The BAA every clinic signs.

Acceptance

CUSTOMER AGREES TO BE LEGALLY BOUND BY THIS BUSINESS ASSOCIATE AGREEMENT BY (A) CLICKING "I AGREE," "ACCEPT," OR A SIMILAR BUTTON OR CHECKBOX PRESENTED WITH THIS BAA AS PART OF AUTOAPPOINT'S ONBOARDING, ORDER FLOW, OR ACCOUNT CREATION PROCESS, AND (B) EXECUTING THE SIGNATURE BLOCK AT THE END OF THIS BAA. EXECUTION BY CUSTOMER'S DULY AUTHORIZED REPRESENTATIVE IS REQUIRED IN ALL CASES.

This Business Associate Agreement (this "BAA") is entered into between Trick Consulting LLC, a Wyoming limited liability company doing business as AutoAppoint ("AutoAppoint"), and the customer accepting or executing this BAA ("Customer"), and forms part of the Service Agreement, Statement of Work, Ovea Club Terms of Service, order form, or other written or electronic agreement between the parties governing AutoAppoint's services (the "Agreement"). This BAA applies where and to the extent that Customer is a "covered entity" (or a "business associate" acting on behalf of a covered entity) under HIPAA and AutoAppoint creates, receives, maintains, or transmits PHI on Customer's behalf in connection with the Services. If you are accepting this BAA on behalf of a company or other legal entity, you represent and warrant that you have the authority to bind such entity. This BAA is effective as of the date of Customer's execution of the signature block below (the "BAA Effective Date").

1. Definitions

1.1 "Breach," "Business Associate," "Covered Entity," "Designated Record Set," "Protected Health Information" ("PHI"), "Required by Law," "Secretary," and "Security Incident" have the meanings given to them under HIPAA. As used in this BAA, PHI is limited to the Protected Health Information that AutoAppoint creates, receives, maintains, or transmits on behalf of Customer in connection with the Services.

1.2 "HIPAA" means the Health Insurance Portability and Accountability Act of 1996 and the rules and regulations promulgated thereunder, including the Health Information Technology for Economic and Clinical Health (HITECH) Act, each as amended from time to time.

1.3 "Privacy Rule" means the federal privacy regulations issued pursuant to HIPAA, codified at 45 C.F.R. Parts 160 and 164 (Subparts A and E). "Security Rule" means the federal security regulations issued pursuant to HIPAA, codified at 45 C.F.R. Parts 160 and 164 (Subparts A and C).

1.4 "Services" means the Ovea Club branded patient app and clinic admin (including memberships, loyalty points and rewards, booking requests, wallet passes, and messaging), the AI voice and text agents, and related products and services provided by AutoAppoint to Customer under the Agreement.

1.5 "Subcontractor" means a third party to whom AutoAppoint provides PHI in connection with the Services.

1.6 "Unsuccessful Security Incident" means a Security Incident that does not result in unauthorized access, use, disclosure, modification, or destruction of PHI, such as pings, port scans, denial-of-service attacks that do not compromise PHI, and unsuccessful log-on attempts.

1.7 Capitalized terms used but not defined in this BAA have the meanings given to them under HIPAA or, if not defined therein, in the Agreement.

2. Permitted Uses and Disclosures

2.1 AutoAppoint may use and disclose PHI as reasonably necessary to provide the Services, as otherwise permitted under this BAA, or as Required by Law. AutoAppoint will not use or disclose PHI in any other manner.

2.2 AutoAppoint may use PHI for its proper management and administration and to carry out its legal responsibilities, and may disclose PHI for such purposes where the disclosure is Required by Law or AutoAppoint obtains reasonable written assurances from the recipient that the PHI will be held confidentially, used only for the purpose for which it was disclosed or as Required by Law, and that the recipient will notify AutoAppoint of any breach of confidentiality of which it becomes aware.

2.3 AutoAppoint will make reasonable efforts to limit its uses, disclosures, and requests of PHI to the minimum necessary to accomplish the intended purpose, consistent with 45 C.F.R. 164.502(b).

3. AutoAppoint Obligations

3.1 Safeguards. AutoAppoint will implement appropriate administrative, physical, and technical safeguards designed to protect the confidentiality, integrity, and availability of PHI, and will comply with the Security Rule with respect to electronic PHI.

3.2 Privacy and Security Program. AutoAppoint will maintain a privacy and information security program reasonably designed to ensure that its workforce complies with this BAA, including workforce training and the designation of privacy and security officials as required under HIPAA.

3.3 Mitigation. AutoAppoint will mitigate, to the extent practicable, any harmful effect known to AutoAppoint of a use or disclosure of PHI by AutoAppoint in violation of this BAA.

3.4 Subcontractors. Before disclosing PHI to a Subcontractor, AutoAppoint will enter into a written agreement with such Subcontractor requiring it to protect PHI under terms consistent with this BAA. AutoAppoint will conduct reasonable due diligence on its Subcontractors. AutoAppoint's current list of Subcontractors that receive PHI is available at https://docs.google.com/document/d/1TBY4gaHauyVfl9duLKyHdVeqsLEAs8nyb2S7cQxzPr4/preview or upon Customer's written request.

3.5 Reporting. AutoAppoint will report to Customer in writing any use or disclosure of PHI not permitted by this BAA, any Breach of unsecured PHI, and any Security Incident, in each case of which AutoAppoint becomes aware, without unreasonable delay and in no event more than ten (10) business days after discovery. Such report will include the information reasonably available to AutoAppoint at the time and will be supplemented as additional information becomes available. The parties agree that this Section 3.5 constitutes notice to Customer of the ongoing existence and occurrence of Unsuccessful Security Incidents, for which no separate or individual reporting will be required.

3.6 Individual Requests. If an individual submits a request directly to AutoAppoint to exercise rights under HIPAA (including access under 45 C.F.R. 164.524, amendment under 45 C.F.R. 164.526, or an accounting of disclosures under 45 C.F.R. 164.528), AutoAppoint will forward the request to Customer within ten (10) business days and will not respond directly to the individual except as directed by Customer in writing or as required by law. To the extent AutoAppoint maintains PHI in a Designated Record Set, AutoAppoint will make such PHI available to Customer, incorporate amendments as reasonably directed by Customer, and provide an accounting of the disclosures it is required to record under 45 C.F.R. 164.528, in each case within ten (10) business days of Customer's written request.

3.7 HHS. AutoAppoint will make its internal practices, books, and records relating to the use and disclosure of PHI available to the Secretary for purposes of determining compliance with HIPAA.

3.8 Customer Review. Upon reasonable written notice, and no more than once in any twelve (12) month period absent a Breach attributable to AutoAppoint, AutoAppoint will make available to Customer a summary of its relevant privacy and security policies and practices, or such other information as is reasonably necessary to demonstrate compliance with this BAA. AutoAppoint is not required to provide information or records that would compromise the confidentiality or security of other customers' data, AutoAppoint's proprietary information, or AutoAppoint's compliance with its legal obligations.

3.9 Delegated Obligations. To the extent AutoAppoint carries out one or more of Customer's obligations under the Privacy Rule, AutoAppoint will comply with the requirements of the Privacy Rule that apply to Customer in the performance of such obligations.

4. Customer Obligations

4.1 Notices and Restrictions. Customer will notify AutoAppoint in a timely manner of (a) any limitation in Customer's notice of privacy practices, (b) any change in, or revocation of, an individual's permission to use or disclose PHI, and (c) any restriction on the use or disclosure of PHI that Customer has agreed to or is required to abide by under 45 C.F.R. 164.522, in each case to the extent it may affect AutoAppoint's use or disclosure of PHI. AutoAppoint's obligations under this BAA are subject to any such notified limitations only on a prospective basis.

4.2 Lawful Instructions. Customer will not request or instruct AutoAppoint to use or disclose PHI in any manner that would not be permissible under HIPAA if done by Customer. Customer will use and disclose PHI to AutoAppoint only in accordance with HIPAA and applicable law, and will limit such disclosures to the minimum necessary for AutoAppoint to perform the Services.

4.3 Consents; Call Recording; AI Disclosure. As between the parties, Customer is solely responsible for obtaining and maintaining all consents, authorizations, and notices required under applicable law in connection with the Services, including consents relating to the recording of calls and any notices or disclosures required in connection with the use of an automated or artificial intelligence voice agent, except for such automated in-call disclosures as the parties agree AutoAppoint will configure the Services to deliver.

4.4 Breach Determination and Notifications. As between the parties, Customer is solely responsible for determining whether an incident reported by AutoAppoint constitutes a Breach requiring notification under HIPAA or other applicable law, and for making any required notifications to individuals, the Secretary, the media, or any other person or authority.

4.5 Customer's Failure to Perform. If Customer (or its contractor or agent) does not perform its obligations under this BAA or the Agreement, AutoAppoint will be excused from its responsibilities under this BAA to the extent that such responsibilities depend on Customer's performance.

5. Data Rights

5.1 De-Identification. AutoAppoint may de-identify PHI in accordance with 45 C.F.R. 164.514(b). De-identified data is not PHI and is not subject to this BAA, and AutoAppoint may use and disclose de-identified data for its lawful business purposes, including analytics, benchmarking, and the improvement and development of its products and services.

5.2 Aggregation. AutoAppoint may use PHI to provide data aggregation services relating to Customer's health care operations in accordance with 45 C.F.R. 164.504(e)(2)(i)(B), and may aggregate de-identified data for its own purposes.

5.3 Processing Location. AutoAppoint and its Subcontractors may use, disclose, and process PHI outside of the United States as necessary to provide the Services, provided that the safeguards and protections of this BAA continue to apply to such PHI.

6. Term and Termination

6.1 Term. This BAA takes effect on the BAA Effective Date and continues until the later of (a) the expiration or termination of the Agreement, or (b) the date on which all PHI is returned, destroyed, or retained subject to Section 6.3.

6.2 Termination for Cause. Either party may terminate this BAA if the other party fails to cure a material breach of this BAA within thirty (30) days after receiving written notice describing the breach in reasonable detail. A material breach of this BAA will be deemed a material breach of the Agreement.

6.3 Effect of Termination. Upon expiration or termination of this BAA, AutoAppoint will, at Customer's written direction, return or destroy all PHI maintained by AutoAppoint or its Subcontractors, to the extent feasible. If Customer provides no direction within thirty (30) days, AutoAppoint may destroy the PHI. Notwithstanding the foregoing: (a) PHI contained in routine backup, archival, or disaster-recovery media may be deleted in the ordinary course of AutoAppoint's standard backup rotation cycle, and in no event later than ninety (90) days following termination, with the protections of this BAA continuing to apply until deletion; and (b) if return or destruction of any PHI is not feasible, AutoAppoint will extend the protections of this BAA to such PHI and limit its further use and disclosure to the purposes that make return or destruction infeasible. AutoAppoint will confirm destruction in writing upon Customer's written request.

7. Limitation of Liability

7.1 To the maximum extent permitted by applicable law, neither party will be liable to the other for any indirect, incidental, special, consequential, exemplary, or punitive damages, or for any loss of profits, revenue, business, or data, arising out of or relating to this BAA, however caused and regardless of the theory of liability, even if advised of the possibility of such damages.

7.2 To the maximum extent permitted by applicable law, each party's total aggregate liability arising out of or relating to this BAA, whether in contract, tort, or otherwise, will not exceed the total fees actually paid by Customer to AutoAppoint under the Agreement during the twelve (12) months immediately preceding the event first giving rise to the claim.

7.3 This Section 7 applies notwithstanding anything to the contrary in this BAA or the Agreement, and does not apply to a party's fraud or willful misconduct.

8. Miscellaneous

8.1 Amendment. The parties will take such action as is reasonably necessary to amend this BAA from time to time for compliance with HIPAA and other applicable law. AutoAppoint may update this BAA upon written notice to Customer to the extent reasonably required by changes in applicable law; the updated BAA will apply thirty (30) days after notice unless Customer objects in writing within that period, in which case the parties will negotiate in good faith.

8.2 Interpretation. Any ambiguity in this BAA will be interpreted to permit compliance with HIPAA.

8.3 Order of Precedence. In the event of a conflict between this BAA and the Agreement with respect to PHI, this BAA controls; provided that nothing in this BAA or the Agreement limits or overrides Section 7 (Limitation of Liability).

8.4 No Third-Party Beneficiaries; Independent Contractors. Nothing in this BAA confers any rights or remedies upon any person other than the parties. The parties are independent contractors, and nothing in this BAA creates an agency, partnership, or joint venture relationship.

8.5 Governing Law. This BAA is governed by and construed in accordance with the laws of the State of Wyoming, without regard to conflict-of-law principles, except to the extent preempted by federal law.

8.6 Notices. Notices under this BAA will be provided in accordance with the notice provisions of the Agreement or, if none exist, via email or other electronic means reasonably designed to provide notice. Notices to AutoAppoint shall be sent to info@autoappoint.me. Email notices are deemed received at the close of the next business day following transmission absent a delivery failure notification.

8.7 Severability. If any provision of this BAA is held invalid or unenforceable, the remaining provisions remain in full force and effect.

8.8 Electronic Acceptance and Signature; Counterparts. THE PARTIES AGREE THAT THIS BAA MAY BE ACCEPTED AND EXECUTED ELECTRONICALLY, INCLUDING THROUGH CLICK-WRAP OR SIMILAR ONLINE ACCEPTANCE MECHANISMS AND ELECTRONIC SIGNATURE PLATFORMS, AND THAT SUCH ELECTRONIC ACCEPTANCE AND SIGNATURE CONSTITUTE A VALID AND BINDING AGREEMENT ENFORCEABLE AGAINST THE PARTIES TO THE SAME EXTENT AS A HANDWRITTEN SIGNATURE. This BAA may be executed in counterparts.

IN WITNESS WHEREOF, the parties have caused this BAA to be executed by their duly authorized representatives as of the BAA Effective Date.