TheraBee Terms & Conditions

Effective Date: 10/23/2026
Last Updated: 10/23/2026

These Terms & Conditions (“Terms”) constitute a legally binding agreement between you and TheraBee, LLC (“TheraBee,” “we,” “us,” or “our”) governing your access to and use of TheraBee's website, applications, AI-powered clinical documentation tools, Ask Bea, and related products and services (collectively, the “Services”).

By affirmatively accepting these Terms during registration, or through another legally valid acceptance process, you agree to be bound by these Terms and any applicable agreements incorporated herein. Our Privacy Policy describes how we collect, use, and protect information. Where applicable, the Business Associate Agreement (“BAA”) attached as Schedule A forms part of these Terms.

If you accept these Terms on behalf of a healthcare practice, organization, or other legal entity, you represent that you have authority to bind that entity. If you lack such authority, you may not accept these Terms on its behalf.

If you do not agree to these Terms, you may not use the Services.

1. Eligibility, Registration, and Account Responsibility

TheraBee is intended for mental health professionals and other authorized healthcare personnel who are at least 18 years old.

By registering, you represent that you are appropriately licensed, credentialed, supervised, employed, or otherwise legally authorized to use the Services within your professional role and jurisdiction.

You agree to provide accurate account information, maintain the confidentiality of your login credentials, and promptly notify TheraBee of suspected unauthorized access. You are responsible for activity conducted through your account to the extent attributable to you or individuals you authorize, but not for unauthorized activity caused by TheraBee's own failure to meet its legal or contractual obligations.

Each user must maintain individual account credentials. Sharing credentials or permitting unauthorized access to patient information is prohibited.

Where an organization establishes or administers accounts, that organization is responsible for determining which individuals are authorized to use the Services and managing their access, subject to available account controls.

TheraBee may verify eligibility and restrict access when these requirements are not met.

2. License, Permitted Use, and Restrictions

Subject to these Terms and payment of applicable fees, TheraBee grants you a limited, non-exclusive, non-transferable, non-sublicensable, revocable license to access and use the Services for authorized professional and internal business purposes.

You may not:

  • Reverse-engineer, decompile, disassemble, or attempt to extract the source code, underlying models, or proprietary architecture of the Services, except where prohibited by applicable law.
  • Copy, modify, reproduce, redistribute, sublicense, resell, or commercially exploit the Services without TheraBee's written authorization.
  • Use the Services or their outputs to develop, train, or improve a competing product or AI model without authorization.
  • Circumvent security protections, usage restrictions, payment systems, or access controls.
  • Introduce malicious software or interfere with the operation, security, or availability of the Services.
  • Access information or accounts without authorization.
  • Use the Services for unlawful, fraudulent, or otherwise prohibited activities.
  • Misrepresent unreviewed AI-generated material as independently verified clinical work.
  • Use the Services as an autonomous clinical decision-making system or substitute for qualified professional care.

TheraBee reserves all rights not expressly granted under these Terms.

3. Description and Scope of Services

TheraBee provides AI-assisted tools intended to support healthcare professionals with clinical documentation, administrative workflows, and professional decision support.

Depending on the features available through your account, the Services may include session recording and transcription, clinical note generation, customizable documentation formats, processing of additional clinical context, and Ask Bea.

Ask Bea may help users prepare for sessions, review historical clinical context, identify themes, explore treatment considerations, and reflect on therapeutic interactions.

The Services are intended for professional use and may evolve as technology, product capabilities, and operational requirements change.

TheraBee may modify, enhance, suspend, or discontinue features, subject to applicable law, paid-plan commitments, and separately executed agreements. Where practicable, TheraBee will provide reasonable notice of material changes affecting paid functionality.

4. AI Limitations, Clinical Responsibility, and Prohibited Reliance

TheraBee is a technology provider, not a healthcare provider. TheraBee does not practice medicine, psychology, counseling, psychotherapy, or any other licensed healthcare profession.

4.1 AI Accuracy and Independent Professional Judgment

The Services may generate clinical notes, summaries, observations, suggestions, analyses, and other material (“AI Outputs”).

AI Outputs are generated using probabilistic technology and may contain errors, omissions, inaccurate statements, unsupported conclusions, or incomplete interpretations.

You acknowledge that AI Outputs require independent professional review and are not guaranteed to be clinically accurate, complete, appropriate, or suitable for any particular patient.

You are solely responsible for reviewing, correcting, and approving AI Outputs before incorporating them into medical records, communicating them to others, or relying on them in professional practice.

You retain responsibility for clinical assessments, diagnoses, treatment plans, interventions, referrals, documentation, and other professional decisions. You agree not to rely on AI Outputs without exercising independent professional judgment and complying with applicable standards of care.

TheraBee does not independently evaluate patients, verify clinical findings, or determine the appropriateness of treatment.

4.2 Ask Bea and Clinical Decision Support

Ask Bea may provide clinical observations, treatment-related suggestions, professional feedback, session preparation assistance, and reflections on therapeutic interactions.

Ask Bea is not a licensed clinical supervisor, professional consultant, or substitute for qualified supervision, peer consultation, or independent clinical judgment.

Its outputs are intended for informational and professional support purposes. You are responsible for determining whether suggestions are appropriate, accurate, and consistent with applicable professional standards.

TheraBee does not independently diagnose patients, prescribe treatment, establish standards of care, or make autonomous clinical decisions.

4.3 Emergencies, High-Risk Situations, and Professional Relationships

The Services are not designed or authorized for emergency response, crisis intervention, continuous patient monitoring, or autonomous identification of imminent clinical risk.

You must independently assess and manage suicide risk, threats of violence, abuse, neglect, medical emergencies, and other urgent safeguarding concerns. You may not rely on the Services as the sole means of detecting or responding to such circumstances.

Use of TheraBee does not establish a healthcare provider-patient relationship between TheraBee and any patient or client.

TheraBee does not assume responsibility for the delivery, quality, or outcomes of healthcare services provided by its users, except to the extent responsibility cannot lawfully be excluded for TheraBee's own conduct.

You are responsible for obtaining all legally required consent or authorization before recording, transcribing, or processing clinical sessions or other communications.

You acknowledge that recording-consent laws vary by jurisdiction and may require the consent of multiple participants.

You are responsible for complying with applicable privacy laws, professional licensing requirements, ethical standards, organizational policies, and patient confidentiality obligations.

You represent that you have the legal authority to submit information to the Services and authorize its processing for the purposes described in these Terms.

TheraBee does not independently verify patient consent, professional licensure, or the legal permissibility of each recording.

You are also responsible for determining whether use of the Services is appropriate for your clinical setting, patient population, and professional obligations.

6. Customer Data, Ownership, and Privacy

6.1 Ownership and Permitted Processing

As between you and TheraBee, you or the applicable healthcare organization retain your rights in information submitted to or generated through the Services, subject to applicable patient rights and law.

“Customer Data” includes recordings, transcripts, clinical notes, prompts, patient history, and related clinical information.

TheraBee does not claim ownership of Customer Data.

You authorize TheraBee and its approved service providers to process Customer Data only as reasonably necessary to provide requested Services, administer your account, maintain security, meet applicable legal obligations, and perform other processing expressly permitted by the applicable agreements.

This authorization does not transfer ownership of Customer Data to TheraBee.

6.2 No AI Training or Unrelated Secondary Use

TheraBee does not use clinical recordings, transcripts, notes, patient information, or other submitted clinical content to train or fine-tune AI models.

TheraBee does not repurpose clinical content to create independent datasets for advertising, research, benchmarking, or unrelated internal product improvement.

TheraBee may use non-clinical operational metrics, technical performance information, and voluntarily provided product feedback to maintain and improve its Services, subject to applicable privacy obligations.

6.3 Data Processing, Retention, and Deletion

Original session audio may contain protected health information (“PHI”) and is temporarily processed by TheraBee and authorized providers before redaction.

Following successful transcription and processing, original audio is deleted from TheraBee's application upload storage.

TheraBee applies a multi-stage process designed to identify and redact personal identifiers from retained transcripts. Because automated redaction is not infallible, retained information may still contain PHI or other sensitive information.

Clinical notes and redacted transcripts may remain available to support documentation and Ask Bea until deleted by the user, removed through account closure, or otherwise handled as required by law.

Deleting a clinical note also removes its associated transcript record from TheraBee's active application database. This may reduce Ask Bea's ability to reference prior sessions or identify longitudinal clinical patterns.

Certain information may remain temporarily in backups, operational logs, or authorized service-provider systems under applicable retention requirements.

Our Privacy Policy provides further information about data processing, security, retention, and deletion. Where an applicable BAA governs PHI, that agreement controls to the extent of a conflict.

7. HIPAA and Business Associate Agreement

Where TheraBee creates, receives, maintains, or transmits PHI on behalf of a HIPAA-covered entity or business associate, the parties' applicable HIPAA obligations are governed by the BAA attached as Schedule A or a separately executed BAA.

Schedule A is incorporated into these Terms when the contracting customer is an applicable covered entity or business associate and TheraBee performs business associate or subcontractor functions on its behalf.

An individual user's acceptance does not, by itself, establish that the individual has authority to bind a separate healthcare organization.

Customers accepting on behalf of an organization represent that they have authority to enter into the applicable BAA.

Where a separately executed BAA exists, that agreement controls to the extent of a conflict.

8. Pricing, Successful Processing, and Payment

TheraBee may offer usage-based pricing, subscription plans, bundled session credits, premium features, and promotional offers. Applicable prices, features, included usage, and billing conditions are disclosed during enrollment, checkout, or within the Services.

By selecting a paid plan or using a billable feature, you agree to the associated charges and payment terms.

8.1 Usage-Based Charges and Recording Cancellation

TheraBee charges users for successfully processed sessions—not simply for starting a recording. A session is considered billable when processing has been successfully completed and an applicable clinical note or other designated billable output has been generated.

Users are not charged a session-processing fee when a recording fails to produce a completed billable output due to a processing error or technical failure.

Users may cancel a recording within the first five (5) minutes after recording begins without incurring a session-processing charge. Once this cancellation window has elapsed, a charge may apply if the session is successfully processed and a billable output is generated.

A successfully generated output constitutes a completed billable service, regardless of whether the user subsequently edits, exports, deletes, or chooses not to use the resulting documentation.

Because AI-generated content is inherently variable, dissatisfaction with the wording, formatting, or perceived clinical usefulness of an otherwise successfully generated output does not, by itself, make the session nonbillable. Users remain responsible for reviewing and verifying all AI-generated documentation.

8.2 Subscriptions, Included Credits, and Payment Authorization

Certain plans may include recurring subscription fees, premium functionality, bundled session credits, or other benefits. Subscriptions renew automatically at the billing interval disclosed during enrollment unless canceled before the next renewal.

Included session credits are applied according to the terms of the selected plan. Unless expressly stated otherwise, unused credits have no cash value and may not be redeemed for cash. Any applicable expiration, rollover, or forfeiture rules will be disclosed in the plan details.

By providing a payment method, you authorize TheraBee and its third-party payment processor to charge applicable subscription fees, usage-based charges, taxes, and other disclosed amounts. You agree to maintain accurate payment information and acknowledge that failure to do so may interrupt access to paid features.

You may cancel a subscription through available account settings. Cancellation prevents future renewals but does not automatically reverse charges already incurred or terminate access to benefits for which you have already paid.

8.3 Pricing Changes, Refunds, and Billing Disputes

TheraBee reserves the right to modify its pricing, plan features, and billing arrangements prospectively. Material changes to recurring subscription fees will be communicated in advance as required by applicable law. Pricing changes will not retroactively affect charges already incurred.

Except as required by law or expressly provided in an applicable offer, charges for successfully completed billable services and elapsed subscription periods are nonrefundable. Deleting a completed session or choosing not to use its output does not automatically entitle a user to a refund.

Users may contact TheraBee to dispute suspected billing errors, unsuccessful processing charges, or other payment discrepancies. TheraBee will review reported issues in good faith and correct verified billing errors.

If payment cannot be collected, TheraBee may suspend or restrict access to paid functionality, subject to applicable notice requirements. Users remain responsible for outstanding charges incurred before suspension or cancellation.

9. Third-Party Providers and AI Infrastructure

TheraBee uses third-party providers for AI processing, hosting, payment processing, authentication, and related infrastructure.

Enhanced AI, through its FluxPrompt platform, supports TheraBee's AI processing and may transmit information to authorized underlying AI providers.

Enhanced AI has entered into a BAA with TheraBee and has represented that it maintains SOC 2 certification.

TheraBee requires appropriate contractual safeguards from providers, including subcontractor BAAs where required by HIPAA.

Third-party infrastructure may experience interruptions, technical failures, or changes in availability.

TheraBee does not guarantee uninterrupted availability of third-party systems but remains responsible for obligations imposed on it by applicable law and contract.

10. Service Availability, Data Loss, and Continuity

10.1 Service Availability and Processing Failures

The Services may experience maintenance interruptions, processing errors, failed recordings, network outages, software defects, or temporary unavailability.

TheraBee does not guarantee uninterrupted access or successful processing of every session.

TheraBee may perform maintenance, deploy updates, or temporarily restrict access when reasonably necessary to protect security, maintain functionality, or address operational issues.

Where practicable, TheraBee will provide reasonable notice of planned disruptions materially affecting paid Services.

10.2 Independent Clinical Records and Data Loss

TheraBee is not intended to serve as your sole electronic health record, permanent clinical archive, or guaranteed backup system.

You are responsible for maintaining clinical records in accordance with applicable law, professional obligations, and organizational policies.

You should verify successful processing and preserve required documentation in your designated recordkeeping system.

You are also responsible for maintaining reasonable alternative documentation and clinical workflows if TheraBee becomes unavailable.

To the maximum extent permitted by law, TheraBee disclaims liability for indirect or consequential losses arising from service interruptions, unsuccessful recordings, unavailable historical context, or data loss.

This provision is subject to the limitations, exceptions, and nonwaivable obligations described elsewhere in these Terms and any applicable BAA.

11. Intellectual Property and Feedback

TheraBee and its licensors retain all rights, title, and interest in the Services, software, proprietary AI workflows, interfaces, branding, designs, and underlying technology.

Nothing in these Terms transfers ownership of TheraBee intellectual property to you.

Your ownership rights in Customer Data do not extend to TheraBee's underlying software, systems, models, or proprietary technology.

Users may use legitimately generated AI Outputs for authorized professional and internal business purposes, subject to applicable law and third-party rights.

If you voluntarily provide suggestions, ideas, or product feedback, TheraBee may use that feedback to improve its Services without compensation, provided doing so does not violate restrictions on clinical content.

12. Warranties and Disclaimers

TO THE MAXIMUM EXTENT PERMITTED BY LAW, THE SERVICES ARE PROVIDED “AS IS” AND “AS AVAILABLE.”

TheraBee disclaims implied warranties of merchantability, fitness for a particular purpose, and noninfringement to the extent legally permitted.

Without limiting the foregoing, TheraBee does not warrant that:

  • AI Outputs will be clinically accurate, complete, or suitable for a particular patient.
  • The Services will satisfy every regulatory or professional requirement applicable to the user.
  • Every recording or processing request will succeed.
  • The Services will operate without interruption, delay, or error.
  • Automated redaction will identify every instance of PHI.
  • Ask Bea will identify every clinical concern or provide appropriate recommendations in every circumstance.
  • Use of the Services will produce a particular clinical outcome.

Users acknowledge that AI-assisted clinical technology involves inherent limitations and that independent professional review is essential to its appropriate use.

These disclaimers do not override express contractual commitments, applicable BAA obligations, or legal responsibilities that cannot be disclaimed.

13. Limitation of Liability

13.1 Exclusion of Certain Damages

TO THE MAXIMUM EXTENT PERMITTED BY LAW, THERABEE AND ITS OFFICERS, DIRECTORS, EMPLOYEES, AND AFFILIATES WILL NOT BE LIABLE FOR INDIRECT, INCIDENTAL, CONSEQUENTIAL, SPECIAL, EXEMPLARY, OR PUNITIVE DAMAGES ARISING OUT OF OR RELATING TO THE SERVICES.

THIS INCLUDES LOST PROFITS, BUSINESS INTERRUPTION, LOST OPPORTUNITIES, AND CONSEQUENTIAL LOSSES ARISING FROM RELIANCE ON AI OUTPUTS, SERVICE INTERRUPTIONS, OR DATA LOSS, TO THE EXTENT SUCH DAMAGES MAY LAWFULLY BE EXCLUDED.

THESE EXCLUSIONS APPLY REGARDLESS OF WHETHER THERABEE WAS ADVISED OF THE POSSIBILITY OF SUCH DAMAGES, EXCEPT WHERE APPLICABLE LAW PROHIBITS THE EXCLUSION.

13.2 Aggregate Liability Cap and Exceptions

TO THE MAXIMUM EXTENT PERMITTED BY LAW, THERABEE'S TOTAL AGGREGATE LIABILITY FOR CLAIMS ARISING OUT OF OR RELATING TO THESE TERMS OR THE SERVICES WILL NOT EXCEED THE GREATER OF:

  1. THE TOTAL FEES PAID OR PAYABLE BY THE CLAIMING CUSTOMER TO THERABEE DURING THE THREE (3) MONTHS IMMEDIATELY PRECEDING THE EVENT GIVING RISE TO THE CLAIM; OR
  2. ONE HUNDRED DOLLARS ($100).

THIS CAP APPLIES IN THE AGGREGATE TO ALL CLAIMS ARISING FROM THE SAME OR RELATED EVENTS, REGARDLESS OF LEGAL THEORY, INCLUDING CONTRACT, TORT, NEGLIGENCE, OR STRICT LIABILITY, TO THE EXTENT PERMITTED BY LAW.

Nothing in these Terms excludes or limits liability that cannot lawfully be excluded or limited, including liability for fraud, willful misconduct, or other conduct to the extent applicable law prohibits such limitation.

Applicable HIPAA obligations and regulatory enforcement are not eliminated by contractual liability limitations.

The parties acknowledge that the pricing of the Services reflects the allocation of risks established by these Terms and that these limitations are material to the agreement.

Any different liability limits expressly agreed in a separately executed agreement will control as specified in that agreement.

14. Indemnification and Third-Party Claims

To the extent permitted by law, you agree to defend, indemnify, and hold harmless TheraBee, LLC and its officers, directors, employees, and affiliates against third-party claims, damages, liabilities, losses, and reasonable legal expenses arising from:

  • Your violation of these Terms or applicable law.
  • Your failure to obtain required recording consent or authorization.
  • Your unauthorized submission or disclosure of information.
  • Your negligent, unlawful, or wrongful professional conduct.
  • Your clinical assessments, diagnoses, treatment decisions, or interventions.
  • Your failure to independently review or verify AI Outputs before professional use.
  • Your use of the Services in a manner expressly prohibited by these Terms.

This obligation applies only to the extent the relevant claim is attributable to your conduct and does not require you to indemnify TheraBee for its own negligence, misconduct, breach, or legal violations.

TheraBee will provide reasonably prompt notice of an indemnifiable claim, subject to any prejudice caused by delay.

The indemnifying party may control the defense using qualified counsel, subject to reasonable cooperation and protection of the other party's interests.

No settlement may impose an admission of wrongdoing, nonmonetary obligation, or unreimbursed liability on TheraBee without its prior written consent.

15. Suspension, Cancellation, Termination, and Data Access

Users may cancel subscriptions or discontinue use through available account controls.

Cancellation prevents future subscription renewals but does not eliminate charges already incurred.

TheraBee may suspend or terminate access for material violations, nonpayment, unlawful conduct, security threats, or misuse of the Services.

Where appropriate and practicable, TheraBee will provide notice and an opportunity to cure. Immediate suspension may occur when reasonably necessary to protect security, prevent unlawful activity, or limit material harm.

Users are responsible for exporting and preserving clinical records they are legally required to maintain before closing their accounts.

TheraBee will handle remaining Customer Data according to its Privacy Policy and applicable BAA. TheraBee may preserve information where required by law or reasonably necessary for legitimate legal claims, subject to applicable confidentiality and privacy obligations.

Provisions concerning payment, intellectual property, liability, indemnification, dispute resolution, and other obligations that by their nature survive termination will remain effective.

16. Dispute Resolution, Arbitration, and Governing Law

16.1 Informal Dispute Resolution

Before commencing formal proceedings, the parties agree to attempt to resolve disputes in good faith.

A party initiating a dispute must provide written notice describing the claim, relevant circumstances, and requested relief.

The parties will have thirty (30) days after receipt of notice to attempt resolution, unless immediate relief is legally necessary.

16.2 Binding Individual Arbitration

Except for disputes eligible for small claims court, claims seeking permitted provisional injunctive relief, or matters that cannot lawfully be arbitrated, disputes arising from these Terms or the Services will be resolved through binding individual arbitration administered by the American Arbitration Association under its applicable rules.

The Federal Arbitration Act governs the interpretation and enforcement of this arbitration agreement to the extent applicable.

Arbitration will take place remotely or in Utah, as permitted by applicable rules and law. The applicable arbitration rules govern filing procedures, arbitrator selection, and fees, except where a different arrangement is required by law.

The arbitrator may award relief available under applicable law, subject to enforceable contractual limitations.

Either party may pursue eligible claims in small claims court or seek temporary or preliminary injunctive relief from a court of competent jurisdiction when necessary to protect confidential information, intellectual property, or other rights pending arbitration.

16.3 Governing Law, Venue, and Claim Period

These Terms are governed by the laws of the State of Utah, without regard to conflict-of-law principles, except where superseded by applicable federal law.

For disputes properly brought in court, the parties consent to the jurisdiction of state and federal courts located in Utah, subject to mandatory venue and jurisdiction requirements.

To the extent permitted by applicable law, contractual claims arising under these Terms must be commenced within one (1) year after the claimant knew or reasonably should have known of the facts giving rise to the claim.

This provision does not shorten statutory periods where doing so is prohibited or restrict nonwaivable legal rights.

17. Class Action and Representative Proceeding Waiver

To the maximum extent permitted by law, disputes will be resolved individually rather than through class, collective, consolidated, or representative proceedings.

An arbitrator may not consolidate unrelated parties' claims or preside over a class proceeding without the parties' agreement, except where applicable law requires otherwise.

If a court determines that this waiver is unenforceable for a particular claim, the effect of that determination will be governed by applicable law, without automatically invalidating unrelated enforceable provisions.

18. Force Majeure

TheraBee will not be liable for delays or failures resulting from circumstances beyond its reasonable control, including natural disasters, power outages, telecommunications failures, cyberattacks, government actions, labor disruptions, or failures of critical third-party infrastructure.

This provision does not excuse obligations that cannot legally be suspended or waived.

19. Changes to These Terms

TheraBee may update these Terms to reflect changes in its Services, technology, business practices, or legal requirements.

Material changes will be communicated through reasonable notice, which may include email, in-product notifications, or posting updated Terms.

Where affirmative consent is legally required, TheraBee will obtain that consent before the changes take effect.

Continued use after valid notice and the effective date of an update constitutes acceptance only to the extent permitted by applicable law.

20. Miscellaneous

Entire Agreement: These Terms, applicable plan terms, the Privacy Policy, any applicable BAA, and separately executed agreements constitute the parties' applicable contractual arrangement.

Order of Precedence: Separately executed agreements control where expressly stated. Applicable BAAs control with respect to conflicting provisions governing PHI.

Severability: Unenforceability of one provision does not invalidate the remaining provisions, except where applicable law requires otherwise.

No Waiver: Failure to enforce a provision does not constitute waiver of future enforcement.

Assignment: You may not assign these Terms without TheraBee's written consent. TheraBee may assign them in connection with a legitimate business transaction, subject to applicable law and privacy obligations.

Independent Contractors: The parties are independent contractors. Nothing creates a partnership, joint venture, employment relationship, or agency relationship.

Electronic Acceptance: The parties agree that electronic acceptance may constitute a valid signature and binding agreement, subject to applicable law.

Notices: TheraBee may provide notices through registered email addresses or the Services. Notices to TheraBee may be sent to support@therabee.ai.

21. Contact Information

TheraBee, LLC

Website: www.therabee.ai
Email: support@therabee.ai

Schedule A — Business Associate Agreement

This Business Associate Agreement (“BAA”) is entered into between TheraBee, LLC (“Business Associate”) and the applicable healthcare provider or organization accepting the accompanying Terms (“Customer”).

Where Customer is a HIPAA-covered entity and TheraBee performs business associate functions on its behalf, Customer is referred to as “Covered Entity.”

Where Customer is itself a business associate and TheraBee acts as its subcontractor, references to Covered Entity will be interpreted as referring to Customer in its applicable business associate capacity, except where the HIPAA Rules require otherwise.

This BAA is effective when an authorized representative of the applicable Customer accepts the Terms, provided the relationship involves PHI subject to HIPAA.

The parties intend to comply with HIPAA, HITECH, and applicable implementing regulations (the “HIPAA Rules”).

A1. Definitions

Terms not otherwise defined have the meanings assigned by the HIPAA Rules, including PHI, Breach, Security Incident, Subcontractor, Designated Record Set, and Unsecured PHI.

A2. Permitted Uses and Disclosures

Business Associate may use or disclose PHI only:

  • To perform the Services for Covered Entity.
  • As permitted by this BAA and applicable law.
  • For proper management and administration or to carry out legal responsibilities, subject to the conditions required by HIPAA.
  • As required by law.

Business Associate will not use PHI for AI model training, fine-tuning, advertising, or unrelated product improvement.

Business Associate will not repurpose clinical information into independent datasets for unrelated research, benchmarking, or commercial development.

Business Associate will not use or disclose PHI in a manner that would violate the HIPAA Privacy Rule if performed by Covered Entity, except as expressly permitted for business associates under the HIPAA Rules.

A3. Safeguards and HIPAA Compliance

Business Associate will implement appropriate administrative, physical, and technical safeguards to protect PHI.

Business Associate will comply with the applicable HIPAA Security Rule requirements concerning electronic PHI.

Safeguards will include access controls, workforce security measures, encryption where appropriate, risk assessment procedures, and controls intended to minimize unnecessary PHI processing and retention.

To the extent Business Associate carries out any Covered Entity obligation under the HIPAA Privacy Rule, Business Associate will comply with the requirements applicable to Covered Entity in performing that obligation.

A4. Breach and Security Incident Reporting

Business Associate will report uses or disclosures of PHI not permitted by this BAA, including reportable Breaches of Unsecured PHI, as required by HIPAA.

Reports of Breaches of Unsecured PHI will be made without unreasonable delay and no later than ten (10) calendar days after discovery.

Business Associate will provide reasonably available information necessary for Covered Entity to investigate and satisfy applicable notification obligations.

The parties acknowledge that routine unsuccessful security events, such as blocked access attempts, may be addressed through agreed periodic or summary reporting to the extent permitted by law.

A5. Subcontractors

Business Associate will ensure that subcontractors creating, receiving, maintaining, or transmitting PHI on its behalf agree in writing to applicable restrictions, conditions, and requirements consistent with HIPAA.

Business Associate will maintain appropriate oversight of its subcontractor arrangements and remain responsible for its own contractual and legal obligations.

A6. Individual Rights and Records

To the extent applicable to the PHI maintained by Business Associate, Business Associate will:

  • Make PHI available as necessary for Covered Entity to satisfy access obligations under 45 CFR §164.524.
  • Make PHI available for amendment and incorporate amendments as directed under 45 CFR §164.526.
  • Maintain and provide information necessary for Covered Entity to satisfy applicable accounting-of-disclosures obligations under 45 CFR §164.528.

The parties will cooperate in good faith regarding requests involving PHI, taking into account the nature of the information TheraBee maintains and the applicable HIPAA requirements.

A7. Government Access and Mitigation

Business Associate will make internal practices, books, and records relating to PHI available to the Secretary of Health and Human Services as required by HIPAA.

Business Associate will mitigate, to the extent practicable, harmful effects of impermissible uses or disclosures known to it.

A8. Minimum Necessary

Business Associate will comply with applicable minimum-necessary requirements when using, disclosing, or requesting PHI, subject to exceptions under HIPAA.

A9. Covered Entity Obligations

Covered Entity will:

  • Obtain legally required patient consents and authorizations.
  • Notify Business Associate of applicable restrictions on PHI use or disclosure that affect the Services.
  • Notify Business Associate of relevant revocations or changes in permissions.
  • Avoid requesting impermissible uses or disclosures of PHI.
  • Fulfill its independent responsibilities for patient records, clinical decisions, and HIPAA compliance.

A10. Term, Termination, and PHI Disposition

This BAA remains effective while Business Associate processes PHI on behalf of Covered Entity under the applicable service relationship.

If either party becomes aware of a material violation by the other, the nonbreaching party may provide notice and an opportunity to cure where feasible.

If the violation is not cured within thirty (30) days, or cure is not possible, the nonbreaching party may terminate the BAA and applicable Services, or take other action required by HIPAA.

Upon termination, Business Associate will return or destroy PHI if feasible, including PHI held by subcontractors to the extent required by the HIPAA Rules.

Where return or destruction is infeasible, Business Associate will extend the protections of this BAA to retained PHI and limit further uses and disclosures to the purposes that make return or destruction infeasible.

These obligations apply to retained backup copies and other residual PHI as required by law.

A11. Interpretation and Miscellaneous

Regulatory References: HIPAA references include applicable amendments.

Amendments: The parties will amend this BAA as necessary to comply with applicable HIPAA requirements.

Interpretation: Ambiguities will be resolved in favor of an interpretation consistent with HIPAA.

No Third-Party Beneficiaries: This BAA creates no contractual rights for third parties except as required by law.

Survival: Obligations relating to retained PHI and other provisions that by their nature continue after termination will survive as applicable.

Order of Precedence: This BAA controls over conflicting Terms with respect to PHI.

Electronic Acceptance: Acceptance by an authorized representative of an applicable Customer constitutes agreement to this BAA, subject to applicable electronic contracting requirements.