Business Associate Agreement

This Business Associate Agreement ("BAA") is between DCI Brands LLC, a Wyoming limited liability company, 312 W 2nd Street, Casper, WY 82601, United States ("Vavus", "we", the Business Associate), and the organization named in the signature record made in the Vavus console ("Customer", "you"). Customer is a Covered Entity, or a Business Associate of a Covered Entity, under the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations.

Customer uses Vavus AI under a Healthcare account that Vavus has approved (the "Services"). Vavus Concierge is not covered by this BAA. Providing the Services may require Vavus to create, receive, maintain, or transmit Protected Health Information on Customer's behalf. This BAA sets out how Vavus handles that information. It applies in addition to the Vavus Terms of Service and the Privacy Policy, and it controls over them for Protected Health Information.

"HIPAA Rules" means the Privacy, Security, Breach Notification, and Enforcement Rules at 45 CFR Parts 160 and 164, as amended, including by the HITECH Act.

"Protected Health Information" or "PHI" has the meaning in 45 CFR 160.103, limited to the information Vavus creates, receives, maintains, or transmits on Customer's behalf. "Breach", "Business Associate", "Covered Entity", "Designated Record Set", "Individual", "Required by Law", "Secretary", "Security Incident", "Subcontractor", and "Unsecured PHI" have the meanings given in the HIPAA Rules.

"Unsuccessful Security Incident" means an attempt that does not result in unauthorized access to, or use, disclosure, modification, or destruction of, PHI or interference with the Services, such as a blocked sign-in attempt, a port scan, a ping, a rejected malformed request, or malware that is stopped before it runs.

Vavus may use and disclose PHI only (a) to provide the Services to Customer and its authorized users as the Services are described in the Terms and configured by Customer, including speech recognition, translation, transcription, document processing, messaging, calls, storage, and support for those features; (b) for the proper management and administration of Vavus, and to carry out its legal responsibilities, as 45 CFR 164.504(e)(4) allows; and (c) as Required by Law.

A disclosure under (b) is permitted only if it is Required by Law, or if Vavus first obtains reasonable written assurances from the recipient that the PHI will be held confidentially, used or further disclosed only as Required by Law or for the purpose for which it was disclosed, and that the recipient will notify Vavus of any instance it becomes aware of in which the confidentiality of the PHI has been breached.

Vavus will not use or disclose PHI in a way that would violate Subpart E of 45 CFR Part 164 if done by Customer, except as allowed under (b) above. Vavus will not sell PHI, will not use or disclose PHI for marketing or fundraising, will not use PHI to train or improve artificial intelligence or machine learning models, and will not aggregate PHI across customers. Vavus will not de-identify PHI for its own purposes. Vavus will request, use, and disclose only the minimum PHI necessary for the intended purpose, in line with 45 CFR 164.502(b).

Where a feature works only if PHI is processed in a readable form on Vavus servers, such as live speech translation or the translation of a voice message that a user has chosen to have translated, Vavus processes that PHI only for that request, under the safeguards in Section 4, and does not keep a readable copy longer than the feature requires. Content that Customer's users save in the Services is encrypted on their devices before it is stored, and Vavus holds only the encrypted form.

Vavus will:

(a) not use or disclose PHI other than as permitted by this BAA or as Required by Law;

(b) use appropriate administrative, physical, and technical safeguards, and comply with Subpart C of 45 CFR Part 164 (the Security Rule) with respect to electronic PHI, to prevent any use or disclosure of PHI other than as this BAA provides. These safeguards include encryption of PHI in transit using TLS 1.2 or higher and at rest, client-side encryption of stored content with keys held on Customer's devices, role-based access controls, 8-hour session tokens and a 15-minute idle timeout for Healthcare accounts, audit logging of PHI access that records metadata only and never PHI, application logs designed to exclude PHI, and secure deletion of PHI assets;

(c) report to Customer, in writing to the email address of the signer or another address Customer designates in the console, (i) any Breach of Unsecured PHI without unreasonable delay and in no case later than 72 hours after Vavus discovers the Breach, and (ii) any other use or disclosure of PHI not permitted by this BAA, and any Security Incident other than an Unsuccessful Security Incident, within 10 business days after Vavus discovers it. Each report will include, to the extent known or later learned, the identity of each Individual whose PHI was involved, a description of what happened and the dates of the incident and its discovery, the types of PHI involved, the steps Individuals should take to protect themselves, what Vavus is doing to investigate, mitigate harm, and prevent recurrence, and a contact for questions. Vavus will update the report as material information becomes available. This paragraph is Customer's notice of Unsuccessful Security Incidents, which occur routinely; Vavus will provide aggregate information about them on reasonable written request;

(d) in accordance with 45 CFR 164.502(e)(1)(ii) and 164.308(b)(2), ensure that any Subcontractor that creates, receives, maintains, or transmits PHI on behalf of Vavus agrees in writing to the same restrictions, conditions, and requirements that apply to Vavus under this BAA, including compliance with the Security Rule. Vavus will provide its current list of Subcontractors that may handle PHI on written request and will give Customer at least 30 days' notice in the console or by email before a new Subcontractor handles PHI, during which Customer may object and terminate this BAA and its Healthcare account without penalty;

(e) make PHI in a Designated Record Set available to Customer, within 10 business days of Customer's written request, so that Customer can meet its obligations under 45 CFR 164.524. Because the Services store saved content in a form only Customer's users can decrypt, Customer's users can access and export their own content directly in the Services at any time. If an Individual makes a request directly to Vavus, Vavus will forward it to Customer within 5 business days and will not respond to the Individual except as Customer directs or as Required by Law;

(f) make PHI in a Designated Record Set available for amendment, and incorporate any amendment, within 10 business days of Customer's written request, as 45 CFR 164.526 requires, and forward any amendment request received directly from an Individual as described in (e);

(g) maintain and, within 10 business days of Customer's written request, make available the information required to provide an accounting of disclosures under 45 CFR 164.528, covering at least the six years before the request;

(h) to the extent Vavus carries out one or more of Customer's obligations under Subpart E of 45 CFR Part 164, comply with the requirements of Subpart E that apply to Customer in the performance of those obligations;

(i) make its internal practices, books, and records relating to the use and disclosure of PHI available to the Secretary for the purpose of determining compliance with the HIPAA Rules;

(j) mitigate, to the extent practicable, any harmful effect known to Vavus of a use or disclosure of PHI by Vavus or its Subcontractors in violation of this BAA; and

(k) honor any restriction on the use or disclosure of PHI that Customer has agreed to under 45 CFR 164.522 and has communicated to Vavus in writing, to the extent the Services can carry it out, and tell Customer promptly if they cannot.

Customer will (a) use the Services for PHI only through a Healthcare account that Vavus has approved, and enroll only users it has authorized to handle PHI; (b) notify Vavus in writing of any limitation in its notice of privacy practices, any change in or revocation of an Individual's permission to use or disclose PHI, and any restriction agreed under 45 CFR 164.522, to the extent the limitation, change, or restriction may affect Vavus's use or disclosure of PHI; (c) not request Vavus to use or disclose PHI in a way that would not be permitted under Subpart E of 45 CFR Part 164 if done by Customer, except as Section 3(b) allows; (d) obtain any consent or authorization that the law requires before PHI is entered into the Services, including consent from the people on a call or in a conversation where their jurisdiction requires it; and (e) configure the Services, including retention settings and user roles, in line with its own obligations.

Customer is responsible for the content its users enter and for the accuracy of the information in the signature record. Customer confirms that the person who signs this BAA is authorized to bind Customer.

This BAA takes effect when Vavus approves the signature request that Customer's authorized signer submitted in the Vavus console and records the approval. Until then the request is pending, Vavus may decline it, and the Services must not be used for PHI. Once in effect, this BAA continues for as long as Customer holds a Healthcare account, unless terminated earlier under this Section.

Either party may terminate this BAA if the other party materially breaches it and does not cure the breach within 30 days after written notice describing it, or immediately on written notice if cure is not possible. Terminating this BAA ends Customer's right to use the Services for PHI, and Vavus may convert or suspend the Healthcare account accordingly.

On termination Vavus will return or destroy all PHI that it still maintains in any form and keep no copies, as 45 CFR 164.504(e)(2)(ii)(J) requires. Because saved content is encrypted with keys held on Customer's devices, Customer can export its content before termination; Vavus will then destroy the remaining stored copies through its secure deletion process. Encrypted backups that contain PHI age out under Vavus's backup lifecycle and are never restored for any other purpose; Vavus treats PHI in them as subject to this BAA until they are destroyed. Where return or destruction is infeasible, Vavus will tell Customer why, extend the protections of this BAA to that PHI, and limit further uses and disclosures to the purposes that make return or destruction infeasible, for as long as Vavus maintains it.

Vavus keeps audit log entries about PHI access, which hold metadata only and never PHI, for six years after they are created, as 45 CFR 164.316(b)(2) and 164.530(j) require, and keeps the signature record of this BAA for six years after this BAA ends. Sections 3, 4(c), 4(i), 6, and 7 survive termination.

The parties will amend this BAA as needed to comply with changes in the HIPAA Rules or other applicable law. Vavus may publish a new version of this BAA; the version Customer signed continues to apply until Customer's authorized signer accepts the new version in the console, and Vavus will give at least 30 days' notice before any change that reduces Customer's rights or protections. Any ambiguity in this BAA will be resolved to permit compliance with the HIPAA Rules. Nothing in this BAA creates rights in any third party, including Individuals.

This BAA is governed by federal law and, to the extent state law applies, by the laws of the State of Wyoming, United States, consistent with the Vavus Terms of Service. If this BAA conflicts with the Terms of Service or the Privacy Policy on a matter involving PHI, this BAA controls.

Signing in the Vavus console, by entering the authorized signer's name, title, and account email and confirming the agreement, is Customer's electronic signature under the Electronic Signatures in Global and National Commerce Act and the Uniform Electronic Transactions Act, and it binds Customer once Vavus accepts it. Vavus records the version and fingerprint of the text shown, the signer, the organization, and the time, and emails the signer that the request was received. Vavus accepts this BAA when it approves the request, records the approval, emails a confirmation to the signer, and makes the Healthcare controls available to Customer; the signed version is then available in the console.

Notices to Vavus under this BAA go to support@vavusai.com with "HIPAA" in the subject line, or by post to DCI Brands LLC, 312 W 2nd Street, Casper, WY 82601, United States. Notices to Customer go to the signer's email address or to another address Customer designates in the console.