Business Associate Addendum

Nayya Health, Inc. (“Nayya” or “Business Associate”) and the Customer (collectively, the “Parties” and each a “Party”) have entered into an Order Form or other ordering document subject to Nayya’s Standard Terms available at https://legal.nayya.com/standard-business-terms (together, the “Underlying Agreement”), pursuant to which Nayya provides certain services to Customer (“Services”). Capitalized terms used but not defined herein have the meanings set forth in the Underlying Agreement.

As used in this Business Associate Addendum (“BAA”), “HIPAA” means the Health Insurance Portability and Accountability Act of 1996, as amended by sections 13400 through 13424 of the Health Information Technology for Economic and Clinical Health Act, and all regulations promulgated thereunder, including 45 C.F.R. Part 160 and Part 164, Subparts A and E (“Privacy Rule”), 45 C.F.R. Parts 160, 162, and 164, Subpart C (“Security Rule”) and 45 C.F.R. Parts 164, Subpart D (“Breach Notification Rule”), together with all applicable guidance issued by the Secretary of the Department of Health and Human Services (the “Secretary”) as amended from time to time.

The purpose of this BAA is to comply with HIPAA. If Customer is a Covered Entity or Business Associate to one or more Covered Entities (as defined under HIPAA), this BAA is incorporated into the Underlying Agreement by reference, and any Protected Health Information (“PHI”) disclosed by Customer to Nayya is subject to the terms of this BAA. In performing the Services, Nayya may act as a Business Associate or Business Associate subcontractor of Customer.

For relevant Services, the relationship between Nayya and Customer’s individual end users is separately established under the End User Terms of Service available at https://legal.nayya.com/end-user-terms and does not modify or supersede this BAA.

The Parties agree as follows:

1. 1. Definitions.

Capitalized terms used, but not otherwise defined, in this BAA or the Agreement shall have the same meaning as is set forth in 45 C.F.R. Parts 160 and 164, where applicable. The terms “use,” “disclose” and “discovery,” or derivations thereof, although not capitalized, shall also have the same meanings set forth in HIPAA.

2. 2. Obligations and Activities of Business Associate

   1. 2.1. To the extent Business Associate is to carry out one or more of Customer’s obligations under Subpart E of 45 CFR Part 164, Business Associate agrees to comply with the requirements of Subpart E that apply to Customer in the performance of such obligation(s).

   2. 2.2. Business Associate shall Use and Disclose PHI only as permitted or required by this BAA, the Underlying Agreement, or as Required By Law.

   3. 2.3. Business Associate shall use appropriate safeguards to prevent the Use or Disclosure of PHI other than as contemplated by the Underlying Agreement and this BAA. Business Associate shall implement administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of Electronic PHI that it creates, receives, maintains or transmits on behalf of Customer, and shall comply with Subpart C of 45 C.F.R. Part 164 with respect to Electronic PHI.

   4. 2.4. Business Associate Shall report to Customer any use or disclosure of PHI not provided for by this BAA or the Underlying Agreement of which Business Associate becomes aware, including Breaches of Unsecured PHI as required at 45 CFR 164.410 and any security incident of which it becomes aware.

      1. 2.4.1. Unauthorized Uses and Disclosures.  Business Associate agrees to report in writing to Customer any use or disclosure of the PHI not provided for by this Agreement of which it becomes aware, including breaches of unsecured PHI as required at 45 CFR 164.410. Further, the Parties agree that Business Associate need not report to Customer any such use or disclosure of information if Business Associate: (a) reasonably determines that such a use or disclosure is not a breach under 45 CFR §164.402; (b) documents its determination that the use or disclosure is not a breach in a manner that satisfies the requirements under 45 CFR §164.402 (including performing a risk assessment where appropriate) and provides such documentation to Customer upon request. With respect to a Breach of Unsecured PHI, Business Associate shall notify Customer in accordance with the requirements at 45 C.F.R. 164.410.

      2. 2.4.2. Security Incidents.  The Parties acknowledge and agree that this Section 2.4.2 constitutes notice by Business Associate to Customer of the ongoing existence and occurrence of attempted but unsuccessful Security Incidents for which no additional notice to Customer shall be required. Unsuccessful Security Incidents shall include, but not be limited to, pings and other broadcast attacks on Business Associate’s firewall, port scans, unsuccessful log-on attempts, denials of service and any combination of the above, so long as such incidents do not result, to the extent Business Associate is aware, in unauthorized access, use or disclosure of Electronic PHI.

   5. 2.5. Business Associate shall require each agent and subcontractor that creates, maintains, receives, or transmits PHI on behalf of Business Associate, to execute a business associate agreement that imposes on such agents and subcontractors the same restrictions, conditions, and requirements that apply through this BAA to Business Associate with respect to such information.

   6. 2.6. Each party acknowledges that the Business Associate does not create or maintain any Designated Record Set and Business Associate shall not be required to retain any PHI in a Designated Record Set. Business Associate shall provide Customer with information reasonably necessary to satisfy Customer’s obligations under 45 C.F.R. § 164.524 to provide PHI: (a) pursuant to an Individual’s right to obtain a copy of his or her PHI under 45 C.F.R. § 164.524(a); (b) that may be related to an Individual’s right to amend his or her PHI under 45 C.F.R. § 164.526; and (c) that may be required to provide an accounting of disclosures pursuant to 45 C.F.R. § 164.528. If any Individual requests an accounting directly from Business Associate or inquires about his or her right to an accounting, to the extent Business Associate is able to associate such request with Customer, Business Associate shall forward such request to Customer. Business Associate shall also, as directed by Customer, incorporate any amendments to PHI into copies of such PHI maintained by Business Associate.

   7. 2.7. Business Associate agrees to make its internal practices, books, and records relating to the Use and Disclosure of PHI available to the Secretary as necessary for the purposes of the Secretary determining Customer’s or Customer’s clients’ compliance with the Privacy Rule. Except to the extent prohibited by law or prevented by the Secretary, Business Associate shall notify Customer of such requests served upon Business Associate for information or documentation by or on behalf of the Secretary.

3. 3. Permitted Uses and Disclosures by Business Associate

   1. 3.1. Business Associate agrees to Use and Disclose PHI only for the purpose of performing Business Associate’s obligations under the applicable Underlying Agreement and as permitted by this BAA or as Required by Law.

   2. 3.2. Business Associate may not Use or Disclose PHI in a manner that would be inconsistent with Customer’s or its own obligations under the HIPAA, except that Business Associate may Use or Disclose PHI: (i) for the proper management and administration of Business Associate; (ii) to carry out the legal responsibilities of Business Associate, provided that with respect to any Disclosure by the Business Associate for such purposes, either: (a) the Disclosure is Required by Law or (b) Business Associate obtains a written agreement from the person to whom the PHI is to be Disclosed that such person shall hold the PHI in confidence and shall not Use and further Disclose such PHI except as Required by Law or for the purpose(s) for which it was Disclosed by Business Associate to such person, and that such person shall notify Business Associate of any instances of which it is aware in which the confidentiality of the PHI has been breached.

   3. 3.3. Business Associate shall limit its Use, Disclosure or request for PHI to the minimum necessary to accomplish the intended Use, Disclosure or request, in accordance with 45 C.F.R. § 164.502(b)(1).

   4. 3.4. Business Associate may use PHI in its possession to provide Data Aggregation services relating to the Health Care Operations of Customer.

   5. 3.5. Business Associate is authorized to use PHI to de-identify the PHI in accordance with 45 C.F.R. 164.502(d) and 164.514(a)-(c) and use such de-identified data for any lawful purpose. For the avoidance of doubt, such de-identified data will no longer be considered PHI.

   6. 3.6. Business Associate agrees that it shall not, directly or indirectly, receive remuneration in exchange for any PHI, consistent with 42 U.S.C. § 17935(d) and 45 C.F.R. § 164.502(a)(5)(ii), except with the prior written consent of the Individual in accordance with 45 C.F.R. § 164.508(a)(4).

   7. 3.7. MCP Plug-In.  At Customer’s direction or as enabled by Customer, Business Associate may transmit data, including PHI, through any model context protocol, plug-in, connector, API, or similar functionality Business Associate makes available (each, an “MCP Plug-In”, which includes the MCP Service and MCP Server described in the Nayya MCP AI Addendum) to any AI system, model, platform, or other third-party system that Customer selects, authorizes, or connects (each, an “AI System”). Any such disclosure is deemed requested and authorized by Customer and permitted under this Agreement. The MCP Plug-In is solely a technical means of enabling data transfer and is not a representation or warranty regarding any AI System’s compliance with HIPAA or other law. Business Associate has no obligation to assess any AI System’s compliance. Customer is solely responsible for determining the legality of disclosing PHI to, and ensuring the compliance of each AI System it selects, including obtaining any business associate or other agreement required by law. An AI System does not become a subcontractor of Business Associate, and Business Associate does not become responsible for any AI System’s acts or omissions, solely because Business Associate makes the MCP Plug-In available for Customer’s use. Customer agrees that Business Associate has no liability arising from an AI System’s acts or omissions, including any unauthorized use or disclosure of PHI, once PHI has been transmitted to an AI System selected or authorized by Customer.

4. 4. Obligations of Customer

Customer covenants and agrees that it shall:

1. 1. Promptly notify Business Associate of any limitation(s) in the notice of privacy practices of Covered Entity under 45 C.F.R. 164.520, to the extent that such limitation may affect Business Associate’s use or disclosure of PHI.

   1. 1.1. Promptly notify Business Associate of any changes in, or revocation of, the permission by an Individual to use or disclose his or her PHI, to the extent that such changes may affect Business Associate’s use or disclosure of PHI.

   2. 1.2. Promptly notify Business Associate of any restriction on the use or disclosure of PHI that Covered Entity has agreed to or is required to abide by under 45 C.F.R. 164.522, to the extent that such restriction may affect Business Associate’s use or disclosure of PHI.

   3. 1.3. Except with respect to uses and disclosures by Business Associate of PHI under Sections 3.4, 3.5 and 3.6, above, Covered Entity shall not request Business Associate to use or disclose PHI in any manner that would not be permissible under Subpart E of 45 C.F.R. Part 164 if done by Covered Entity.

2. 2. Term & Termination

   1. 2.1. Term.  This BAA shall become effective as of the date of execution of the Underlying Agreement by Business Associate and Customer and shall terminate when all the PHI provided by Customer to Business Associate or created or received by Business Associate on behalf of Customer, is destroyed or returned to Customer. If it is infeasible to return or destroy such PHI, the protections herein are extended to such information, in accordance with the termination provisions in Section 5.3.

   2. 2.2. Termination.  Either party may terminate the Underlying Agreement if the other party breaches in any material respect any term or condition of this BAA and fails to cure such breach within 30 days of receiving written notice from the non-breaching party specifying the breach in detail or, if such a breach is incurable, immediately upon written notice.

   3. 2.3. Effect of Termination.  Upon termination of this BAA, Business Associate shall either return or destroy, at its election, all PHI received from, or created or received by the Business Associate on behalf of the Customer (including copies) that the Business Associate still maintains in any form; provided however that Customer acknowledges that Business Associate may be required to retain portions of PHI to meet its legal obligations or to comply with applicable law. If Business Associate is required to retain portions of PHI for any reason, or if such return or destruction is infeasible for any reason, Business Associate shall extend the protections of this BAA to the information retained and limit further uses and disclosures to those purposes that make the return or destruction of the information infeasible.

3. 3. Miscellaneous

   1. 3.1. Regulatory References.  A reference in this BAA to a section in the Privacy, Breach Notification, or Security Rules means the section as in effect or as amended, and for which compliance is required.

   2. 3.2. Amendment.  The Parties agree to take such action as is necessary to amend this BAA from time to time as is necessary for the Parties to comply with the requirements of HIPAA.

   3. 3.3. Interpretation.  Any ambiguity in this BAA shall be resolved in favor of a meaning that permits Business Associate to comply with HIPAA.

   4. 3.4. Conflicts.  In the event that any terms of this BAA conflict with any terms of the Underlying Agreement, the terms of this BAA shall govern and control, except to the extent that the Underlying Agreement imposes more stringent requirements related to the use and protection of PHI upon Business Associate or the Underlying Agreements specify additional permitted uses of PHI.

   5. 3.5. Survival.  The respective rights and obligations of the Parties under this BAA shall survive the termination of this BAA as long as Business Associate and its subcontractors or agents are in possession of any PHI.

   6. 3.6. Assignment.  This BAA will be binding on the successors and assigns of the Parties. However, this BAA may not be assigned by either Party except to the extent the Underlying Agreement is capable of assignment.

   7. 3.7. No Third-Party Beneficiaries.  Nothing express or implied in this BAA is intended to confer, nor shall anything herein confer, upon any person other than the Parties and their respective successors or assigns, any rights, remedies, obligations, or liabilities whatsoever.

   8. 3.8. Notices.  Any notice, consent, request or other communication required or permitted under this BAA shall be delivered in the manner as set forth in the Underlying Agreement.

   9. 3.9. Governing Law, Venue, and Disputes.  The governing law, venue, and dispute resolution provisions in the Underlying Agreement shall apply to this BAA.

   10. 3.10. Limitation of Liability.  IN THE EVENT THE UNDERLYING AGREEMENT DOES NOT CONTAIN PROVISIONS LIMITING EITHER PARTY’S LIABILITY, THEN THE FOLLOWING TERMS SHALL APPLY TO THIS BAA.

1. NO CONSEQUENTIAL DAMAGES. IN NO EVENT SHALL EITHER PARTY BE LIABLE TO THE OTHER PARTY FOR ANY INDIRECT, INCIDENTAL, CONSEQUENTIAL, SPECIAL, PUNITIVE, OR EXEMPLARY DAMAGES (INCLUDING, WITHOUT LIMITATION, DAMAGES FOR LOSS OF BUSINESS PROFITS, BUSINESS INTERRUPTION, OR LOSS OF DATA), WHETHER IN CONTRACT, TORT, OR ANY OTHER LEGAL THEORY, EVEN IF SUCH PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

2. LIABILITY CAP. IN NO EVENT SHALL EITHER PARTY’S AGGREGATE LIABILITY ARISING OUT OF OR RELATED TO THIS BAA EXCEED THREE TIMES (3X) THE TOTAL AMOUNT PAID OR PAYABLE TO BUSINESS ASSOCIATE BY THE SPECIFIC EMPLOYER TO WHOM THE CLAIM RELATES IN CONNECTION WITH THE SERVICES PROVIDED DURING THE TWELVE (12) MONTH PERIOD IMMEDIATELY PRECEDING THE EVENT GIVING RISE TO THE CLAIM.

3. EXCEPTIONS TO LIMITATIONS. THE LIMITATIONS SET FORTH IN SECTION 6.10(b) SHALL NOT APPLY TO: (I) A PARTY’S BREACH OF ITS CONFIDENTIALITY OBLIGATIONS; (II) LIABILITY ARISING FROM A PARTY’S GROSS NEGLIGENCE OR WILLFUL MISCONDUCT; OR (III) ANY REGULATORY FINES OR PENALTIES IMPOSED DIRECTLY ON A PARTY AS A RESULT OF ITS VIOLATION OF HIPAA; PROVIDED, HOWEVER, THAT EACH PARTY’S AGGREGATE LIABILITY UNDER THIS SUBSECTION (c) SHALL NOT EXCEED FIVE TIMES (5X) THE TOTAL AMOUNT PAID OR PAYABLE TO BUSINESS ASSOCIATE BY THE SPECIFIC EMPLOYER TO WHOM THE CLAIM RELATES IN CONNECTION WITH THE SERVICES PROVIDED DURING THE TWELVE (12) MONTH PERIOD IMMEDIATELY PRECEDING THE EVENT GIVING RISE TO THE CLAIM.