⚠ DRAFT — PENDING COUNSEL REVIEW

This Business Associate Agreement has been drafted by Aarya Innovations

LLC based on HHS sample provisions (45 CFR § 164.504(e)) and standard

healthcare-SaaS practices. It has not yet been reviewed by an attorney.

By accepting this draft, you acknowledge it is an interim version that

will be replaced with a counsel-reviewed final version when one is

available. You will be asked to re-accept the final version at that

time.

Business Associate Agreement

Effective date: the date you accept this Agreement through the Vaidya portal.

Parties:

• Business Associate: Aarya Innovations LLC, a Nevada limited liability company doing business as Vaidya ("Vaidya", "Business Associate", "we").
• Covered Entity: You, on behalf of the entity (medical practice, hospital, or other HIPAA-covered organization) you represent ("Customer", "Covered Entity", "you").

1. Background

Customer is a Covered Entity under the Health Insurance Portability and Accountability Act of 1996, as amended ("HIPAA"). Customer has engaged Vaidya to provide medical records review and analysis services (the "Services") under Vaidya's Terms of Service.

In the course of providing the Services, Vaidya will receive, store, and process Protected Health Information ("PHI") on Customer's behalf, making Vaidya a Business Associate as defined at 45 CFR § 160.103.

This Business Associate Agreement ("BAA") sets forth the terms under which Vaidya will handle PHI. In the event of any conflict between this BAA and the Terms of Service, this BAA controls with respect to PHI.

2. Definitions

Capitalized terms used but not defined in this BAA have the meanings set forth in 45 CFR Parts 160 and 164. The following additional definitions apply:

• "PHI Input Materials" means the medical records, billing records, imaging reports, and other documents containing PHI that Customer uploads to the Vaidya portal for processing.

• "Operational Metadata" means audit logs, system access records, case-level metadata (such as case identifiers, timestamps, and status events), and other administrative records that Vaidya generates and retains to maintain the security, integrity, and auditability of the Services in compliance with the HIPAA Security Rule.

• "Report Output" means the analyses, summaries, and reports that Vaidya generates and delivers to Customer in connection with the Services.

3. Permitted Uses and Disclosures

3.1 Use and disclosure for the Services

Vaidya may use and disclose PHI only as necessary to perform the Services for Customer, as further described in the Terms of Service, or as Required by Law.

3.2 Specific permitted activities

Without limiting the foregoing, Vaidya may:

• Process PHI Input Materials through automated and AI-assisted analysis pipelines to generate Report Output
• Disclose PHI to Vaidya's subcontractors as listed in Section 7, subject to written agreements requiring HIPAA-equivalent protections
• Use PHI for the proper management and administration of Vaidya's own operations, including security monitoring and quality assurance, as permitted by 45 CFR § 164.504(e)(4)
• Aggregate de-identified data derived from PHI in accordance with 45 CFR § 164.514 for purposes of improving the Services, provided that such data cannot be re-identified

3.3 Activities not permitted

Vaidya will not:

• Sell PHI or use it for marketing
• Use PHI to train machine learning models that benefit other customers or third parties, except where the data has been de-identified in accordance with 45 CFR § 164.514
• Disclose PHI to third parties except as permitted in this BAA or Required by Law
• Use or disclose PHI in any manner that would violate HIPAA if done by Customer

4. Safeguards

Vaidya will implement administrative, physical, and technical safeguards in compliance with the HIPAA Security Rule (45 CFR Part 164, Subpart C) to protect the confidentiality, integrity, and availability of PHI. These safeguards include, at a minimum:

• Encryption in transit using TLS 1.2 or higher for all data transmitted between Customer's systems and the Vaidya portal
• Encryption at rest using AES-256 for PHI stored in Vaidya's cloud infrastructure
• Access controls limiting PHI access to authorized Vaidya personnel under written confidentiality obligations, with role-based access enforced at the application and infrastructure layers
• Audit logging of all PHI access events sufficient to satisfy 45 CFR § 164.312(b)
• Workforce training on HIPAA Privacy and Security Rule requirements for all personnel with access to PHI
• Vulnerability management including regular security updates and dependency monitoring

5. Breach Notification

5.1 Notification timing

Vaidya will notify Customer of any Breach of Unsecured PHI involving Customer's data without unreasonable delay, and in no case later than sixty (60) calendar days after Vaidya's discovery of the Breach, in accordance with 45 CFR §§ 164.410 and 164.412.

5.2 Content of notice

Each breach notice will include, to the extent then known to Vaidya:

• A description of what occurred, including the date of the Breach and the date of discovery
• The types of Unsecured PHI involved
• Steps Customer should take to protect themselves from potential harm
• Steps Vaidya is taking to investigate, mitigate, and prevent recurrence
• Contact information for Customer's HIPAA Privacy Officer to obtain additional information

5.3 Security incidents

Vaidya will report to Customer any Security Incident (as defined at 45 CFR § 164.304) of which it becomes aware. Unsuccessful security incidents (e.g., pings, port scans, denial-of-service attempts that do not result in unauthorized access) are reported in aggregate on request rather than individually.

6. Customer Rights

6.1 Access

Within fifteen (15) business days of a written request from Customer, Vaidya will make available PHI in its possession in a Designated Record Set as necessary to enable Customer to respond to an Individual's request for access under 45 CFR § 164.524.

6.2 Amendment

Vaidya will make available PHI in its possession to enable Customer to respond to an Individual's request for amendment under 45 CFR § 164.526, and will incorporate amendments as directed by Customer.

6.3 Accounting of disclosures

Vaidya will document and provide an accounting of disclosures of PHI as required by 45 CFR § 164.528. Disclosures of PHI for treatment, payment, or healthcare operations purposes, and disclosures made to the Individual or their personal representative, are not required to be included in the accounting.

6.4 Inspection

Vaidya will make its internal practices, books, and records relating to its use and disclosure of PHI available to the Secretary of Health and Human Services for purposes of determining Customer's compliance with HIPAA.

7. Subcontractors

7.1 Use of subcontractors

Vaidya uses the following subcontractors in providing the Services as of the Effective Date:

• Amazon Web Services, Inc. — cloud hosting, storage, and database infrastructure. Vaidya has a Business Associate Agreement in place with AWS.
• Anthropic, PBC — AI model inference for medical records analysis. Subject to HIPAA-equivalent terms.
• OpenAI, L.L.C. — AI model inference for certain analysis tasks. Subject to HIPAA-equivalent terms.
• Stripe, Inc. — payment processing. Stripe does not receive PHI. Stripe receives only opaque case identifiers and dollar amounts.

7.2 Subcontractor flow-down

Vaidya will require any subcontractor that creates, receives, maintains, or transmits PHI on its behalf to agree in writing to restrictions and conditions at least as protective as those that apply to Vaidya under this BAA, in accordance with 45 CFR § 164.504(e)(2)(ii)(D).

7.3 Additional subcontractors

Vaidya may engage additional subcontractors to support the Services. Vaidya will provide Customer with at least thirty (30) days' advance notice (by email or through the Vaidya portal) before any new subcontractor begins processing PHI, and will obtain a HIPAA-equivalent written agreement from such subcontractor before disclosing PHI to it.

8. Data Retention and Deletion

8.1 PHI Input Materials

Vaidya will retain PHI Input Materials only as long as necessary to provide the Services and to allow Customer reasonable time to download the Report Output. PHI Input Materials are securely deleted within thirty (30) days of Report Output delivery. Vaidya intends to tighten this retention window further as its deletion infrastructure matures, but is not contractually obligated to do so under this version of the BAA.

8.2 Report Output

Report Output remains available to Customer through the Vaidya portal for the duration of the Customer's account. Customer may download Report Output at any time. Vaidya retains Report Output to enable Customer access; it is treated as PHI under this BAA while retained.

8.3 Operational Metadata

Vaidya retains Operational Metadata for six (6) years from the date of creation, as required by 45 CFR § 164.530(j). Operational Metadata is protected by the same safeguards as PHI Input Materials and is not disclosed to third parties except as permitted under this BAA.

8.4 Termination

Upon termination of the underlying Terms of Service, Vaidya will, within thirty (30) days:

• Return or securely delete all PHI Input Materials and Report Output in its possession, at Customer's election, where feasible
• Where return or deletion is not feasible (for example, where PHI is embedded in disaster recovery snapshots or backup media), extend the protections of this BAA to such PHI and limit further use to the purposes that make return or deletion infeasible, and document the disposition

9. Term and Termination

9.1 Term

This BAA is effective on the date Customer accepts it and continues until terminated in accordance with this Section.

9.2 Termination for breach

Either party may terminate this BAA upon written notice if the other party has materially breached this BAA and fails to cure the breach within thirty (30) days of receiving written notice describing the breach. In the event Vaidya's breach is incurable, Customer may terminate immediately and report the breach to the Secretary of HHS if so required by law.

9.3 Termination of Services

This BAA automatically terminates upon termination of Customer's underlying Terms of Service.

9.4 Survival

Vaidya's obligations under Sections 4 (Safeguards), 5 (Breach Notification), 6 (Customer Rights), and 8 (Data Retention and Deletion) survive termination with respect to any PHI Vaidya retains.

10. Indemnification

Each party will indemnify, defend, and hold harmless the other from and against any third-party claims, losses, damages, and reasonable attorneys' fees arising out of or relating to the indemnifying party's breach of this BAA or violation of HIPAA. This indemnity is subject to the limitations of liability in the Terms of Service, except that the Terms of Service liability cap does not apply to a party's breach of its confidentiality, data protection, or HIPAA obligations.

11. Amendment

11.1 By Vaidya

Vaidya may amend this BAA to reflect changes in HIPAA, related regulations, or its operations. Material amendments will require Customer's renewed acceptance through the Vaidya portal before Customer continues to upload PHI.

11.2 By regulation

The parties agree to take such action as is necessary to amend this BAA from time to time as is necessary for Vaidya and Customer to comply with applicable requirements of HIPAA.

12. Miscellaneous

12.1 Governing law

This BAA is governed by the laws of the State of Nevada, without regard to its conflict-of-laws principles. The parties consent to the exclusive jurisdiction of the state and federal courts located in Clark County, Nevada for any disputes arising under this BAA.

12.2 Interpretation

Any ambiguity in this BAA will be resolved in favor of an interpretation that permits Vaidya and Customer to comply with HIPAA.

12.3 Entire agreement

This BAA, together with the Terms of Service and Privacy Policy, constitutes the entire agreement between the parties with respect to the subject matter and supersedes any prior agreements relating to PHI.

12.4 No third-party beneficiaries

Nothing in this BAA creates rights in any third party other than as expressly required by HIPAA (including the right of HHS to enforce regulatory requirements).

13. Counterparty Acknowledgment

By accepting this BAA, Customer represents that Customer is a Covered Entity or Business Associate as defined under HIPAA, that Customer is authorized to bind the entity on whose behalf Customer is accepting, and that Customer has read and agrees to all of the terms above.

Vaidya's countersigned execution of this BAA is on file with Aarya Innovations LLC and is available on request to contact@aaryainnovations.com.

Aarya Innovations LLC

Business Associate

By: Prerna Roy, CEO

Date: as of the Effective Date