Business Associate Agreement

This Business Associate Agreement (BAA) is entered into by OMNIBIO LLC, a Wyoming limited liability company, with notice address 1309 Coffeen Avenue, Suite 1200, Sheridan, WY 82801 (Business Associate or OMNIBIO), and the healthcare provider or organization identified below (Covered Entity).

Covered Entity legal name and address: as recorded in the Covered Entity's OMNIBIO account.

Covered Entity privacy/security contact and notice email: the email address of the Covered Entity's owner as recorded in its OMNIBIO account, unless the Covered Entity names another contact in writing to support@omnibio.com.

The effective date is the date the Covered Entity's owner accepts this BAA for the Covered Entity on the Platform. Services Agreement means the Provider Platform Payment & Compliance Agreement in the version the Covered Entity has accepted. Every published version of this BAA and the acceptance records are kept on the Platform, and the Covered Entity's users see its acceptances in Settings. Required PHI protections apply before any permitted processing; storage or signature does not activate an otherwise unauthorized service.

1. Purpose, Scope and Definitions

1.1 This BAA governs Protected Health Information (PHI) that OMNIBIO creates, receives, maintains or transmits on behalf of Covered Entity in performing the non-clinical services authorized by the executed Services Agreement. It applies to electronic and other forms of PHI. Signing this BAA does not authorize a new product route, establish product eligibility, permit dispensing by OMNIBIO or activate patient-specific ordering.

1.2 Authorized services are limited to the expressly agreed patient-specific prescription-routing, order administration, pharmacy communications, transaction support and related lawful record-handling functions. Patient-specific compounded medications must follow the licensed-pharmacy route and activation requirements in Schedule B of the Services Agreement. OMNIBIO does not make clinical decisions or provide clinical consultations under this BAA.

1.3 HIPAA Rules means the Privacy, Security, Breach Notification and Enforcement Rules at 45 CFR Parts 160 and 164, as amended, and applicable provisions of the HITECH Act. Breach, Designated Record Set, Individual, Minimum Necessary, Required By Law, Secretary, Security Incident, Subcontractor, Unsecured PHI, Use and Disclosure have the meanings assigned by the HIPAA Rules. PHI in this BAA means PHI handled by OMNIBIO on Covered Entity's behalf.

1.4 Each party's legal role follows its actual activities and applicable law. A pharmacy acting as an independent treating or dispensing covered entity is not automatically OMNIBIO's subcontractor. A vendor acting on OMNIBIO's behalf that creates, receives, maintains or transmits PHI must satisfy Section 5. This BAA does not establish HIPAA status for an entity that does not meet the applicable legal definition.

2. Permitted Uses and Disclosures

2.1 OMNIBIO may use or disclose PHI only as necessary to perform authorized services for Covered Entity, as expressly permitted by this BAA, or as Required By Law. OMNIBIO shall not use or disclose PHI in a manner that would violate Subpart E of 45 CFR Part 164 if done by Covered Entity, except for the limited management and administration purposes permitted below.

2.2 Uses, disclosures and requests must be limited to the minimum necessary where that standard applies and consistent with Covered Entity's communicated lawful minimum-necessary policies. The parties shall respect applicable treatment and other statutory exceptions without using them to justify unrelated access.

2.3 OMNIBIO may use PHI for its proper management and administration or to carry out its legal responsibilities. Disclosure for those purposes is permitted only if Required By Law or if OMNIBIO obtains reasonable assurances that the recipient will maintain confidentiality, use or further disclose the PHI only as Required By Law or for the purpose of disclosure, and report known breaches of confidentiality to OMNIBIO.

2.4 OMNIBIO shall not sell PHI, disclose it for cross-context behavioral advertising, use it for unrelated marketing, or submit patient or prescription information to AI services or use it for model training. This BAA grants no independent right to commercialize PHI or to create or use de-identified datasets or cross-client data aggregation for OMNIBIO's own purposes. Additional purposes require a separate lawful written authorization or agreement and may not override applicable law.

3. Safeguards and Compliance

3.1 OMNIBIO shall implement appropriate administrative, physical and technical safeguards to prevent uses or disclosures not permitted by this BAA and comply with Subpart C of 45 CFR Part 164 for electronic PHI. Its obligations include applicable risk analysis and risk management, workforce authorization and training, access controls, audit controls, integrity protections, transmission security, incident response and contingency measures. Required safeguards shall extend to PHI throughout its authorized lifecycle.

3.2 OMNIBIO shall limit workforce access to authorized duties and bind personnel to appropriate confidentiality obligations. It shall maintain the policies, procedures and documentation required by the HIPAA Rules. This BAA states contractual duties; it is not a certification of existing controls, vendor compliance or operational readiness.

3.3 To the extent OMNIBIO performs an obligation of Covered Entity under Subpart E of 45 CFR Part 164, OMNIBIO shall comply with the requirements applicable to that obligation. No obligation is delegated merely by signing this BAA; the authorized service scope must identify the task.

4. Incident and Breach Reporting

4.1 OMNIBIO shall report to Covered Entity any use or disclosure not permitted by this BAA and any Security Incident of which it becomes aware. Reporting shall occur without unreasonable delay and in time to support applicable legal deadlines. This BAA does not deem unsuccessful Security Incidents reported merely by its execution.

4.2 For a Breach of Unsecured PHI, OMNIBIO shall notify Covered Entity following discovery without unreasonable delay and in no event later than sixty calendar days after discovery under 45 CFR 164.410, or earlier if applicable law requires. Sixty days is an outer legal limit, not a permitted waiting period. Discovery includes knowledge attributable to OMNIBIO under the applicable rule, including what would have been known through reasonable diligence.

4.3 Notification shall identify, to the extent known, affected Individuals; the incident and discovery dates; the nature and categories of PHI involved; containment and mitigation measures; and information reasonably available that Covered Entity needs for notifications under 45 CFR 164.404. OMNIBIO shall provide available information promptly and supplement it as additional information becomes available rather than delay initial notice pending completion of an investigation.

4.4 OMNIBIO shall investigate, preserve relevant evidence lawfully, mitigate harmful effects to the extent practicable, take appropriate corrective action and reasonably cooperate with Covered Entity's investigation and legally required notifications. Covered Entity remains responsible for its notifications to Individuals, regulators and media unless a lawful written arrangement expressly assigns particular tasks. OMNIBIO retains its own legally required reporting obligations.

4.5 Reports to Covered Entity shall use its designated privacy/security contact above and a secure channel for PHI. Covered Entity may notify OMNIBIO or request a secure reporting channel at support@omnibio.com. General email notices shall not include PHI unless an appropriate secure method has been established. Notice contacts shall be kept current; inability to reach a designated contact does not excuse reasonable escalation or statutory deadlines.

5. Subcontractors and Other Recipients

5.1 Before permitting a Subcontractor to create, receive, maintain or transmit PHI on OMNIBIO's behalf, OMNIBIO shall obtain a written agreement imposing the same applicable restrictions, conditions and requirements, including Security Rule duties for electronic PHI, as apply to OMNIBIO under this BAA, consistent with 45 CFR 164.502(e) and 164.308(b).

5.2 OMNIBIO shall limit subcontractor PHI access to authorized functions and address known material subcontractor violations as required by applicable law. Signing this BAA does not certify that any particular hosting, routing, support or logistics vendor has an executed BAA or qualifies to receive PHI.

5.3 Disclosures to independent pharmacies and other recipients require the applicable lawful basis and service arrangements. A vendor or supplier's access to a product catalog, account or order does not authorize unrelated PHI access. Whether a product may be supplied to a patient is governed by the product's label and the Services Agreement, not by this BAA.

6. Individual Rights, Records and Government Access

6.1 OMNIBIO shall make PHI in a Designated Record Set available to Covered Entity as necessary for Covered Entity to satisfy 45 CFR 164.524, including applicable electronic access requirements. OMNIBIO shall act sufficiently promptly to enable Covered Entity to meet its legal response deadline, including any earlier applicable state deadline.

6.2 OMNIBIO shall make amendments to PHI in a Designated Record Set as directed or agreed to by Covered Entity, or take other measures necessary to satisfy 45 CFR 164.526. OMNIBIO shall document disclosures and make available information needed for Covered Entity's accounting obligations under 45 CFR 164.528, for the applicable legally required accounting period.

6.3 OMNIBIO shall promptly forward Individual requests received directly to Covered Entity and shall not deny or decide such requests on Covered Entity's behalf unless expressly authorized or required by law. The parties shall coordinate secure transmission and the applicable deadline. A service label such as transaction data does not exclude information from a Designated Record Set if the legal definition applies.

6.4 OMNIBIO shall make its internal practices, books and records concerning the use and disclosure of PHI available to the Secretary for determining compliance with the HIPAA Rules. No confidentiality term, fee dispute or liability limitation may prevent required government access or the performance of mandatory HIPAA duties.

7. Covered Entity Responsibilities

7.1 Covered Entity shall provide only information that it may lawfully disclose for authorized services, obtain required permissions, and communicate relevant limitations in its notice of privacy practices, changes or revocations of permissions, and restrictions agreed to or required under 45 CFR 164.522 to the extent they affect OMNIBIO's handling of PHI.

7.2 Covered Entity shall not request a use or disclosure that would violate the HIPAA Rules, shall maintain accurate notice contacts, and shall identify applicable Individual-request deadlines when seeking assistance. Covered Entity remains responsible for its clinical records and decisions; these duties do not relieve OMNIBIO of its own obligations.

7.3 Before any patient-specific service is enabled, the parties shall confirm the authorized functions, data flows, participating pharmacy and jurisdictions, applicable vendor arrangements, secure communication methods and operating contacts under the Services Agreement. This BAA is not a substitute for those arrangements.

8. Term, Termination and PHI Disposition

8.1 This BAA begins on its effective date and continues while OMNIBIO handles PHI on Covered Entity's behalf, subject to termination and the continuing protections below. Execution does not authorize PHI submission to an inactive or unapproved service.

8.2 Covered Entity may terminate this BAA and the affected services if it determines that OMNIBIO has violated a material term. Covered Entity may permit a reasonable cure period where appropriate, but none is required where immediate termination is necessary. Nothing limits either party's mandatory action under the HIPAA Rules when it knows of a material violation by the other.

8.3 Upon termination, OMNIBIO shall return to Covered Entity, or destroy if Covered Entity agrees, all PHI held in any form, including PHI held by subcontractors, and retain no copies except to the extent return or destruction is infeasible or retention is Required By Law. OMNIBIO shall notify Covered Entity of the basis and scope of any retention and document completion of return or destruction upon reasonable request.

8.4 Where return or destruction is infeasible, OMNIBIO shall extend this BAA's protections to retained PHI and limit further uses and disclosures to the purposes making return or destruction infeasible, for as long as PHI is retained. It shall return or destroy retained PHI when feasible and lawful. A backup or retention policy does not create unrestricted reuse rights. Safeguards, confidentiality, required cooperation and these disposition obligations survive termination.

9. Relationship to Other Agreements

9.1 This BAA controls over conflicting Services Agreement or policy terms concerning PHI protection and compliance with the HIPAA Rules. The Services Agreement otherwise controls commercial terms, indemnity, liability allocation, governing law and dispute procedures to the extent lawful and consistent with this BAA. This BAA creates no separate indemnity or monetary cap and does not enlarge or reset an existing contractual cap.

9.2 No contractual cap, exclusion or dispute procedure limits a party's direct regulatory liability, binds Individuals or authorities, or excuses required safeguards, reports, records assistance, government access or other nonwaivable duties. The parties shall interpret ambiguities to permit HIPAA compliance and execute necessary amendments when legal requirements change. Material changes require written agreement; a website policy does not unilaterally amend this BAA.

9.3 This BAA grants no third-party beneficiary rights except where nonwaivable law provides otherwise. If a provision is unenforceable, remaining lawful provisions continue. Counterparts and electronic signatures are permitted. Each signatory represents authority to bind the identified party.

10. Signatures

OMNIBIO LLC accepts this BAA by publishing this version on the Platform. The Covered Entity accepts it when its owner accepts it for the Covered Entity on the Platform; the owner represents authority to bind the Covered Entity, and the acceptance record identifies the version, the owner, the Covered Entity and the date and time.