Business Associate Agreement (HIPAA)

1. Parties and scope

This Business Associate Agreement ("BAA") is entered into between SANORIA CARE LTDA, a company organized under the laws of Brazil (tax ID 69.430.101/0001-07), which operates Sanoria ("Sanoria" or "Business Associate"), and the clinic that accepts it ("Customer" or "Covered Entity"), together "the Parties".

This BAA applies to every Customer located in the United States that is a Covered Entity, or a Business Associate of a Covered Entity, under the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations at 45 CFR Parts 160 and 164, as amended by the HITECH Act ("HIPAA"). It supplements the Sanoria Terms of Use ("Terms"). If this BAA and the Terms conflict regarding Protected Health Information, this BAA prevails.

The Customer accepts this BAA when it creates a clinic in the United States in Sanoria, or when it changes the clinic country to the United States, by checking the acceptance box. Sanoria records the date, the version and the user who accepted.

2. Definitions

Capitalized terms used and not defined here (including Breach, Data Aggregation, Designated Record Set, Disclosure, Health Care Operations, Individual, Minimum Necessary, Required by Law, Secretary, Security Incident, Subcontractor, Unsecured Protected Health Information and Use) have the meanings given in HIPAA. "Protected Health Information" or "PHI" means protected health information, as defined at 45 CFR 160.103, that Sanoria creates, receives, maintains or transmits on behalf of the Customer, including electronic PHI.

3. Permitted uses and disclosures

• To provide the Sanoria service to the Customer, as described in the Terms and as the Customer configures and uses it.
• For the proper management and administration of Sanoria and to carry out its legal responsibilities, provided that any disclosure for these purposes is Required by Law, or Sanoria obtains reasonable written assurances from the recipient that the PHI will be held confidentially, used or further disclosed only as Required by Law or for the purpose for which it was disclosed, and that the recipient will notify Sanoria of any instance in which the confidentiality of the information has been breached.
• As Required by Law.
• Sanoria will not use or disclose PHI in any manner that would violate Subpart E of 45 CFR Part 164 if done by the Customer, except as permitted above. Sanoria will not sell PHI, will not use it for marketing, and will not use it to train models or for any purpose other than providing the service.
• Sanoria will limit its uses, disclosures and requests of PHI to the Minimum Necessary to accomplish the intended purpose.

4. Safeguards

Sanoria will use appropriate administrative, physical and technical safeguards, and comply with Subpart C of 45 CFR Part 164 (the Security Rule) with respect to electronic PHI, to prevent use or disclosure of PHI other than as provided by this BAA. These include, among others: role-based access in which front desk and managers cannot read clinical records, and clinical entries that a provider can restrict to their author; an audit trail of who opened, created, changed or deleted patient records, documents and attached files; encryption at rest with managed keys of the database and of stored files, such as photos, exams and patient signatures; malware scanning of uploaded files; encrypted connections (HTTPS) between the user and the service; automatic sign-out after inactivity (15 minutes on a computer marked as shared, 60 minutes otherwise) and a maximum session length of 12 hours; two-step verification available to every user and required for sensitive actions; and daily backups.

5. Reporting

Sanoria will report to the Customer, without unreasonable delay and in no case later than thirty (30) calendar days after discovery: (a) any use or disclosure of PHI not provided for by this BAA; (b) any Security Incident of which it becomes aware; and (c) any Breach of Unsecured PHI, as required by 45 CFR 164.410.

A Breach report will include, to the extent available, the identification of each Individual affected, a description of what happened, the dates of the Breach and of its discovery, the types of PHI involved, the steps Sanoria is taking to investigate, mitigate and prevent recurrence, and any other information the Customer reasonably needs to meet its own notification obligations. Sanoria will supplement the report as information becomes available.

The Parties agree that this section constitutes notice of the ongoing existence of unsuccessful Security Incidents, such as pings, port scans, failed log-in attempts and denial-of-service attempts that do not result in unauthorized access, use or disclosure of PHI, for which no further notice is required.

Reports are sent to the e-mail of the Customer's owner registered in Sanoria. The Customer should send any notice to Sanoria to contato@sanoria.care.

6. Subcontractors

Sanoria will ensure, in accordance with 45 CFR 164.502(e)(1)(ii) and 164.308(b)(2), that any Subcontractor that creates, receives, maintains or transmits PHI on its behalf agrees in writing to the same restrictions, conditions and requirements that apply to Sanoria under this BAA.

PHI is hosted by Amazon Web Services, Inc. (AWS), in the United States (region us-east-1), under AWS's Business Associate Addendum and only in HIPAA-eligible AWS services: the database in Amazon RDS, files in Amazon S3 (scanned for malware by Amazon GuardDuty) and e-mail sent through Amazon SES. Payment data is processed by Stripe and does not include PHI. Integrations that a clinic chooses to turn on (such as Google Calendar) receive no PHI from clinics in the United States: calendar events carry no patient name or appointment notes. WhatsApp is not available to clinics in the United States, neither automatic messages nor links that open WhatsApp on the user's device.

7. Individual rights

• Access: within fifteen (15) days of a request by the Customer, Sanoria will make PHI in a Designated Record Set available so the Customer can meet its obligations under 45 CFR 164.524. Most of this information is directly available to the Customer in the product.
• Amendment: within fifteen (15) days of a request by the Customer, Sanoria will make PHI available for amendment and incorporate any amendment, as required by 45 CFR 164.526. Signed clinical records are locked by design; amendments are made by adding a new signed entry.
• Accounting of disclosures: Sanoria will document disclosures of PHI and, within fifteen (15) days of a request by the Customer, provide the information the Customer needs to respond to a request under 45 CFR 164.528.
• If an Individual contacts Sanoria directly with any of these requests, Sanoria will forward the request to the Customer within ten (10) days.

8. Other obligations

• To the extent Sanoria carries out an obligation of the Customer under Subpart E of 45 CFR Part 164, it will comply with the requirements of Subpart E that apply to the Customer in the performance of that obligation.
• Sanoria will make its internal practices, books and records relating to the use and disclosure of PHI available to the Secretary for purposes of determining compliance with HIPAA.
• Sanoria will mitigate, to the extent practicable, any harmful effect known to it of a use or disclosure of PHI in violation of this BAA.

9. Customer obligations

• The Customer will not ask Sanoria to use or disclose PHI in any manner that would not be permissible under HIPAA if done by the Customer.
• The Customer will notify Sanoria of any restriction on the use or disclosure of PHI that it has agreed to, and of any change in or revocation of an Individual's permission, to the extent it may affect Sanoria's use or disclosure of PHI.
• The Customer is responsible for configuring user access in Sanoria (who belongs to its team and with which role), for removing access of people who leave, and for the content its users enter.

10. Term and termination

This BAA takes effect when accepted and remains in force while the Customer uses Sanoria. It ends when the Customer's subscription or account ends, or when the clinic country is changed away from the United States, without prejudice to obligations regarding PHI already received.

If either Party determines that the other has violated a material term of this BAA, it may give written notice and an opportunity of thirty (30) days to cure. If the violation is not cured, the non-breaching Party may terminate this BAA and the related service.

Upon termination, the Customer may export its data during the period described in the Terms. Sanoria will then destroy the PHI it maintains, and will not retain copies, except for encrypted backups and previous versions of deleted files, which are deleted automatically within their retention cycle (currently fourteen days) and any copy whose return or destruction is infeasible or is Required by Law. For any retained PHI, Sanoria will extend the protections of this BAA and limit further uses and disclosures to the purposes that make return or destruction infeasible.

11. Miscellaneous

• A reference in this BAA to a section of HIPAA means the section as in effect or as amended. The Parties agree to amend this BAA as necessary to comply with changes in HIPAA; Sanoria will publish the amended version on this page and notify the Customer.
• Any ambiguity in this BAA will be resolved to permit compliance with HIPAA.
• Sections 5, 7, 8 and 10 survive the termination of this BAA for as long as Sanoria maintains PHI.
• Nothing in this BAA confers any rights on any person other than the Parties.
• This BAA is governed by HIPAA and, to the extent not preempted by it, by the law chosen in the Terms.