HIPAA Business Associate Agreement Agreement 06 of 06 RonanRx Inc. This HIPAA Business Associate Agreement (this "BAA") forms part of the RonanRx Provider Packet and is entered into by and between RonanRx Inc. ("RonanRx"), acting as a business associate, and the Provider and, where one exists, the Provider Entity, acting together as the covered entity. The Provider, the Provider Entity, the fees, the dates, and the other particulars are stated on the Packet cover page, which is incorporated into this BAA by reference. This BAA establishes how RonanRx will safeguard and handle Protected Health Information that it creates, receives, maintains, or transmits on behalf of the Provider or Provider Entity in performing non-clinical Platform and MSO functions. It also allocates, in Sections 18 through 23, responsibility for the consumer data that RonanRx collects in its own right. This is Agreement 06 of 06 in the RonanRx Provider Packet. 1. Parties and Roles For purposes of this BAA: (a) RonanRx, a health-technology Marketplace and Management Services Organization (MSO) that supplies non-clinical services only and does not practice medicine or make any clinical judgment, is the "Business Associate"; (b) the Provider and, where one exists, the Provider Entity (the professional entity, such as a PC or PLLC, identified as the Provider Entity stated on the cover page, of the entity type stated on the cover page) are together the "Covered Entity"; (c) where a Provider Entity exists, it is the primary contracting clinical party under the MSO-PC model, and references to "Covered Entity" include the Provider Entity and the individual Provider (the Provider name stated on the cover page, the credentials stated on the cover page) as applicable; and (d) this BAA is entered into in support of, and is subordinate to, the underlying RonanRx Management Services Agreement and the related documents in the RonanRx Provider Packet (collectively, the "Agreement"). Capitalized terms not defined in this BAA have the meanings given in the Agreement. 2. Recitals In performing Platform and MSO functions for the Covered Entity, RonanRx creates, receives, maintains, or transmits information that includes Protected Health Information ("PHI"). RonanRx handles PHI through, among other things: (a) Patient onboarding and intake workflow; (b) secure messaging tools between Patient and Provider; (c) record routing and records-transfer workflows; (d) payment collection and processing support for charges tied to care; (e) non-clinical administrative and customer support; and (f) coordination of prescription and pharmacy routing and provider-transfer workflows as a non-clinical operational function, it being understood that RonanRx does not prescribe, dispense, or make clinical decisions. Because these functions involve PHI on behalf of the Covered Entity, RonanRx is a business associate of the Covered Entity, and HIPAA requires this BAA. The Covered Entity engages RonanRx to provide HIPAA-compliant technology and administrative services in support of the Covered Entity's treatment, payment, and health care operations ("TPO"). PHI under this BAA does not include information that RonanRx collects from consumers in its own right, outside and before any provider-patient relationship; RonanRx's independent responsibilities for that consumer data are addressed in Sections 18 through 23 of this BAA. 3. Definitions The following rules of construction and definitions apply to this BAA: (a) terms used but not otherwise defined in this BAA have the meanings assigned to them under the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations, as amended by the Health Information Technology for Economic and Clinical Health Act (the "HITECH Act") and its regulations (collectively, "HIPAA/HITECH"), including the Privacy Rule, the Security Rule, the Breach Notification Rule, and the Enforcement Rule; (b) "PHI" means Protected Health Information, and "ePHI" means electronic Protected Health Information, in each case limited to information that RonanRx creates, receives, maintains, or transmits for or on behalf of the Covered Entity; and (c) the terms "Individual," "Required by Law," "Security Incident," "Breach," "Unsecured PHI," "Designated Record Set," "Subcontractor," "Use," and "Disclosure" have the meanings given under HIPAA/HITECH. 4. Permitted Uses and Disclosures of PHI RonanRx may Use and Disclose PHI only as follows: (a) as permitted or required by this BAA, by the Agreement, or as Required by Law; (b) as necessary to perform the non-clinical Platform and MSO functions described in the Agreement and in Section 2, including intake, scheduling, secure messaging, record routing and records transfer, payment collection and processing support, prescription and pharmacy routing coordination, and non-clinical administrative and customer support, in each case in support of the Covered Entity's TPO; (c) for RonanRx's own proper management and administration and to carry out its legal responsibilities, provided that RonanRx may Disclose PHI for such purposes only if the Disclosure is Required by Law or RonanRx obtains reasonable assurances from the recipient that the PHI will be held confidentially and used or further disclosed only as Required by Law or for the purpose for which it was disclosed, and that the recipient will notify RonanRx of any breach of confidentiality; and (d) to de-identify PHI in accordance with 45 C.F.R. Section 164.514(a) through (b), where applicable. RonanRx will not Use or Disclose PHI in any manner that would violate HIPAA/HITECH if done by the Covered Entity, except as otherwise permitted for a business associate. 5. Prohibition on Other Use or Disclosure RonanRx will not Use or Disclose PHI other than as permitted or required by this BAA, the Agreement, or as Required by Law. RonanRx will not sell PHI and will not Use or Disclose PHI for marketing except as permitted under HIPAA/HITECH and expressly authorized in writing. RonanRx's compensation under the Agreement (the flat Platform Fee of the Platform Fee stated on the cover page) is for non-clinical services only and is never consideration for the Use, Disclosure, or sale of PHI. 6. Fees and Payment Processing The following provisions govern fees and payment processing: (a) the Provider sets the Provider Fee (the amount in effect is stated on the cover page as the Provider Fee stated on the cover page), RonanRx charges a separate flat Platform Fee, stated as the Platform Fee stated on the cover page, for non-clinical services, and the Patient's Total Monthly Charge is the Total Monthly Charge stated on the cover page; (b) the Platform Fee is a fixed, fair-market-value fee for non-clinical services, and it is not a percentage, not a revenue split, and not tied to prescriptions, refills, medication or pharmacy choice, drug or pharmacy revenue, or referrals, such that RonanRx's compensation under the Agreement does not vary with any clinical decision, and RonanRx's separately disclosed affiliation with Elite Care Pharmacy LLC is addressed in Section 12 of the MSA; (c) RonanRx uses Stripe, a third-party payment processor, and collects the Total Monthly Charge from the Patient as the limited payment-collection agent of the Provider or Provider Entity with respect to the Provider Fee component; and (d) Stripe promptly remits the Provider Fee, less the payment-processing fees described in the Fee Schedule and Payment Processing Addendum, to the Provider or Provider Entity, and RonanRx retains only its separate flat Platform Fee and holds any Provider Fee funds solely in that agency capacity pending remittance. 7. Minimum Necessary and De-identification RonanRx will observe the following limitations: (a) when Using or Disclosing PHI, or requesting PHI from the Covered Entity, RonanRx will limit PHI to the minimum necessary to accomplish the intended purpose, consistent with HIPAA/HITECH and applicable guidance; (b) RonanRx applies role-based access so that Platform personnel and Provider users access only the PHI appropriate to their function; and (c) where a function can be performed with de-identified data, such as aggregate reporting or analytics, RonanRx will use de-identified information in accordance with 45 C.F.R. Section 164.514. 8. Appropriate Safeguards RonanRx will use appropriate administrative, physical, and technical safeguards, and will comply with the Security Rule with respect to ePHI, to prevent Use or Disclosure of PHI other than as provided by this BAA. These safeguards include, at a minimum: (a) access controls and role-based permissions; (b) encryption of ePHI in transit and at rest as appropriate; (c) audit logging; (d) workforce training and confidentiality obligations; and (e) administrative policies and procedures reasonably designed to protect PHI and ePHI. RonanRx will document and periodically review these safeguards. 9. Reporting of Breaches and Security Incidents RonanRx will report to the Covered Entity as follows: (a) any Use or Disclosure of PHI not permitted by this BAA of which it becomes aware; and (b) any Security Incident of which it becomes aware, and any Breach of Unsecured PHI, without unreasonable delay and in no event more than five (5) business days after discovery, and in all events within any shorter period required by HIPAA/HITECH, the Breach Notification Rule, or applicable state breach-notification law. Each report will include, to the extent known, the nature of the incident, the PHI involved, the Individuals affected, and the mitigation and remediation steps taken or planned. RonanRx will cooperate with the Covered Entity in the Covered Entity's breach analysis and notification obligations. Unsuccessful security incidents, such as routine pings and scans, that do not result in unauthorized access are reported on an aggregate basis upon reasonable request. 10. Subcontractors and Flow-Down RonanRx will use Subcontractors that create, receive, maintain, or transmit PHI on RonanRx's behalf only if RonanRx first obtains written assurances, in a written agreement, that the Subcontractor agrees to substantially the same restrictions, conditions, and safeguards that apply to RonanRx under this BAA with respect to such PHI. RonanRx remains responsible for its Subcontractors' compliance to the extent required by HIPAA/HITECH. 11. Support for Individual Rights RonanRx will support the Covered Entity's obligations regarding Individual rights, in each case for PHI in a Designated Record Set maintained by RonanRx, as follows: (a) Access: RonanRx will make PHI available to the Covered Entity (or, as directed, to the Individual) to enable the Covered Entity to meet its access obligations under 45 C.F.R. Section 164.524, including in electronic form where applicable; (b) Amendment: RonanRx will make PHI available for amendment and will incorporate amendments directed by the Covered Entity under 45 C.F.R. Section 164.526; (c) Accounting of Disclosures: RonanRx will document and make available the information required for the Covered Entity to provide an accounting of disclosures under 45 C.F.R. Section 164.528; and (d) RonanRx will forward to the Covered Entity any request it receives directly from an Individual to exercise these rights, and will not act on such requests except as directed by the Covered Entity or as Required by Law. 12. Availability to HHS RonanRx will make its internal practices, books, and records, and PHI relating to the Use and Disclosure of PHI on behalf of the Covered Entity, available to the Secretary of the U.S. Department of Health and Human Services (HHS) for purposes of determining the Covered Entity's and RonanRx's compliance with HIPAA/HITECH. 13. Platform Functions Involving PHI Consistent with its role as a non-clinical MSO and Platform, and without granting RonanRx any clinical authority, the parties acknowledge that RonanRx may: (a) maintain PHI as needed to perform Platform and MSO functions for the Covered Entity; (b) route Patient records to the provider the Patient has selected, and support records-transfer workflows; (c) update role-based Provider access when a Patient changes providers, so that a Patient's records are accessible to the current treating provider and access is appropriately adjusted for a former provider; (d) support Patient requests to send a copy of their records to a new provider (records transfer being a copy or share, and not a delete or move, so that the former provider retains its own legal medical record) in a manner consistent with applicable information-blocking requirements, so that a provider may not obstruct or place conditions on a lawful transfer of care; (e) coordinate prescription and pharmacy routing as a non-clinical operational function; and (f) use Subcontractors only where bound by HIPAA-appropriate obligations under Section 10. 14. Term and Termination The following provisions govern term and termination: (a) this BAA is effective on the Effective Date (the Effective Date stated on the cover page) and continues for so long as RonanRx creates, receives, maintains, or transmits PHI on behalf of the Covered Entity, and in any event is coterminous with the underlying Agreement; and (b) if either party determines that the other has materially breached this BAA, the non-breaching party may provide written notice and a reasonable opportunity to cure, and if the breach is not cured within the time specified (or if cure is not feasible), the non-breaching party may terminate this BAA and, to the extent it relates to the breach, the underlying Agreement, and if termination is not feasible, the Covered Entity may report the violation to HHS. 15. Return or Destruction of PHI on Termination The following provisions govern the disposition of PHI on termination: (a) upon termination of this BAA, RonanRx will, where feasible, return to the Covered Entity or destroy all PHI that RonanRx (or its Subcontractors) still maintains in any form, and will retain no copies; (b) where return or destruction is not feasible, including where retention is Required by Law or necessary for RonanRx's proper management or the continuity of the Covered Entity's records, RonanRx will extend the protections of this BAA to such PHI and limit further Uses and Disclosures to those purposes that make return or destruction infeasible, for so long as RonanRx retains the PHI; and (c) nothing in this Section requires deletion of the Covered Entity's own legal medical record, as records transfer under the Platform is a copy or share, and each treating provider retains its own legal record. 16. Survival RonanRx's obligations under this BAA that by their nature protect PHI, including safeguards, breach reporting, availability to HHS, and return, destruction, or continued protection of PHI, survive termination of this BAA and the Agreement for so long as RonanRx retains any PHI. RonanRx's obligations under Sections 18 through 23 likewise survive termination for so long as RonanRx retains Consumer Data collected during the Provider's participation. 17. Interpretation and Amendment This BAA will be interpreted to permit compliance with HIPAA/HITECH. In the event of a conflict between this BAA and any other document in the RonanRx Provider Packet regarding the handling of PHI, the terms of this BAA control. The parties agree to amend this BAA as necessary to remain compliant with HIPAA/HITECH as amended. Sections 18 through 23 of this BAA govern Consumer Data, as defined in Section 18, and do not modify the PHI provisions of Sections 1 through 17. This BAA is governed by the law of the Governing-Law State (the Governing-Law State stated on the cover page) except to the extent HIPAA/HITECH or other federal law applies. 18. Consumer Data; Scope The parties acknowledge that two distinct categories of data move through the Platform: (a) PHI, meaning information RonanRx handles for or on behalf of the Provider or Provider Entity as the Provider's business associate, which is governed exclusively by Sections 1 through 17 of this BAA; and (b) "Consumer Data," meaning information RonanRx collects from individuals in its own right, including account registration details, contact information, date of birth, government-issued identification submitted for identity verification, health-related intake responses submitted before a provider-patient relationship forms, product interests, device and usage data, and payment records for RonanRx's own charges. RonanRx, not the Provider, is responsible for Consumer Data. Nothing in Sections 18 through 23 makes RonanRx a health care provider, gives RonanRx any clinical role, or changes the parties' roles under Sections 1 through 17. Where the same data item is both PHI in RonanRx's hands as business associate and Consumer Data collected independently by RonanRx, Sections 1 through 17 govern the business-associate copy and Sections 18 through 23 govern the copy RonanRx holds in its own right. 19. RonanRx Responsibilities for Consumer Data RonanRx will, at its own expense and in its own name: (a) maintain and honor a clear, publicly posted consumer privacy notice that accurately describes its collection, use, sharing, and retention of Consumer Data, including any health-related Consumer Data; (b) obtain every consent, and any signed authorization, that applicable law requires before collecting, sharing, or selling Consumer Data, and refrain from selling consumer health data where applicable law prohibits or conditions its sale; (c) comply with applicable state consumer-health-data and consumer-privacy laws in each state where the Platform operates, before Patients from that state are accepted; (d) not deploy location tracking or geofencing that applicable law prohibits in connection with health services; (e) honor consumer rights requests (access, correction, deletion, withdrawal of consent) within the timelines applicable law requires, and flow corresponding obligations to its processors and vendors; and (f) apply administrative, physical, and technical safeguards to Consumer Data commensurate with its sensitivity, and notify affected individuals and regulators of any breach of Consumer Data as applicable law requires. 20. Sharing with Affiliates RonanRx will not share health-related Consumer Data with any affiliate of RonanRx (including Elite Care Pharmacy LLC) except as permitted by applicable law and, where the law of the individual's state requires a separate consent or authorization for such sharing, only after that separate consent or authorization has been obtained. Routing of a prescription and related information to a pharmacy at the Patient's direction is a treatment-related function handled under Sections 1 through 17 of this BAA and the pharmacy workflow, not a marketing use of Consumer Data. 21. Marketing and Advertising Technology RonanRx is solely responsible for its own marketing, advertising, analytics, and tracking technologies. RonanRx will not use health-related Consumer Data for third-party advertising in violation of applicable law, will configure trackers and pixels on its properties consistent with its privacy notice and applicable law, and will not represent to any individual that its marketing or data practices are performed on the Provider's behalf. The Provider is responsible only for the Provider's own marketing and communications. 22. Subscription Billing Transparency For the recurring charges RonanRx presents to Patients (including the Provider Fee component it collects as limited payment-collection agent): (a) RonanRx will disclose, clearly and conspicuously before enrollment, the amount and frequency of the recurring Total Monthly Charge, its components as described in the Fee Schedule and Payment Processing Addendum, and the fact that it renews automatically until cancelled; (b) RonanRx will obtain the Patient's express consent to the recurring charge before the first charge; and (c) RonanRx will provide a cancellation mechanism at least as simple as the enrollment mechanism, honor cancellations as described in the Fee Schedule and Payment Processing Addendum, and send renewal or price-change notices where applicable law requires them. 23. Indemnity for First-Party Data Practices RonanRx will indemnify, defend, and hold harmless the Provider and the Provider Entity from third-party claims, regulatory actions, and penalties arising out of RonanRx's collection, use, sharing, sale, or breach of Consumer Data, or RonanRx's marketing and advertising practices, except to the extent caused by the Provider's own unauthorized use or disclosure of such data. This indemnity is in addition to, and does not limit, the indemnities in the MSA. 24. Provider Acknowledgments I, the Provider (on my own behalf and on behalf of my Provider Entity), acknowledge that: (a) I am, or my Provider Entity is, the Covered Entity, and RonanRx is my business associate for the non-clinical Platform and MSO functions that involve PHI; (b) RonanRx may Use and Disclose PHI only as permitted by this BAA, the Agreement, or as Required by Law, and is prohibited from other Uses and Disclosures; (c) RonanRx will apply appropriate administrative, physical, and technical safeguards and will comply with the Security Rule for ePHI; (d) RonanRx will report unpermitted Uses or Disclosures, Security Incidents, and Breaches of Unsecured PHI to me without unreasonable delay and in no event more than five (5) business days after discovery, and will cooperate with my breach-response and notification obligations; (e) RonanRx will bind its Subcontractors to substantially the same restrictions and conditions that apply to RonanRx; (f) RonanRx will support my obligations to provide Individuals access to and amendment of PHI and an accounting of disclosures, and will forward Individual requests to me; (g) RonanRx will make relevant records and PHI available to HHS for compliance review; (h) RonanRx may maintain PHI to run the Platform, route records to the selected provider, update role-based access when a Patient changes providers, and support Patient requests to send records to a new provider, and that records transfer is a copy or share, not a delete or move, so that I retain my own legal medical record; (i) RonanRx will apply minimum-necessary and de-identification principles where applicable; (j) on termination, RonanRx will return or destroy PHI where feasible and continue to protect any PHI it cannot feasibly return or destroy, and that PHI-protective obligations survive termination; (k) RonanRx's compensation is the flat Platform Fee (the Platform Fee stated on the cover page) for non-clinical services and is never payment for the Use, Disclosure, or sale of PHI, nor tied to prescriptions, referrals, medication selection, or pharmacy use; (l) RonanRx collects Consumer Data in its own right, outside and before any provider-patient relationship, and RonanRx, not I, is responsible for its lawful collection, use, sharing, and protection; (m) RonanRx will maintain a consumer privacy notice, obtain legally required consents and authorizations, honor consumer rights requests, and comply with applicable consumer-health-data and consumer-privacy laws in each state where the Platform operates; (n) RonanRx will not share health-related Consumer Data with its affiliates, including Elite Care Pharmacy LLC, except as permitted by applicable law and with any separately required consent or authorization; (o) RonanRx is solely responsible for its own marketing, advertising, and tracking technologies and for the transparency of its recurring billing; and (p) RonanRx will indemnify me and my Provider Entity for claims arising from RonanRx's first-party data and marketing practices as described in Section 23. Provider signature, typed name, date, entity, license details, and packet version are completed on the signing screen.