Business associate agreement

This Business Associate Agreement ("BAA") is between Salisan, Inc., a Delaware corporation with its registered address at 2261 Market Street STE 38901, San Francisco, CA 94114, United States ("Salisan", "we", "us"), and the organization that has accepted our Terms of Service ("Customer", "you"). It forms part of the Terms and applies to Protected Health Information that we create, receive, maintain or transmit on your behalf when we provide the Service.

This BAA applies to Customers whose organization's main country is the United States. An Account Owner accepts it in the Service together with the Terms, before the organization enters Patient Data. Acceptance in the Service is your electronic signature of this BAA. If you would like a copy signed by both parties for your records, sign the form at the end and send it to legal@salisan.com.

1. Definitions

1.1 Terms defined in the Terms. Service, Order, Authorized User, Customer Data, Patient Data and AI Output have the meaning given in the Terms of Service ("Terms"). "Agreement" means the Terms, any Order and this BAA.

1.2 HIPAA terms. Breach, Business Associate, Covered Entity, Data Aggregation, De-identified Information, Designated Record Set, Disclosure, Health Care Operations, Individual, Limited Data Set, Minimum Necessary, Notice of Privacy Practices, Required by Law, Secretary, Security Incident, Subcontractor, Unsecured Protected Health Information and Use have the meaning given in the HIPAA Rules.

1.3 Further definitions.

• HIPAA Rules: the Privacy, Security, Breach Notification and Enforcement Rules at 45 CFR Parts 160 and 164, as amended, including by the HITECH Act.
• Protected Health Information (PHI): protected health information, as defined in 45 CFR 160.103, that we create, receive, maintain or transmit on your behalf to provide the Service.
• Account Owner: a member of your organization in the Service who holds the owner role.
• Unsuccessful Security Incident: an attempted Security Incident that does not result in unauthorized access to, or use, disclosure, modification or destruction of, PHI, or in interference with the systems that hold it.

2. Roles

2.1 Business associate. You are a Covered Entity, or a Business Associate of a Covered Entity. We are your Business Associate. Where you are a Business Associate, we act as your Subcontractor, and you confirm that your own business associate agreement allows this BAA. If you are neither, we still handle Patient Data as this BAA describes, as a contractual commitment.

2.2 Independent contractor. We provide the Service as an independent contractor. We decide how the Service is designed, operated and secured. Nothing in the Agreement makes us your agent, gives you the right to control how we perform the Service, or makes us your workforce.

2.3 Information that is not PHI. This BAA does not apply to information that is not PHI, such as account, sign-in and billing details, or to De-identified Information. Our Privacy Policy describes how we handle that information. Where information we handle for support, security or the usage data in section 5.5 of the Terms contains PHI, this BAA applies to that PHI.

3. Permitted uses and disclosures

3.1 The Service. We may use and disclose PHI to provide, maintain, secure and support the Service for you under the Agreement, including fixing errors, improving how the Service works for you, and operating the features that you and your Authorized Users choose to use, and as otherwise permitted or required by this BAA or Required by Law. We improve our products generally with De-identified Information (section 3.4).

3.2 Management and administration. We may use PHI for our proper management and administration and to carry out our legal responsibilities. We may disclose PHI for those purposes where the disclosure is Required by Law, or where we obtain reasonable assurances from the recipient that it will keep the PHI confidential, use or further disclose it only as Required by Law or for the purpose for which we disclosed it, and notify us of any instance in which the confidentiality of the PHI has been breached.

3.3 Data Aggregation. We may provide Data Aggregation services relating to your Health Care Operations. Anything we show you that is drawn from other customers' data is De-identified Information.

3.4 De-identification. You authorize us to de-identify PHI in accordance with 45 CFR 164.514(a) to (c). De-identified Information is not PHI or Customer Data, and we may use and disclose it for any lawful purpose, including to operate, analyze, develop and improve our products and services and their AI features. We will not attempt to re-identify De-identified Information, and we will not permit anyone to whom we disclose it to do so.

3.5 Reporting violations of law. We may use PHI to report violations of law to appropriate federal and state authorities, consistent with 45 CFR 164.502(j)(1).

3.6 Minimum necessary. We limit our own requests for, and uses and disclosures of, PHI to the minimum necessary for the purpose, in line with 45 CFR 164.502(b). You decide what PHI you and your Authorized Users put into the Service, and you are responsible for sending us only the PHI that is needed for the purpose.

3.7 Limits. We do not use or further disclose PHI other than as this BAA permits or requires, or as Required by Law. We do not use or disclose PHI in a way that would breach Subpart E of 45 CFR Part 164 if you did it, except as sections 3.2 and 3.3 permit. We do not sell PHI, and we do not use it for marketing.

4. Safeguards

4.1 Security Rule. We comply with Subpart C of 45 CFR Part 164 for electronic PHI, and use appropriate administrative, physical and technical safeguards to prevent any use or disclosure of PHI other than as this BAA provides. Annex 1 summarizes the safeguards. We may change them as technology and risks develop, provided that a change does not reduce the overall protection of PHI.

4.2 Personnel. Our personnel with access to PHI are bound by a written obligation of confidentiality and are trained in HIPAA at least once a year.

4.3 Location. We store PHI in the United States. AI requests are processed by Fireworks, which does not store them.

4.4 Your safeguards. You are responsible for the safeguards within your control, such as managing your Authorized Users, their roles and their two-factor authentication, and protecting the devices and networks they use.

5. Reporting

5.1 What we report. We report to you any Use or Disclosure of PHI not provided for by this BAA, any Security Incident, and any Breach of Unsecured PHI, of which we become aware.

5.2 When. We notify you of a Breach of Unsecured PHI without unreasonable delay, and in any case within 30 calendar days after we discover it, including where a Subcontractor reports it to us. The notice includes, to the extent possible, the information required by 45 CFR 164.410(c), and we provide further information promptly as it becomes available. A Breach is treated as discovered on the first day on which it is known to us, or would have been known to us by exercising reasonable diligence. We report the other matters in section 5.1 without unreasonable delay, and give any notice that state law requires of us within the time it sets.

5.3 Unsuccessful Security Incidents. Unsuccessful Security Incidents are part of operating any online service: for example pings and other broadcast attacks on firewalls, port scans, unsuccessful sign-in attempts, denial-of-service attempts that do not affect availability, and malware that is blocked. This section is our notice to you of them, so we do not report each one separately.

5.4 How. We notify your Account Owners, and any further contact you give us for this purpose, by email. Details that identify Individuals are shared through a secure method that we agree with you.

5.5 Response. We take reasonable steps to contain and investigate the incident and to mitigate, as far as practicable, any harmful effect that is known to us. You decide whether and how to notify Individuals, the Secretary, the media and others, and you do so. We do not notify them ourselves about PHI unless the law requires us to.

5.6 Facts, not fault. A report describes the facts as we know them. It is not an admission of fault or liability.

6. Subcontractors

6.1 Contracts. We may engage Subcontractors to provide the Service. Each Subcontractor that creates, receives, maintains or transmits PHI on our behalf agrees in writing to the same restrictions and conditions that apply to us under this BAA, including to comply with Subpart C of 45 CFR Part 164, as required by 45 CFR 164.502(e)(1)(ii), 164.308(b)(2) and 164.314(a). Our AI providers do not use PHI to train or improve their models: our agreements and account settings with them prevent it.

6.2 List and changes. Annex 2 lists our Subcontractors at the date of this BAA. The current list is published at salisan.com/us/legal/subcontractors, separately from the subprocessor list for our European data processing agreement. We notify your Account Owners at least 15 days before a new Subcontractor receives PHI. If you object to a new Subcontractor, you may terminate the Agreement by written notice before it receives your PHI, and we refund prepaid fees for the period after termination.

7. Individuals' rights

7.1 Access and amendment. The Service lets you meet requests for access and amendment yourself: you can view and export a patient's record, and correct and add to entries while keeping their history. Where you cannot do so in the Service, we make PHI in a Designated Record Set available to you, or make the amendments you direct, within 15 business days of your written request, so that you can meet 45 CFR 164.524 and 164.526.

7.2 Accounting of disclosures. We document the Disclosures of PHI that we make and that you would need to account for under 45 CFR 164.528, and we give you that information within 15 business days of your written request.

7.3 Requests to us. If an Individual asks us directly for access, amendment or an accounting, we forward the request to you within 10 business days. You are responsible for responding to it.

8. Your obligations

You will:

• (a) tell us about any limitation in your Notice of Privacy Practices, any restriction you have agreed to under 45 CFR 164.522, and any change in or revocation of an Individual's permission, to the extent it affects our Use or Disclosure of PHI;
• (b) not ask us to use or disclose PHI in a way that the HIPAA Rules would not allow you to;
• (c) obtain any authorization, consent or notice that the law requires for the PHI you put into the Service, including under state laws that protect particular kinds of health information, such as mental health, HIV, reproductive health and substance use disorder records;
• (d) use the Service's controls, such as roles, care-team access and AI exclusion, to protect information that needs more protection; and
• (e) tell us in writing before you put records subject to 42 CFR Part 2 into the Service.

9. Your obligations that we carry out

To the extent that we carry out one of your obligations under Subpart E of 45 CFR Part 164, we comply with the requirements of Subpart E that apply to you in carrying it out.

10. Books, records and security information

10.1 The Secretary. We make our internal practices, books and records relating to the Use and Disclosure of PHI available to the Secretary, for the purpose of determining compliance with the HIPAA Rules.

10.2 You. Once a year, on request, we answer a reasonable security questionnaire and give you a summary of our security policies and any independent audit report or certification that we hold at the time. These documents are our confidential information. We use them to show you how we protect PHI.

11. Term and termination

11.1 Term. This BAA applies from its acceptance until the Agreement ends and all PHI has been returned or destroyed under section 12.

11.2 Termination for breach. If either party determines that the other has materially breached this BAA, it may notify the other party, who then has 30 days to cure the breach. If the breach is not cured, the notifying party may terminate the Agreement by written notice. If the breach cannot be cured, the notifying party may terminate immediately by written notice. If you terminate for our breach, we refund prepaid fees for the period after termination.

12. Return and destruction

12.1 During the Agreement. You can export Customer Data at any time while your account is open (section 5.6 of the Terms).

12.2 At the end. After the Agreement ends, your workspace remains readable and exportable until an Account Owner closes the account in the Service. If no Account Owner has closed it 90 days after the Agreement ends, we close it, after telling your Account Owners. A closed account stays readable and exportable for a further 30 days. Your export is how we return PHI to you.

12.3 Destruction. We then destroy PHI in the Service and send your Account Owners a deletion certificate. Copies in backups expire on their normal schedule, within 35 days after deletion.

12.4 Where return or destruction is infeasible. We keep PHI only where we determine in good faith that its return or destruction is infeasible, such as the access audit records, which we keep for 7 years in write-once storage to meet our legal responsibilities, and PHI that the law requires us to keep. We extend the protections of this BAA to what we keep, and limit further Uses and Disclosures to the purposes that make its return or destruction infeasible, for as long as we keep it.

13. Substance use disorder records (42 CFR Part 2)

This section applies to any records subject to 42 CFR Part 2 in the Service. Where you are a Part 2 program, we act as your qualified service organization under 42 CFR 2.11: we acknowledge that we are fully bound by 42 CFR Part 2 in receiving, storing, processing or otherwise dealing with them, and, if necessary, we will resist in judicial proceedings any effort to obtain access to them, except as 42 CFR Part 2 permits. Where you are a lawful holder of Part 2 records, we act as your contractor under 42 CFR 2.33(c) and comply with 42 CFR Part 2 for those records.

14. Liability

Each party's liability arising out of or in connection with this BAA is subject to section 16 of the Terms, including its cap, exclusions and exceptions. Each party bears its own costs of meeting its notification obligations, and any civil money penalty imposed on it for its own violations.

15. Changes

We may change this BAA as set out in section 18 of the Terms, with at least 30 days' notice of a material change. A change will not reduce the protection of PHI without your agreement. Where a change to the HIPAA Rules or to other law requires it, we may change this BAA with shorter notice so that both parties comply, and we will tell you why. If you keep using the Service after a change takes effect, the changed BAA applies. If you object to a change, you may terminate the Agreement by written notice before it takes effect, or, where we gave shorter notice, within 30 days after it takes effect.

16. General

16.1 Part of the Agreement. A breach of this BAA is a breach of the Agreement.

16.2 Order of precedence. In case of conflict on a matter concerning PHI, this BAA prevails over the rest of the Agreement.

16.3 Interpretation. This BAA is interpreted to permit compliance with the HIPAA Rules. A reference to a section of the HIPAA Rules means that section as in effect or as amended.

16.4 No third-party beneficiaries. Nothing in this BAA gives any right or remedy to anyone other than you, us and our respective successors.

16.5 Survival. Our obligations under this BAA continue for as long as we hold any PHI.

16.6 Governing law. This BAA is governed by the law and courts set out in section 19.1 of the Terms, except to the extent that the HIPAA Rules apply.

16.7 Notices. We send notices under this BAA to your Account Owners' email addresses or through the Service. You send notices about this BAA to privacy@salisan.com.

Annex 1: Safeguards

1. Hosting. PHI and its backups are stored in Amazon Web Services' us-east-1 region (Northern Virginia), in an AWS account used only for the US Service.
2. Encryption. TLS 1.2 or higher for connections to the Service and between our services, and AES-256 encryption at rest.
3. Access control. Every request is checked on the server for the organization and the patient, including requests by AI tools and background jobs. You manage your members, roles and care-team access. Our platform administration roles give no access to patient data, and impersonation is disabled.
4. Authentication. Two-factor authentication, passkeys and single sign-on are available, and you can require two-factor authentication for your members. Our infrastructure access uses single sign-on with multi-factor authentication and no long-lived access keys.
5. Audit trail. Every read, search, change, export and deletion of patient data writes an audit record, with a copy in a write-once archive.
6. AI. AI features run through Subcontractors under business associate agreements, and they do not use PHI to train or improve their models. The patient details our AI tools read from the record give an age instead of a date of birth and leave out address, contact details and government identifiers. Documents and recordings you send to AI features are processed as you provide them. Patients under 13, patients you exclude, and patients under 18 while AI for them is off in Settings are excluded from AI features. Web research sends a question from which patient identifiers are removed.
7. Backups and resilience. Point-in-time database recovery and daily file backups for 35 days in the same region, with a restore tested at least once a year.
8. Program. Information security and privacy policies reviewed every year, a named Security Officer, a security risk analysis kept current, yearly HIPAA training, and a tested incident response procedure.

Annex 2: Subcontractors

Optional signature

Accepted in the Service by an Account Owner of the Customer. For a signed copy: