Business Associate Agreement

This Business Associate Agreement ("BAA") supplements the Terms of Service or other written agreement (the "Agreement") between Torqueshift Inc., 2810 N Church St, STE 88224, Wilmington, DE 19802, USA, operator of the Voisnap and Torqueshift platforms ("Business Associate"), and the customer identified in the executed signature page or order form ("Covered Entity", which includes a customer acting as a business associate engaging us as subcontractor).

Unlike our Data Processing Agreement, this BAA does not apply automatically. It takes effect only when executed by both parties. To execute it, contact legal@voisnap.ai. Protected Health Information may be submitted to the Service only after this BAA is in effect and the workspace is configured as advised for health data (see Section 6 of the Terms of Service).

1. Definitions

"HIPAA" means the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations at 45 C.F.R. Parts 160 and 164, including the Privacy, Security, and Breach Notification Rules, as amended by the HITECH Act. Capitalized terms not defined in this BAA — including "Protected Health Information" ("PHI"), "Electronic PHI", "Breach", "Security Incident", "Designated Record Set", and "Required by Law" — have the meanings given in HIPAA. "PHI" in this BAA is limited to PHI that Business Associate creates, receives, maintains, or transmits on behalf of Covered Entity through the Service.

2. Permitted uses and disclosures

• Business Associate may use and disclose PHI only to provide the Service to Covered Entity as described in the Agreement and this BAA, or as Required by Law.
• Business Associate may use PHI for its proper management and administration and to carry out its legal responsibilities, and may disclose PHI for those purposes where the disclosure is Required by Law or where it obtains reasonable assurances of confidentiality, limited use, and breach notification from the recipient.
• Business Associate may de-identify PHI in accordance with 45 C.F.R. § 164.514(b) solely to provide and improve the Service; de-identified data is no longer PHI.
• Business Associate will not use or disclose PHI in any manner that would violate the HIPAA Privacy Rule if done by Covered Entity, will not sell PHI, and will not use PHI for marketing or fundraising. Business Associate does not use PHI to train general-purpose AI models and configures its AI sub-processors so that they do not.
• Business Associate will request, use, and disclose only the minimum PHI necessary for the intended purpose.

3. Safeguards

Business Associate will use appropriate administrative, physical, and technical safeguards to prevent use or disclosure of PHI other than as provided by this BAA, and will comply with the HIPAA Security Rule with respect to Electronic PHI, including the measures described in Annex II of the Data Processing Agreement (encryption in transit and at rest, access controls, audit logging, PII redaction features, and regional data residency).

4. Reporting

• Business Associate will report to Covered Entity, without unreasonable delay and in no case later than ten (10) business days after discovery: any use or disclosure of PHI not provided for by this BAA of which it becomes aware, and any Breach of Unsecured PHI as required by 45 C.F.R. § 164.410, including, to the extent known, the identity of affected individuals and the information required for Covered Entity's own notifications.
• The parties acknowledge the ongoing existence of unsuccessful Security Incidents (such as pings, port scans, and login attempts that do not result in unauthorized access), for which this paragraph serves as notice; no further reporting of unsuccessful incidents is required.

5. Subcontractors

Business Associate will ensure that subcontractors that create, receive, maintain, or transmit PHI on its behalf agree in writing to restrictions and conditions at least as restrictive as those in this BAA, in accordance with 45 C.F.R. §§ 164.308(b) and 164.502(e). The sub-processors in Annex III of the Data Processing Agreement that handle workspace content are Business Associate's subcontractors for PHI, subject to the notice-and-objection process described there.

6. Individual rights

• To the extent Business Associate maintains PHI in a Designated Record Set, it will make that PHI available to Covered Entity as needed to satisfy access requests under 45 C.F.R. § 164.524 and will make amendments directed by Covered Entity under 45 C.F.R. § 164.526, in each case within fifteen (15) business days of Covered Entity's request. The Service's export, correction, and deletion features may be used to satisfy these obligations directly.
• Business Associate will document and make available to Covered Entity the information required for an accounting of disclosures under 45 C.F.R. § 164.528.
• If an individual contacts Business Associate directly about PHI, Business Associate will forward the request to Covered Entity without undue delay.

7. Government access and compliance

Business Associate will make its internal practices, books, and records relating to the use and disclosure of PHI available to the Secretary of the U.S. Department of Health and Human Services for purposes of determining Covered Entity's compliance with HIPAA. To the extent Business Associate is to carry out a Covered Entity obligation under the Privacy Rule, it will comply with the requirements of the Privacy Rule that apply to Covered Entity in the performance of that obligation.

8. Covered Entity obligations

• Covered Entity will not request Business Associate to use or disclose PHI in a manner not permissible under HIPAA, will obtain any consents and authorizations needed for the processing (including recording notices and consents for calls containing PHI), and will notify Business Associate of restrictions or revocations that affect Business Associate's permitted uses.
• Covered Entity is responsible for configuring the workspace as advised for health data, including recording, retention, redaction, and residency settings appropriate to its obligations.

9. Term and termination

• This BAA is effective on execution and terminates when the Agreement terminates or when Business Associate no longer holds PHI for Covered Entity, whichever is later.
• Either party may terminate this BAA and the affected services if the other party materially breaches this BAA and fails to cure within thirty (30) days of written notice; where cure is not possible, termination may be immediate.
• Upon termination, Business Associate will return or destroy all PHI, per Covered Entity's election within the export window stated in the Agreement. If return or destruction is infeasible (for example, data in scheduled-overwrite backups), Business Associate will extend the protections of this BAA to the retained PHI, limit further use and disclosure to the purposes that make return infeasible, and destroy it when feasible.

10. Miscellaneous

• Nothing in this BAA creates an agency relationship; Business Associate acts as an independent contractor.
• Any ambiguity in this BAA is resolved to permit compliance with HIPAA, and this BAA is deemed amended to the extent required by amendments to HIPAA; the parties will cooperate on any further changes HIPAA requires.
• No third-party beneficiaries are created by this BAA. In the event of conflict between this BAA and the Agreement or DPA regarding PHI, this BAA controls.
• This BAA is governed by the governing-law provisions of the Agreement, except where HIPAA preempts.

Execution

To put this BAA in force for your workspace, request a signature copy at legal@voisnap.ai stating your workspace name and region. We countersign and return executed copies, and mark the workspace as BAA-covered.

Contact

Torqueshift Inc. (operating the Voisnap and Torqueshift platforms) · 2810 N Church St, STE 88224, Wilmington, DE 19802, USA · legal@voisnap.ai