Business Associate Agreement

1. Definitions

1.1 Capitalized terms not defined here (including Breach, Data Aggregation, Designated Record Set, Disclosure, Individual, Minimum Necessary, Required By Law, Secretary, Security Incident, Subcontractor, Unsecured Protected Health Information, and Use) have the meanings HIPAA gives them.

1.2 "PHI" means Protected Health Information that Solafya creates, receives, maintains, or transmits for or on behalf of Covered Entity.

1.3 "Services" means the services Solafya provides to Covered Entity that are described in Exhibit A.

1.4 "De-Identified Data" means information de-identified under 45 CFR 164.514(a) and (b).

2. Permitted Uses and Disclosures

2.1 Solafya may Use and Disclose PHI only (a) to perform the Services for Covered Entity, (b) as Required By Law, and (c) as this Section 2 allows.

2.2 Solafya may Use PHI for its own proper management and administration or to carry out its legal responsibilities. Solafya may Disclose PHI for those purposes only if the Disclosure is Required By Law, or Solafya first obtains reasonable written assurance from the recipient that the PHI will be kept confidential, will be used or further disclosed only as Required By Law or for the purpose it was disclosed, and that the recipient will tell Solafya of any breach of confidentiality.

2.3 If Covered Entity asks for it, Solafya may provide Data Aggregation services relating to Covered Entity's health care operations.

2.4 Solafya will Use, Disclose, and request only the Minimum Necessary PHI to perform the Services.

2.5 Covered Entity authorizes Solafya to de-identify PHI under 45 CFR 164.514(b). Solafya may use De-Identified Data only to produce aggregate statistics (such as industry benchmarks). Solafya will not re-identify De-Identified Data, will not disclose it in any way that identifies Covered Entity, its clinicians, or any Individual, and will not use it to train or fine-tune any artificial intelligence or machine-learning model.

2.6 Solafya will not Use or Disclose PHI in a way that would violate Subpart E of 45 CFR Part 164 if Covered Entity did it, except as Sections 2.2 and 2.3 allow.

3. What Solafya Will Not Do

3.1 Solafya will not sell PHI, and will not Use or Disclose PHI for marketing or fundraising.

3.2 Solafya will not use PHI to train or fine-tune any artificial intelligence or machine-learning model, and will not send PHI to any AI model provider or other service that is not Solafya's Subcontractor under a written agreement that meets Section 6.

3.3 Solafya will store and process PHI only in the United States.

4. Safeguards

4.1 Solafya will use appropriate administrative, physical, and technical safeguards, and will comply with Subpart C of 45 CFR Part 164 for electronic PHI, to prevent Use or Disclosure of PHI other than as this Agreement allows.

4.2 Exhibit B describes Solafya's current security measures. Solafya may improve or change them, but will not materially reduce the protection they give PHI.

5. Reporting and Breach Notification

5.1 Solafya will report to Covered Entity any Use or Disclosure of PHI not allowed by this Agreement of which it becomes aware.

5.2 Solafya will report any successful Security Incident of which it becomes aware. Unsuccessful attempts that do not result in unauthorized access to PHI (such as pings, port scans, and blocked log-in attempts) happen routinely; this Section is notice of them, and no further report is required.

5.3 After discovering a Breach of Unsecured PHI, Solafya will notify Covered Entity without unreasonable delay and in any event within ten (10) calendar days of discovery. HIPAA's outer limit is sixty (60) days; the ten-day period is Solafya's commitment. The notice will identify each Individual affected (to the extent known), and will describe what happened, when it happened and was discovered, the types of PHI involved, and what Solafya is doing in response. Solafya will provide further information as it learns it, and will reasonably cooperate with Covered Entity's investigation and notifications.

5.4 Solafya will mitigate, to the extent practicable, any harmful effect known to it of a Use or Disclosure of PHI that violates this Agreement.

6. Subcontractors

6.1 Solafya will make sure that any Subcontractor that creates, receives, maintains, or transmits PHI for Solafya agrees in writing to the same restrictions and conditions that apply to Solafya under this Agreement (45 CFR 164.502(e)(1)(ii) and 164.308(b)(2)).

6.2 Exhibit C lists Solafya's current Subcontractors for the Services. Solafya will notify Covered Entity by email at least fifteen (15) days before a new Subcontractor first handles PHI. If Covered Entity reasonably objects and the parties cannot resolve the objection, Covered Entity may terminate the affected Services.

7. Individual Rights

7.1 Solafya does not maintain a Designated Record Set for Covered Entity in providing the Audit Services. If Solafya maintains one in providing other Services, it will make PHI available to Covered Entity for access under 45 CFR 164.524 and for amendment under 45 CFR 164.526 within fifteen (15) days of Covered Entity's request.

7.2 Solafya will keep the information needed to account for its Disclosures of PHI under 45 CFR 164.528, and will give it to Covered Entity within fifteen (15) days of Covered Entity's request.

7.3 If an Individual contacts Solafya directly about their PHI, Solafya will refer the Individual to Covered Entity within five (5) business days and will not respond on Covered Entity's behalf.

7.4 To the extent Solafya carries out any of Covered Entity's obligations under Subpart E of 45 CFR Part 164, it will comply with the requirements of Subpart E that apply to Covered Entity in doing so.

8. Government Access

8.1 Solafya will make its internal practices, books, and records relating to its Use and Disclosure of PHI available to the Secretary for the purpose of determining compliance with HIPAA.

9. Covered Entity's Responsibilities

9.1 Covered Entity will tell Solafya of (a) any limitation in its notice of privacy practices, (b) any change in or revocation of an Individual's permission, and (c) any restriction on Use or Disclosure it has agreed to, in each case to the extent it affects Solafya's Use or Disclosure of PHI.

9.2 Covered Entity will not ask Solafya to Use or Disclose PHI in a way that HIPAA would not permit Covered Entity to do.

9.3 Covered Entity will send PHI to Solafya only through the secure method Solafya gives it in writing, and never through website forms, ordinary email, or text messages.

9.4 Covered Entity represents that the person accepting this Agreement is authorized to bind it, and that it has the right to disclose the PHI it provides to Solafya for the Services.

10. Term and Termination

10.1 This Agreement starts on the Effective Date and continues until the Services end and all PHI has been returned or destroyed under Section 11.

10.2 Either party may end this Agreement, and the Services, by written notice to the other party.

10.3 If Solafya materially breaches this Agreement, Covered Entity may terminate it and the affected Services if Solafya does not cure the breach within thirty (30) days after written notice, or immediately if cure is not possible (45 CFR 164.504(e)(2)(iii)). Solafya may terminate on the same terms if Covered Entity materially breaches this Agreement.

11. Return or Destruction of PHI

11.1 When this Agreement ends, Solafya will return or destroy all PHI it still maintains in any form, and will keep no copies, within thirty (30) days.

11.2 For the Audit Services, Solafya will delete the data Covered Entity provided within thirty (30) days after delivering the audit results, or sooner if Covered Entity asks. Solafya may keep aggregate counts that do not identify any Individual.

11.3 Copies of PHI in system backups will be deleted in the ordinary course of backup rotation, and remain protected by this Agreement until they are.

11.4 If returning or destroying PHI is not feasible, Solafya will tell Covered Entity why, will extend the protections of this Agreement to that PHI, and will limit further Use and Disclosure to the purposes that make return or destruction infeasible.

12. General Terms

12.1 Each party is responsible for its own compliance with HIPAA. Nothing in this Agreement limits either party's obligations or liability under HIPAA.

12.2 If HIPAA or its regulations change in a way that requires a change to this Agreement, the parties will amend it as needed to comply. Any ambiguity will be resolved in favor of a meaning that complies with HIPAA.

12.3 If this Agreement conflicts with any other agreement between the parties about PHI, this Agreement controls. Sections 5, 7, 8, 11, and 12 survive termination.

12.4 This Agreement can be changed only in writing signed or accepted by both parties. Solafya may publish a new version, but a new version binds Covered Entity only if Covered Entity accepts it.

12.5 This Agreement is governed by the laws of the State of Delaware, except where federal law governs. It creates no rights for anyone other than the parties.

12.6 Notices to Solafya go to security@solafya.com, with a copy to support@solafya.com. Notices to Covered Entity go to the email address given when it accepted this Agreement.

12.7 Electronic acceptance of this Agreement is a valid signature under the federal E-SIGN Act and state electronic-transactions laws. Solafya has signed this Agreement by publishing it under the name below, and Covered Entity signs by accepting it.

Exhibit A: Services Covered

A.1 Missed-Lab Audit Services (the "Audit Services"). Solafya analyzes a data export that Covered Entity provides (for example, lab results, visits, orders, and communications for a review period) to identify abnormal lab results that have no documented follow-up in the exported data, and gives Covered Entity a summary and a list for its clinicians to review. The Audit Services are read-only: Solafya does not write to Covered Entity's electronic health record, contact patients, or take any clinical action.

A.2 The Audit Services are informational. They are not clinical advice, medical decision-making, a legal or compliance determination, or a finding that care was missed. Results depend on the completeness of the data provided, and Covered Entity's clinicians remain responsible for all clinical decisions.

A.3 Platform Services. Solafya's other products (such as LabWatch, Lumina, and ClinicScribe) are covered by this Agreement only after the parties sign a written order or pilot agreement that names them, and Solafya confirms in writing that Exhibits B and C accurately describe those Services.

Exhibit B: Security Measures

B.1 Encryption in transit: connections that carry PHI use TLS 1.2 or higher.

B.2 Encryption at rest: PHI is stored only in AWS services with encryption at rest enabled.

B.3 Pseudonymization: patient identifiers are replaced by one-way hashed (SHA-256) and internally generated identifiers in Solafya's analysis workflows, and audit reports identify patients by hashed identifier unless Covered Entity asks otherwise for its own review.

B.4 Access control: access to PHI is limited to Solafya personnel and systems that need it to provide the Services, using least-privilege roles.

B.5 Logging: access and administrative actions in the systems that hold PHI are recorded in AWS audit logs.

B.6 Location: PHI is stored only in United States AWS regions, and is processed only in the United States. Data analysis may run on Solafya-managed computers in the United States, which read it from AWS storage into memory and do not save a copy.

B.7 AI: the Audit Services use rule-based analysis and send no PHI to any AI model. Where other Services use AI models, they run through Amazon Bedrock in Solafya's own AWS account, and PHI is not used to train models.

Exhibit C: Subcontractors

C.1 Amazon Web Services, Inc.: cloud hosting, storage, and computing for the Audit Services. Solafya has a business associate addendum with AWS in effect.

Signature of Business Associate

Solafya, Inc.
By: its authorized officer

Signed electronically by publication of this version.