Business Associate Agreement

Reference version 2026-09-23

This Business Associate Agreement (the "Agreement") is entered into by and between the legal entity identified in Schedule A, Part 1 ("Covered Entity"), and RxRecon Pro LLC, a New Jersey limited liability company ("Business Associate"). Covered Entity and Business Associate may each be referred to as a "Party" and together as the "Parties." This Agreement is effective on the date Business Associate countersigns it, as recorded in the DocuSign completion certificate (the "Effective Date").

1. Purpose and relationship

1.1 Covered Entity is a pharmacy that is a covered entity under HIPAA. Covered Entity may disclose Protected Health Information ("PHI") to Business Associate, and Business Associate may create, receive, maintain, or transmit PHI on Covered Entity's behalf, solely to provide the RxRecon Pro pharmacy reconciliation, analytics, and related support services described in the Parties' subscription terms, order form, or other service agreement (the "Service Agreement") (the "Services").

1.2 The Parties intend this Agreement to satisfy the business associate contract requirements of 45 C.F.R. §§ 164.314(a) and 164.504(e) under the Health Insurance Portability and Accountability Act of 1996, the Health Information Technology for Economic and Clinical Health Act, and their implementing regulations at 45 C.F.R. Parts 160 and 164, including the Privacy, Security, Breach Notification, and Enforcement Rules, each as amended (collectively, "HIPAA").

1.3 Business Associate is an independent contractor and is not an agent of Covered Entity within the meaning of the federal common law of agency. Neither Party has authority to bind the other, and Covered Entity does not control the manner in which Business Associate performs the Services.

1.4 Conditional scope; no expansion of PHI handling. This Agreement does not represent that Business Associate routinely stores source reports or direct patient or prescriber identifiers, and it does not convert information that has been de-identified in accordance with 45 C.F.R. § 164.514 into PHI. This Agreement applies only to PHI, if any, that Business Associate creates, receives, maintains, or transmits on Covered Entity's behalf. It is intended as a protective, conditional framework for the Analytical Projection, Improper Submissions, support or legal-process events, and any other circumstance in which Business Associate may receive PHI. Properly de-identified information is outside the PHI-specific restrictions of this Agreement, except that Business Associate shall not attempt to re-identify it.

2. Definitions

2.1 Capitalized terms not defined in this Agreement, including Breach, Designated Record Set, Electronic Protected Health Information ("ePHI"), Individual, Minimum Necessary, Protected Health Information, Required by Law, Secretary, Security Incident, Subcontractor, Unsecured Protected Health Information, Use, and Disclosure, have the meanings given in 45 C.F.R. §§ 160.103, 164.304, 164.402, and 164.501. "PHI" in this Agreement means PHI that Business Associate creates, receives, maintains, or transmits on behalf of Covered Entity.

2.2 "Analytical Projection" means the versioned, allowlisted set of data elements that the Services transmit from the authorized user's browser to Business Associate's protected compute environment, as described in the Data Flow Description.

2.3 "Approved Channel" means a channel that Business Associate has expressly designated in writing (including in the Data Flow Description or the in-product documentation) as approved for PHI. The public Request Access form, Stripe checkout and billing pages, ordinary email, chat or support messages, and telephone are not Approved Channels.

2.4 "Approved Location" means a pharmacy location owned or operated by Covered Entity that Business Associate has verified and approved in writing for use of the Services, initially as listed in Schedule A.

2.5 "Browser-Local Data" means source reports, direct patient and prescriber identifiers, re-association data, and any other data that the Services are designed to process in the authorized user's browser without transmission to Business Associate's servers, as described in the Data Flow Description.

2.6 "Data Flow Description" means the description of the Services' data flows, Analytical Projection, and Approved Channels attached as Schedule B, as updated in accordance with Section 5.5.

2.7 "Discovery" of a Breach or Security Incident occurs on the first day on which it is known to Business Associate or, by exercising reasonable diligence, would have been known to Business Associate, consistent with 45 C.F.R. § 164.410(a)(2). Business Associate is deemed to have knowledge of an event known to any person, other than the person committing it, who is a workforce member or agent of Business Associate.

2.8 "Successful Security Incident" means a Security Incident that results in unauthorized access to, or unauthorized use, disclosure, modification, or destruction of, PHI or interference with system operations in an information system that contains PHI. "Unsuccessful Security Incident" means a Security Incident that does not, including pings and other broadcast attacks on firewalls, port scans, unsuccessful log-on attempts, denial-of-service attacks that do not result in a server being taken offline, and malware that is detected and quarantined before it accesses PHI.

3. Permitted uses and disclosures

3.1 Services. Business Associate may use and disclose PHI only as necessary to perform the Services, as otherwise permitted by this Agreement, or as Required by Law. Business Associate shall not use or disclose PHI in a manner that would violate Subpart E of 45 C.F.R. Part 164 if done by Covered Entity, except as expressly permitted for a business associate under Sections 3.2 and 3.3.

3.2 Management and administration. Business Associate may use PHI for its proper management and administration or to carry out its legal responsibilities. Business Associate may disclose PHI for those purposes only if the disclosure is Required by Law or Business Associate first obtains reasonable written assurances from the recipient that the PHI will be held confidentially, used or further disclosed only as Required by Law or for the purpose for which it was disclosed, and that the recipient will notify Business Associate of any instance of which it becomes aware in which the confidentiality of the PHI has been breached.

3.3 Data aggregation. Business Associate may provide data aggregation services relating to the health care operations of Covered Entity as permitted by 45 C.F.R. § 164.504(e)(2)(i)(B).

3.4 De-identification. Business Associate may de-identify PHI in accordance with 45 C.F.R. § 164.514(a)–(c). Information is not de-identified merely because direct names are omitted. Information that has been de-identified in accordance with this Section is not PHI, and Business Associate may use it for any lawful purpose, including improving, benchmarking, and developing the Services, provided that Business Associate shall not attempt to re-identify it and shall contractually prohibit any recipient from attempting to re-identify it.

3.5 Prohibited uses; de-identified information. To the extent Business Associate creates, receives, maintains, or transmits PHI, Business Associate shall not sell PHI, use or disclose PHI for marketing, or use or disclose PHI for any purpose other than the Services, this Agreement, or as Required by Law. This restriction does not prohibit use of information that has first been de-identified in accordance with Section 3.4, provided Business Associate does not attempt to re-identify it. Business Associate shall not use or disclose PHI in a manner inconsistent with a restriction or limitation of which Covered Entity has notified Business Associate under Section 6.1.

3.6 Minimum necessary. To the extent PHI is used, disclosed, or requested, Business Associate shall make reasonable efforts to limit the PHI to the Minimum Necessary to accomplish the intended purpose, consistent with 45 C.F.R. § 164.502(b) and applicable guidance. The local-processing and allowlisting controls in Schedule B are the Parties' current data-minimization design. Those controls do not, by themselves, establish HIPAA de-identification. If information is de-identified in accordance with Section 3.4 before Business Associate receives it, the HIPAA Minimum Necessary standard does not apply to that de-identified information.

3.7 Privacy Rule obligations carried out for Covered Entity. To the extent Business Associate carries out any of Covered Entity's obligations under Subpart E of 45 C.F.R. Part 164, Business Associate shall comply with the requirements of Subpart E that apply to Covered Entity in the performance of that obligation.

4. Business Associate obligations

4.1 Safeguards. Business Associate shall use appropriate administrative, physical, and technical safeguards, and shall comply with Subpart C of 45 C.F.R. Part 164 with respect to ePHI, to prevent uses or disclosures of PHI other than as provided for by this Agreement. Without limiting the foregoing, Business Associate shall: (a) encrypt PHI in transit using industry-standard protocols (TLS 1.2 or higher) and at rest; (b) require multi-factor authentication for Business Associate workforce access to production systems and administrative consoles that contain PHI; (c) maintain role-based access controls and audit logging for systems that contain PHI; (d) conduct and document an accurate and thorough risk analysis at least annually and upon material changes to the Services, and implement risk-management measures in response; (e) maintain vulnerability-management and patching practices; (f) maintain a documented incident-response plan and contingency plan; and (g) train its workforce on HIPAA and its policies before granting access to PHI and at least annually.

4.2 Incident reporting — initial notice. Business Associate shall notify Covered Entity, at the notice contacts in Schedule A, without unreasonable delay and in no event later than seventy-two (72) hours after Discovery of (a) any Breach of Unsecured PHI, or (b) any Successful Security Incident that Business Associate reasonably believes involves or is reasonably likely to involve Covered Entity's PHI. The initial notice may be preliminary and may state that an investigation is ongoing.

4.3 Incident reporting — full report. Business Associate shall provide a written report without unreasonable delay and in no event later than ten (10) calendar days after Discovery of any Breach of Unsecured PHI, any Successful Security Incident involving Covered Entity's PHI, and any use or disclosure of PHI not permitted by this Agreement. To the extent then known, the report shall include: the identification of each Individual whose Unsecured PHI has been, or is reasonably believed by Business Associate to have been, accessed, acquired, used, or disclosed; a description of what happened, including the date of the event and the date of Discovery; the types of PHI involved; the identity of any unauthorized person who used the PHI or to whom it was disclosed, if known; whether the PHI was actually acquired or viewed, if known; the extent to which risk has been mitigated; the steps Individuals should take to protect themselves; and corrective actions taken or planned. Business Associate shall supplement the report as additional information becomes available and shall provide any other information Covered Entity reasonably requires to satisfy 45 C.F.R. §§ 164.404 through 164.408. Nothing in this Agreement extends any deadline in 45 C.F.R. § 164.410.

4.4 Unsuccessful Security Incidents. The Parties acknowledge that Unsuccessful Security Incidents occur routinely. This Section 4.4 constitutes notice by Business Associate to Covered Entity of the ongoing existence and occurrence of Unsuccessful Security Incidents, and no further notice of them is required, provided that Business Associate shall provide a summary of Unsuccessful Security Incidents affecting systems containing Covered Entity's PHI upon Covered Entity's reasonable written request, no more often than once per calendar quarter.

4.5 Breach determination and notifications. Except as the Parties otherwise agree in writing for a particular incident, Covered Entity shall make the risk assessment under 45 C.F.R. § 164.402 and shall be responsible for notifications to Individuals, the Secretary, the media, and any state regulator. Business Associate shall not notify Individuals or regulators of a Breach involving Covered Entity's PHI without Covered Entity's prior written consent unless Required by Law. Business Associate shall provide cooperation required by HIPAA and commercially reasonable assistance with Covered Entity's investigation, risk assessment, mitigation, and legally required notifications. Business Associate has no obligation to advance funds or reimburse voluntary, enhanced, or non-required costs. Any responsibility for reasonable, documented, out-of-pocket costs of legally required notification must be established by a final non-appealable judgment or a written settlement signed by Business Associate and is subject to Section 12.3.

4.6 Mitigation. Business Associate shall mitigate, to the extent practicable, any harmful effect known to Business Associate of a use or disclosure of PHI by Business Associate, its workforce, or its Subcontractors in violation of this Agreement.

4.7 Workforce access. Business Associate shall limit PHI access to workforce members who require it for authorized duties, bind them to written confidentiality obligations, apply appropriate sanctions for violations, and terminate access promptly when no longer required.

4.8 Subcontractors. Business Associate shall not permit a Subcontractor to create, receive, maintain, or transmit PHI on Business Associate's behalf unless Business Associate first enters into a written business associate agreement with the Subcontractor that complies with 45 C.F.R. §§ 164.314(a) and 164.504(e) and imposes restrictions, conditions, and safeguards at least as protective of PHI as those in this Agreement. Business Associate remains responsible for its Subcontractors' performance. Infrastructure, hosting, database, and similar service providers that maintain or transmit PHI are Subcontractors for this purpose.

4.9 Designated Record Set; access and amendment. The Parties acknowledge that Covered Entity's pharmacy management system, not the Services, is the authoritative record of dispensing and patient information, and that Business Associate does not maintain PHI in a Designated Record Set as of the Effective Date. If Business Associate later maintains PHI in a Designated Record Set, it shall, within ten (10) business days after Covered Entity's request, make that PHI available to Covered Entity for access and amendment as necessary for Covered Entity to meet its obligations under 45 C.F.R. §§ 164.524 and 164.526, and shall incorporate any amendments Covered Entity directs.

4.10 Accounting of disclosures. Business Associate shall document disclosures of PHI, and information related to such disclosures, as would be required for Covered Entity to respond to a request for an accounting under 45 C.F.R. § 164.528, and shall provide that information to Covered Entity within ten (10) business days after request.

4.11 Requests received directly. If Business Associate receives a request from an Individual or a third party for access to, amendment of, an accounting of, or a restriction on PHI, or a subpoena, court order, or other legal demand for PHI, Business Associate shall forward it to Covered Entity within five (5) business days (or sooner if the demand requires) and, unless prohibited by law, shall not respond on the merits without Covered Entity's direction, except as Required by Law.

4.12 Secretary access. Business Associate shall make its internal practices, books, and records relating to the use and disclosure of PHI available to the Secretary for purposes of determining Covered Entity's and Business Associate's compliance with HIPAA.

4.13 Security documentation and assessment. Upon Covered Entity's reasonable written request, no more than once in any twelve (12) month period (and additionally following a Breach attributable to Business Associate), Business Associate shall provide (a) a summary of its then-current HIPAA security policies and safeguards, (b) any third-party security attestation or assessment report Business Associate then maintains (such as a SOC 2 Type II report or HIPAA security assessment), subject to confidentiality, and (c) written responses to a reasonable security questionnaire. On-site inspection is not required. Business Associate shall provide a written verification of its Security Rule safeguards at least annually if and when required by 45 C.F.R. § 164.308(b), as amended.

4.14 Data location. Business Associate shall store and process PHI only in data centers located in the United States and shall not permit remote access to PHI from outside the United States without Covered Entity's prior written consent.

4.15 Insurance. Business Associate shall periodically evaluate cyber liability, network security, and privacy liability insurance in light of its size, revenue, services, risk profile, contractual obligations, market availability, and cost. Business Associate shall maintain coverage, if any, that its authorized management determines is commercially reasonable and shall provide evidence of then-current coverage on reasonable written request. This Agreement does not impose a fixed minimum policy limit, require coverage that is unavailable on commercially reasonable terms, or make insurance the exclusive means of satisfying Business Associate's obligations under HIPAA.

4.16 Cooperation. Business Associate shall reasonably cooperate with Covered Entity's investigation, risk assessment, legally required notices, mitigation, and response concerning any Breach or Successful Security Incident involving Covered Entity's PHI.

5. Service-specific privacy model, safeguards, and limits

5.1 Local-processing design. The Services are designed so that supported source reports are parsed in the authorized user's browser; direct patient and prescriber identifiers and re-association data remain Browser-Local Data; and only the Analytical Projection, together with run-scoped opaque tokens that cannot be resolved to an Individual without Browser-Local Data, is transmitted to Business Associate's protected compute environment. Business Associate shall not intentionally receive, retain, or log Browser-Local Data through the hosted Services. The Data Flow Description sets out the data elements in the current Analytical Projection, the persistence (if any) of Browser-Local Data in browser storage, the Approved Channels.

5.2 Status of transmitted data. The Parties acknowledge that data elements in the Analytical Projection, alone or in combination with values controlled by Covered Entity, may constitute PHI. The local-processing design is a data-minimization safeguard and is not, by itself, a determination that any transmitted data is de-identified. Business Associate shall treat the Analytical Projection and all other data received from Covered Entity through the Services as PHI protected by this Agreement unless and until de-identified under Section 3.4.

5.3 Application code and telemetry. Business Associate is responsible for the security and integrity of the application code it delivers to the authorized user's browser, including protection against unauthorized modification in transit and in its hosting and build pipeline. Business Associate shall not deploy third-party analytics, advertising, session-replay, or similar tracking technologies on pages of the Services that process Browser-Local Data or the Analytical Projection except tools that are covered by a business associate agreement and configured not to capture PHI, and shall configure error-reporting and diagnostic logging to exclude Browser-Local Data.

5.4 Filenames and free-text. Business Associate shall design the Services so that source-report filenames are not transmitted to Business Associate's servers, or are transmitted only after sanitization to a generic or hashed value. Any free-text field within the Services that is transmitted to Business Associate's servers shall be either (a) designated in the Data Flow Description as an Approved Channel and protected as PHI, or (b) clearly labeled in the user interface as not for PHI.

5.5 Changes to the data flow. Business Associate may update the Data Flow Description from time to time. Business Associate shall give Covered Entity at least thirty (30) days' prior written notice, by email to the notice contacts in Schedule A and by in-product notice, before any change that (a) adds data elements to the Analytical Projection or (b) causes Browser-Local Data to be transmitted to or retained by Business Associate. Covered Entity may object in writing before the change takes effect; if the Parties cannot resolve the objection, Covered Entity may terminate the Services and this Agreement without penalty under Section 7. Changes that reduce the data transmitted or add protections require no advance notice.

5.6 Data-minimization and storage limitation. The hosted reconciliation workflow is designed so that uploaded source reports and direct patient and prescriber identifiers are processed in Covered Entity's authorized browser and are not intentionally stored on Business Associate's servers or in Supabase. Business Associate's protected compute service processes only the Analytical Projection described in Schedule B through the approved reconciliation workflow and is designed not to persist analytical request rows or analytical outputs after returning the response. Business Associate may retain account, authentication, entitlement, legal-acceptance, billing, minimum usage, pharmacy-identity-hash, opaque run-token, request-digest, and security or audit metadata as permitted by the Service Agreement, this Agreement, and applicable law. These safeguards reduce the volume and duration of regulated information handled by Business Associate, but do not by themselves establish that the Analytical Projection is de-identified under HIPAA, eliminate obligations applicable to PHI that Business Associate actually creates, receives, maintains, or transmits, or waive liability that cannot lawfully be limited.

5.7 Improper submissions. If PHI is submitted to Business Associate through a channel that is not an Approved Channel (an "Improper Submission"), whichever Party first becomes aware of it shall notify the other within two (2) business days. Business Associate shall, within ten (10) business days after becoming aware, delete or securely destroy the Improper Submission from all systems under its control to the extent feasible (including requesting deletion from any third-party service through which it was received), limit access to it in the interim, and confirm the deletion in writing. An Improper Submission caused solely by Covered Entity or its workforce is not a breach of this Agreement by Business Associate, but Business Associate shall still report it under Section 4.3 to the extent it constitutes a Breach of Unsecured PHI or Successful Security Incident.

6. Covered Entity obligations

6.1 Notice of limitations. Covered Entity shall notify Business Associate in writing of any limitation in its notice of privacy practices, any change in or revocation of an Individual's permission, and any restriction on use or disclosure agreed to under 45 C.F.R. § 164.522, in each case to the extent it may affect Business Associate's use or disclosure of PHI.

6.2 Permissible requests. Covered Entity shall not request Business Associate to use or disclose PHI in any manner that would not be permissible under Subpart E of 45 C.F.R. Part 164 if done by Covered Entity, except as permitted for a business associate under Section 3.

6.3 Authority and Minimum Necessary. Covered Entity is responsible for having lawful authority to disclose PHI to Business Associate, for applying the Minimum Necessary standard to the source reports and data it elects to process through the Services, for the accuracy of its source records, and for using only supported source reports as described in the Data Flow Description.

6.4 Endpoint and workforce security. Covered Entity is responsible for the security of its own devices, browsers, networks, pharmacy management and other source systems, and backups. Covered Entity shall maintain a HIPAA risk analysis and risk-management program; keep devices, browsers, and source systems patched and protected by current anti-malware controls; use unique user accounts for each authorized user, screen locks, and device encryption where reasonable and appropriate; enable multi-factor authentication for the Services where offered; train and sanction its workforce; and disable access promptly when a user is no longer authorized.

6.5 Credentials and Approved Locations. Covered Entity shall use the Services only for Approved Locations, shall not share credentials among users, and shall not submit source reports or other information belonging to a different legal entity or an unapproved pharmacy location.

6.6 Approved Channels; Browser-Local Data. Covered Entity shall submit PHI to Business Associate only through Approved Channels and shall not place PHI in the public Request Access form, Stripe checkout or billing fields, ordinary email, support or chat messages, or any free-text field labeled as not for PHI. Covered Entity is responsible for Browser-Local Data and PHI stored, retained, downloaded, exported, printed, copied, displayed, photographed, or otherwise exposed through its devices, browsers, credentials, source systems, networks, workforce practices, screenshots, clipboard, or local storage, except to the extent an incident is caused by Business Associate's breach of this Agreement or violation of applicable law. Covered Entity shall apply its own safeguards and retention policies to that information.

6.7 Reporting by Covered Entity. Covered Entity shall notify Business Associate at the notice contacts in Section 12.7 without unreasonable delay and in no event later than twenty-four (24) hours after discovering suspected compromise of credentials for the Services or unauthorized access to the Services, and within two (2) business days after discovering an Improper Submission, and shall preserve relevant evidence and reasonably cooperate with containment.

6.8 Retained responsibilities. Covered Entity remains responsible for clinical and professional judgment, its authoritative records, its own obligations under HIPAA and applicable pharmacy law, legal notices to Individuals and regulators except where law or this Agreement assigns a duty to Business Associate, and the acts and omissions of its workforce and agents. Business Associate is not responsible for a Security Incident, Breach, or impermissible use or disclosure to the extent caused by Covered Entity's systems, devices, credentials, instructions, workforce, or failure to perform its obligations under this Agreement, except to the extent Business Associate caused or contributed to it.

7. Term, termination, and cure

7.1 Term. This Agreement begins on the Effective Date and continues until the later of (a) termination or expiration of the Service Agreement and (b) the return or destruction of all PHI in accordance with Section 8. If return or destruction is infeasible, the protections of this Agreement continue to apply to retained PHI for as long as it is retained.

7.2 Termination for cause. If either Party determines that the other Party has violated a material term of this Agreement, it shall give written notice describing the violation. The non-breaching Party may (a) allow the breaching Party a reasonable cure period of not more than thirty (30) days and terminate this Agreement and the affected Services if cure is not completed in that time, or (b) if cure is not possible, terminate this Agreement and the affected Services immediately upon written notice. Neither Party is required to offer a cure period where the violation poses an imminent risk to PHI or is a repeat violation.

7.3 Suspension. Business Associate may immediately suspend access to the Services, in whole or in part, when reasonably necessary to prevent or contain unauthorized use or disclosure of PHI or a security risk, and shall notify Covered Entity promptly of the suspension and its reasons.

7.4 Reporting to the Secretary. Nothing in this Agreement requires a Party to report the other Party to the Secretary; each Party shall make any report Required by Law.

7.5 Survival. Sections 3, 4.5, 4.6, 4.10 through 4.12, 8, 10, and 12, and any other provision that by its nature should survive, survive termination or expiration of this Agreement.

7.6 Single-location license; unauthorized multi-location use. Each subscription, administrator login, and production access authorization is limited to the single physical pharmacy location identified in Schedule A, Part 2, unless Business Associate expressly approves a separate location in a separate written order, subscription, and pharmacy-specific BAA or amendment. Covered Entity shall not use one location's credentials, entitlement, or files for another pharmacy location and shall not share credentials. Unauthorized multi-location use is a material breach. Business Associate may immediately suspend affected access, preserve relevant records, require the additional location to complete verification and separate contracting, recover only fees expressly stated in the applicable Service Agreement and permitted by law, and terminate the affected Services under Section 7.2. No unspecified penalty, liquidated damages, or punitive charge is created by this Section.

8. Return or destruction of PHI

8.1 Return or destruction. Within thirty (30) days after termination or expiration of this Agreement or the Service Agreement, or after Covered Entity's earlier written request with respect to PHI no longer needed for the Services, Business Associate shall, at Covered Entity's election communicated in writing, return or securely destroy all PHI in its possession or in the possession of its Subcontractors, and retain no copies, except as provided in Section 8.2. Destruction shall be performed in accordance with NIST Special Publication 800-88 (Guidelines for Media Sanitization) or a successor standard, and Business Associate shall certify completion in writing on request. If Covered Entity makes no election, Business Associate shall destroy the PHI.

8.2 Infeasibility; backups. If return or destruction of particular PHI is infeasible, Business Associate shall notify Covered Entity in writing of the conditions that make it infeasible, extend the protections of this Agreement to that PHI, and limit further uses and disclosures to those purposes that make return or destruction infeasible, for so long as Business Associate maintains the PHI. PHI remaining in encrypted backups shall not be restored except for disaster recovery or as Required by Law and shall be overwritten or destroyed in the ordinary secure backup lifecycle, which shall not exceed ninety (90) days after the destruction date under Section 8.1.

8.3 Records Business Associate may retain. Business Associate may retain account, entitlement, authentication, security and audit-log, legal-acceptance, billing, and minimum usage records that are not PHI, and de-identified data under Section 3.4, after termination.

8.4 Browser-Local Data. Return or destruction of Browser-Local Data and any PHI on Covered Entity's devices or in its downloads, exports, or browser storage is Covered Entity's responsibility.

9. Approved and future locations

9.1 One approved physical location. This Agreement, the associated subscription, and each administrator login apply only to the single Approved Location identified in Schedule A, Part 2. Common ownership, affiliation, shared management, or use of the same pharmacy management system does not authorize another location to use the Services.

9.2 Additional locations and entities. Each additional physical pharmacy location requires a separate access request, pharmacy verification, subscription or written order, administrator authorization, and a pharmacy-specific BAA or written amendment approved by Business Associate before access or PHI use. A location owned or operated by a different corporation, limited liability company, or other legal entity must execute its own BAA; common ownership alone is insufficient.

9.3 Changes. Covered Entity shall notify Business Associate in writing within ten (10) business days after any change of ownership, legal name, entity type, NPI, NCPDP Provider ID, permit or license, physical address, authorized administrator, closure, or sale of the Approved Location. Business Associate may require reverification, a new Service Agreement, or a new BAA before continued production access.

10. Documentation retention

10.1 Each Party shall retain this Agreement, its schedules and amendments, execution evidence (including the DocuSign completion certificate and envelope identifier), and the policies, procedures, and other documentation required by 45 C.F.R. §§ 164.316(b) and 164.530(j), in written or electronic form, for at least six (6) years from the date of its creation or the date when it last was in effect, whichever is later, and longer where required by applicable New Jersey or other law, contractual duty, or legal hold.

11. Execution and activation

11.1 Verification. Before sending this Agreement for signature, Business Associate verifies the Covered Entity legal entity, the Approved Location, and the identity and authority of the signer using information supplied in Schedule A and reasonable public sources (including NPPES, the New Jersey Board of Pharmacy or other state licensing records, and state business-entity records).

11.2 Signing sequence. Business Associate sends the pharmacy-specific Agreement, including a completed Schedule A and the then-current Schedule B, through DocuSign to the signer email in Schedule A. Covered Entity signs first. Business Associate countersigns only after confirming the signer, legal entity, Approved Location, and agreement version. The DocuSign completion certificate and envelope identifier form part of the execution record.

11.3 Effectiveness and activation. This Agreement becomes binding on the Effective Date. Business Associate shall not accept payment for, provision, issue invitations for, or permit PHI use of the Services for an Approved Location before the fully executed envelope is recorded and Business Associate has verified the completion evidence. Business Associate separately confirms in writing when each Approved Location is activated for production PHI use. Any evaluation or demonstration before activation shall use only synthetic or de-identified data.

11.4 Authority. Each person signing this Agreement represents that he or she is duly authorized to bind the Party on whose behalf he or she signs, and Covered Entity represents that the information in Schedule A is accurate and complete.

11.5 Reference copy. Any reference or sample version of this Agreement published by Business Associate is provided for information only, is not an offer, and creates no agreement. Only the pharmacy-specific DocuSign envelope completed by both Parties is a binding agreement, and in the event of any difference the executed envelope controls.

12. General provisions

12.1 Third-party claims and regulatory matters. Subject to Section 12.3 and to the extent permitted by law, each Party is responsible for third-party claims, regulatory fines, penalties, assessments, and legally required notification costs only to the extent caused by that Party's breach of this Agreement or violation of applicable law and finally determined by a court or regulator of competent jurisdiction, or agreed in a written settlement signed by the responsible Party. Neither Party has a duty under this Agreement to advance defense costs, make an admission, or accept a settlement without its written consent. No settlement may impose non-monetary obligations or admissions on the other Party without that Party's prior written consent.

12.2 Compliance with state law. Each Party shall comply with New Jersey and other applicable state laws governing the confidentiality, security, breach notification, and disposal of personal and health information, including N.J.S.A. 56:8-161 through 56:8-166 (breach notification and records disposal) and N.J.S.A. 45:14-40 et seq. (Pharmacy Practice Act) and its regulations, to the extent applicable to that Party. Where a state law requires notification of a security breach of personal information that is also PHI and imposes a shorter deadline or additional content than HIPAA, Business Associate shall notify Covered Entity in time for Covered Entity to comply. Business Associate's obligations under this Agreement apply to PHI regardless of whether the New Jersey Data Privacy Act (N.J.S.A. 56:8-166.4 et seq.) or another comprehensive state privacy law exempts it.

12.3 Limitation of liability; no compensation commitment. TO THE MAXIMUM EXTENT PERMITTED BY LAW, BUSINESS ASSOCIATE'S TOTAL AGGREGATE LIABILITY ARISING OUT OF OR RELATING TO THIS AGREEMENT, THE SERVICES, OR ANY INCIDENT AFFECTING THE APPROVED LOCATION SHALL NOT EXCEED THE TOTAL FEES ACTUALLY PAID BY COVERED ENTITY TO BUSINESS ASSOCIATE FOR THAT APPROVED LOCATION DURING THE TWELVE (12) MONTHS IMMEDIATELY PRECEDING THE EVENT GIVING RISE TO THE CLAIM. NEITHER PARTY SHALL BE LIABLE FOR INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, OR PUNITIVE DAMAGES, OR FOR LOST PROFITS, REVENUE, BUSINESS, DATA, OR GOODWILL. This Agreement does not create a service-level guarantee, uptime commitment, refund, credit, liquidated damages, penalty, reimbursement, or other compensation obligation. No employee, contractor, email, support communication, or oral statement may bind Business Associate to any payment or compensation; any such commitment must be in a separate written instrument signed by an authorized manager of RxRecon Pro LLC. The limitations in this Section apply to Section 4.5 and Section 12.1. They do not limit Covered Entity's obligation to pay fees due, liability that cannot lawfully be limited, or liability for a Party's fraud or willful misconduct as finally determined by a court of competent jurisdiction.

12.4 Regulatory references; amendment for changes in law. References to HIPAA and other laws mean those provisions as amended and in effect from time to time. The Parties shall amend this Agreement as necessary to comply with changes in applicable law. If Business Associate proposes an amendment reasonably required for compliance and Covered Entity does not sign it within thirty (30) days after receipt, either Party may terminate this Agreement and the Services on written notice.

12.5 Interpretation; precedence. Any ambiguity in this Agreement shall be resolved to permit compliance with HIPAA. This Agreement controls over the Service Agreement, any terms of service, privacy notice, order form, or online click-through terms with respect to the privacy and security of PHI. Headings are for convenience only.

12.6 Governing law; venue. This Agreement is governed by the laws of the State of New Jersey without regard to its conflict-of-laws principles, except to the extent federal law controls. The Parties submit to the exclusive jurisdiction of the state and federal courts located in Middlesex County, New Jersey and the District of New Jersey for any action arising out of this Agreement, provided that either Party may seek injunctive relief in any court of competent jurisdiction to protect PHI.

12.7 Notices. Notices under this Agreement shall be in writing and delivered by email with confirmation of transmission, by nationally recognized overnight courier, or by certified mail, and are effective on receipt. Notices to Business Associate: RxRecon Pro LLC, Attn: Privacy and Security Officer, 301 Plainfield Road, Edison, NJ 08820; email: admin@rxreconpro.com. Notices to Covered Entity: the notice address and email in Schedule A, with incident notices under Section 4.2 also sent to the incident contact in Schedule A. A Party may change its notice information by written notice to the other Party, and Covered Entity may update its Schedule A contacts through the Services' account settings.

12.8 Entire agreement; amendments; waiver. This Agreement, including its Schedules, constitutes the entire agreement of the Parties concerning their HIPAA business associate relationship and supersedes any prior business associate agreement between them for the Services. Amendments must be in writing and signed by authorized representatives of both Parties, except that (a) Schedule B may be updated by Business Associate under Section 5.5, and (b) Schedule A contact information that does not change the Covered Entity legal entity or Approved Location may be updated under Section 12.7. No additional location is approved without the separate process required by Sections 7.6 and 9.2. No waiver is effective unless in writing.

12.9 No third-party beneficiaries. This Agreement creates no rights in any person other than the Parties and their permitted successors and assigns, except as applicable law requires.

12.10 Assignment. Neither Party may assign this Agreement without the other Party's written consent, except to a successor in a merger, acquisition, or sale of substantially all of the assets of its business to which this Agreement relates, provided the successor assumes this Agreement in writing.

12.11 Severability. If any provision of this Agreement is held invalid or unenforceable, the remaining provisions remain in effect and the Parties shall replace the invalid provision with a valid one that most nearly achieves its intent and HIPAA compliance.

12.12 Electronic signatures; counterparts. This Agreement may be executed electronically and in counterparts, each of which is an original and all of which together constitute one instrument, in accordance with the federal Electronic Signatures in Global and National Commerce Act and the New Jersey Uniform Electronic Transactions Act (N.J.S.A. 12A:12-1 et seq.). The completed DocuSign certificate and envelope record form part of the execution evidence.

IN WITNESS WHEREOF, the Parties have executed this Agreement through DocuSign as of the dates indicated below.

Schedule A — Covered Entity, Contacts, and Approved Locations

Part 1. Covered Entity — completed by Covered Entity; reviewed and verified by RxRecon Pro before signature

Part 2. Single Initially Approved Pharmacy Location — completed by Covered Entity; reviewed and verified by RxRecon Pro before signature

Covered Entity completes both parts of this Schedule and submits the information for RxRecon Pro's independent verification before the DocuSign envelope is created. RxRecon Pro reviews the entries against the access request and available verification records and may request corrections or supporting information. Part 1 identifies the legal entity entering the BAA. Part 2 identifies the one physical pharmacy location licensed and approved under this Agreement. Covered Entity must review the final populated Schedule before signing. No required entry may remain blank in an executed envelope; an optional item must be marked ‘Not applicable’ or ‘Declined.’

Only the single location listed in Part 2 is approved. Any additional physical pharmacy location requires the separate verification, subscription, access, and BAA process in Sections 7.6 and 9.2. Business Associate's verification is for onboarding and does not relieve Covered Entity of its representation in Section 11.4.

Schedule B — Data Flow Description

Version: B-4, 2026-09-23. Business Associate may update this Schedule under Section 5.5. This Schedule describes the verified application design as of this version. Production PHI use remains prohibited until the applicable security and operational prerequisites are satisfied and documented.

1. Processing model

Supported source reports are parsed in the authorized user's browser. Direct patient identifiers, prescriber identifiers, re-association data, and selected source files are Browser-Local Data held in volatile browser memory and the browser's live file-input objects; the Services do not intentionally place them in localStorage, sessionStorage, or IndexedDB. They are cleared when the page is closed or reloaded, except for files or exports the user separately saves on the Covered Entity's device. No Browser-Local Data is transmitted to Business Associate's servers. Only the Analytical Projection described in Part 2, together with run-scoped opaque tokens generated in the browser, is transmitted.

2. Analytical Projection (allowlisted elements)

Elements expressly excluded from transmission: patient name, address, date of birth, phone, email, SSN, member ID, prescription number, prescriber name, prescriber NPI/DEA, source-report filenames, and free text entered by users, except as listed above.

3. Retention of Analytical Projection data

The protected compute service processes Analytical Projection data transiently for the duration of the request and does not intentionally persist request rows or analytical outputs after returning the response. Supabase retains the minimum account, entitlement, legal-acceptance, pharmacy-identity-hash, opaque run-token, request-digest, usage timestamp, and security/audit metadata needed for authorization, metering, evidence, and security. Security and audit logs must be configured to exclude request bodies, source-report filenames, Browser-Local Data, and analytical outputs, and are retained under RxRecon Pro LLC's documented retention schedule.

4. Approved Channels for PHI

The authenticated RxRecon Pro web application at https://rxreconpro.com/app/ (report upload and reconciliation workspace) is the Approved Channel for the data elements expressly listed in Part 2. All other channels, including the Request Access form, Stripe checkout and billing, email (including transactional email), support and chat, and telephone, are not Approved Channels.