (2) termination at any time by Business Associate pursuant to this section of this Agreement.
   1.                   Business Associate may immediately terminate the Terms and/or this Agreement if the Covered Entity is in material breach or default of any obligation in this Agreement. Business Associate may, but does not have the duty to, provide Covered Entity with an opportunity to cure any material breach of the Agreement or end the violation within thirty (30) days.
   2.                  Business Associate may immediately terminate this Agreement, regardless of whether the Covered Entity is in breach or default of any obligation in this Agreement. Such termination shall take effect immediately.
   3.                   Upon expiration or termination of this Agreement, Business Associate shall return or destroy all Protected Health Information in its possession, if it is feasible to do so, and as set forth in the applicable termination provisions of the Agreement. If it is not feasible to return or destroy any portions of the Protected Health Information upon termination of this Agreement, as determined by the Business Associate, then Business Associate shall extend the protections of this Agreement, without limitation, to such Protected Health Information and limit any further use or disclosure of the Protected Health Information to those purposes that make the return or destruction infeasible for the duration of the retention of the Protected Health Information.

1.              No Third-Party Relationships. This Agreement is between the parties hereto. Nothing express or implied in this Agreement is intended to confer, nor shall anything herein confer, any rights, remedies, obligations, or liabilities whatsoever upon any person other than Business Associate and Covered Entity and any respective successors and assigns.
2.              Applicable Law. This Agreement shall be construed, administered, and governed by the governing law set forth in the Terms, except to the extent preempted by applicable federal law.
3.              Notices. All notices hereunder shall be in writing, and be provided in accordance with the provision for notices set forth in the Terms.
4.              Interpretation. This Agreement is to be interpreted in accordance with HIPAA, the HITECH Act, and the regulations promulgated thereunder, as amended from time to time.
5.              Counterparts. This Agreement may be executed in separate counterparts, none of which need contain the signatures of both parties, and each of which, when so executed, shall be deemed to be an original, and such counterparts shall together constitute and be one and the same instrument.