Business Associate Agreement

This Business Associate Agreement ("Agreement") is entered into between Stillbook LLC ("Business Associate") and the massage-therapy practice that has created a Stillbook account ("Covered Entity"), effective on the date the Covered Entity accepts it below.

1. Permitted uses and disclosures. Business Associate may use and disclose Protected Health Information ("PHI") only to perform the scheduling, charting, and client-management services the Covered Entity has engaged Stillbook to provide, and as otherwise required by law.

2. Safeguards. Business Associate will implement administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of PHI, including encryption in transit and at rest and tenant isolation between practices.

3. Subcontractors. Business Associate will ensure that any subcontractor that creates, receives, maintains, or transmits PHI on its behalf agrees to restrictions and conditions at least as protective as those in this Agreement.

4. Breach notification. Business Associate will report to the Covered Entity any use or disclosure of PHI not provided for by this Agreement, and any Breach of Unsecured PHI, without unreasonable delay.

5. Access, amendment, and accounting. Business Associate will make PHI available to the Covered Entity as needed to satisfy the Covered Entity's obligations under 45 CFR §§ 164.524, 164.526, and 164.528.

6. Term and termination. This Agreement is effective on acceptance and terminates when all PHI is returned or destroyed. On termination, Business Associate will return or securely destroy all PHI it maintains, where feasible.

[PLACEHOLDER — this draft is provided so the acceptance flow can be exercised end to end. The final, binding BAA language is provided by counsel and replaces this text before launch.]