Business Associate Agreement

I. Covered Entity enters into this BAA in its capacity as a covered entity under the Health Insurance Portability and Accountability Act of 1996, as amended by the Health Information Technology for Economic and Clinical Health Act of 2009, and their implementing regulations (collectively, “HIPAA”).

II. The Parties have entered into, or Covered Entity has accepted, the Denti Note Terms of Use or another agreement governing Covered Entity’s access to and use of the Denti Note mobile application, web application, and related services (the “Services Agreement”).

III. In providing the Services under the Services Agreement, Business Associate may create, receive, maintain, transmit, store, or securely dispose of Protected Health Information on behalf of Covered Entity.

IV. In performing those activities, Business Associate acts as a business associate of Covered Entity within the meaning of HIPAA.

V. The Parties intend this BAA to establish the terms governing Business Associate’s handling of Protected Health Information and to satisfy the applicable requirements of HIPAA and other applicable laws governing the privacy and security of such information.

VI. If Covered Entity provides records subject to 42 U.S.C. § 290dd-2 and 42 C.F.R. Part 2 (“Part 2”) through the Services, the Parties acknowledge that those records are subject to additional confidentiality requirements. To the extent Business Associate acts as a qualified service organization (“QSO”) with respect to those records, Business Associate will comply with applicable Part 2 requirements, and the Parties will enter into any additional written QSO terms required by Part 2 before Business Associate receives those records.

NOW, THEREFORE, in consideration of the mutual covenants and conditions contained herein and the continued provision of PHI by Covered Entity to Business Associate under the Services Agreement in reliance on this BAA, the Parties agree as follows:

For purposes of this BAA, capitalized terms not otherwise defined have the meanings assigned to them by the HIPAA Rules or applicable law. References to Breach, Data Aggregation, Designated Record Set, Disclosure, Health Care Operations, Individual, Minimum Necessary, Required by Law, Secretary, Security Incident, Subcontractor, Unsecured Protected Health Information, and Use are to those terms or concepts as used in the HIPAA Rules, unless this BAA expressly provides otherwise.

1. Business Associate. “Business Associate” refers to Topmuse Pte. Ltd. in its capacity as a business associate of Covered Entity under 45 C.F.R. § 160.103. Denti Note is the product through which Business Associate provides the Services; it is not a separate contracting party.
2. Covered Entity. “Covered Entity” refers to the individual or entity accepting this BAA in its capacity as a covered entity under 45 C.F.R. § 160.103.
3. HIPAA Rules. “HIPAA Rules” means the Privacy, Security, Breach Notification, and Enforcement Rules at 45 C.F.R. Parts 160 and 164.
4. Protected Health Information or PHI. “Protected Health Information” or “PHI” means protected health information received from Covered Entity, or created, received, maintained, or transmitted by Business Associate on behalf of Covered Entity. PHI includes electronic protected health information (“ePHI”) where applicable. Information de-identified in accordance with 45 C.F.R. § 164.514(a)–(c) is not PHI for purposes of this BAA.
5. HITECH Act. “HITECH Act” means the Health Information Technology for Economic and Clinical Health Act of 2009, as amended.
6. APP and Services. “APP” means the Denti Note mobile application and web application. “Services” means the functions provided through the APP and described in the Services Agreement, including recording audio during dental sessions or appointments; generating transcripts and speaker or timestamp metadata; processing patient identifiers, session metadata, dental clinical information, and clinician input; generating draft clinical notes, odontograms or tooth charts, patient instructions, referral letters, medical leave letters, patient explanation letters, and other template-based drafts; enabling review, editing, copying, downloading, and management of draft outputs; and processing limited technical, security, support, and audit information needed to operate and secure those functions.
7. AI-generated Draft Content. “AI-generated Draft Content” means any transcript, note, odontogram, letter, or other content generated by the APP. It is draft material requiring independent professional review before use as clinical documentation or placement in a patient record.
8. PHI Processing. “PHI Processing” means creating, receiving, maintaining, transmitting, storing, or securely disposing of PHI.
9. Business Associate Subcontractor. “Business Associate Subcontractor” means a subcontractor engaged by Business Associate that performs PHI Processing on Business Associate’s behalf in connection with the Services.

The use and disclosure of PHI by Business Associate in connection with the Services are subject to the permissions, conditions, and restrictions set out in this Section.

1. Services. Business Associate may use or disclose PHI only as reasonably necessary to provide the Services and perform its obligations under the Services Agreement, as otherwise permitted by this BAA, or as Required by Law. Business Associate may not use or disclose PHI in a manner that would violate Subpart E of 45 C.F.R. Part 164 if done by Covered Entity, except for uses and disclosures expressly permitted for Business Associate’s proper management and administration, legal responsibilities, or Data Aggregation under this BAA.
2. Management and legal responsibilities. Business Associate may use PHI for its proper management and administration or to carry out its legal responsibilities. It may disclose PHI for those purposes only if the disclosure is Required by Law or Business Associate obtains reasonable written assurances from the person or entity to whom the PHI is disclosed that the information will remain confidential, will be used or further disclosed only as Required by Law or for the purpose for which it was disclosed, and the recipient will notify Business Associate of any breach of confidentiality of which it becomes aware.
3. Minimum Necessary. To the extent that Business Associate uses, discloses, or requests PHI to provide the Services, Business Associate shall use reasonable efforts to limit PHI to the minimum necessary to accomplish the intended purpose of the use, disclosure, or request, unless an exception to the minimum necessary requirements under HIPAA applies. Notwithstanding anything to the contrary, the parties acknowledge and agree that all PHI that is transmitted to Business Associate is the minimum necessary required by Business Associate to perform its obligations and exercise its rights under the Agreement.
4. Service-specific restrictions. Business Associate will not:
   1. sell PHI or receive remuneration in exchange for PHI except as expressly permitted by the HIPAA Rules;
   2. use or disclose PHI for advertising, unrelated marketing, fundraising, or another independent commercial purpose;
   3. use PHI to train a general-purpose or cross-customer artificial-intelligence or machine-learning model unless Covered Entity has separately authorized that use in writing and the use is permitted by the HIPAA Rules;
   4. use PHI to make autonomous diagnosis, treatment, medication, coding, billing, or other clinical decisions;
   5. represent AI-generated Draft Content as independently verified clinical fact; or
   6. automatically transmit draft clinical content to a practice-management system, electronic health record, or patient record without a separately authorized integration and appropriate clinician review and confirmation.

The Services do not automatically read from or write to a practice-management system or electronic health record through an application programming interface unless separately enabled or agreed by Covered Entity. Covered Entity may manually transfer reviewed content to such a system.

1. Data Aggregation. Business Associate may provide Data Aggregation services relating to Covered Entity’s Health Care Operations only to the extent those services are included in the Services Agreement and permitted by the HIPAA Rules.
2. De-identification. Business Associate may de-identify PHI only in accordance with 45 C.F.R. § 164.514(a)–(c). It may use or disclose properly de-identified information to operate, secure, maintain, support, and improve the Services, conduct lawful analytics, and fulfill other lawful business purposes, provided it does not attempt to re-identify the information or permit a recipient to do so. This paragraph does not permit use of PHI for a purpose prohibited by the service-specific restrictions in this Section 2 before de-identification.
3. Reports of unlawful conduct. Nothing in this BAA prohibits a disclosure to an appropriate government authority that is permitted by 45 C.F.R. § 164.502(j)(1) or otherwise Required by Law.

Business Associate will use appropriate administrative, physical, and technical safeguards to prevent use or disclosure of PHI other than as provided by this BAA. With respect to ePHI, Business Associate will comply with the applicable requirements of Subpart C of 45 C.F.R. Part 164. Business Associate will maintain a written privacy and security program appropriate to the size and complexity of its operations, the nature and scope of its activities, and the sensitivity of the PHI it processes.

Business Associate will report to Covered Entity, without unreasonable delay after becoming aware, any use or disclosure of PHI not permitted by this BAA and any Security Incident. The report will include information then available to Business Associate that is reasonably necessary for Covered Entity to evaluate and respond to the event.

The Parties acknowledge that unsuccessful attempts to access, use, disclose, modify, or destroy ePHI, including routine port scans, pings, unsuccessful login attempts, denial-of-service attempts, and similar events that do not result in unauthorized access, use, disclosure, modification, or destruction of ePHI or material interference with system operations, occur frequently. This paragraph constitutes notice of those unsuccessful events; no additional report is required unless Covered Entity reasonably requests it or the event becomes a reportable Security Incident or Breach.

After Discovery, as determined under 45 C.F.R. § 164.410, of a Breach of Unsecured PHI, Business Associate will notify Covered Entity without unreasonable delay and no later than ten (10) calendar days after Discovery, except to the extent a law-enforcement delay permitted by 45 C.F.R. § 164.412 applies.

To the extent available, the notice will identify each Individual whose Unsecured PHI was, or is reasonably believed to have been, accessed, acquired, used, or disclosed; describe what happened and the dates of the Breach and Discovery, if known; describe the types of Unsecured PHI involved; identify any unauthorized recipient, if known; describe corrective and mitigation actions taken or planned; and provide other information then available that Covered Entity needs for notifications under the HIPAA Rules. Business Associate will promptly supplement its notice as material information becomes available and reasonably cooperate with Covered Entity’s investigation, risk assessment, and legally required notifications. Unless the Parties agree otherwise in writing, Covered Entity will control notifications to Individuals, the Secretary of the U.S. Department of Health and Human Services, and the media.

Business Associate will mitigate, to the extent practicable, any harmful effect known to Business Associate resulting from a use or disclosure of PHI by Business Associate in violation of this BAA.

Covered Entity authorizes Business Associate to engage Business Associate Subcontractors in connection with the Services. In accordance with 45 C.F.R. §§ 164.308(b)(2) and 164.502(e)(1)(ii), Business Associate will ensure that each Business Associate Subcontractor performing PHI Processing agrees in writing to the same applicable restrictions, conditions, and requirements that apply to Business Associate under this BAA. Business Associate will maintain a reasonable vendor-management process consistent with the HIPAA Rules.

To the extent Business Associate maintains PHI in a Designated Record Set, it will make that PHI available to Covered Entity, or as directed by Covered Entity to an Individual or the Individual’s designee, as necessary for Covered Entity to satisfy 45 C.F.R. § 164.524. Unless the Parties agree otherwise, Business Associate will provide the requested information within fifteen (15) business days after receiving Covered Entity’s written request. If Business Associate receives an access request directly from an Individual, it will promptly forward the request to Covered Entity and will not deny the request on Covered Entity’s behalf.

To the extent Business Associate maintains PHI in a Designated Record Set, it will make amendments as directed or agreed to by Covered Entity and incorporate them as necessary for Covered Entity to satisfy 45 C.F.R. § 164.526. Unless the Parties agree otherwise, Business Associate will act within thirty (30) calendar days after receiving Covered Entity’s written direction. If an Individual requests an amendment directly from Business Associate, Business Associate will promptly forward the request to Covered Entity; Covered Entity remains responsible for deciding the request.

Business Associate will document disclosures of PHI and related information as necessary for Covered Entity to respond to a request for an accounting under 45 C.F.R. § 164.528. Unless the Parties agree otherwise, Business Associate will make that information available within thirty (30) calendar days after receiving Covered Entity’s written request. If an Individual sends an accounting request directly to Business Associate, Business Associate will promptly forward it to Covered Entity.

Business Associate will make its internal practices, books, and records relating to the use and disclosure of PHI received from Covered Entity, or created or received by Business Associate on behalf of Covered Entity, available to the Secretary for purposes of determining compliance with the HIPAA Rules. To the extent legally permitted, Business Associate will notify Covered Entity of such a request.

With respect to the Services and PHI processed under this BAA, Covered Entity agrees to fulfill the responsibilities set out below.

1. Lawful instructions. Covered Entity will not request Business Associate to use or disclose PHI in a manner that would violate Subpart E of 45 C.F.R. Part 164 if done by Covered Entity, except for uses and disclosures permitted for Business Associate’s proper management and administration, legal responsibilities, or Data Aggregation under this BAA. Covered Entity will provide only PHI reasonably necessary for the Services.
2. Notice of privacy practices. Covered Entity will notify Business Associate of any limitation in its notice of privacy practices under 45 C.F.R. § 164.520 to the extent the limitation may affect Business Associate’s use or disclosure of PHI.
3. Changes in permission. Covered Entity will notify Business Associate of any change in, or revocation of, an Individual’s permission to use or disclose PHI to the extent the change may affect Business Associate’s permitted or required uses or disclosures.
4. Restrictions. Covered Entity will notify Business Associate of any restriction on the use or disclosure of PHI that Covered Entity has agreed to or is required to abide by under 45 C.F.R. § 164.522 to the extent the restriction may affect Business Associate’s permitted or required uses or disclosures.
5. Authority, notice, and consent. Covered Entity represents and warrants that it is a covered entity within the meaning of HIPAA; that it has authority to provide PHI to Business Associate for processing under this BAA; and that it has given all notices and obtained all permissions, authorizations, and consents required by applicable law and professional obligations, including federal and state requirements concerning audio recording, privacy, and patient consent. Covered Entity is responsible for determining whether and how patient consent must be obtained before recording, and for retaining evidence of patient-specific consent where required. A general in-product acknowledgement is not evidence that consent was obtained from each patient.
6. Clinical responsibility. Covered Entity and its users retain responsibility for professional judgment, patient assessment, and review of AI-generated Draft Content for accuracy, completeness, and appropriateness before use. Covered Entity is responsible for final signing, submission, and placement of clinical documentation in its patient record or practice-management system or electronic health record.
7. Account and endpoint security. Covered Entity is responsible for its users, the security of its credentials and devices, and safeguarding PHI downloaded, copied, exported, or otherwise removed from the Services by Covered Entity or its users.
8. Accuracy, provenance, and instructions. Covered Entity is responsible for the accuracy, quality, and legality of PHI that it or its users provide to Business Associate, the means by which it acquired that PHI, and the lawfulness and accuracy of its instructions to Business Associate under this BAA. This allocation does not relieve Business Associate of its own obligations under this BAA or applicable law with respect to its processing of PHI.
9. Minimum Necessary submission. Covered Entity will use reasonable efforts to limit PHI that it provides to Business Associate, or requests Business Associate to process, to the Minimum Necessary for the intended purpose to the extent that standard applies. Business Associate remains responsible for its own obligations under Section 2, and the acknowledgement in the “Minimum Necessary” provision of Section 2 does not relieve either Party of any applicable Minimum Necessary obligation under the HIPAA Rules.
10. Documentation and changes in permission. Covered Entity will reasonably document the notices, permissions, authorizations, and consents required for its use of the Services and the processing of PHI under this BAA. Following a change or revocation that affects the Services, Covered Entity will promptly notify Business Associate and adjust its use of the Services and its instructions accordingly.
11. Mitigation by Covered Entity. Covered Entity will take reasonable steps to mitigate, to the extent practicable, harmful effects of its own violation of this BAA or applicable law of which it becomes aware and will reasonably cooperate with Business Associate in responding to any resulting incident.
12. Patient matching and output routing. Before signing, disclosing, or relying on AI-generated Draft Content, Covered Entity will verify that relevant inputs and outputs are matched to the correct patient and session and will direct the output only to its intended authorized recipient. This does not excuse Business Associate from errors in its own processing of PHI.
13. Professional validation and qualified personnel. Covered Entity will evaluate the Services and AI-generated Draft Content for accuracy and suitability in its own clinical workflows and ensure that only appropriately trained and licensed or otherwise authorized professionals use the Services or Draft Content for clinical decisions. If Covered Entity provides Draft Content to another healthcare provider for healthcare use, it will communicate any known material limitations of that Draft Content.
14. Other healthcare recipients. If Covered Entity permits a separate healthcare organization or professional to use the Services or Draft Content on its behalf, Covered Entity will ensure that any written arrangement required by applicable law is in place and that the recipient complies with applicable law and uses appropriately qualified personnel. Covered Entity remains responsible for its own users and instructions.
15. Additional legal requirements. Covered Entity will determine whether federal or state laws governing sensitive health information, recording, privacy, or professional practice impose requirements more restrictive than HIPAA on its use of the Services or disclosure of PHI. Covered Entity will not submit such information for processing unless its use and disclosure are lawful and all required permissions, authorizations, and consents have been obtained.

Business Associate’s stewardship of PHI under this BAA does not confer ownership of Covered Entity’s PHI on Business Associate. Rights in other data and content remain governed by the Services Agreement, subject to this BAA’s requirements for PHI.

The following rules apply subject to the HIPAA Rules, the Services Agreement, Covered Entity’s instructions, legal holds, and Business Associate’s documented retention and deletion policies.

1. Original audio. Business Associate will retain each original audio segment for up to thirty (30) calendar days after that segment ends and will then delete it. A supplemental recording does not restart the period for an earlier segment. Encrypted local or temporary upload copies will be removed after successful upload is confirmed, except where temporary retention is reasonably necessary to complete or retry the upload. Deletion of original audio does not by itself delete an existing transcript or generated output.
2. Other PHI during the subscription. Business Associate may retain non-audio PHI while Covered Entity’s subscription remains active as necessary to provide the Services. PHI contained solely in backups or archival systems may remain until deleted under Business Associate’s ordinary backup retention cycle, provided it remains protected and is not used for any other purpose.
3. After termination. Business Associate will return or destroy PHI as provided in Section 15 (“Return or destruction”). If retention is Required by Law or return or destruction is infeasible, Business Associate may retain only the PHI necessary for its proper management and administration or legal responsibilities, no longer than the applicable retention period, and subject to the protections and use restrictions in Section 15 (“Return or destruction”). Under its ordinary retention policy, Business Associate may retain non-audio PHI for no longer than seven (7) years after termination of the associated APP subscription, except where longer retention is Required by Law or subject to a legal hold. Any such retention remains subject to Section 15 (“Return or destruction”).
4. Agreement records. Business Associate will maintain the electronic acceptance record, applicable agreement snapshot, and any digitally signed copy of the same standard BAA as a single retrievable agreement record linked to the same user ID and registered account email used for electronic acceptance. These are compliance records rather than clinical PHI records and will be retained for seven (7) years after expiration or termination of the applicable Services relationship, or longer if Required by Law or subject to a litigation hold. After the applicable period, Business Associate will securely destroy the records under its documented disposal procedures.

This Section governs the duration of this BAA, the circumstances in which it may be terminated, and the disposition of PHI upon termination.

1. Term. This BAA begins on the Effective Date and remains in effect while Business Associate creates, receives, maintains, transmits, or retains PHI on behalf of Covered Entity, unless terminated earlier under this BAA.
2. Material breach by Business Associate. Covered Entity may terminate this BAA and the affected Services if Business Associate materially violates this BAA and does not cure the violation or end the offending practice within thirty (30) days after written notice. Covered Entity may terminate immediately if cure is not feasible. If termination is not feasible, Covered Entity may report the violation to the Secretary.
3. Material breach by Covered Entity. Business Associate may terminate this BAA and the affected Services if Covered Entity materially violates this BAA and does not cure within thirty (30) days after written notice, or immediately if cure is not feasible. A request to withdraw electronic acceptance does not by itself terminate this BAA or require immediate deletion of PHI; any resulting termination and disposition of PHI are governed by the Services Agreement and this Section 15.
4. Return or destruction. Upon termination, Business Associate will, if feasible and as directed by Covered Entity, return or destroy all PHI received from Covered Entity or created, received, maintained, or transmitted on Covered Entity’s behalf that Business Associate still maintains in any form, and will retain no copies. This requirement also applies to PHI held by Business Associate Subcontractors. If return or destruction is infeasible or specified PHI must be retained as Required by Law, Business Associate will notify Covered Entity of the conditions making return or destruction infeasible unless prohibited by law; retain only the PHI necessary for the applicable legal, management, or administrative purpose; continue the protections of this BAA while retaining it; limit further uses and disclosures to the purpose requiring retention or as Required by Law; and return or destroy it when the reason for retention ends.
5. Survival. Business Associate’s obligations regarding retained PHI, government access, retention and deletion, and cooperation survive termination for as long as Business Associate retains PHI.

This Section addresses the relationship between this BAA and the Services Agreement, third-party rights, assignment, and the entire agreement between the Parties concerning PHI.

1. Relationship to Services Agreement. This BAA is incorporated into and forms part of the Services Agreement. If the two conflict, this BAA controls solely with respect to the use, disclosure, safeguarding, return, or destruction of PHI. Otherwise, the Services Agreement remains in effect, including provisions concerning fees, disclaimers, limitations of liability, indemnification, dispute resolution, governing law, and notices. To the maximum extent permitted by applicable law, limitations and exclusions of liability in the Services Agreement apply to claims arising out of or relating to this BAA.
2. Third parties. This BAA creates no right, remedy, obligation, or liability in favor of a person other than the Parties and their permitted successors and assigns.
3. Assignment. Neither Party may assign this BAA except as permitted under the Services Agreement. A permitted successor or assign remains bound by this BAA.
4. Entire agreement concerning PHI. This BAA and the applicable provisions of the Services Agreement constitute the entire agreement between the Parties concerning Business Associate’s processing of PHI on behalf of Covered Entity and supersede earlier or contemporaneous understandings on that subject.
5. Limitation of liability. Without increasing any lower limit of liability or displacing any express exception in the Services Agreement, and to the maximum extent permitted by applicable law, the aggregate liability of Business Associate and its present and former affiliates, directors, officers, employees, and agents arising out of or relating to this BAA, whether in contract, tort, or otherwise, will not exceed the amounts actually paid by Covered Entity and amounts due from Covered Entity under the Services Agreement during the twelve (12) months immediately preceding the event giving rise to the claim. This limitation does not apply to liability that cannot lawfully be limited.
6. Exclusion of certain damages. To the maximum extent permitted by applicable law, Business Associate and its present and former affiliates, directors, officers, employees, and agents will not be liable to Covered Entity for lost profits, loss of data, loss of use, costs of procuring substitute goods or services, or indirect, special, incidental, punitive, or consequential damages arising out of or relating to this BAA, whether in contract, tort, or otherwise, even if advised of the possibility of those damages. This exclusion does not apply to liability that cannot lawfully be excluded or to any express exception in the Services Agreement.
7. Scope. This BAA applies to Business Associate’s processing of PHI on behalf of Covered Entity in connection with the Services. It does not govern Business Associate’s activities that do not involve such PHI and for which no business associate agreement is required. The Parties’ permitted successors and assigns remain bound as provided in this Section 16.
8. Professional-use disclaimer. The Services and AI-generated Draft Content are documentation aids and are not substitutes for the judgment or services of appropriately trained and licensed clinicians or other qualified personnel. Business Associate does not make clinical, diagnostic, treatment, coding, billing, or claims decisions for Covered Entity and is not responsible for those decisions or for the accuracy, completeness, or suitability of information supplied by Covered Entity, except to the extent a loss is caused by Business Associate's own breach of this BAA, negligence, willful misconduct, or an obligation that cannot be excluded under applicable law. Covered Entity will not use the Services or Draft Content as an autonomous medical device or without independent professional review.
9. Covered Entity indemnity. To the extent permitted by applicable law and subject to any applicable procedures and limitations in the Services Agreement, Covered Entity will defend, indemnify, and hold harmless Business Associate and its Business Associate Subcontractors against third-party claims or regulatory proceedings, and resulting damages, judgments, settlements, and reasonable costs (including legal fees and penalties only to the extent lawfully indemnifiable), to the extent arising from:
   • (a) PHI or other information unlawfully obtained, submitted, or disclosed by Covered Entity or its users, including failure to obtain a required consent or authorization;
   • (b) materially inaccurate input, patient matching, or instructions supplied by Covered Entity or its users; or
   • (c) Covered Entity's or its users' unlawful acts, professional decisions, or use or disclosure of AI-generated Draft Content, in each case to the extent such conduct causes or is alleged to cause Business Associate or a Business Associate Subcontractor to violate applicable law. This indemnity does not apply to the extent a claim or loss is caused by the independent breach of this BAA, negligence, or willful misconduct of Business Associate or the relevant Business Associate Subcontractor, and does not shift any non-delegable statutory obligation.

A reference to a HIPAA provision means that provision as in effect or as amended and for which compliance is required. Any ambiguity in this BAA will be interpreted to permit compliance with the HIPAA Rules. Headings are for convenience and do not affect interpretation.

Notices required under this BAA will be delivered in accordance with the notice procedures of the Services Agreement unless this BAA expressly specifies a different recipient or method. Requests concerning Individual rights, incidents, or Breaches will also follow the specific procedures in this BAA.

The Parties will take action reasonably necessary to amend this BAA to comply with the HIPAA Rules and other applicable laws governing the privacy or security of PHI. Business Associate may update the standard BAA prospectively through the process permitted by the Services Agreement, but an update will not retroactively change the terms applicable to an earlier event unless Required by Law. A waiver of a provision in one instance is not a continuing waiver or a waiver in another instance.

Each Party will comply with the provisions of the HITECH Act applicable to its role under this BAA. The amendment process in Section 19 applies if a change in applicable law makes a revision to this BAA reasonably necessary.

This BAA may be accepted electronically through a process that makes the then-current Privacy Policy, Terms of Use, and BAA available and requires affirmative acceptance. Business Associate will retain a user-linked audit trail recording the user ID, registered account email, acceptance date and time, and acceptance status, together with separate snapshots of the Privacy Policy, Terms of Use, and BAA presented for acceptance.

The version made available for electronic acceptance is Business Associate’s standard BAA. At Covered Entity’s request, the Parties may execute a digitally signed copy of the same standard BAA. That copy includes the signature block below, is identical in substance to the standard BAA then in effect, supplements rather than replaces the electronic acceptance record, and is linked to the same user ID and registered account email as the electronic acceptance record and retained under Section 14 (“Agreement records”). Counterparts and electronic signatures have the same effect as an original.

The following signature block is used only when Covered Entity requests a digitally signed copy of the same standard BAA. The Effective Date for that digitally signed copy is the date entered below. If no date is entered, the Electronic Acceptance Date applies.