Business Associate Addendum

This Business Associate Addendum (the Addendum) is between BrandKlout, Inc., a Delaware corporation (BrandKlout or Business Associate) and the Customer identified by its legal name in the accepted service order or service agreement that expressly incorporates this Addendum (the Order). For this Addendum, that Customer is the health care provider and Covered Entity (Provider). The Order, its incorporated Terms of Service, and agreed service descriptions form the Underlying Agreement. This Addendum governs protected health information handled by BrandKlout for Provider.

Acceptance of the Order accepts this identified version of the Addendum under Section 4.1. No separate BAA signature, countersignature, or signed service schedule is required unless the parties expressly agree otherwise. Provider approvals required by this Addendum may be recorded in the Order, an authorized email, or a documented onboarding approval; they need not use a separate signature form. A general service purchase does not grant a specific permission that this Addendum reserves for express approval.

This Addendum controls over conflicting service terms, privacy notices, cookie policies, or other general permissions for matters within its scope. Those documents do not expand the permitted uses of PHI. A separately executed BAA remains controlling unless the parties expressly replace it in writing. If Provider is itself a business associate rather than a covered entity, the parties must adapt this Addendum in writing for that subcontractor relationship before the services begin.

HIPAA Rules means the applicable Privacy, Security, Breach Notification, and Enforcement Rules in 45 C.F.R. Parts 160 and 164, as amended and legally effective, including applicable HITECH requirements. Capitalized HIPAA terms have their regulatory meanings. Protected Health Information (PHI) means PHI received, created, maintained, or transmitted by BrandKlout on behalf of Provider in any form. Electronic PHI (ePHI) includes PHI in electronic form. Business days are Monday through Friday excluding U.S. federal holidays. References to days otherwise mean calendar days. California Law means the Confidentiality of Medical Information Act (Cal. Civ. Code § 56 et seq.) and Cal. Civ. Code §§ 1798.81.5 and 1798.82, to the extent they apply to the PHI or to a party.

1. Obligations of BrandKlout

1.1 Use and disclosure restrictions. BrandKlout will use or disclose PHI only as this Addendum permits or as Required by Law. It will limit access, requests, uses, and disclosures to the minimum necessary where that HIPAA standard applies. Provider instructions do not authorize conduct prohibited by law. BrandKlout will also comply with California Law that applies to it as a recipient of medical information from Provider, including the limits on further disclosure in Cal. Civ. Code § 56.13.

1.2 Safeguards and security. BrandKlout will implement appropriate administrative, physical, and technical safeguards and comply with Subpart C of 45 C.F.R. Part 164 for ePHI. It will maintain a documented risk analysis and risk management process, designate a security official, train and supervise its workforce, apply confidentiality and access obligations, and maintain incident response and contingency procedures. Access will be limited by role, reviewed, and promptly revoked when no longer authorized.

1.2a Technical protections. For systems under its control, BrandKlout will use unique accounts, access and activity logging, secure disposal, protected backups, and reasonable vulnerability and patch management. It will encrypt ePHI in transit and at rest and require multifactor authentication for remote and privileged access to ePHI. If a particular system cannot support one of these contractual controls, BrandKlout must document the risk and an equivalent safeguard and obtain Provider's written approval before using it for PHI. No exception may waive a legal requirement. BrandKlout will document shared security responsibilities in the operational record under Section 5.4.

1.3 Incident and breach reporting. BrandKlout will notify Provider without unreasonable delay and no later than five business days after discovery of any impermissible use or disclosure of PHI, Breach of Unsecured PHI, or other Security Incident involving PHI or systems containing it of which BrandKlout becomes aware. Only the routine unsuccessful attempts described in Section 1.3b are covered by standing notice instead of individual reports. Discovery includes when the event is known or reasonably should have been known through reasonable diligence, including knowledge attributed under 45 C.F.R. § 164.410. Initial notice will not await a completed investigation or final Breach determination. Any shorter applicable legal deadline controls, including the requirement in Cal. Civ. Code § 1798.82(b) to notify Provider immediately following discovery of a breach of computerized personal information that BrandKlout maintains for Provider. A lawful notification delay under 45 C.F.R. § 164.412 will be documented and followed.

1.3a Notice contents and follow up. The initial notice will describe available facts, discovery and occurrence dates, affected systems and PHI categories, known or reasonably believed affected Individuals, containment steps, and a response contact. BrandKlout will promptly supplement the notice as facts become available and provide information needed for Provider's required notices under 45 C.F.R. § 164.404(c). It will reasonably cooperate in investigation, risk assessment, mitigation, and corrective action, while preserving relevant evidence and applicable privileges. Preliminary notice alone is not an admission that a reportable Breach has occurred.

1.3b Routine unsuccessful attempts. This Addendum serves as standing notice that routine unsuccessful attempts, such as blocked scans, pings, and failed logins, may occur. Separate notices are not required for attempts that result in no unauthorized access or material effect on PHI or system security. BrandKlout will monitor such attempts and provide an available summary upon reasonable request. This provision does not exclude ransomware, successful intrusions, data exfiltration, material service disruption, or credible suspected compromise from individual reporting.

1.4 Access to records. For PHI in a Designated Record Set maintained by BrandKlout, BrandKlout will provide access to Provider or, as Provider directs, to an Individual or lawful designee as necessary for 45 C.F.R. § 164.524. It will respond within ten business days of Provider's request, or sooner when necessary to meet an applicable legal deadline identified by Provider. It will use the requested electronic format if readily producible or an agreed readable format. No advance-notice requirement, normal-business-hours restriction, or payment dispute will block legally required access.

1.5 Amendments. BrandKlout will make, append, or link amendments to PHI in a Designated Record Set as Provider directs or agrees under 45 C.F.R. § 164.526. It will act within ten business days or sooner when necessary for a legal deadline identified by Provider and confirm completion. Provider retains responsibility for deciding whether an Individual's requested amendment is accepted or denied, unless that duty is expressly delegated in writing.

1.6 Delegated privacy duties. To the extent BrandKlout performs Provider's duties under Subpart E of 45 C.F.R. Part 164, it will comply with the requirements applicable to those duties. Individual requests received directly by BrandKlout will be forwarded to Provider within three business days unless Provider has expressly authorized BrandKlout to fulfill them. Forwarding will not reset a legal deadline or excuse a duty imposed directly on BrandKlout.

1.7 Accountings and documentation. BrandKlout will maintain and provide information needed for Provider to account for disclosures under 45 C.F.R. § 164.528, including the applicable six-year accounting period and regulatory exceptions. It will supply requested accounting information within ten business days or sooner when necessary for a legal deadline identified by Provider. It will retain required HIPAA compliance documentation for the period required by law. That documentation obligation does not require indefinite retention of patient records or every technical log.

1.8 HHS oversight. BrandKlout will make its internal practices, books, and records relating to PHI available to the Secretary of the U.S. Department of Health and Human Services as required to determine compliance with the HIPAA Rules. Customer audit limitations, confidentiality terms, and fee disputes do not restrict this obligation.

1.9 Subcontractors. Before a subcontractor creates, receives, maintains, or transmits PHI on BrandKlout's behalf, BrandKlout will obtain a written BAA imposing the same applicable restrictions, conditions, and requirements, including Security Rule compliance, incident reporting, and return or destruction. This applies to covered cloud, hosting, communications, analytics, and AI vendors, including vendors that maintain encrypted ePHI without a decryption key. BrandKlout will take reasonable steps to cure a known material subcontractor violation and terminate the affected arrangement if cure fails and termination is feasible. BrandKlout remains responsible for its own compliance and contracted work.

1.10 Mitigation and notifications. BrandKlout will mitigate, to the extent practicable, known harmful effects of an impermissible use or disclosure by BrandKlout or its subcontractors. Provider controls notices to Individuals, HHS, and the media unless law imposes a direct duty on BrandKlout or Provider delegates notice responsibilities in writing. Coordination will not delay a required report or permit concealment.

1.11 International access. BrandKlout will not enable PHI storage or access outside the United States unless Provider approves the relevant countries, recipients, and safeguards in writing. Approved international access remains subject to this Addendum, applicable law, documented risk assessment, and any required downstream BAA. Directly controlled workforce members must be trained and bound by confidentiality and security duties. A separate company does not become workforce merely by being an affiliate.

1.12 Compliance evidence. Upon reasonable written request, BrandKlout will provide relevant summaries of safeguards, subcontractors, and corrective actions sufficient to support Provider's compliance review. Routine requests may be limited to once annually, with additional review after a material incident or credible compliance concern. Reviews must protect other customers' data and sensitive security details. Provider has no right to unannounced system access or penetration testing without written agreement. This provision does not limit lawful HHS or other regulatory access.

2. Permitted uses and disclosures

2.1 Services for Provider. BrandKlout may process PHI only as necessary to perform Provider's purchased, approved services identified in the Underlying Agreement, including agreed package descriptions and documented workflow approvals under Section 5.4. Those services may include approved patient communications, intake, scheduling support, or operations reporting. Only purchased and approved workflows are included. BrandKlout may not use or disclose PHI in a manner that would violate Subpart E if done by Provider, except for the specific management, administration, and Data Aggregation permissions allowed below and by law.

2.2 Management and legal responsibilities. BrandKlout may use PHI only as necessary for its proper management and administration or legal responsibilities. Related disclosures are permitted only if Required by Law or if BrandKlout obtains reasonable assurances that the recipient will keep PHI confidential, use or further disclose it only for the permitted purpose or as Required by Law, and report known confidentiality breaches. This permission does not authorize PHI use for unrelated product development, general research, advertising, or shared model training.

2.3 Legal demands. BrandKlout may disclose PHI when Required by Law after assessing the applicable requirements, including any stricter protections. Unless legally prohibited, it will promptly notify Provider of a demand and reasonably cooperate with lawful efforts to limit or challenge it. A subpoena or other demand does not by itself eliminate HIPAA or Part 2 conditions. BrandKlout will disclose only the legally required information.

2.4 Aggregation and deidentification. Data Aggregation is permitted only when expressly approved in writing and limited to the health care operations of the participating covered entities as permitted by 45 C.F.R. § 164.504(e)(2)(i)(B). Deidentification is permitted only for a purpose and method approved by Provider in writing and meeting 45 C.F.R. § 164.514(a)-(c). PHI remains protected until deidentification is completed. Removing names, hashing identifiers, or labeling data anonymous is not sufficient by itself. BrandKlout will not reidentify data, identify Provider in external reports, sell data, or use deidentified data for an independent commercial purpose without a separate written agreement.

2.5 AI marketing and tracking. BrandKlout may process PHI with an AI tool only for an approved Provider workflow, in an approved environment, with a downstream BAA where required and verified retention, access, and training settings. PHI may not be used to train or improve general-purpose or shared models or unrelated products. This Addendum does not authorize PHI uploads to consumer AI accounts, public tools, advertising networks, retargeting audiences, session replay tools, or unapproved tracking vendors. A new PHI-based marketing or public testimonial workflow requires separate written approval and all legally required Individual authorizations. Cookie consent and a privacy-policy disclosure do not replace a required HIPAA authorization.

2.6 Specially protected records. Provider will not send BrandKlout records subject to 42 C.F.R. Part 2, psychotherapy notes, or medical information subject to Cal. Civ. Code § 56.101(c) (gender-affirming care, abortion, or contraception) unless the parties first document the lawful basis, consent scope, and any required additional agreement in writing. If such records arrive unexpectedly, BrandKlout will protect them, stop unapproved processing, notify Provider, and coordinate lawful handling with Provider. BrandKlout will comply with applicable Part 2 limits for any Part 2 records it receives. Failure to label records does not eliminate a legal duty.

3. Obligations of Provider

3.1 Privacy limits and restrictions. Provider will give BrandKlout timely notice of relevant limits in its Notice of Privacy Practices, restrictions agreed to or required under 45 C.F.R. § 164.522, changes or revocations of Individual permissions, and applicable special-record requirements. Provider will describe how the change affects the services. BrandKlout will implement lawful notified restrictions and promptly identify any implementation issue.

3.2 Lawful instructions and permissions. Provider will disclose only PHI reasonably needed for approved services and establish the lawful basis for requested uses, communications, recordings, and publication of patient material, including required consents or authorizations. It will use approved transfer channels and identify authorized users. Provider will not instruct BrandKlout to act unlawfully. Provider will send PHI only through channels approved in the operational record and will not direct patients to submit PHI through general website forms, ordinary email, text messages, or other channels not approved for PHI. If PHI reaches BrandKlout through an unapproved channel, BrandKlout will protect it and notify Provider, but that receipt does not expand the services or, by itself, make Provider's choice of channel a violation by BrandKlout. These obligations do not shift BrandKlout's own legal duties or excuse an impermissible act by BrandKlout.

3.3 Clinical records and shared systems. Provider remains responsible for clinical decisions, medical-record retention, patient-rights decisions not delegated in writing, and safeguards for systems under its control. It will keep appropriate copies of essential records and promptly report suspected compromise affecting shared services. BrandKlout's responsibilities for systems and workflows it controls remain in force. Either party may suspend an affected unsafe workflow while the parties resolve a legal or security concern.

3.4 Provider responsibility. To the extent permitted by law, Provider will defend, indemnify, and hold harmless BrandKlout against third-party claims, regulatory fines and penalties, and reasonable defense costs to the extent caused by Provider's instructions, Provider's disclosure of PHI to BrandKlout outside approved channels, or Provider's failure to obtain an authorization, consent, or notice that Provider was responsible for obtaining. This obligation does not cover the portion of a claim caused by BrandKlout's violation of this Addendum. This Section supplements, and does not limit, Section 19 of the Terms of Service.

4. Term and termination

4.1 Acceptance effective date and survival. An Order issued or approved as an offer by an authorized BrandKlout representative binds BrandKlout to this identified Addendum when Provider signs or affirmatively accepts that Order through a documented electronic process. The signer represents authority to bind Provider. That single acceptance forms this written BAA for both parties without a separate signature or countersignature. The Addendum is effective on Order acceptance even if commercial services begin on a later date, and must be binding before PHI processing begins. The parties may instead enter into a separately signed or electronically accepted BAA. A website visit, payment alone, or a posted update without acceptance is insufficient. On termination, confidentiality, security, reporting, access, and return or destruction duties continue for retained PHI until fulfilled. The Addendum adds no minimum commercial service term.

4.2 Termination for cause and legal changes. Provider may terminate this Addendum and the affected services if BrandKlout materially violates it. Where cure is appropriate, Provider may give a reasonable cure period of up to 30 days. Provider may terminate immediately if cure is infeasible or delay would create a material legal or security risk. BrandKlout may suspend or terminate affected services for Provider's uncured material violation or unlawful instructions on comparable terms. For a legal change, the parties will promptly cooperate on a compliant amendment and document any agreed change in scope or price. If lawful performance cannot continue, either may end the affected services with notice and an orderly transition where feasible. Increased cost does not excuse compliance or remove duties for retained PHI.

4.3 Return and destruction. At termination, BrandKlout will, within 30 days, return PHI in a reasonably usable agreed format or, as Provider directs in writing, securely destroy it, including feasible subcontractor copies. It will retain no copies except under Section 4.3a. BrandKlout will provide Provider a reasonable export opportunity and written confirmation of return or destruction, identifying any permitted retained copies. A fee dispute will not block access or return. Provider remains responsible for its own legally required records.

4.3a Limited infeasibility exception. If return or destruction is infeasible, BrandKlout will document and notify Provider of the specific PHI, reason, safeguards, and expected disposal date. Retention is limited to what law requires or what is genuinely infeasible to remove, such as restricted backup copies. No blanket management, administration, or product-development retention permission applies. Retained PHI remains protected by this Addendum, and uses and disclosures are limited to the purpose making return or destruction infeasible. Restricted backups will be removed through the documented deletion cycle, no later than 90 days after termination unless a documented legal duty or genuine infeasibility prevents it. Restored copies will be protected and deleted again when their permitted purpose ends. BrandKlout will return or destroy retained PHI when the reason for retention ends.

5 Administration and relationship to service terms

5.1 Notices. Provider's contact email and phone in the Order are its default notice and escalation contacts until Provider supplies replacements or a designated privacy or security contact in writing. Notices to BrandKlout may be sent to [email protected] or a replacement address designated in writing. The parties will confirm a monitored urgent escalation method before PHI services. Reports containing PHI must use an approved secure channel, and a notice is effective on receipt by the designated system. Ordinary email should contain only a PHI-free alert directing the recipient to the secure report.

5.2 Changes and interpretation. The parties will make changes needed for applicable law through written or documented electronic agreement. Mandatory law controls on its effective compliance date. Posting a new web version alone does not amend an accepted BAA. Ambiguities will be resolved to permit compliance, and an invalid provision will not eliminate remaining lawful obligations. If HHS finalizes amendments to Subpart C of 45 C.F.R. Part 164, the parties will amend this Addendum as needed by the applicable compliance date. BrandKlout may also update this Addendum on at least 30 days' written notice to Provider's designated contact to conform it to changes in the HIPAA Rules or California Law, or to reflect changes in subcontractors or safeguards that do not reduce the protection of PHI. Provider may terminate the affected services before the effective date if it objects. An update does not apply to an incident discovered before its effective date.

5.3 Ownership and commercial remedies. Provider retains its rights in its PHI. No broad data license arises from the services or this Addendum. The Underlying Agreement governs commercial fees and remedies only to the extent consistent with this Addendum and law. Any commercial liability limitation or cost allocation applies only between the parties where lawful and cannot reduce required safeguards, reporting, Individual rights, cooperation, or return and destruction duties, or bind HHS or other regulators. Claims between the parties under this Addendum are subject to the Data Claims Cap and exclusions in Section 18 of the Terms of Service. BrandKlout's reimbursement of breach response costs is limited to reasonable, documented costs of legally required notices, a call center, and credit monitoring where legally required or customary, to the extent caused by BrandKlout's violation of this Addendum. Each party remains accountable for its own acts and omissions. Nothing promises that a security incident can never occur.

5.4 Operational records and approvals. BrandKlout will maintain an operational record for purchased PHI workflows before processing begins, covering the approved purpose and PHI categories, relevant systems and recipients, downstream BAAs, shared security responsibilities, retention and deletion, and secure reporting and escalation contacts. This record may reference the Order, agreed package descriptions, and documented onboarding instructions. It is not a separately signed schedule or a condition to formation of this Addendum. It documents existing authority and does not independently grant a new use, expand purchased scope, authorize an optional permission, or amend this Addendum. Material workflow changes and permissions requiring Provider approval must be documented with Provider's authorized approval before use. BrandKlout will provide the relevant record on reasonable request.