Business Associate Agreement

This Business Associate Agreement ("BAA") is entered into between ArkPulse, LLC ("Business Associate") and the undersigned covered entity ("Covered Entity"), collectively the "Parties," effective as of the date of last signature below.

1. Definitions

Terms used in this BAA shall have the same meanings as in the HIPAA Rules, 45 C.F.R. Parts 160 and 164. Key terms include:

• PHI: Protected Health Information as defined in 45 C.F.R. § 160.103
• HIPAA Rules: The Health Insurance Portability and Accountability Act of 1996 and its implementing regulations, as amended by HITECH
• Breach: As defined in 45 C.F.R. § 164.402
• Security Incident: As defined in 45 C.F.R. § 164.304

2. Obligations of ArkPulse (Business Associate)

2.1 Permitted Uses and Disclosures

ArkPulse may use and disclose PHI only as necessary to provide the services described in the ArkPulse Terms of Service and as required by law. ArkPulse shall not use or disclose PHI in a manner that would violate the HIPAA Rules if done by the Covered Entity.

2.2 Safeguards

ArkPulse shall:

• Use appropriate administrative, physical, and technical safeguards to prevent unauthorized use or disclosure of PHI
• Comply with the Security Rule (45 C.F.R. Part 164, Subpart C) with respect to electronic PHI
• Report to Covered Entity any use or disclosure of PHI not permitted by this BAA, and any Security Incident, without unreasonable delay
• Report any Breach of Unsecured PHI within 60 days of discovery, as required by 45 C.F.R. § 164.410

2.3 Subcontractors

ArkPulse shall ensure that any subcontractors that create, receive, maintain, or transmit PHI on behalf of ArkPulse agree to the same restrictions and conditions as apply to ArkPulse under this BAA.

ArkPulse's platform uses OpenAI and xAI (Grok) to generate and verify AI review replies, and OpenAI to classify inbound call transcripts and generate sentiment analysis. If your review text, replies, or call transcripts may contain PHI, this processing means OpenAI and/or xAI act as subcontractors handling that PHI.

As of the effective date of this BAA, ArkPulse has not executed subcontractor agreements meeting HIPAA's Business Associate Agreement requirements with OpenAI or xAI. Covered Entities that intend to submit PHI through ArkPulse's AI-assisted features should factor this into their own risk assessment before doing so. Contact support@ark-pulse.com for the current status of these subcontractor agreements before submitting PHI.

2.4 Access and Amendment

ArkPulse shall provide access to PHI and incorporate amendments to PHI in accordance with 45 C.F.R. §§ 164.524 and 164.526, as directed by Covered Entity.

2.5 Accounting of Disclosures

ArkPulse shall maintain documentation of disclosures of PHI sufficient to enable Covered Entity to respond to requests for an accounting of disclosures as required by 45 C.F.R. § 164.528.

2.6 Minimum Necessary

ArkPulse shall, to the extent practicable, use, disclose, or request only the minimum amount of PHI necessary to accomplish the intended purpose.

3. Obligations of Covered Entity

Covered Entity shall:

• Notify ArkPulse of any limitation in its Notice of Privacy Practices that may affect ArkPulse's use or disclosure of PHI
• Notify ArkPulse of any changes in, or revocation of, authorization by an individual to use or disclose PHI
• Not request that ArkPulse use or disclose PHI in a manner that would violate the HIPAA Rules
• Obtain any consent or authorization that may be required by applicable law prior to providing PHI to ArkPulse

4. Term and Termination

4.1 Term

This BAA is effective as of the date of last signature and shall remain in effect for the duration of the ArkPulse service agreement, unless earlier terminated.

4.2 Termination for Cause

Either party may terminate this BAA if the other party materially breaches any provision of this BAA and fails to cure the breach within 30 days of written notice. If cure is not possible, the non-breaching party may terminate immediately upon written notice.

4.3 Effect of Termination

Upon termination, ArkPulse shall return or destroy all PHI received from or created on behalf of Covered Entity. Where return or destruction is not feasible, ArkPulse shall extend the protections of this BAA to such PHI and limit further use or disclosure.

5. Miscellaneous

5.1 Regulatory References

Any reference to a section of the HIPAA Rules shall mean that section as in effect at the time the obligation arises.

5.2 Amendment

The Parties agree to amend this BAA as necessary to comply with changes in HIPAA Rules. ArkPulse will provide 30 days' advance notice of material amendments.

5.3 Interpretation

Any ambiguity in this BAA shall be resolved in favor of the interpretation that permits the Parties to comply with the HIPAA Rules.

5.4 Governing Law

This BAA is governed by the laws of the State of Texas, to the extent not preempted by federal law. Disputes shall be resolved in Dallas County, Texas.

5.5 Entire Agreement

This BAA, together with the ArkPulse Terms of Service, constitutes the entire agreement between the Parties with respect to HIPAA compliance and supersedes any prior agreements on the same subject.

6. Signatures

By signing below, each party represents that it has the authority to execute this BAA and agrees to be bound by its terms.

To initiate the BAA process, email support@ark-pulse.com with subject line "BAA Request." An ArkPulse representative will send you an executable copy within 3 business days.