BUSINESS ASSOCIATE AGREEMENT

This Business Associate Agreement (this "BAA") is entered into by and between the health care provider, professional practice, or other person or entity that accepts this BAA as described in Section 10(a) ("Covered Entity") and Refleo Health, Inc., a Delaware corporation ("Business Associate" or "Refleo"). This BAA is effective on the date Covered Entity accepts it (the "BAA Effective Date"). Covered Entity and Refleo may be individually referred to as a "Party" and collectively as the "Parties."

RECITALS

A. Refleo provides a software platform and related services to Covered Entity under the Refleo Terms of Service accepted by Covered Entity (as amended, the "Terms"), and in connection with the Terms Covered Entity may disclose to Refleo, and Refleo may create, receive, maintain, or transmit on Covered Entity's behalf, information that constitutes Protected Health Information ("PHI").

B. The Parties intend to protect the privacy and provide for the security of PHI in compliance with the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), the Health Information Technology for Economic and Clinical Health Act (the "HITECH Act"), and the regulations promulgated under them at 45 C.F.R. Parts 160 and 164, including the Privacy Rule and the Security Rule (as defined below), and to satisfy the requirements of 45 C.F.R. §§ 164.314(a)(2)(i), 164.502(e), and 164.504(e).

In consideration of the mutual promises below and the exchange of information under this BAA, the Parties agree as follows:

1. Definitions.

a. Capitalized terms used in this BAA and not otherwise defined have the meanings set forth in the Privacy Rule, the Security Rule, and the HIPAA regulations as amended from time to time, which definitions are incorporated by reference, including "Breach" (45 C.F.R. § 164.402), "Data Aggregation" (45 C.F.R. § 164.501), "Designated Record Set" (45 C.F.R. § 164.501), "Individual" (45 C.F.R. § 160.103, including a personal representative under 45 C.F.R. § 164.502(g)), "Required by Law" (45 C.F.R. § 164.103), "Subcontractor" (45 C.F.R. § 160.103), and "Unsecured PHI" (45 C.F.R. § 164.402 and guidance promulgated under it). References to a regulation include its successor provisions.

b. "Electronic Protected Health Information" or "Electronic PHI" has the meaning given in 45 C.F.R. § 160.103, as applied to information that Refleo creates, receives, maintains, or transmits from or on behalf of Covered Entity.

c. "Privacy Rule" means the Standards for Privacy of Individually Identifiable Health Information at 45 C.F.R. Part 160 and Part 164, Subparts A and E. "Security Rule" means the Security Standards at 45 C.F.R. Part 160 and Part 164, Subparts A and C.

d. "Protected Health Information" or "PHI" has the meaning given in 45 C.F.R. § 160.103, as applied to information created, received, maintained, or transmitted by Refleo from or on behalf of Covered Entity in connection with the Terms.

e. "Secretary" means the Secretary of the U.S. Department of Health and Human Services ("HHS") or his or her designee.

f. "Security Incident" has the meaning given in 45 C.F.R. § 164.304, but does not include (i) unsuccessful attempts to penetrate computer networks or servers maintained by Refleo, and (ii) immaterial incidents that occur on a routine basis, such as general "pinging" or "denial of service" attacks that do not result in unauthorized access to or acquisition, use, disclosure, modification, or destruction of PHI.

2. Permitted Uses and Disclosures of PHI.

a. Services. Except as otherwise limited in this BAA, Refleo may use or disclose PHI to perform functions, activities, or services for, or on behalf of, Covered Entity as contemplated by the Terms, provided that such use or disclosure would not violate the Privacy Rule if done by Covered Entity. To the extent Refleo carries out one or more of Covered Entity's obligations under the Privacy Rule, Refleo will comply with the requirements of the Privacy Rule that apply to Covered Entity in the performance of those obligations.

b. Management and Administration. Refleo may use PHI for the proper management and administration of Refleo or to carry out Refleo's legal responsibilities, and may disclose PHI for those purposes if the disclosure is Required by Law or Refleo obtains reasonable assurances from the recipient that the information will remain confidential, will be used or further disclosed only as Required by Law or for the purpose for which it was disclosed, and that the recipient will notify Refleo of any instance of which it is aware in which the confidentiality of the information has been breached. Refleo may use PHI to report violations of law to appropriate federal and state authorities, consistent with 45 C.F.R. § 164.502(j)(1).

c. Data Aggregation. Refleo may use PHI to provide Data Aggregation services relating to the health care operations of Covered Entity, as permitted by 45 C.F.R. § 164.504(e)(2)(i)(B).

d. Data Ownership; De-Identified Data. As between the Parties, Covered Entity retains all right, title, and interest in and to PHI, and Refleo's stewardship of PHI does not confer ownership on Refleo. Refleo may de-identify PHI in accordance with 45 C.F.R. § 164.514(b). Information de-identified in accordance with those standards is not PHI, and Refleo may use and disclose de-identified data, alone or in aggregated form, for its lawful business purposes, including developing, improving, and validating its products and services. Covered Entity acknowledges that Refleo owns such de-identified and aggregated data. Refleo will not use PHI in identifiable form to train, tune, fine tune, or otherwise improve any artificial intelligence model, whether Refleo's own model or that of a third party. Any use of data to train or improve a model is limited to de-identified, aggregated data. Refleo will not attempt to re-identify de-identified data and will not knowingly disclose it to a third party for the purpose of re-identification.

e. Minimum Necessary; Prohibited Uses. Refleo will request, use, and disclose the minimum amount of PHI necessary to accomplish the purpose of the request, use, or disclosure, in accordance with 45 C.F.R. § 164.502(b). Refleo will not sell PHI and will not receive direct or indirect remuneration in exchange for PHI, and Refleo will not use or disclose PHI for marketing or fundraising purposes.

3. Obligations of Refleo.

a. Appropriate Safeguards. Refleo will use appropriate administrative, physical, and technical safeguards, and will comply with the applicable provisions of the Security Rule with respect to Electronic PHI, to prevent use or disclosure of PHI other than as provided for by the Terms and this BAA. Refleo stores PHI in data centers located in the United States and will not store PHI outside the United States without Covered Entity's consent.

b. Reporting. Refleo will report to Covered Entity, in writing, any Breach of Unsecured PHI without unreasonable delay and in no event more than ten (10) calendar days after discovery of the Breach, consistent with 45 C.F.R. § 164.410. The initial report will include, if known, a reasonably detailed description of the Breach, the types of information involved, and the steps Refleo is taking, and proposes to take, to mitigate and prevent recurrence. Refleo will supplement the report as additional information becomes reasonably available, including, if known, the identification of each Individual whose Unsecured PHI was or is reasonably believed to have been involved and the information reasonably necessary for Covered Entity to perform a risk assessment under 45 C.F.R. Part 164, Subpart D and to provide any required notifications to Individuals, HHS, the media, or state regulators. Refleo will also report to Covered Entity any use or disclosure of PHI not provided for by this BAA, and any Security Incident, of which Refleo becomes aware, in each case without unreasonable delay.

c. Subcontractors. In accordance with 45 C.F.R. §§ 164.502(e)(1)(ii) and 164.308(b)(2), Refleo will enter into a written agreement with any Subcontractor that creates, receives, maintains, or transmits PHI on behalf of Refleo, providing that the Subcontractor agrees to restrictions and conditions at least as protective as those that apply to Refleo under this BAA, including implementation of reasonable and appropriate safeguards for Electronic PHI. Each such agreement will prohibit the Subcontractor from using PHI to train, tune, fine tune, or otherwise improve any artificial intelligence model, and from retaining PHI longer than necessary to perform its services for Refleo. Refleo will maintain a current list of Subcontractors that create, receive, maintain, or transmit PHI and will make that list available to Covered Entity.

d. Access to PHI. To the extent Refleo maintains PHI in a Designated Record Set, Refleo will make that PHI available to Covered Entity pursuant to 45 C.F.R. § 164.524 within ten (10) business days of Refleo's receipt of Covered Entity's written request; provided that Refleo is not required to provide access where the PHI is duplicative of PHI in a Designated Record Set possessed by Covered Entity, and provided further that Covered Entity's ability to retrieve the PHI directly through the services satisfies this obligation. If an Individual requests access directly from Refleo, Refleo will direct the Individual to Covered Entity.

e. Amendment of PHI. To the extent Refleo maintains PHI in a Designated Record Set, Refleo will make that PHI available to Covered Entity for amendment, and will incorporate any amendment Covered Entity directs, pursuant to 45 C.F.R. § 164.526 within ten (10) business days of Refleo's receipt of Covered Entity's written request. If an Individual submits an amendment request directly to Refleo, Refleo will direct the Individual to Covered Entity.

f. Accounting of Disclosures. Refleo will document disclosures of PHI, and information related to such disclosures, as would be required for Covered Entity to respond to a request for an accounting of disclosures under 45 C.F.R. § 164.528, and will provide that information to Covered Entity within ten (10) business days of Refleo's receipt of Covered Entity's written request. If an Individual submits an accounting request directly to Refleo, Refleo will direct the Individual to Covered Entity.

g. Governmental Access to Records. Refleo will make its internal practices, books, and records relating to the use and disclosure of PHI received from, or created or received by Refleo on behalf of, Covered Entity available to the Secretary for purposes of determining compliance with the Privacy Rule and the Security Rule, subject to all applicable legal privileges. If Refleo receives a notification from or on behalf of HHS regarding a compliance review, audit, or investigation pertaining to the services, Refleo will notify Covered Entity within ten (10) business days of receipt, to the extent permitted by law. If Refleo receives a subpoena, court order, or other legal process seeking PHI, Refleo will notify Covered Entity promptly and, where practicable, before responding, to the extent permitted by law, so that Covered Entity may respond or object.

h. Mitigation. To the extent reasonably practicable, Refleo will mitigate, and will cooperate with Covered Entity's efforts to mitigate, any harmful effect that is known to Refleo of a use or disclosure of PHI that is not permitted by this BAA.

4. Obligations of Covered Entity.

a. Notice of Privacy Practices. Covered Entity will notify Refleo in writing of any limitation in an applicable notice of privacy practices under 45 C.F.R. § 164.520, of any change in or revocation of an Individual's permission to use or disclose PHI, and of any restriction on the use or disclosure of PHI that Covered Entity has agreed to under 45 C.F.R. § 164.522, in each case to the extent the limitation, change, or restriction may affect Refleo's use or disclosure of PHI, and no later than fifteen (15) days before its effective date. If Refleo reasonably believes that any such restriction materially impairs Refleo's ability to perform under the Terms or this BAA, the Parties will mutually agree on any necessary modification of Refleo's obligations.

b. Consents and Authorizations. Covered Entity will obtain any consent, authorization, or permission required by the Privacy Rule or applicable state law before furnishing PHI to Refleo or submitting patient information to the services, including the consent of a parent, guardian, or other legally authorized representative where the patient is a minor, and any consent or authorization required under Chapter 181 of the Texas Health and Safety Code or other applicable state law. Consent to treatment of Covered Entity's patients is solely Covered Entity's responsibility.

c. Permissible Requests. Covered Entity will not request that Refleo use or disclose PHI in any manner that would not be permissible under the Privacy Rule or the Security Rule if done by Covered Entity, except as permitted for a business associate under Section 2 of this BAA.

5. Term and Termination.

a. Term. This BAA commences on the BAA Effective Date and continues until the Terms expire or are terminated and all PHI provided by Covered Entity to Refleo, or created or received by Refleo on behalf of Covered Entity, is destroyed or returned to Covered Entity or, if return or destruction is infeasible, protections are extended to such PHI in accordance with Section 5(c).

b. Termination for Cause. Upon either Party's knowledge of a material breach of this BAA by the other Party, that Party will provide written notice stating the nature of the breach and providing an opportunity to cure within thirty (30) days. If the breach is not cured within the cure period, or if cure is not possible, the non-breaching Party may terminate this BAA and, at its election, the Terms.

c. Effect of Termination. Upon termination of the Terms or this BAA for any reason, Refleo will make PHI available for export by Covered Entity for thirty (30) days and will then return or destroy all PHI and retain no copies, if feasible. If return or destruction is infeasible, including where retention is required by law or where PHI resides in routine backup media, Refleo will extend the protections of this BAA to the retained PHI, limit further uses and disclosures to those purposes that make return or destruction infeasible for so long as Refleo maintains the PHI, and will not disclose the retained PHI to any other Refleo client or third party unless the information has been de-identified in accordance with 45 C.F.R. § 164.514(b). The rights and obligations under this Section 5(c) and Sections 2(d), 6, and 8 survive termination of this BAA and the Terms.

6. Cooperation in Investigations.

Each Party will cooperate reasonably and in good faith with the other Party in connection with any request by a federal or state governmental authority for information or documents, or any governmental investigation, complaint, action, or other inquiry relating to PHI under this BAA, to the extent permitted by law and subject to all applicable legal privileges.

7. Insurance.

During the term of this BAA, Refleo will maintain commercially reasonable insurance appropriate to its size and the nature of the services, including cyber liability coverage for privacy and network security events, and will provide a certificate of insurance to Covered Entity upon written request.

8. Liability.

Neither Party will be liable to the other for any indirect, incidental, special, consequential, exemplary, or punitive damages, or for lost profits, revenue, business, or goodwill, arising out of or relating to this BAA, even if advised of the possibility of such damages. Refleo's total aggregate liability arising out of or relating to this BAA is subject to, and shall not exceed, the limitation of liability set forth in the Terms, which applies to this BAA and the Terms together as a single aggregate limit and does not apply separately to each. That limitation does not apply to liability for fraud or willful misconduct, to Covered Entity's indemnification obligations under the Terms, to amounts Covered Entity owes Refleo under the Terms, or to any liability that applicable law does not permit to be limited. Nothing in this Section limits either Party's responsibility for its own violations of HIPAA to a regulator.

9. Effect of BAA.

In the event of any inconsistency between this BAA and the Terms with respect to PHI, this BAA controls. In the event of any inconsistency between this BAA and mandatory provisions of the Privacy Rule or the Security Rule, or their interpretation by any court or regulatory agency with authority over a Party, the mandatory provision or interpretation controls. Where provisions of this BAA differ from those mandated by the Privacy Rule or the Security Rule but are nonetheless permitted, this BAA controls. Any ambiguity in this BAA will be interpreted to permit compliance with the Privacy Rule and the Security Rule.

10. General.

a. Acceptance; Authority. Covered Entity accepts this BAA by clicking "I Agree" (or a similar acceptance mechanism) where this BAA is presented, by signing it, or by using the services after being presented with it. Acceptance by electronic means constitutes execution of a written agreement, and the Parties agree this BAA satisfies the writing requirement of 45 C.F.R. § 164.504(e). The individual accepting represents and warrants that he or she is authorized to bind Covered Entity. Refleo will record the acceptance and will provide Covered Entity a copy of this BAA upon acceptance and upon request.

b. Amendment. The Parties will amend this BAA as necessary to comply with changes in HIPAA, the HITECH Act, or other applicable law. Refleo may amend this BAA to maintain compliance with applicable law by posting a revised version and giving Covered Entity at least thirty (30) days' written notice; Covered Entity's continued use of the services after the notice period constitutes acceptance of the revised BAA. Any other amendment must be in a writing accepted by both Parties.

c. Governing Law. This BAA is governed by, and construed in accordance with, the laws of the State of Texas, without regard to its conflict of laws principles, except to the extent preempted by federal law. The venue, jury waiver, and limitations period provisions of the Terms apply to any dispute arising out of or relating to this BAA.

d. Notices. Notices under this BAA must be in writing and reference this BAA. Notices to Refleo must be sent to Refleo Health, Inc., Attn: Legal, at the notice address stated in the Terms. Notices to Covered Entity may be sent to the email address associated with Covered Entity's account and are effective when sent.

e. Severability; No Third-Party Beneficiaries; Entire Agreement. If any part of a provision of this BAA is found illegal or unenforceable, it will be enforced to the maximum extent permissible, and the remainder of this BAA will not be affected. Nothing in this BAA confers any right, remedy, or obligation upon anyone other than the Parties. This BAA, together with the Terms, is the complete and exclusive agreement between the Parties with respect to its subject matter and supersedes all prior agreements, communications, and understandings regarding that subject matter.

11. Independent Contractor Status.

Refleo is an independent contractor for all purposes and will not act as agent, servant, or employee of Covered Entity or make any commitments or incur any liabilities on behalf of Covered Entity without its express written consent. Nothing in this BAA creates an employment, principal-agent, or partnership relationship between the Parties.

Acceptance.

BY CLICKING "I AGREE," BY SIGNING BELOW, OR BY USING THE SERVICES AFTER BEING PRESENTED WITH THIS BAA, COVERED ENTITY AGREES TO THIS BAA, AND THE INDIVIDUAL ACCEPTING REPRESENTS THAT HE OR SHE IS AUTHORIZED TO BIND COVERED ENTITY.

For Covered Entities executing by signature rather than electronic acceptance:

COVERED ENTITY: ______________________________

By: ______________________________

Print Name: ______________________________

Title: ______________________________

Date: ______________________________

REFLEO HEALTH, INC.

By: ______________________________

Print Name: ______________________________

Title: ______________________________

Date: ______________________________