Business Associate Agreement

Terms under which TrueMedAI creates, receives, maintains or transmits Protected Health Information on behalf of the Customer.

This Business Associate Agreement (“BAA”) is effective as of the UTC electronic-acceptance timestamp in the digitally signed record between the practice legal entity identified in the electronic acceptance record (“Covered Entity”) and TrueMedAI LLC (“Business Associate”). It supplements the agreement that governs Covered Entity's subscription to the TrueMedAI Platform — the signed Master Subscription Agreement, if applicable or, for self-serve customers, the online Terms of Service (the “Agreement”) — and controls over the Agreement for all matters involving PHI.

1. Definitions

Capitalized terms used but not defined here have the meanings given in the HIPAA Rules (45 C.F.R. Parts 160 and 164), including: Breach, Data Aggregation, Designated Record Set, Disclosure, Health Care Operations, Individual, Minimum Necessary, Notice of Privacy Practices, Protected Health Information (“PHI”), Required by Law, Secretary, Security Incident, Subcontractor, Unsecured PHI and Use. “HIPAA Rules” means the Privacy, Security, Breach Notification and Enforcement Rules, as amended by the HITECH Act.

2. Obligations of Business Associate

Business Associate agrees to:

1. Not Use or Disclose PHI other than as permitted or required by this BAA or as Required by Law.
2. Use appropriate safeguards, and comply with Subpart C of 45 C.F.R. Part 164 (the Security Rule) for electronic PHI, to prevent Use or Disclosure of PHI other than as provided for by this BAA — including encryption in transit and at rest, role-based access controls, unique user identification, audit logging and workforce training.
3. Report to Covered Entity any Use or Disclosure of PHI not provided for by this BAA of which it becomes aware, including Breaches of Unsecured PHI as required by 45 C.F.R. § 164.410, and any Security Incident, as follows:
   • Breach of Unsecured PHI: without unreasonable delay and in no case later than 10 calendar days after discovery (and never later than 60 days as required by law), including, to the extent known, the identity of each affected Individual and the information Covered Entity needs to meet its own notification obligations.
   • Other Security Incidents: within 5 business days after discovery. The Parties agree that this Section is notice of, and no further report is required for, unsuccessful attempts (such as pings, port scans, blocked log-in attempts and denial-of-service attempts) that do not result in unauthorized access to PHI.
4. Ensure, in accordance with 45 C.F.R. §§ 164.502(e)(1)(ii) and 164.308(b)(2), that any Subcontractor (for example, cloud hosting, messaging and AI model providers) that creates, receives, maintains or transmits PHI on its behalf agrees in writing to the same restrictions, conditions and requirements that apply to Business Associate.
5. Within 15 days of a request, make PHI in a Designated Record Set available to Covered Entity as needed for Covered Entity to meet its obligations under 45 C.F.R. § 164.524 (access), including in electronic form.
6. Within 15 days of a request, make amendments to PHI in a Designated Record Set as directed by Covered Entity under 45 C.F.R. § 164.526.
7. Maintain and, within 15 days of a request, provide the information required for Covered Entity to give an accounting of Disclosures under 45 C.F.R. § 164.528.
8. To the extent Business Associate carries out any of Covered Entity's obligations under Subpart E of 45 C.F.R. Part 164, comply with the requirements of Subpart E that apply to Covered Entity in performing that obligation.
9. Make its internal practices, books and records relating to PHI available to the Secretary for purposes of determining compliance with the HIPAA Rules.
10. Forward to Covered Entity, within 5 business days, any request it receives directly from an Individual to access, amend or account for PHI.
11. Mitigate, to the extent practicable, any harmful effect known to Business Associate of a Use or Disclosure of PHI in violation of this BAA.

3. Permitted Uses and Disclosures

1. Services. Business Associate may Use and Disclose PHI as necessary to perform the Services described in the Agreement, including appointment scheduling, AI-assisted chat and phone booking, patient intake and check-in, insurance capture and eligibility checks, secure messaging, reminders, document and lab exchange, and synchronization with Covered Entity's Connected EHR.
2. Minimum necessary. Business Associate will Use, Disclose and request only the Minimum Necessary PHI in accordance with Covered Entity's minimum-necessary policies and procedures.
3. Management and administration. Business Associate may Use PHI for its proper management and administration or to carry out its legal responsibilities, and may Disclose PHI for those purposes if the Disclosure is Required by Law, or if Business Associate obtains reasonable assurances that the recipient will keep it confidential, use it only for the purpose for which it was disclosed, and report any breach of confidentiality.
4. Data aggregation. Business Associate may provide Data Aggregation services relating to Covered Entity's Health Care Operations.
5. De-identification. Business Associate may de-identify PHI in accordance with 45 C.F.R. § 164.514(a)–(c) and use de-identified information as permitted by the Agreement.
6. Prohibited uses. Business Associate will not (a) sell PHI; (b) use PHI for marketing; (c) use PHI to train or fine-tune artificial-intelligence models; or (d) Use or Disclose PHI in any manner that would violate Subpart E of 45 C.F.R. Part 164 if done by Covered Entity, except for the specific uses permitted in Sections 3.3–3.5.
7. Location. Business Associate will store and process PHI only within the United States unless Covered Entity agrees otherwise in writing.

4. Obligations of Covered Entity

1. Notify Business Associate of any limitation in its Notice of Privacy Practices, any change in or revocation of an Individual's permission, and any restriction on Use or Disclosure it has agreed to under 45 C.F.R. § 164.522, to the extent it may affect Business Associate's Use or Disclosure of PHI.
2. Not ask Business Associate to Use or Disclose PHI in any manner not permitted under the HIPAA Rules if done by Covered Entity.
3. Obtain any consents or authorizations from Individuals that are required for the Services, including consent to receive text messages and automated calls.
4. Configure user roles and permissions in the Platform so that its workforce accesses only the PHI they need, and promptly remove access for departing personnel.

5. Term and Termination

1. Term. This BAA is effective on the date above and ends when the Agreement ends and all PHI has been returned or destroyed under Section 5.3.
2. Termination for cause. If either Party determines that the other has violated a material term of this BAA, it may give written notice describing the violation. The non-breaching Party may terminate this BAA and the Agreement if the violation is not cured within 30 days after that notice, or immediately if cure is not possible.
3. Return or destruction. For 30 days after termination, Business Associate will make PHI available for export, using the Platform's self-serve export tools or on request, in a standard format such as CSV or JSON together with uploaded documents; during that window Covered Entity may elect to have PHI returned instead of destroyed. Within 60 days after termination, Business Associate will destroy all PHI it or its Subcontractors maintain — including attachments, logs containing PHI and Subcontractor copies — retaining no copies, and will certify destruction in writing on request. Encrypted backups expire on a rolling schedule of no more than 35 days after that. If Business Associate must retain any PHI (for a legal hold) or return or destruction is infeasible, the protections of this BAA continue for that PHI for as long as it is retained, and further Uses and Disclosures are limited to the reason it was retained.
4. Survival. Business Associate's obligations under Section 5.3 survive termination.

6. Miscellaneous

1. Regulatory references. A reference to a section of the HIPAA Rules means that section as in effect or as amended.
2. Amendment. The Parties will amend this BAA as necessary for compliance with changes to the HIPAA Rules or other applicable law.
3. Interpretation. Any ambiguity in this BAA will be resolved to permit compliance with the HIPAA Rules.
4. State law. Where applicable state privacy law (for example, laws governing mental-health, reproductive-health, HIV or genetic-testing, or minors' records) is more protective than HIPAA, Business Associate will comply with the more protective requirement.
5. 42 C.F.R. Part 2. The Platform is not designed to receive substance use disorder treatment records protected by the federal confidentiality rules at 42 C.F.R. Part 2 (“Part 2 Records”). Covered Entity will not submit Part 2 Records to the Platform unless the Parties have signed a Part 2 addendum. If Business Associate nonetheless receives Part 2 Records, it will protect them as required by 42 C.F.R. Part 2, as amended (compliance date February 16, 2026).
6. Liability. Liability under this BAA is subject to the limitation-of-liability provisions of the Agreement, including any data-breach cap it contains.
7. No third-party beneficiaries. Nothing in this BAA confers any rights on any person other than the Parties.

Privacy and security contacts

For electronic acceptance, the signer reads this BAA, types their full name, and clicks “I accept.” The signed record automatically contains the acceptance timestamp and BAA number.