Business Associate Agreement

TreatPath Inc. — Standard Practice Agreement, Version 1.5 (October 2026)

This Agreement is built on the U.S. Department of Health and Human Services, Office for Civil Rights, “Sample Business Associate Agreement Provisions” (January 25, 2013), with TreatPath’s actual data flows filled in. Review by healthcare counsel is anticipated and may produce an amended and restated version under Section 6(b).

This Business Associate Agreement (“Agreement”) is entered into as of the Effective Date by and between the Covered Entity and Business Associate identified below. The “Effective Date” is the date of the last signature below or, where Covered Entity accepts this Agreement electronically under Section 6(h), the date and time of that acceptance.

Covered Entity: the dental practice that signs below or, where this Agreement is accepted electronically under Section 6(h), the dental practice under whose account with the Services it is accepted, identified by the practice name and account email recorded with the acceptance.

Practice legal name: ________________________________________________

Doing business as (if different): ________________________________________

Address: _____________________________________________________________

(“Covered Entity”)

Business Associate: TreatPath Inc., a Delaware corporation, with a notice address at 12879 Flintwood Way, San Diego, CA 92130 (“TreatPath” or “Business Associate”; this Agreement uses “Business Associate” throughout, as the HIPAA Rules attach obligations to that role)

Covered Entity and Business Associate are each a “Party” and together the “Parties.”

Recitals. Business Associate provides Covered Entity with a treatment plan presentation and case acceptance platform (the “Services”). In performing the Services, Business Associate creates, receives, maintains, and transmits Protected Health Information on behalf of Covered Entity. The Parties enter into this Agreement to comply with the HIPAA Rules.

1. Definitions

The following terms used in this Agreement have the same meaning as those terms in the HIPAA Rules: Breach, Data Aggregation, Designated Record Set, Disclosure, Health Care Operations, Individual, Minimum Necessary, Notice of Privacy Practices, Protected Health Information, Required By Law, Secretary, Security Incident, Subcontractor, Unsecured Protected Health Information, and Use.

1. Business Associate has the same meaning as the term “business associate” at 45 CFR 160.103, and means TreatPath Inc.

2. Covered Entity has the same meaning as the term “covered entity” at 45 CFR 160.103, and means the dental practice identified as Covered Entity above, including, where this Agreement is accepted electronically, the practice under whose account it was accepted.

3. HIPAA Rules means the Privacy, Security, Breach Notification, and Enforcement Rules at 45 CFR Part 160 and Part 164.

4. Services means the treatment plan presentation, case acceptance, analytics, and related software services provided by Business Associate to Covered Entity, as described in Business Associate’s then-current service documentation.

2. Obligations and Activities of Business Associate

Business Associate agrees to:

1. Not use or disclose Protected Health Information other than as permitted or required by this Agreement or as Required By Law;

2. Use appropriate safeguards, and comply with Subpart C of 45 CFR Part 164 with respect to electronic Protected Health Information, to prevent use or disclosure of Protected Health Information other than as provided for by this Agreement;

3. Report to Covered Entity any use or disclosure of Protected Health Information not provided for by this Agreement of which it becomes aware, including Breaches of Unsecured Protected Health Information as required at 45 CFR 164.410, and any Security Incident of which it becomes aware. Business Associate shall make such report without unreasonable delay and in no case later than five (5) calendar days after discovery. The report shall include, to the extent known: the nature of the incident, the Individuals affected, the Protected Health Information involved, and the mitigation steps taken;

4. In accordance with 45 CFR 164.502(e)(1)(ii) and 164.308(b)(2), ensure that any Subcontractors that create, receive, maintain, or transmit Protected Health Information on behalf of Business Associate agree in writing to the same restrictions, conditions, and requirements that apply to Business Associate with respect to such information. Business Associate’s current Subcontractors are identified in Exhibit A. Business Associate shall give Covered Entity written notice before Protected Health Information is first transmitted to any Subcontractor not listed in Exhibit A;

5. Make available Protected Health Information in a Designated Record Set to Covered Entity as necessary to satisfy Covered Entity’s obligations under 45 CFR 164.524, within ten (10) business days of a written request. Should an Individual submit such a request directly to Business Associate, Business Associate shall forward it to Covered Entity within five (5) business days and shall not respond directly;

6. Make any amendment(s) to Protected Health Information in a Designated Record Set as directed or agreed to by Covered Entity pursuant to 45 CFR 164.526, or take other measures as necessary to satisfy Covered Entity’s obligations under 45 CFR 164.526, within ten (10) business days of a written request;

7. Maintain and make available the information required to provide an accounting of disclosures to Covered Entity as necessary to satisfy Covered Entity’s obligations under 45 CFR 164.528, within ten (10) business days of a written request;

8. To the extent Business Associate is to carry out one or more of Covered Entity’s obligations under Subpart E of 45 CFR Part 164, comply with the requirements of Subpart E that apply to Covered Entity in the performance of such obligation(s); and

9. Make its internal practices, books, and records available to the Secretary for purposes of determining compliance with the HIPAA Rules.

3. Permitted Uses and Disclosures by Business Associate

1. Business Associate may use or disclose Protected Health Information only as necessary to perform the Services, which comprise:

1. Extracting treatment plan procedure and fee data from documents supplied by Covered Entity;
2. Extracting per-procedure insurance benefit amounts from insurance eligibility documents supplied by Covered Entity, when enabled by Covered Entity;
3. Organizing treatment plans into treatment options and rendering them, with plain-language descriptions, for presentation to Individuals, including on Covered Entity’s devices;
4. Capturing and storing Individual electronic signatures evidencing acceptance of a treatment plan, together with the date, time and network address recorded at signing (and the signing device’s details, when recorded), and recording an Individual’s decline of a treatment plan and any reason the Individual gives;
5. Generating treatment plan documents for Covered Entity’s records, and transmitting a copy to an Individual at the Individual’s request or at Covered Entity’s direction, which may include a time-limited link through which the Individual can view the plan;
6. Providing Covered Entity with practice-level analytics regarding case acceptance and production.

2. Business Associate may use or disclose Protected Health Information as Required By Law.

3. Business Associate agrees to make uses and disclosures and requests for Protected Health Information consistent with Covered Entity’s Minimum Necessary policies and procedures.

4. Business Associate may not use or disclose Protected Health Information in a manner that would violate Subpart E of 45 CFR Part 164 if done by Covered Entity, except for the specific uses and disclosures set forth in paragraphs (e) and (f) below.

5. Business Associate may use Protected Health Information for the proper management and administration of Business Associate or to carry out its legal responsibilities.

6. Business Associate may disclose Protected Health Information for the proper management and administration of Business Associate or to carry out its legal responsibilities, provided the disclosures are Required By Law, or Business Associate obtains reasonable assurances from the person to whom the information is disclosed that the information will remain confidential and be used or further disclosed only as Required By Law or for the purposes for which it was disclosed, and that the person will notify Business Associate of any instance of which it is aware in which the confidentiality of the information has been breached.

7. De-identified data. Business Associate may de-identify Protected Health Information in accordance with 45 CFR 164.514(a)-(c). De-identified information is not Protected Health Information and may be used by Business Associate for product improvement, benchmarking, and aggregate reporting, provided such information cannot reasonably be used to identify any Individual and is never re-identified.

8. Data aggregation. Business Associate may provide Data Aggregation services relating to the Health Care Operations of Covered Entity.

4. Obligations of Covered Entity

1. Covered Entity shall notify Business Associate of any limitation(s) in its Notice of Privacy Practices under 45 CFR 164.520, to the extent such limitation may affect Business Associate’s use or disclosure of Protected Health Information.

2. Covered Entity shall notify Business Associate of any changes in, or revocation of, an Individual’s permission to use or disclose his or her Protected Health Information, to the extent such change may affect Business Associate’s use or disclosure of Protected Health Information.

3. Covered Entity shall notify Business Associate of any restriction on the use or disclosure of Protected Health Information that Covered Entity has agreed to or is required to abide by under 45 CFR 164.522, to the extent such restriction may affect Business Associate’s use or disclosure of Protected Health Information.

4. Covered Entity shall not request Business Associate to use or disclose Protected Health Information in any manner that would not be permissible under Subpart E of 45 CFR Part 164 if done by Covered Entity, except as permitted under Sections 3(e), 3(f), and 3(g).

5. Covered Entity is responsible for the accuracy of the treatment plan and insurance information it supplies to the Services, for reviewing plans prior to presenting them to an Individual, and for controlling which of its personnel are given access to the Services.

5. Term and Termination

1. Term. This Agreement is effective as of the Effective Date and shall terminate when all Protected Health Information provided by Covered Entity to Business Associate, or created or received by Business Associate on behalf of Covered Entity, is returned or destroyed, or, if it is infeasible to return or destroy such information, protections are extended to it in accordance with paragraph (c).

2. Termination for Cause. Covered Entity may terminate this Agreement if it determines Business Associate has violated a material term of this Agreement and Business Associate has not cured the breach or ended the violation within thirty (30) days of written notice.

3. Obligations Upon Termination. Upon termination for any reason, Business Associate shall, with respect to Protected Health Information received from Covered Entity or created, maintained, or received on behalf of Covered Entity:

1. Retain only that Protected Health Information necessary for its proper management and administration or to carry out its legal responsibilities;
2. Return to Covered Entity, or, if agreed by Covered Entity, destroy, the remaining Protected Health Information that Business Associate still maintains in any form, within thirty (30) days, and provide written certification of such return or destruction;
3. Continue to use appropriate safeguards and comply with Subpart C of 45 CFR Part 164 with respect to electronic Protected Health Information for as long as Business Associate retains it;
4. Not use or disclose the retained Protected Health Information other than for the purposes for which it was retained, subject to the conditions in Sections 3(e) and 3(f); and
5. Return or destroy the retained Protected Health Information when it is no longer needed for those purposes.

4. Survival. The obligations of Business Associate under this Section survive termination of this Agreement.

6. Miscellaneous

1. Regulatory References. A reference in this Agreement to a section in the HIPAA Rules means the section as in effect or as amended.

2. Amendment. The Parties agree to take such action as is necessary to amend this Agreement from time to time as is necessary for compliance with the requirements of the HIPAA Rules and any other applicable law. Any amendment must be in writing and signed by both Parties.

3. Interpretation. Any ambiguity in this Agreement shall be interpreted to permit compliance with the HIPAA Rules.

4. Governing Law. This Agreement shall be governed by the laws of the State of California, without regard to conflict of law principles.

5. Relationship to Other Agreements. In the event of a conflict between this Agreement and any other agreement between the Parties, including Business Associate’s Terms of Service, the terms of this Agreement control with respect to Protected Health Information.

6. Indemnification / Limitation of Liability. This Agreement includes no indemnification or limitation-of-liability provisions; the Parties acknowledge these may be added by amendment on the advice of counsel.

7. Notices. Notices under this Agreement shall be in writing to the addresses above, or to such other address as a Party designates in writing. Notices to Business Associate may also be sent to support@gettreatpath.com.

8. Execution and Electronic Acceptance. This Agreement may be executed (i) by signature, in counterparts and by electronic signature, each of which is deemed an original, or (ii) by Covered Entity’s electronic acceptance in the Services — at account creation, checkout or activation — by an individual who represents that he or she has authority to bind Covered Entity. Electronic acceptance is Covered Entity’s signature to this Agreement for all purposes. Business Associate’s agreement to this Agreement is given by offering it for acceptance in the Services and by providing the Services under it, and binds Business Associate as if signed by it. Business Associate records with each acceptance the version accepted, the date and time, the account email, the practice name entered, and the network address from which it was given, and will provide Covered Entity a copy of this Agreement as accepted, countersigned by an officer of Business Associate, on request. If Covered Entity has both accepted this Agreement electronically and signed it, the later of the two governs under paragraph (i).

9. Prior Business Associate Agreements. This Agreement supersedes and replaces, as of the Effective Date, any earlier business associate agreement between the Parties relating to the Services, together with any amendment to it (a “Prior Agreement”). Protected Health Information received, created, maintained, or transmitted under a Prior Agreement is governed by this Agreement from the Effective Date. Replacement of a Prior Agreement by this Agreement is not a termination for purposes of Section 5(c) or of any corresponding provision of the Prior Agreement. Any obligation under a Prior Agreement arising from an event that occurred before the Effective Date, including an obligation to report a Breach or Security Incident, survives the replacement.

10. Updates to Exhibit A. Business Associate may update Exhibit A by written notice to Covered Entity, without an amendment under Section 6(b), to add or remove a Subcontractor or to change the description of a Subcontractor’s role, the Protected Health Information involved, or the written agreement in place. Notice of an added Subcontractor shall be given before Protected Health Information is first transmitted to it, as Section 2(d) requires. A notice under this paragraph may be given by email to the address Covered Entity uses to administer its account with the Services, and takes effect when sent. Covered Entity may object in writing within thirty (30) days after a notice is sent; if the Parties do not resolve the objection within thirty (30) days after Business Associate receives it, Covered Entity may terminate this Agreement by written notice, and Section 5(c) applies. This paragraph applies to Exhibit A only; any other change to this Agreement requires an amendment under Section 6(b).

Signatures

Where this Agreement is accepted electronically under Section 6(h), the acceptance record takes the place of the signature blocks below.

COVERED ENTITY

Practice: _______________________________________________

Signature: ______________________________ Date: ______________

Printed name: ____________________________________________

Title: __________________________________________________

BUSINESS ASSOCIATE — TreatPath Inc.

Signature: ______________________________ Date: ______________

Printed name: Ethan Chotiner

Title: President, TreatPath Inc.

EXHIBIT A — Subcontractors with Access to Protected Health Information

Business Associate uses the following Subcontractors in providing the Services. Business Associate represents that it has a written agreement with each imposing restrictions and conditions equivalent to those in this Agreement, and will give notice under Section 2(d) before any addition. Exhibit A may be updated by notice under Section 6(j).

Business Associate’s payment processor receives practice billing details only and no Protected Health Information; it is therefore not a Subcontractor under this Agreement. Where Covered Entity enables financing estimates, the financing provider Covered Entity uses receives treatment dollar amounts only, never a name or other identifier of an Individual, and is likewise not a Subcontractor. Business Associate’s error-monitoring service is configured to exclude request contents and variable values, and is verified not to receive Protected Health Information. Staff sign-in (Firebase Authentication) holds office staff accounts only and no Protected Health Information.

Source of model provisions: U.S. Department of Health and Human Services, Office for Civil Rights, “Sample Business Associate Agreement Provisions,” January 25, 2013. https://www.hhs.gov/hipaa/for-professionals/covered-entities/sample-business-associate-agreement-provisions/index.html