Business Associate Agreement

Parties

This Business Associate Agreement (“BAA”) is entered into between Evolve Medical Systems, LLC (“Business Associate”) and the clinic or healthcare organization accepting this Agreement (“Covered Entity”).

This BAA forms part of the agreement governing Covered Entity’s use of the SmartBP Clinic services.

1. Definitions

Terms used but not otherwise defined in this BAA, including Breach, Protected Health Information (“PHI”), Electronic Protected Health Information (“ePHI”), Security Incident, Subcontractor, and Unsecured PHI, have the meanings given to them under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) and its implementing regulations at 45 CFR Parts 160 and 164.

“PHI” under this BAA means PHI that Business Associate creates, receives, maintains, or transmits on behalf of Covered Entity in connection with SmartBP Clinic.

2. Permitted Uses and Disclosures

45 CFR 164.504(e)(2)(i), (ii)(A)

Business Associate may use or disclose PHI only:

1. To provide SmartBP Clinic services to Covered Entity;

2. As permitted by this BAA;

3. As required by law; or

4. For Business Associate’s proper management and administration or to carry out its legal responsibilities, provided any disclosure for those purposes complies with applicable HIPAA requirements.

Business Associate will not sell PHI.

Business Associate will not use or disclose PHI for advertising or marketing except as expressly authorized by Covered Entity and permitted by applicable law.

Business Associate will not use PHI to train generalized artificial-intelligence or machine-learning models offered to third parties.

Business Associate will apply the applicable minimum necessary requirements when using, disclosing, or requesting PHI.

3. Safeguards

45 CFR 164.504(e)(2)(ii)(B)

Business Associate will:

• Use appropriate administrative, physical, and technical safeguards to protect PHI;

• Comply with the HIPAA Security Rule at 45 CFR Part 164 Subpart C with respect to ePHI;

• Take reasonable steps to prevent uses or disclosures of PHI not permitted by this BAA;

• Maintain appropriate access controls, authentication, and security practices for SmartBP Clinic.

4. Reporting of Breaches and Security Incidents

45 CFR 164.504(e)(2)(ii)(C); 164.410

Business Associate will report to Covered Entity any use or disclosure of PHI not permitted by this BAA.

Business Associate will notify Covered Entity of any Breach of Unsecured PHI without unreasonable delay and in no event later than 60 calendar days after discovery, as required by 45 CFR 164.410.

To the extent available, the notice will include information reasonably necessary for Covered Entity to fulfill its breach-notification obligations.

Business Associate will also report Security Incidents involving ePHI as required by HIPAA.

Routine unsuccessful security events, such as unsuccessful login attempts, network scans, pings, or similar activity that does not result in unauthorized access, use, disclosure, modification, or destruction of PHI, do not require separate individual notice.

5. Subcontractors

45 CFR 164.504(e)(2)(ii)(D)

Business Associate will ensure that any Subcontractor that creates, receives, maintains, or transmits PHI on behalf of Business Associate agrees in writing to restrictions, safeguards, and obligations applicable to PHI that are at least as protective as those required by HIPAA and this BAA.

6. Individual Rights

45 CFR 164.504(e)(2)(ii)(E), (F), (G)

To the extent Business Associate maintains applicable PHI on behalf of Covered Entity, Business Associate will reasonably assist Covered Entity in meeting its obligations under:

• 45 CFR 164.524 — access to PHI;

• 45 CFR 164.526 — amendment of PHI; and

• 45 CFR 164.528 — accounting of disclosures.

Business Associate will make applicable PHI and related information available to Covered Entity as reasonably necessary to fulfill those obligations.

Unless otherwise required by law, requests received directly from an individual relating to Covered Entity’s PHI may be referred to Covered Entity.

7. Privacy Rule Obligations Performed by Business Associate

45 CFR 164.504(e)(2)(ii)(H)

To the extent Business Associate performs any obligation of Covered Entity under 45 CFR Part 164 Subpart E, Business Associate will comply with the requirements of Subpart E that apply to Covered Entity in performing that obligation.

8. Availability to the Secretary

45 CFR 164.504(e)(2)(ii)(I)

Business Associate will make its internal practices, books, and records relating to the use and disclosure of PHI received from, created for, or maintained on behalf of Covered Entity available to the Secretary of the U.S. Department of Health and Human Services as required to determine Covered Entity’s compliance with HIPAA.

9. Covered Entity Responsibilities

Covered Entity will:

• Use SmartBP Clinic and PHI in accordance with HIPAA and other applicable law;

• Ensure that individuals accessing SmartBP Clinic on its behalf are appropriately authorized;

• Notify Business Associate of any restrictions or limitations affecting Business Associate’s permitted use or disclosure of PHI;

• Not request Business Associate to use or disclose PHI in a manner that would violate HIPAA if performed by Covered Entity, except where HIPAA expressly permits a Business Associate to do so.

Covered Entity is responsible for its own clinical decisions, patient care, and determining when and how patient information is reviewed.

SmartBP Clinic is not an emergency or continuous patient-monitoring service.

10. Consumer SmartBP Services

SmartBP is also offered directly to consumers independently of any clinic relationship.

To the extent Evolve Medical Systems processes an individual’s information solely in connection with the consumer SmartBP application and not on behalf of Covered Entity, that processing is outside the scope of this BAA.

When Business Associate creates, receives, maintains, or transmits PHI on behalf of Covered Entity through a patient’s clinic connection, that PHI is subject to this BAA.

11. Patient Connection and Consent

A patient’s SmartBP account will not be connected to Covered Entity until the applicable connection and consent process has been completed.

Business Associate will maintain records reasonably documenting the clinic connection and associated patient consent or authorization where applicable.

Termination of a patient’s clinic connection will stop future access or sharing as provided by the SmartBP service, subject to applicable legal, contractual, retention, and backup requirements.

12. Term and Termination

45 CFR 164.504(e)(2)(iii)

This BAA becomes effective when Covered Entity accepts it and remains in effect while Business Associate creates, receives, maintains, or transmits PHI on behalf of Covered Entity.

Covered Entity may terminate this BAA if Business Associate materially violates this BAA and fails to cure the violation within a reasonable period after notice, where cure is possible.

Business Associate may terminate SmartBP Clinic services and this BAA in accordance with the applicable SmartBP Clinic terms, subject to HIPAA requirements relating to PHI.

13. Return or Destruction of PHI

45 CFR 164.504(e)(2)(ii)(J)

Upon termination of this BAA, Business Associate will return or destroy PHI received from, created for, or maintained on behalf of Covered Entity where feasible.

If return or destruction is not feasible, Business Associate will continue to protect the PHI under this BAA and limit further uses and disclosures to those purposes that make return or destruction infeasible.

This provision survives termination.

14. De-Identification

45 CFR 164.514

Business Associate may de-identify PHI only in accordance with 45 CFR 164.514.

Any use of properly de-identified information must comply with applicable law and the agreements between the parties.

15. Changes in Law

The parties agree that this BAA will be interpreted consistently with HIPAA.

If applicable law changes in a manner that requires amendment of this BAA, the parties will cooperate in making reasonably necessary changes.

16. Order of Precedence

If there is a conflict between this BAA and another agreement between the parties regarding PHI, this BAA controls with respect to HIPAA obligations.

17. Electronic Acceptance

The individual accepting this BAA on behalf of Covered Entity represents that they have authority to bind Covered Entity.

Electronic acceptance has the same effect as a signed agreement.

Business Associate may record:

• Clinic name;

• Accepting user;

• Date and time of acceptance;

• Version of this BAA accepted;

• Relevant account and technical records associated with acceptance.

Parties and effective date

BUSINESS ASSOCIATE: Evolve Medical Systems, LLC

COVERED ENTITY: The clinic or healthcare organization identified in the SmartBP Clinic account and accepting this BAA electronically.

Effective Date: Date of electronic acceptance.