Business Associate Agreement

Parties

This Business Associate Agreement ("Agreement") is entered into between:

• "Covered Entity" - The individual or organization using ParrotPadMD services who is subject to HIPAA regulations
• "Business Associate" - Problem Solver Software LLC, a company organized under the laws of the State of Oregon, doing business as ParrotPadMD

1. Definitions

For purposes of this Agreement, the following terms shall have the meanings set forth below:

1.1 "HIPAA"

The Health Insurance Portability and Accountability Act of 1996, as amended, and its implementing regulations at 45 CFR Parts 160-164.

1.2 "Protected Health Information" (PHI)

Individually identifiable health information that is transmitted or maintained in any form or medium, as defined in 45 CFR § 160.103.

1.3 "Electronic Protected Health Information" (ePHI)

Protected Health Information that is transmitted or maintained in electronic media, as defined in 45 CFR § 160.103.

1.4 "Services"

The voice-to-text transcription services provided by Business Associate through the ParrotPadMD browser extension and related systems.

1.5 "Security Incident"

The attempted or successful unauthorized access, use, disclosure, modification, or destruction of information or interference with system operations in an information system, as defined in 45 CFR § 164.304.

2. Obligations of Business Associate

2.1 Permitted Uses and Disclosures

Business Associate shall not use or disclose PHI other than as permitted or required by this Agreement or as Required by Law.

2.2 Appropriate Safeguards

Business Associate shall implement appropriate administrative, physical, and technical safeguards to prevent unauthorized use or disclosure of PHI, including:

• Processing dictation audio in memory only, with immediate deletion after transcription. Visit recordings are stored encrypted only until transcription completes, and are then deleted, as described in Section 5.1
• Not storing text dictated into Covered Entity's application at the cursor. Notes Covered Entity writes or dictates in the Scratchpad, visit transcripts, and the clinical notes generated from them are stored encrypted in Covered Entity's account until Covered Entity deletes them or the retention period Covered Entity chooses ends, as described in Section 5.2
• TLS encryption for all data in transit
• SOC 2 Type II compliant cloud infrastructure (Google Cloud Platform)
• No training of AI models on PHI

2.3 Reporting

Business Associate shall report to Covered Entity any use or disclosure of PHI not provided for by this Agreement, including any Security Incident or Breach, within seventy-two (72) hours of becoming aware of such incident.

2.4 Subcontractors

Business Associate shall ensure that any subcontractors that create, receive, maintain, or transmit PHI on behalf of Business Associate agree to the same restrictions and conditions that apply to Business Associate under this Agreement. Business Associate's current subcontractors include:

• Google Cloud Platform (infrastructure, authentication via Identity Platform, and speech-to-text services) - BAA in place
• AssemblyAI, Inc. (speech-to-text services) - BAA in place
• Stripe, Inc. (payment processing) - No PHI shared

2.5 Access to PHI

Business Associate shall make available PHI in accordance with 45 CFR § 164.524 to the extent Business Associate maintains such PHI. Dictation at the cursor: Business Associate does not store text dictated into Covered Entity's application and therefore cannot provide access to it. Scratchpad notes and encounter recordings: saved Scratchpad notes, visit transcripts, and any clinical notes generated from them are stored in Covered Entity's account and are available to Covered Entity through the Services, where Covered Entity may copy or delete them. Access to stored PHI requires a sign-in within the preceding twelve hours, which is a security control rather than a limit on availability, and signing in again restores access immediately.

2.6 Amendment of PHI

Business Associate shall make any amendment(s) to PHI as directed by Covered Entity pursuant to 45 CFR § 164.526, to the extent Business Associate maintains such PHI.

2.7 Accounting of Disclosures

Business Associate shall document and make available information required to provide an accounting of disclosures in accordance with 45 CFR § 164.528. Business Associate records every access to stored PHI, including the principal, the record and the time, and retains those records for six years. That record commenced on September 13, 2026, and no equivalent record exists for access before that date. On written request to the address in Section 6.5, Business Associate will provide the relevant extract within thirty days. Business Associate makes no disclosure of PHI except to the subprocessors listed in Section 2.4 for the purpose of providing the Services, and as required by law under Section 2.8.

2.8 Government Access

Business Associate shall make its internal practices, books, and records relating to the use and disclosure of PHI available to the Secretary of the U.S. Department of Health and Human Services for purposes of determining compliance with HIPAA.

3. Obligations of Covered Entity

3.1 Permissions

Covered Entity shall obtain any consent, authorization, or permission that may be required under applicable law prior to furnishing PHI to Business Associate.

3.2 Notice of Privacy Practices

Covered Entity shall notify Business Associate of any limitations in its Notice of Privacy Practices that may affect Business Associate's use or disclosure of PHI.

3.3 Restrictions

Covered Entity shall notify Business Associate of any restriction on the use or disclosure of PHI that Covered Entity has agreed to in accordance with 45 CFR § 164.522.

4. Term and Termination

4.1 Term

This Agreement shall be effective as of the date Covered Entity accepts these terms and shall remain in effect until terminated as provided herein.

4.2 Termination for Cause

Either party may terminate this Agreement if the other party materially breaches any provision of this Agreement and fails to cure such breach within thirty (30) days of receiving written notice of the breach.

4.3 Effect of Termination

Upon termination of this Agreement, Business Associate shall return or destroy all PHI received from Covered Entity. In practice: Covered Entity may delete any saved Scratchpad note, visit transcript or clinical note in the Services at any time, and may delete the account and all PHI within it from the account page at any time. On written request to the address in Section 6.5, Business Associate will do the same within thirty days, following the documented procedure Business Associate maintains for that purpose. Two copies outlive that deletion and cannot be reached by it. Provider backups and point-in-time recovery hold a deleted record for up to seven days before they age out on their own. A transcript held by the transcription subprocessor is deleted on the schedule set in that subprocessor's account. For both, Business Associate extends the protections of this Agreement to those copies until they are gone, which is the treatment this Section requires where destruction is not immediately feasible.

5. Data Processing Details

For transparency, Business Associate provides the following details about how the Services process PHI:

5.1 Audio Processing

• Audio is captured by the browser extension on Covered Entity's device
• Audio is transmitted via TLS-encrypted connections to our speech-to-text providers (AssemblyAI and Google Cloud Speech-to-Text)
• Dictation audio is processed in memory and immediately discarded after transcription; no dictation audio is stored on any Business Associate systems
• Encounter (visit) recordings are uploaded to encrypted object storage, are read once by the transcription subprocessor, and are deleted on every path that ends the recording's processing. A storage lifecycle rule removing any object older than one day operates as a second measure
• A deleted recording is removed permanently. The storage provider keeps no recoverable copy

5.2 Transcription Output

• Transcribed text is returned directly to the browser extension
• Text is inserted into Covered Entity's application at the cursor position
• Business Associate does not store, log, or retain text dictated into Covered Entity's application at the cursor
• Notes Covered Entity writes or dictates in the Scratchpad are saved encrypted in Covered Entity's account as they change, so that they can be opened on another device, until Covered Entity deletes them
• Encounter transcripts and the clinical notes generated from them are stored encrypted in Covered Entity's account until Covered Entity deletes them or the account is closed. Business Associate does not use them or saved Scratchpad notes for any purpose other than providing the Services
• Covered Entity may choose to have stored transcripts, clinical notes and Scratchpad notes deleted automatically once 30 or 90 days have passed since they were created or, for Scratchpad notes, last changed. Deletion completes within about two days after that point. The default keeps them until Covered Entity deletes them
• A deleted transcript or note remains present in provider backups and point-in-time recovery for up to seven days, after which those copies age out

5.3 Usage Data

• Business Associate records one usage entry per request, holding the duration, the language, the specialty selected, the subscription tier, the originating IP address and the browser user agent. It never holds dictated text, transcript text or note content
• No PHI is included in usage tracking or analytics, and no analytics or advertising script runs on any page that displays stored PHI

6. Miscellaneous

6.1 Amendment

The parties agree to take such action as is necessary to amend this Agreement from time to time as is necessary for compliance with HIPAA and other applicable law.

6.2 Survival

The obligations of Business Associate under Sections 2 and 4.3 shall survive the termination of this Agreement.

6.3 Interpretation

Any ambiguity in this Agreement shall be interpreted to permit compliance with HIPAA.

6.4 Governing Law

This Agreement shall be governed by the laws of the State of Oregon, without regard to its conflict of laws provisions, except to the extent preempted by federal law.

6.5 Contact Information

For questions about this Agreement or to report a security incident:

7. Acceptance

By clicking "Accept and Continue" in the ParrotPadMD application, Covered Entity acknowledges that they have read, understood, and agree to be bound by the terms of this Business Associate Agreement.

Electronic acceptance of this Agreement shall have the same legal effect as a physical signature.