Business Associate Agreement

Effective Date: October 21, 2026

This Business Associate Agreement (this “BAA”) is incorporated by reference into, and forms part of, the Prescripta Master Subscription Agreement posted at prescripta.com/msa (as amended from time to time, the “MSA”) between PRESCRIPTA, LLC, a Florida limited liability company, together with its affiliates (“Prescripta” or “Business Associate”), and the entity that accepts the MSA (“Customer” or “Covered Entity”). Prescripta and Customer are each a “Party” and together the “Parties.” Capitalized terms used but not defined in this BAA have the meanings given in the MSA.

CUSTOMER MUST REVIEW AND ACCEPT THIS BAA AS A CONDITION OF PURCHASING, SUBSCRIBING TO, ACCESSING, OR USING THE SERVICES, INCLUDING DURING THE BETA PERIOD. BY ACCEPTING THE MSA, CUSTOMER ACCEPTS AND AGREES TO BE BOUND BY THIS BAA. THIS BAA DOES NOT REQUIRE SEPARATE EXECUTION.

1. ACCEPTANCE AND SCOPE

1.1 Acceptance. By clicking to accept the MSA, by executing an Order that references the MSA, or by creating an account for, purchasing, accessing, or using the Services, Customer accepts and agrees to be bound by this BAA. The individual accepting this BAA on Customer’s behalf represents and warrants that he or she is at least eighteen (18) years of age and is duly authorized to bind Customer. Acceptance by electronic means constitutes a valid and binding signature for all purposes, including under the Electronic Signatures in Global and National Commerce Act, 15 U.S.C. § 7001 et seq., the Florida Electronic Signature Act, Fla. Stat. § 668.001 et seq., and the Uniform Electronic Transaction Act, Fla. Stat. § 668.50.

1.2 Effective Date. This BAA takes effect on the earlier of (a) the date Customer first accepts the MSA, or (b) the date Prescripta first creates, receives, maintains, or transmits PHI on Customer’s behalf (the “Effective Date”).

1.3 Applicability. This BAA applies only if and to the extent that (a) Customer is a Covered Entity or a Business Associate under the HIPAA Rules, and (b) Prescripta creates, receives, maintains, or transmits PHI on Customer’s behalf in connection with the Services. If Customer is not subject to the HIPAA Rules, or if no PHI is created, received, maintained, or transmitted by Prescripta on Customer’s behalf, this BAA imposes no substantive obligations on either Party, and acceptance of this BAA does not make Customer a Covered Entity or make Prescripta a Business Associate of Customer. This BAA does not apply to information that is not PHI, including de-identified information, account registration information, billing and payment information, usage, log, and telemetry data, or Customer’s own business records.

1.4 Customer as Business Associate. If Customer is itself a Business Associate rather than a Covered Entity, Prescripta acts as Customer’s Subcontractor within the meaning of 45 C.F.R. §§ 164.502(e)(1)(ii) and 164.308(b)(2). In that event, references in this BAA to “Covered Entity” mean Customer, and Customer represents and warrants that its agreement with the applicable Covered Entity permits the uses and disclosures contemplated by this BAA. Prescripta is not bound by, and assumes no obligation under, any agreement between Customer and a third party to which Prescripta is not a party.

1.5 Customer Affiliates. If Customer accepts the MSA on behalf of one or more affiliated entities, Customer represents and warrants that it has authority to bind each such entity to this BAA, and Customer remains responsible for each such entity’s compliance. Prescripta may treat instructions and notices from Customer as binding on all such entities.

1.6 HIPAA Terms. Unless the context clearly indicates otherwise, the following terms have the meanings given in the HIPAA Rules: Breach, Data Aggregation, Designated Record Set, Disclosure, Electronic Health Record, Electronic Media, Electronic Protected Health Information (“ePHI”), Genetic Information, Health Care Operations, Individual, Limited Data Set, Minimum Necessary, Notice of Privacy Practices, Required By Law, Secretary, Security Incident, Subcontractor, Transaction, Unsecured Protected Health Information (“Unsecured PHI”), and Use.

1.7 PHI. “Protected Health Information” or “PHI” has the meaning given in 45 C.F.R. § 160.103, limited to the information that Prescripta creates, receives, maintains, or transmits on behalf of Covered Entity in connection with the Services and that is in Prescripta’s possession or under its control. PHI includes ePHI.

1.8 HIPAA Rules. “HIPAA” means the Health Insurance Portability and Accountability Act of 1996, as amended. “HIPAA Rules” means the Privacy, Security, Breach Notification, and Enforcement Rules at 45 C.F.R. Parts 160 and 164, as amended by the Health Information Technology for Economic and Clinical Health Act (the “HITECH Act”), Title XIII of the American Recovery and Reinvestment Act of 2009 (“ARRA”), and any successor or implementing regulations and guidance of general application published by the U.S. Department of Health and Human Services (“HHS”). “Privacy Rule” means 45 C.F.R. Parts 160 and 164, Subparts A and E. “Security Rule” means 45 C.F.R. Parts 160 and 164, Subparts A and C. A reference to a section of the HIPAA Rules means that section as in effect or as amended.

1.9 Purpose. This BAA is intended to ensure that Business Associate establishes and implements appropriate safeguards for PHI that it may create, receive, maintain, use, disclose, or transmit in connection with the Services described in the MSA and the applicable Order, including during the Beta Period.

2. OBLIGATIONS OF BUSINESS ASSOCIATE

2.1 Limits on Use and Disclosure. Business Associate shall not use or disclose PHI other than as permitted or required by this BAA or as Required By Law, and shall not use or disclose PHI in a manner that would violate Subpart E of 45 C.F.R. Part 164 if done by Covered Entity, except as permitted by Sections 3.2 through 3.6.

2.2 Safeguards. Business Associate shall use appropriate administrative, physical, and technical safeguards, and comply with Subpart C of 45 C.F.R. Part 164 with respect to ePHI, to prevent use or disclosure of PHI other than as provided for by this BAA.

2.3 Policies, Risk Analysis, and Training. Business Associate shall maintain written HIPAA privacy and security policies and procedures, conduct and periodically update a security risk analysis, and train its workforce members who have access to PHI and apply appropriate sanctions to those who fail to comply.

2.4 Mitigation. Business Associate shall mitigate, to the extent practicable and commercially reasonable, any harmful effect known to Business Associate of a use or disclosure of PHI by Business Associate in violation of this BAA.

2.5 Reporting of Impermissible Uses and Disclosures. Business Associate shall report to Covered Entity any use or disclosure of PHI not provided for by this BAA of which it becomes aware, including any Breach of Unsecured PHI as required by 45 C.F.R. § 164.410, and any Security Incident as provided in Section 5.3.

2.6 Breach Notification.

(a) Timing. Business Associate shall notify Covered Entity of any Breach of Unsecured PHI without unreasonable delay and in no event later than sixty (60) calendar days after discovery of the Breach within the meaning of 45 C.F.R. § 164.410(a)(2), except where a law enforcement official requests a delay under 45 C.F.R. § 164.412, in which case Business Associate may delay notification for the period permitted by that section.

(b) Content. The notice shall include, to the extent then known and as information becomes available: (i) a brief description of what happened, including the date of the Breach and the date of discovery; (ii) the identification of each Individual whose Unsecured PHI has been, or is reasonably believed by Business Associate to have been, accessed, acquired, used, or disclosed; (iii) the types of PHI involved (such as name, Social Security number, date of birth, address, account number, diagnosis, or medication information); (iv) to the extent known, who made and who received the non-permitted use or disclosure; (v) the steps Business Associate has taken or will take to investigate, mitigate harm, and protect against further Breaches; (vi) steps Individuals should take to protect themselves; and (vii) any other information Covered Entity is required to include in its notice to Individuals under 45 C.F.R. § 164.404(c) or reasonably requests to complete its risk assessment under 45 C.F.R. § 164.402. Business Associate may supplement its notice as additional information becomes available.

(c) Notifications to Others. Covered Entity is solely responsible for determining whether an incident requires notification to Individuals, the Secretary, the media, or any state authority, and for making any such notification. Business Associate shall not notify Individuals, the Secretary, the media, or any other third party on Covered Entity’s behalf unless the Parties agree otherwise in writing or Business Associate is Required By Law to do so.

(d) Burden of Proof. Consistent with 45 C.F.R. § 164.414(b), Business Associate bears the burden of demonstrating that any notice it was required to give under this Section 2.6 was given, or that a use or disclosure by Business Associate did not constitute a Breach.

(e) Customer-Caused Incidents. Business Associate shall report Breaches and Security Incidents of which it becomes aware as required by this BAA regardless of cause. As between the Parties, however, Covered Entity bears sole responsibility and liability for any Breach, Security Incident, or impermissible use or disclosure of PHI to the extent it results from the acts or omissions of Covered Entity, its users, workforce members, agents, or other vendors, including its configuration of the Services, its provisioning or failure to deactivate user accounts, or the compromise or misuse of its credentials, and Covered Entity is responsible for investigating, and making any notifications required with respect to, any such incident.

2.7 Subcontractors. In accordance with 45 C.F.R. §§ 164.502(e)(1)(ii) and 164.308(b)(2), Business Associate shall ensure that any Subcontractor that creates, receives, maintains, or transmits PHI on behalf of Business Associate agrees in writing to restrictions, conditions, and requirements that are materially the same as those that apply to Business Associate under this BAA. Business Associate may engage and replace Subcontractors, including cloud hosting, infrastructure, communications, and other service providers, without Covered Entity’s consent or individualized notice. Business Associate shall maintain a current list of the categories of Subcontractors that process PHI, which it shall make available within the Services, on its website, or upon Covered Entity’s reasonable written request.

2.8 Data Location. Business Associate shall store and host PHI in data centers located in the United States.

2.9 Prohibited Activities. Business Associate shall not (a) directly or indirectly receive remuneration in exchange for PHI, except as permitted by 45 C.F.R. § 164.502(a)(5)(ii); (b) use or disclose PHI for marketing or fundraising except as permitted by the HIPAA Rules; or (c) use or disclose Genetic Information for underwriting purposes in violation of 45 C.F.R. § 164.502(a)(5)(i).

2.10 Standard Transactions. If Business Associate conducts any Transaction on behalf of Covered Entity for which HHS has adopted a standard, Business Associate shall comply, and shall require any Subcontractor involved to comply, with the applicable requirements of 45 C.F.R. Part 162, including National Provider Identifier requirements to the extent applicable.

2.11 Covered Entity Obligations. To the extent Business Associate carries out any of Covered Entity’s obligations under Subpart E of 45 C.F.R. Part 164, Business Associate shall comply with the requirements of Subpart E that apply to Covered Entity in the performance of those obligations.

2.12 Books and Records; Compliance Documentation. Business Associate shall make its internal practices, books, and records relating to the use and disclosure of PHI available to the Secretary for purposes of determining compliance with the HIPAA Rules. Upon reasonable prior written notice, not more than once in any twelve (12) month period (except following a Breach affecting Covered Entity’s PHI, in which case not more than one additional time in the twelve (12) months following such Breach, or as Required By Law), and subject to Business Associate’s confidentiality and security policies, Business Associate shall make available to Covered Entity documentation reasonably necessary to demonstrate Business Associate’s compliance with this BAA. Business Associate may satisfy this obligation by providing a current third-party security assessment, audit report, or certification, together with responses to a reasonable written security questionnaire. Covered Entity shall not access, inspect, test, or audit Business Associate’s systems, facilities, or infrastructure, or conduct penetration testing or vulnerability scanning of the Services, without Business Associate’s prior written consent.

2.13 Cooperation with Government Inquiries. Each Party shall reasonably cooperate with the other in responding to any inquiry, investigation, or audit by HHS or another governmental authority relating to PHI processed under this BAA, to the extent permitted by law.

2.14 Direct Liability. Business Associate acknowledges that it is directly subject to the applicable provisions of the HIPAA Rules and to the civil and criminal enforcement provisions of 42 U.S.C. §§ 1320d-5 and 1320d-6, as amended.

3. PERMITTED USES AND DISCLOSURES BY BUSINESS ASSOCIATE

3.1 Services. Business Associate may create, receive, maintain, transmit, use, and disclose PHI as necessary to provide the Services to Covered Entity under the MSA, including hosting, system administration, security monitoring, backup and disaster recovery, support, and related operations, provided that such use or disclosure would not violate the Privacy Rule if done by Covered Entity.

3.2 Management and Administration. Business Associate may use PHI for its proper management and administration or to carry out its legal responsibilities. Business Associate may disclose PHI for those purposes only if (a) the disclosure is Required By Law, or (b) Business Associate obtains reasonable assurances from the person to whom the PHI is disclosed that the PHI will be held confidentially and used or further disclosed only as Required By Law or for the purposes for which it was disclosed to that person, and that the person will notify Business Associate of any instances of which it is aware in which the confidentiality of the PHI has been breached.

3.3 Required By Law. Business Associate may use or disclose PHI as Required By Law.

3.4 Data Aggregation. Business Associate may use PHI to provide Data Aggregation services relating to the Health Care Operations of Covered Entity as permitted by 45 C.F.R. § 164.504(e)(2)(i)(B).

3.5 De-Identified Information. Business Associate may de-identify PHI in accordance with 45 C.F.R. § 164.514(a) through (c), and may use and disclose de-identified information, during and after the term of this BAA, for any lawful purpose, including product development and improvement, analytics, benchmarking, research, and operations, provided that such information does not identify any Individual. De-identified information is not PHI and is not subject to this BAA.

3.6 Reporting Violations of Law. Business Associate may use PHI to report violations of law to appropriate federal and state authorities, consistent with 45 C.F.R. § 164.502(j)(1).

3.7 Minimum Necessary. Business Associate shall make reasonable efforts to limit its uses and disclosures of, and requests for, PHI to the Minimum Necessary to accomplish the intended purpose, including through the use of a Limited Data Set where practicable, in accordance with 45 C.F.R. §§ 164.502(b) and 164.514(d) and related guidance of the Secretary.

4. INDIVIDUAL RIGHTS

4.1 Access. To the extent Business Associate maintains PHI in a Designated Record Set, Business Associate shall, within thirty (30) days after Covered Entity’s written request (which period may be extended once by an additional thirty (30) days upon written notice to Covered Entity explaining the reason for the delay), make that PHI available to Covered Entity (or, at Covered Entity’s written direction, to the Individual or the Individual’s personal representative) as necessary for Covered Entity to meet its obligations under 45 C.F.R. § 164.524. If the PHI is maintained electronically, Business Associate shall provide an electronic copy in the form and format requested if it is readily producible in that form and format, or otherwise in a readable electronic form and format agreed by the Parties. In many cases, Covered Entity can satisfy access requests directly through the export and reporting functions of the Services.

4.2 Amendment. Business Associate shall make any amendments to PHI in a Designated Record Set as directed or agreed to by Covered Entity under 45 C.F.R. § 164.526, or take other measures as necessary to satisfy Covered Entity’s obligations under that section, including by enabling Covered Entity to make the amendment directly in the Services.

4.3 Confidential Communications. Business Associate shall comply with any restriction on the use or disclosure of PHI, or any requirement for confidential communications, that Covered Entity has agreed to or is required to comply with under 45 C.F.R. § 164.522, to the extent Covered Entity notifies Business Associate of it in writing and it is technically supportable within the Services. This includes a restriction on disclosure to a health plan for payment or Health Care Operations purposes where the PHI pertains solely to a health care item or service for which the Individual, or a person on the Individual’s behalf, has paid the health care provider out of pocket in full, as required by 45 C.F.R. § 164.522(a)(1)(vi).

4.4 Accounting of Disclosures. Business Associate shall document disclosures of PHI, and information related to such disclosures, as would be required for Covered Entity to respond to a request by an Individual for an accounting of disclosures under 45 C.F.R. § 164.528. For each accountable disclosure, Business Associate shall record the date, the name and (if known) address of the recipient, a brief description of the PHI disclosed, and a brief statement of the purpose of the disclosure, and shall retain that information for six (6) years after the disclosure. Business Associate shall provide that information to Covered Entity within thirty (30) days after Covered Entity’s written request, and shall comply with any final rule of HHS regarding accounting for disclosures through an Electronic Health Record as of its compliance date.

4.5 Requests from Individuals. Covered Entity is responsible for responding to requests from Individuals. If Business Associate receives a request for access, amendment, restriction, or an accounting directly from an Individual, Business Associate shall forward it to Covered Entity within ten (10) business days and shall not respond directly to the Individual except as Required By Law or as directed in writing by Covered Entity.

4.6 Fees. Any fees charged to Individuals for access to their PHI shall comply with 45 C.F.R. § 164.524(c)(4).

5. SECURITY RULE COMPLIANCE

5.1 Safeguards. Business Associate shall comply with the Security Rule and shall implement the administrative, physical, and technical safeguards and the policies, procedures, and documentation requirements set forth at 45 C.F.R. §§ 164.308, 164.310, 164.312, and 164.316 to reasonably and appropriately protect the confidentiality, integrity, and availability of the ePHI that it creates, receives, maintains, or transmits on behalf of Covered Entity. This obligation applies during the Beta Period; provided, however, that Covered Entity acknowledges the pre-release nature of the Services during the Beta Period and agrees to limit its submission of PHI in accordance with Section 6.6.

5.2 Agents and Subcontractors. Business Associate shall ensure that any agent or Subcontractor to whom it provides ePHI agrees in writing to implement reasonable and appropriate safeguards to protect it, consistent with Section 2.7.

5.3 Security Incidents. Business Associate shall report to Covered Entity any successful Security Incident involving Covered Entity’s ePHI of which it becomes aware, within the time required for Breach notifications under Section 2.6 if the Security Incident constitutes a Breach, and otherwise without unreasonable delay.

5.4 Unsuccessful Security Incidents. The Parties acknowledge that this Section 5.4 constitutes notice by Business Associate to Covered Entity of the ongoing existence and occurrence of Unsuccessful Security Incidents, for which no additional notice is required. “Unsuccessful Security Incidents” means attempted but unsuccessful incidents that do not result in unauthorized access to, or use, disclosure, modification, or destruction of, PHI, or interference with system operations in an information system containing PHI, including pings and other broadcast attacks on firewalls, port scans, unsuccessful log-on attempts, denial-of-service attacks, and malware that does not result in unauthorized access to PHI.

5.5 Third-Party Infrastructure. Business Associate shall not be liable for failures of third-party hosting or infrastructure providers, provided that Business Associate maintains commercially reasonable vendor management and security practices and otherwise complies with Section 2.7 and the HIPAA Rules.

6. OBLIGATIONS OF CUSTOMER

6.1 Notices to Business Associate. Covered Entity shall notify Business Associate in writing of (a) any limitation in its Notice of Privacy Practices under 45 C.F.R. § 164.520, (b) any change in, or revocation of, an Individual’s permission to use or disclose PHI, and (c) any restriction on the use or disclosure of PHI or confidential communication requirement that Covered Entity has agreed to or must comply with under 45 C.F.R. § 164.522, in each case to the extent it may affect Business Associate’s use or disclosure of PHI.

6.2 Permissible Requests. Covered Entity shall not request Business Associate to use or disclose PHI in any manner that would not be permissible under the HIPAA Rules if done by Covered Entity, except as permitted by Section 3.

6.3 Minimum Necessary; Authorizations. Covered Entity shall provide Business Associate only the Minimum Necessary PHI for the Services, and represents and warrants that it has obtained, and will maintain, all authorizations, consents, and permissions required to disclose PHI to Business Associate and to permit the uses and disclosures contemplated by this BAA, and that all PHI and other data it provides complies with applicable law.

6.4 Configuration and Account Security. Covered Entity is solely responsible for configuring and using the Services in compliance with HIPAA and applicable law, including selecting and applying appropriate access controls, user roles, and permission settings; provisioning and promptly deactivating user accounts; safeguarding credentials; enabling available security features; and monitoring the activity of its users. Covered Entity shall comply with the Security Rule with respect to its own systems and its use of the Services.

6.5 Restricted Data. Covered Entity shall not submit PHI to any field, feature, or channel of the Services not designated by Business Associate to receive PHI, including support tickets, chat or feedback forms, file names, and email subject lines. Unless Business Associate agrees otherwise in writing, Covered Entity shall not submit substance use disorder records governed by 42 C.F.R. Part 2 or any other data for which applicable law imposes obligations more stringent than the HIPAA Rules.

6.6 Beta Period. During the Beta Period, Covered Entity shall use test, sample, or de-identified data wherever practicable and shall submit PHI only to the extent necessary for its evaluation of the Services.

6.7 Covered Entity Compliance. Covered Entity retains sole responsibility for its own compliance with the HIPAA Rules, including maintaining its Notice of Privacy Practices, responding to Individual rights requests, obtaining authorizations, conducting its own risk analysis, and making any required notifications to Individuals, the Secretary, the media, or state authorities following a Breach.

6.8 Reliance on Instructions. Business Associate may rely on Covered Entity’s written instructions regarding the use or disclosure of PHI, including instructions submitted through the administrative functions of the Services, and is not responsible for any use or disclosure performed in accordance with them. Business Associate may refuse any requested use, disclosure, or activity involving PHI that it reasonably determines would violate applicable law, and in that event shall promptly notify Covered Entity of the basis for its refusal.

7. INDEMNIFICATION; LIMITATION OF LIABILITY

7.1 By Business Associate. Business Associate shall indemnify, defend, and hold harmless Covered Entity and its affiliates from and against third-party claims, and resulting losses and damages to the extent arising out of (a) Business Associate’s negligent or knowing material failure to provide breach notification in accordance with Section 2.6, or (b) Business Associate’s gross negligence or willful misconduct with respect to PHI.

7.2 By Covered Entity. Covered Entity shall indemnify, defend, and hold harmless Business Associate and its affiliates and their respective members, managers, officers, employees, and agents from and against all claims, losses, damages, fines, penalties, and costs (including reasonable attorneys’ fees) arising out of (a) Covered Entity’s breach of this BAA or applicable law; (b) Covered Entity’s use or configuration of the Services in violation of the MSA or this BAA; (c) any data, including PHI, submitted by Covered Entity in violation of applicable law or Section 6.5; (d) any incident described in Section 2.6(e); or (e) any act or omission of Covered Entity’s users, workforce members, agents, or other vendors.

7.3 Procedure. The indemnification procedures in the MSA apply to this Section 7.

7.4 LIMITATION OF LIABILITY. EXCEPT WITH RESPECT TO A PARTY’S WILLFUL MISCONDUCT AND COVERED ENTITY’S OBLIGATIONS UNDER SECTION 7.2, EACH PARTY’S LIABILITY ARISING OUT OF OR RELATING TO THIS BAA IS SUBJECT TO, AND COUNTS TOWARD, THE EXCLUSIONS OF DAMAGES AND LIMITATIONS OF LIABILITY IN THE MSA (INCLUDING THE BETA PERIOD LIMITATION). THOSE LIMITATIONS APPLY IN THE AGGREGATE TO ALL CLAIMS UNDER THE MSA AND THIS BAA TAKEN TOGETHER AND ARE NOT DUPLICATED BY THIS BAA.

8. TERM AND TERMINATION

8.1 Term. This BAA begins on the Effective Date and continues until the later of (a) the expiration or termination of the MSA and all of Customer’s subscriptions and beta access to the Services, or (b) the date on which all PHI has been returned or destroyed in accordance with Section 8.3, or, if return or destruction is infeasible, protections are extended to that PHI in accordance with Section 8.3.

8.2 Termination for Cause. Upon either Party’s knowledge of a material breach of this BAA by the other Party, the non-breaching Party shall give the breaching Party written notice and an opportunity to cure. If the breaching Party does not cure the breach within thirty (30) days after receiving the notice, or if cure is not possible, the non-breaching Party may terminate this BAA and, correspondingly, Customer’s use of the Services involving PHI, upon written notice. Termination of this BAA terminates Customer’s right to use the Services with respect to PHI.

8.3 Return or Destruction of PHI. Upon termination of this BAA for any reason, and after the data export period provided in the MSA, Business Associate shall, within a commercially reasonable period not to exceed ninety (90) days, return to Covered Entity or destroy all PHI that Business Associate or its Subcontractors still maintain in any form, and shall retain no copies, except for copies in backup, archival, or disaster recovery systems maintained under Business Associate’s standard retention policies, or as Required By Law. If return or destruction of any PHI is infeasible, Business Associate shall notify Covered Entity of the conditions that make it infeasible, extend the protections of this BAA to that PHI, and limit further uses and disclosures to those purposes that make return or destruction infeasible, for so long as Business Associate maintains it. Covered Entity is responsible for exporting its data before termination in accordance with the MSA.

8.4 Survival. Business Associate’s obligations under Section 8.3, and its obligations with respect to any PHI it retains, survive termination of this BAA.

9. AMENDMENTS

9.1 Amendment by Prescripta. Because this BAA is a uniform agreement applicable to all customers, PRESCRIPTA MAY AMEND THIS BAA AT ANY TIME, WITHOUT NOTICE TO CUSTOMER, BY POSTING THE AMENDED VERSION ON PRESCRIPTA’S WEBSITE OR WITHIN THE SERVICES. Each amended version is effective upon posting, unless it states a later effective date, and will identify its version and “Last Updated” date. Customer’s continued access to or use of the Services after an amended version is posted constitutes acceptance of it. If Customer does not agree to an amendment, its sole remedy is to stop using the Services and terminate its account, in which case Section 8.3 applies. Amendments apply prospectively as provided in the MSA.

9.2 Amendments Required by Law. Any provision of this BAA that conflicts with a mandatory requirement of the HIPAA Rules, as amended, is deemed amended to conform to that requirement as of its compliance date, without further action by either Party.

9.3 No Other Modification. Except as provided in this Section 9, this BAA may be modified only by a writing signed by an authorized officer of Prescripta. Prescripta rejects, and is not bound by, any additional or different terms proposed by Customer, including any Customer form of business associate agreement, unless expressly agreed to in a writing signed by an authorized officer of Prescripta.

10. NOTICES

10.1 Notice to Customer. Prescripta may give notice under this BAA, including any Breach or Security Incident notice, by email to the administrative or billing contact on Customer’s account, by notice within the Services, or by any other method permitted under the MSA. Customer is responsible for maintaining a current, monitored contact address and for ensuring that Prescripta’s notices are not blocked or filtered.

10.2 Notice to Prescripta. Customer shall give notice under this BAA in writing to: PRESCRIPTA, LLC Attn: HIPAA Privacy Officer, 6470 Way Point Boulevard, Saint Cloud, Florida 34773, with a copy by email to legal@prescripta.com. Any notice of a restriction, Individual rights request, breach, or termination must be delivered to these addresses to be effective. Notice delivered only through customer support channels or to individual personnel is not effective notice under this BAA.

10.3 Changes. Either Party may change its notice address by notice under this Section 10. Prescripta may also update its notice address by posting it within the Services or on its website.

11. MISCELLANEOUS

11.1 Relationship to the MSA. This BAA is part of the MSA and is not a standalone agreement. In the event of a conflict between this BAA and the MSA, this BAA controls solely as to the use, disclosure, and protection of PHI, and the MSA controls as to all other matters, including fees, warranties, disclaimers, indemnification procedures, and limitations of liability.

11.2 Interpretation. Any ambiguity in this BAA shall be resolved in favor of a meaning that permits the Parties to comply with the HIPAA Rules and, to the extent possible, does not impose obligations on Business Associate beyond those the HIPAA Rules require. A provision of this BAA that differs from, but is permitted by, the HIPAA Rules shall be applied as written. This BAA shall not be construed against either Party as the drafter.

11.3 Survival. Sections 2.6, 3.5, 7, 8.3, 8.4, 10, and 11 survive termination of this BAA.

11.4 Assignment. Customer may not assign this BAA without Prescripta’s prior written consent, and any attempted assignment in violation of this Section is void. Prescripta may assign this BAA, without consent, to an affiliate or in connection with a merger, acquisition, reorganization, or sale of all or substantially all of its assets, provided the assignee agrees to be bound by it.

11.5 No Third-Party Beneficiaries. Nothing in this BAA confers any right, benefit, or remedy on any person other than the Parties and their permitted successors and assigns. No Individual is a third-party beneficiary of this BAA.

11.6 Independent Contractors. The Parties are independent contractors. Nothing in this BAA creates a partnership, joint venture, agency, or employment relationship, and Business Associate is not an agent of Covered Entity for purposes of the federal common law of agency.

11.7 Severability; Waiver. If any provision of this BAA is found invalid or unenforceable, it will be modified to the minimum extent necessary to make it enforceable, and the remaining provisions remain in full force. No failure or delay in exercising any right under this BAA is a waiver of that right.

11.8 Governing Law; Venue. This BAA is governed by the laws of the State of Florida, without regard to its conflict of laws principles, except to the extent preempted by federal law. The Parties irrevocably submit to the exclusive jurisdiction of the state courts located in Osceola County, Florida, and the United States District Court for the Middle District of Florida, Orlando Division, for any proceeding arising out of or relating to this BAA.

11.9 JURY WAIVER. EACH PARTY KNOWINGLY, VOLUNTARILY, AND IRREVOCABLY WAIVES, TO THE FULLEST EXTENT PERMITTED BY LAW, ANY RIGHT TO A TRIAL BY JURY IN ANY PROCEEDING ARISING OUT OF OR RELATING TO THIS BAA.

11.10 10 Entire Agreement. This BAA, together with the MSA, is the entire agreement of the Parties regarding its subject matter and supersedes all prior business associate agreements and understandings between the Parties regarding PHI processed through the Services.

12. ACKNOWLEDGMENT

12.1 BY CLICKING “I ACCEPT,” BY EXECUTING AN ORDER THAT REFERENCES THE MSA, OR BY ACCESSING OR USING THE SERVICES, CUSTOMER ACKNOWLEDGES THAT IT HAS READ, UNDERSTOOD, AND AGREES TO BE BOUND BY THIS BUSINESS ASSOCIATE AGREEMENT, AND REPRESENTS THAT THE INDIVIDUAL ACCEPTING IT IS AUTHORIZED TO BIND CUSTOMER.

12.2 Prescripta will record the date and time of Customer’s acceptance, the version of this BAA accepted, and the account and user credentials associated with the acceptance. That record is conclusive evidence of Customer’s acceptance absent manifest error. A countersigned copy of this BAA is not required. Customer may request a copy of the version it accepted, or a signed counterpart, by contacting Prescripta at the address in Section 10.2.