Business associate agreement

1.1 The Covered Entity is subject to HIPAA. It has bought the Growth tier of the company brain so that its referral-relations and patient-services teams can see each referring hospital's calls, tickets and contracts together.

1.2 The brain is built and run inside the Covered Entity's own Snowflake account. The Business Associate works within that environment only to deliver the services described in the order form.

1.3 The parties agree that the Business Associate may handle protected health information only as set out in this agreement and only so far as is necessary to provide those services.

2. Scope of data

2.1 In scope. Commercial and operational records from the connected systems that relate to referring hospitals and referral sources: call recordings and transcripts with referral contacts, support and helpdesk tickets, contract and order records, and related correspondence.

2.2 Out of scope. Patient-level clinical records are out of scope. The Covered Entity will not connect any clinical record system to the brain, and the Business Associate will not request access to one.

2.3 If any protected health information appears in an in-scope source, for example in a free-text note, the Covered Entity will tell the Business Associate and the parties will agree how that source is filtered or excluded. Nothing is to be assumed to be absent without evidence.

2.4 Any change to the scope of data requires written agreement from the Covered Entity's Privacy and Security Officer before the change takes effect.

3. Obligations of the Business Associate

3.1 Use and disclose protected health information only as permitted by this agreement or as required by law.

3.2 Apply the minimum necessary standard to every access, use and disclosure.

3.3 Maintain administrative, technical and physical safeguards appropriate to the data, and document each control.

3.4 Keep an audit trail of access to in-scope data and make it available to the Covered Entity on reasonable request.

3.5 Report to the Covered Entity, without unreasonable delay, any use or disclosure not permitted by this agreement, and any security incident affecting in-scope data.

3.6 Ensure that any subcontractor with access to in-scope data is bound by restrictions at least as strict as those in this agreement.

3.7 Not attempt to re-identify any data or contact any individual.

4. Obligations of the Covered Entity

4.1 Provide only the data sources agreed in the order form and in section 2.

4.2 Tell the Business Associate promptly of any restriction on use or disclosure that could affect the services.

4.3 Name a privacy and security contact. For this agreement that contact is Marisol Vega, Privacy and Security Officer.

5. Service levels

The following service levels apply to the Growth subscription and are those stated in the order form.

Service credits under this agreement are earned for availability breaches only. They are not earned for data freshness.

6. Return and destruction of data

6.1 Because the brain runs inside the Covered Entity's own Snowflake account, the Covered Entity retains control of the data at all times.

6.2 On termination, the Business Associate will remove its access and any derived data it holds outside that account, and will confirm this in writing to the Privacy and Security Officer.

6.3 Where return or destruction is not feasible, the protections in this agreement continue for as long as the data is held.

7. Term and termination

7.1 This agreement runs from 30 Apr 2026 to 29 Apr 2027, the same term as the Growth order form, and continues for as long as the Business Associate holds in-scope data.

7.2 The Covered Entity may terminate the agreement if the Business Associate materially breaches it and does not remedy the breach within a reasonable period after written notice.

8. Payment

Fees are set out in the order form. Invoices are payable within 30 days of the invoice date. Nothing in this agreement changes the contracted price or terms in the executed order form.

9. General

9.1 This agreement is to be read so that it complies with HIPAA.

9.2 If this agreement conflicts with the order form on the handling of protected health information, this agreement prevails. On price, billing and service levels, the order form prevails.

9.3 Changes must be in writing and signed by both parties.

10. Signatures

Signed on 16 Apr 2026.

Privacy and security review: Marisol Vega, Privacy and Security Officer, Quarrington Care Network, reviewed the scope of data and the safeguards in this agreement before signature.