Juvo Care, Inc.

US Data Processing Agreement

This US Data Processing Agreement (“DPA”) reflects the parties’ agreement with respect to the Processing of Personal Data by Juvo Care, Inc. (“Company”) on behalf of the customer identified in the signature block below (“Customer”) in connection with the provision of the Online Services under a Master Software as a Services Agreement; Master Services Agreement, Terms of Use or other agreement between the Parties (the “Agreement”).

1. Definitions and Interpretation
1. The following definitions and rules of interpretation apply in this DPA.

All capitalized terms used but not otherwise defined herein have the meaning attributed to them in the Agreement.

“Applicable Privacy Law” means all applicable US federal, state, and local laws, rules, and regulations relating to privacy, data security, data protection as applicable to either party’s processing of Personal Data under the Agreement each as amended, replaced or superseded from time to time, in effect any US jurisdiction, including, but not limited to State Privacy Laws and Federal Privacy Laws.

"Business Purpose" means the Services described in the Agreement or any other purpose specifically identified in Appendix A.

“Business” or “Controller”means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of Processing Personal Data.

"Data Subject" means an identified or identifiable natural person who is a resident of the United States or a household to whom Personal Data relates. Data Subject also includes entities

“Federal Privacy Laws” includes, without limitation, the Federal Trade Commission Act; the Health Insurance Portability and Accountability Act (HIPAA), as amended by the Health Information Technology for Economic and Clinical Health (HITECH) Act; the Family Educational Rights and Privacy Act (FERPA); the Children's Online Privacy Protection Act (COPPA); the Gramm-Leach-Bliley Act (GLBA); the Privacy Act of 1974; the Fair Credit Reporting Act (FCRA); the Electronic Communications Privacy Act (ECPA); federal Red Flags Rule regulations, Internal Revenue Service regulations and the Telephone Consumer Protection Act (TCPA) and similar federal laws as may be enacted, collectively with their implementing regulations and as amended or superseded from time to time. Federal Privacy Laws also include any nationally adopted standards for the Processing of Personal Data including, but not limited to the Payment Card Industry Data Security Standards (PCIDSS).

"Personal Data" means information that Customer provides or provides access to, or information which Company creates or obtains on behalf of Customer, in accordance with the Agreement and this Agreement that: (i) directly or indirectly identifies , relates to, describes, is reasonably capable of being associated with, or could reasonably be linked with an individual; or (ii) can be used to identify or authenticate an individual including Sensitive Personal Data. Customer’s business contact information is not, by itself, Personal Data.

"Processing, processes, or process" means any operation(s) performed on Personal Data, whether or not by automatic means, such as collection, storage, adaptation or alteration, retrieval, consultation, use, disclosure, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction, and any other activity identified as processing under Applicable Privacy Law.

"Security Breach" means any act or omission that materially compromises the security, confidentiality, or integrity of Personal Data or the physical, technical, administrative, or organizational safeguards put in place to protect it but does not include unsuccessful attempts or activities that do not compromise the security of Customer Personal Data, including unsuccessful log-in attempts, pings, port scans, denial of service attacks, and other network attacks on firewalls or networked systems. The loss of or unauthorized access, disclosure, or acquisition of Personal Data is a Security Breach whether or not the incident rises to the level of a security breach under the Applicable Privacy Law.

”Sensitive Personal Information” means has the meaning given such terms under Applicable Privacy Law and includes “sensitive information” and similar terms under Applicable Privacy Law and may include an individual’s (i) government-issued identification number, including Social Security number, driver’s license number, or state-issued identification number; (ii) financial account number, credit report information, or credit, debit, or other payment cardholder information, with or without any required security or access code, personal identification number, or password that permits access to the individual’s financial account; (iii) biometric, genetic, health, or health insurance data; (iv) geolocation data; or (v) information regarding their racial or ethnic origin, religious beliefs, sex life or sexual orientation, union membership, or citizenship or immigration status.

“State Privacy Laws” includes, without limitation, the California Consumer Privacy Act, as amended by the California Privacy Rights Act. (the “CCPA”), Colorado Privacy Act (“CPA”), Connecticut Act Concerning Data Privacy and Online Monitoring (“CTDPA”), Virginia Consumer Data Protection Act (“VCDPA”), Delaware Personal Data Privacy Act, Utah Consumer Privacy Act (“UCPA”), and similar privacy laws as may be enacted, collectively with their implementing rules and regulations and as amended or superseded from time to time. “Subprocessors” means third parties, other than Company, engaged and authorized by Company to process Customer Personal Data in relation to the Services.

1. This DPA amends the Agreement and will become effective upon execution by both parties.
2. In case of any conflict or inconsistency with the terms of the Agreement and this DPA, this DPA will take precedence over the terms of the Agreement to the extent of such conflict or inconsistency but only with respect to the processing of Personal Data.

1. Personal Data Types and Processing Purposes
1. For purposes of this DPA, Customer is a Controller or Processor and Company is a Processor or Subprocessor.
2. The Customer retains control of the Personal Data and remains responsible for its compliance obligations under Applicable Privacy Law, including providing any required notices and obtaining any required consents, and for the processing instructions it gives to Company.
3. Appendix A describes the general Personal Data categories and related types of Data Subjects Company may process to fulfill the Business Purposes of the Agreementthe duration of the Processing, and the nature and purposes of the Processing. The Customer discloses Personal Data to Company only for the limited and specified Business Purposes.
4. By entering into this DPA, Customer instructs Company to Process Customer Personal Data only in accordance with Applicable Privacy Laws and Customer’s instructions (including with regard to data transfers): (a) to provide the Services; and (b) as authorized by the Agreement, including this DPA. Company may exercise its reasonable discretion in the selection and use of such means it deems necessary to comply with Customer’s instructions and this DPA when Processing Customer Personal Data. Customer shall have the right to take appropriate and reasonable steps to stop any unauthorized Processing of Customer Personal Data.

1. Company's Obligations
1. Company will only process, retain, use, or disclose the Personal Data to the extent, and in such a manner, as is necessary for the Business Purposes in accordance with the Customer's written instructions. Company will not process, retain, use, or disclose the Personal Data for any other purpose, outside of the parties' business relationship, or in a way that does not comply with this DPA, the Agreement or the Applicable Privacy Law. This includes not combining or updating the Personal Data with Personal Data obtained outside of this DPA and the Agreement unless the Applicable Privacy Law or the Agreement permit such action. Company must promptly notify the Customer if, in its opinion, the Customer's instruction would not comply with the Applicable Privacy Law.
2. Company must promptly comply with any Customer request or instruction requiring Company to amend, transfer, or delete the Personal Data, or to stop, mitigate, or remedy any unauthorized processing.
3. Company will maintain the confidentiality of all Personal Data and will not sell it to anyone, share it for cross-context behavioral advertising (targeted advertising) with anyone, or disclose it to third parties without specific authorization from the Customer or this DPA, unless required by law. If a law requires Company to process or disclose Personal Data, Company must first inform the Customer of the legal requirement and give the Customer an opportunity to object or challenge the requirement, unless the law prohibits such notice.
4. Company will reasonably assist the Customer with meeting the Customer's compliance obligations under Applicable Privacy Law, taking into account the nature, scope and risk associated with the Personal Data processed and the information available to Company.
5. Company must promptly notify the Customer of any changes to Applicable Privacy Law that may impact its ability to meet those obligations set forth herein, that may adversely affect Company's performance of the Agreement or this DPA.
6. Customer acknowledges that Company is under no duty to investigate the completeness, accuracy, or sufficiency of any specific Customer instructions or the Personal Data other than as required under the Applicable Privacy Law.
7. Company will only collect Personal Data for Customer using a notice or method that the Customer specifically pre-approves in writing, which contains an approved data privacy notice informing the Data Subject of the Customer's identity, the purpose or purposes for which their Personal Data will be processed, and any other information that is required by Applicable Privacy Law. Company will not modify or alter the notice in any way without the Customer's prior written consent.
8. In addition to the obligations set forth herein, Company will comply with the Customer Specific Requirements set forth in Appendix C.
2. Company's Employee Access
1. Company will limit access to Personal Data to those employees who require Personal Data access to meet Company's obligations under this DPA and the Agreement.
2. Company will ensure that all employees:
1. are informed of the Personal Data's confidential nature and use restrictions and are obliged to keep the Personal Data confidential;
2. have undertaken training on Applicable Privacy Law relating to handling Personal Data and how it applies to their particular duties; and
3. are aware both of Company's duties and their personal duties and obligations under Applicable Privacy Law and this DPA.
3. Company will take reasonable steps to ensure the reliability, integrity, and trustworthiness of all of Company's employees with access to the Personal Data.
3. Security
1. Company must at all times implement appropriate technical and organizational measures designed to safeguard Personal Data against unauthorized or unlawful processing, access, copying, modification, storage, reproduction, display, or distribution, and against accidental loss, destruction, unavailability, or. Company shall document those measures in writing and periodically review them, at least annually, to ensure they remain current and complete.
2. Company shall take reasonable precautions to preserve the integrity of any Personal Data it processes and to prevent any corruption or loss of the Personal Data, including but not limited to establishing effective back-up and data restoration procedures.
4. Security Breaches and Personal Data Loss
1. Company will promptly notify the Customer if any Personal Data is lost or destroyed or becomes damaged, corrupted, or unusable.
2. Company will within seventy-two hours notify the other party if it becomes aware of:
1. any unauthorized or unlawful processing of the Personal Data; or
2. any Security Breach.
3. Promptly following any unauthorized or unlawful Personal Data processing or Security Breach, the parties will co-ordinate with each other to investigate the matter. Company will reasonably co-operate with the Customer in the Customer's handling of the matter, including:
1. assisting with any investigation;
2. providing the Customer with reasonable access to any facilities and operations affected;
3. facilitating interviews with Company's employees, and others involved in the matter; and
4. making available all relevant records, logs, files, data reporting, and other materials required to comply with all Applicable Privacy Law or as otherwise reasonably required by the Customer.
4. Company will not inform any third party of a Security Breach without first obtaining the Customer's prior written consent, except when law or regulation requires it.
5. Company agrees that the Customer has the sole right to determine:
1. whether to provide notice of the Security Breach to any Data Subjects, regulators, law enforcement agencies, or others, as required by law or regulation or in the Customer's discretion, including the contents and delivery method of the notice; and
2. whether to offer any type of remedy provided by Customer to affected Data Subjects, including the nature and extent of such remedy.
5. Cross-Border Transfers of Personal Data
1. Company will not transfer any Personal Data to another country unless the transfer complies with the Applicable Privacy Law and subject to Customer’s agreement to such transfer.
6. Subprocessors
1. Customer specifically authorizes the engagement of Company Affiliates as Subprocessors. To the extent consent is required under this DPA, Customer consents to the subcontracting by Company of the Processing of Customer Personal Data by Company’s current Subprocessors described in Appendix B.
2. Company may disclose Customer Personal Data to an approved Subprocessor, provided that the Subprocessor will comply with Applicable Privacy Laws, and pursuant to a contract requiring that such Subprocessor implements appropriate administrative, technical, and physical measures to ensure Customer Personal Data is Processed in compliance with Applicable Privacy Laws, the Agreement and this DPA. Company shall be liable for all obligations subcontracted to, and all acts and omissions of Company’s Subprocessors.
3. When a new Subprocessor is engaged during the Term, Company will notify Customer of the engagement (including the name and location of the new Subprocessor and the activities it will perform) at least ten (10) days prior to permitting the new Subprocessor from commencing Services provided that Customer has opted-in to receive email notifications.
4. Customer may object to a new Subprocessor by providing written notice to Company within ten (10) business days of the date on the Company notice. In the event Customer objects to a new Subprocessor, Customer and Company will work together in good faith to find a mutually acceptable resolution to address such objection. If the Parties are unable to reach a mutually acceptable resolution within a reasonable timeframe, Customer may, as its sole and exclusive remedy, terminate the use of the effected Services, terminate that portion of the Agreement related to the effected Services, or terminate the Agreement by providing written notice to Company.
7. Term and Termination
1. This DPA will remain in full force and effect so long as:
1. the Agreement remains in effect; or
2. Company retains any Personal Data related to the Agreement in its possession or control (the "Term").
2. Any provision of this DPA that expressly or by implication should come into or continue in force on or after termination of the Agreement in order to protect Personal Data will remain in full force and effect.
3. Either party’s failure to comply with the terms of this DPA is a material breach of the Agreement. In such an event, the aggrieved party may terminate the Agreement, that portion of the Agreement authorizing the processing of Personal Data effective immediately upon written notice to the other party without further liability or obligation.
4. If a change in any Applicable Privacy Law or either party's circumstances prevents a party from fulfilling all or part of its Agreement and these DPA obligations, the parties will suspend the processing of Personal Data until the party's processing complies with the requirements. If the parties are unable to bring the Personal Data processing into compliance with the Applicable Privacy Law, they may terminate the Agreement upon written notice to the other party.
8. Data Return and Destruction
1. At the Customer's request, Company will give the Customer a copy of or access to all or part of the Customer's Personal Data in its possession or control in a format mutually agreed by the parties.
2. On termination of the Agreement for any reason or expiration of its term, Company will securely destroy or, if directed in writing by the Customer, return and not retain, all or any Personal Data related to this agreement in its possession or control, except as otherwise required by Applicable Privacy Law.
3. Company will certify in writing that it has destroyed the Personal Data within 10 DAYS after it completes the destruction.
9. Records
1. Company will keep detailed, accurate, and up-to-date records regarding any processing of Personal Data it carries out for the Customer, including but not limited to, the access, control, and security of the Personal Data, approved Subprocessors and affiliates, the processing purposes, and any other records required by Applicable Privacy Law (the "Records").
2. Company will ensure that the Records are sufficient to enable the Customer to verify Company's compliance with its obligations under this DPA.
3. The Customer and Company must review the information listed in the Appendices to this DPA once a year to confirm its current accuracy and update it when required to reflect current practices.
10. Audit
1. At least once per year, Company will conduct site audits of its Personal Data processing practices and the information technology and information security controls for all facilities and systems used in complying with its obligations under this DPA, including, but not limited to, obtaining a network-level vulnerability assessment performed by a recognized third-party audit firm based on recognized industry best practices.
2. Upon the Customer's written request, Company will make summaries of all of the relevant audit reports available to the Customer for review, including as applicable: Company's latest Service Organization Controls (SOC) Type 1, 2, or 3 audit reports, reports relating to its ISO/IEC 27001 certification, and OTHER AUDIT REPORTS. The Customer will treat such audit reports as Company's confidential information under this Agreement.
3. Company will promptly address any issues, concerns, or exceptions noted in the audit reports with the development and implementation of a corrective action plan by Company's management.
11. Warranties
1. Company warrants and represents that:
1. its employees, Subprocessors, agents, and any other person or persons accessing Personal Data on its behalf are reliable and trustworthy and have received the required training on the Applicable Privacy Law relating to the Personal Data; and
2. it and anyone operating on its behalf will process the Personal Data in compliance with both the terms of this DPA and Applicable Privacy Law and other laws, enactments, regulations, orders, standards, and other similar instruments; and
3. it has no reason to believe that any Applicable Privacy Law prevent it from providing any of the Agreement's contracted services; and
4. considering the current technology environment and implementation costs, it will take appropriate technical and organizational measures to prevent the unauthorized or unlawful processing of Personal Data and the accidental loss or destruction of, or damage to, Personal Data, and ensure a level of security appropriate to:
1. the harm that might result from such unauthorized or unlawful processing or accidental loss, destruction, or damage; and
2. the nature of the Personal Data protected; and
3. comply with all Applicable Privacy Law and its information and security policies, including the security measures required in 5.1.
2. The Customer warrants and represents that Company's expected use of the Personal Data for the Business Purpose and as specifically instructed by the Customer will comply with all Applicable Privacy Law.
12. Notice
1. Any notice or other communication given to a party under or in connection with this DPA must be in writing and delivered in accordance with the Notice provisions in the Agreement.
13. Counterparts and Electronic Signatures
1. This DPA may be executed in one or more counterparts, each of which shall be deemed an original, and all of which together shall constitute one and the same instrument. The parties agree that electronic signatures shall be deemed original signatures for all purposes and that this DPA may be executed and delivered electronically.

[SIGNATURE PAGE FOLLOWS]

IN WITNESS WHEREOF, the Parties hereto have executed this Agreement as of the date set forth above.

APPENDIX A

Personal Data Processing Purposes and Details

Business Purposes: [BUSINESS PURPOSES]

Personal Data Categories: [PERSONAL DATA CATEGORIES]

Data Subject Types: [DATA SUBJECT TYPES]

Processing Duration: [TIME]

Approved Subprocessors: [APPROVED SUBPROCESSORS]

[Countries where Company may receive, access, transfer or store Personal Data: [COUNTRIES]

APPENDIX B

Subprocessors

APPENDIX C

CUSTOMER SPECIFIC REQUIREMENTS

HEALTHCARE

This Appendix C - Healthcare amends and supplements the DPA. In the event of any conflict or inconsistency between the terms of this Appendix C - Healthcare and the DPA, the terms of this Appendix C – Healthcare shall govern and control in regard to the Processing of Personal Health Data.

If Company’s processing of Sensitive Personal Data includes the processing of Protected Health Information supplied by Customer as a Covered Entity under HIPAA the Parties agree to the Business Associate Agreement terms set forth in Exhibit 1 to this Appendix C. If Company’s processing of Sensitive Personal Data includes Processing restricted Protected Health Information and Limited Data Sets under HIPAA, the Parties agree to the Combined Business Associate and Data Use Agreement terms set forth in Exhibit 2 to this Appendix C.

Exhibit 1 to Appendix D

Business Associate Agreement

HIPAA Business Associate Agreement

1. PREAMBLE AND DEFINITIONS.

1.1 Pursuant to the Health Insurance Portability and Accountability Act of 1996, as amended (”HIPAA”), Customer (”Covered Entity”) and Juvo Care, Inc., or any of its corporate affiliates (”Business Associate”), enter into this Business Associate Agreement (”BAA”) as of the date of last signature (the “Effective Date”) that addresses the HIPAA requirements with respect to “business associates,” as defined under the privacy, security, breach notification, and enforcement rules at 45 C.F.R. Part 160 and Part 164 (”HIPAA Rules”). A reference in this BAA to a section in the HIPAA Rules means the section as in effect or as amended.

1.2 This BAA is intended to ensure that Business Associate will establish and implement appropriate safeguards for the Protected Health Information (”PHI”) (as defined under the HIPAA Rules) that Business Associate may receive, create, maintain, use, or disclose in connection with the functions, activities, and services that Business Associate performs for Covered Entity. The functions, activities, and services that Business Associate performs for Covered Entity are defined in the Agreement (the “Underlying Agreement”).

1.3 Consistent with the Health Information Technology for Economic and Clinical Health Act of 2009 (the “HITECH Act”) and the American Recovery and Reinvestment Act of 2009 (”ARRA”), this BAA also reflects federal breach notification requirements imposed on Business Associate when “Unsecured PHI” (as defined under the HIPAA Rules) is acquired by an unauthorized party, and the expanded privacy and security provisions imposed on business associates.

1.4 Unless the context clearly indicates otherwise, the following terms in this BAA shall have the same meaning as those terms in the HIPAA Rules: Breach, Data Aggregation, Designated Record Set, disclosure, Electronic Media, Electronic Protected Health Information (ePHI), Health Care Operations, individual, Minimum Necessary, Notice of Privacy Practices, Required By Law, Secretary, Security Incident, Subcontractor, Unsecured PHI, and use.

1.5 A reference in this BAA to the Privacy Rule means the Privacy Rule, in conformity with the regulations at 45 C.F.R. Parts 160-164 (the “Privacy Rule”) as interpreted under applicable regulations and guidance of general application published by HHS, including all amendments thereto for which compliance is required, as amended by the HITECH Act, ARRA, and the HIPAA Rules.

2. GENERAL OBLIGATIONS OF BUSINESS ASSOCIATE.

2.1 Business Associate agrees not to use or disclose PHI, other than as permitted or required by this BAA or as Required By Law, or if such use or disclosure does not otherwise cause a Breach of Unsecured PHI.

2.2 Business Associate agrees to use appropriate safeguards, and comply with Subpart C of 45 C.F.R. Part 164 with respect to ePHI, to prevent the use or disclosure of PHI other than as provided for by the BAA.

2.3 Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to Business Associate as a result of a use or disclosure of PHI by Business Associate in violation of this BAA’s requirements or that would otherwise cause a Breach of Unsecured PHI.

2.4 Business Associate agrees to the following breach notification requirements:

(a) Business Associate agrees to report to Covered Entity any Breach of Unsecured PHI not provided for by the BAA of which it becomes aware within sixty (60) calendar days of “discovery” within the meaning of the HITECH Act. Such notice shall include the identification of each individual whose Unsecured PHI has been, or is reasonably believed by Business Associate to have been, accessed, acquired, or disclosed in connection with such Breach. Business Associate also shall provide any additional information reasonably requested by Covered Entity for purposes of investigating the Breach and any other available information that Covered Entity is required to include to the individual under 45 C.F.R. § 164.404(c) at the time of notification or promptly thereafter as information becomes available. Business Associate’s notification of a Breach of Unsecured PHI under this Section shall comply in all respects with each applicable provision of Section 13400 of Subtitle D (Privacy) of ARRA, the HIPAA Rules, and related guidance issued by the Secretary or the delegate of the Secretary from time to time.

(b) In the event of Business Associate’s use or disclosure of Unsecured PHI in violation of HIPAA, the HITECH Act, or ARRA, Business Associate bears the burden of demonstrating that notice as required under this Section 2.4 was made, including evidence demonstrating the necessity of any delay, or that the use or disclosure did not constitute a Breach of Unsecured PHI.

2.5 Business Associate agrees, in accordance with 45 C.F.R. §§ 164.502(e)(1)(ii) and 164.308(b)(2), if applicable, to require that any Subcontractors that create, receive, maintain, or transmit PHI on behalf of the Business Associate agree to the same restrictions, conditions, and requirements that apply to the Business Associate with respect to such information.

2.6 Business Associate agrees to make available PHI in a Designated Record Set to the covered entity as necessary to satisfy Covered Entity’s obligations under 45 C.F.R. § 164.524.

(a) Business Associate agrees to comply with an individual’s request to restrict the disclosure of their personal PHI in a manner consistent with 45 C.F.R. § 164.522, except where such use, disclosure, or request is required or permitted under applicable law.

(b) Business Associate agrees to charge fees related to providing individuals with access to their PHI in accordance with 45 C.F.R. § 164.524(c)(4).

(c) Business Associate agrees that when requesting, using, or disclosing PHI in accordance with 45 C.F.R. § 164.502(b)(1) that such request, use, or disclosure shall be to the minimum extent necessary, including the use of a “limited data set” as defined in 45 C.F.R. § 164.514(e)(2), to accomplish the intended purpose of such request, use, or disclosure, as interpreted under related guidance issued by the Secretary from time to time.

2.7 Business Associate agrees to make any amendments to PHI in a Designated Record Set as directed or agreed to by the Covered Entity pursuant to 45 C.F.R. § 164.526, or to take other measures as necessary to satisfy Covered Entity’s obligations under 45 C.F.R. § 164.526.

2.8 Business Associate agrees to maintain and make available the information required to provide an accounting of disclosures to the Covered Entity as necessary to satisfy Covered Entity’s obligations under 45 C.F.R. § 164.528.

2.9 Business Associate agrees to make its internal practices, books, and records, including policies and procedures regarding PHI, relating to the use and disclosure of PHI and Breach of any Unsecured PHI received from Covered Entity, or created or received by the Business Associate on behalf of Covered Entity, available to Covered Entity (or the Secretary) for the purpose of Covered Entity or the Secretary determining compliance with the Privacy Rule (as defined in Section 1.5).

2.10 To the extent that Business Associate is to carry out one or more of Covered Entity’s obligation(s) under Subpart E of 45 C.F.R. Part 164, Business Associate agrees to comply with the requirements of Subpart E that apply to the Covered Entity in the performance of such obligation(s).

2.11 Business Associate agrees to account for the following disclosures:

(a) Business Associate agrees to maintain and document disclosures of PHI and Breaches of Unsecured PHI and any information relating to the disclosure of PHI and Breach of Unsecured PHI in a manner that would be required for Covered Entity to respond to a request by an individual or the Secretary for an accounting of PHI disclosures and Breaches of Unsecured PHI.

(b) Business Associate agrees to provide to Covered Entity, or to an individual at Covered Entity’s request, information collected in accordance with this Section 2.11, to permit Covered Entity to respond to a request by an individual or the Secretary for an accounting of PHI disclosures and Breaches of Unsecured PHI.

(c) Business Associate agrees to account for any disclosure of PHI used or maintained as an Electronic Health Record (as defined in Section 5) (”EHR”) in a manner consistent with 45 C.F.R. § 164.528 and related guidance issued by the Secretary from time to time; provided that an individual shall have the right to receive an accounting of disclosures of EHR by the Business Associate made on behalf of the Covered Entity only during the three years prior to the date on which the accounting is requested directly from the Business Associate.

(d) In the case of an EHR that the Business Associate acquired on behalf of the Covered Entity as of January 1, 2009, paragraph (c) above shall apply to disclosures with respect to PHI made by the Business Associate from such EHR on or after January 1, 2014. In the case of an EHR that the Business Associate acquires on behalf of the Covered Entity after January 1, 2009, paragraph (c) above shall apply to disclosures with respect to PHI made by the Business Associate from such EHR on or after the later of January 1, 2011, or the date that it acquires the EHR.

2.12 Business Associate agrees to comply with the “Prohibition on Sale of Electronic Health Records or Protected Health Information,” as provided in Section 13405(d) of Subtitle D (Privacy) of ARRA, and the “Conditions on Certain Contacts as Part of Health Care Operations,” as provided in Section 13406 of Subtitle D (Privacy) of ARRA and related guidance issued by the Secretary from time to time.

2.13 Business Associate acknowledges that, effective on the Effective Date of this BAA, it shall be liable under the civil and criminal enforcement provisions set forth at 42 U.S.C. § 1320d-5 and 1320d-6, as amended, for failure to comply with any of the use and disclosure requirements of this BAA and any guidance issued by the Secretary from time to time with respect to such use and disclosure requirements.

3.2 Business Associate may use or disclose PHI as Required By Law.

3.3 Business Associate agrees to make uses and disclosures and requests for PHI: Consistent with Covered Entity’s Minimum Necessary policies and procedures.

3.4 Business Associate may not use or disclose PHI in a manner that would violate Subpart E of 45 C.F.R. Part 164 if done by the Covered Entity.

4. OBLIGATIONS OF COVERED ENTITY.

<4.1 Covered Entity shall:

(a) Provide the Business Associate with the Notice of Privacy Practices that Covered Entity produces in accordance with the Privacy Rule, and any changes or limitations to such notice under 45 C.F.R. § 164.520, to the extent that such changes or limitations may affect Business Associate’s use or disclosure of PHI.

(b) Notify Business Associate of any restriction on the use or disclosure of PHI that Covered Entity has agreed to or is required to comply with under 45 C.F.R. § 164.522, to the extent that such restriction may affect Business Associate’s use or disclosure of PHI under this BAA.

(c) Notify Business Associate of any changes in or revocation of permission by an individual to use or disclose PHI, if such change or revocation may affect Business Associate’s permitted or required uses and disclosures of PHI under this BAA.

4.2 Covered Entity shall not request Business Associate to use or disclose PHI in any manner that would not be permissible under the Privacy and Security Rule if done by Covered Entity, except as provided under Section 3of this BAA.

5. COMPLIANCE WITH SECURITY RULE.

5.1 Business Associate shall comply with the HIPAA Security Rule, which shall mean the Standards for Security of Electronic Protected Health Information at 45 C.F.R. Part 160 and Subparts A and C of Part 164, as amended by ARRA and the HITECH Act. The term “Electronic Health Record” or “EHR” as used in this BAA shall mean an electronic record of health-related information on an individual that is created, gathered, managed, and consulted by authorized health care clinicians and staff.

5.2 In accordance with the Security Rule, Business Associate agrees to:

(a) Implement the administrative safeguards set forth at 45 C.F.R. § 164.308, the physical safeguards set forth at 45 C.F.R. § 164.310, the technical safeguards set forth at 45 C.F.R. § 164.312, and the policies and procedures set forth at 45 C.F.R. § 164.316, to reasonably and appropriately protect the confidentiality, integrity, and availability of the ePHI that it creates, receives, maintains, or transmits on behalf of Covered Entity as required by the Security Rule. Business Associate acknowledges that, effective on the Effective Date of this BAA: (a) the foregoing safeguards, policies, and procedures requirements shall apply to Business Associate in the same manner that such requirements apply to Covered Entity; and (b) Business Associate shall be liable under the civil and criminal enforcement provisions set forth at 42 U.S.C. § 1320d-5 and 1320d-6, as amended from time to time, for failure to comply with the safeguards, policies, and procedures requirements and any guidance issued by the Secretary from time to time with respect to such requirements;

(b) Require that any agent, including a Subcontractor, to whom it provides such PHI agrees to implement reasonable and appropriate safeguards to protect the PHI; and

(c) Report to the Covered Entity any Security Incident of which it becomes aware.

6. INDEMNIFICATION.

The parties agree and acknowledge that except as set forth herein, the indemnification obligations contained under the Agreement shall govern each party’s performance under this BAA.

Notwithstanding the foregoing, nothing in this Section shall limit any rights that any of the Indemnified Parties may have to additional remedies under the Underlying Agreement or under applicable law for any acts or omissions of Business Associate or its agents or Subcontractors.

7. TERM AND TERMINATION.

7.1 This BAA shall remain in effect from the Effective Date, and shall terminate on the earlier of the date that:

(a) Either party terminates for cause as authorized under Section 7.2.

(b) All of the PHI received from Covered Entity, or created or received by Business Associate on behalf of Covered Entity, is destroyed or returned to Covered Entity. If it is not feasible to return or destroy PHI, protections are extended in accordance with Section 7.3.

7.2 Upon either party’s knowledge of material breach by the other party, the non-breaching party shall provide an opportunity for the breaching party to cure the breach or end the violation; or terminate the BAA. If the breaching party does not cure the breach or end the violation within a reasonable timeframe not to exceed thirty (30) days from the notification of the breach, or if a material term of the BAA has been breached and a cure is not possible, the non-breaching party may terminate this BAA and the Agreement, upon written notice to the other party.

7.3 Upon termination of this BAA for any reason, the parties agree that:

Upon termination of this BAA for any reason, Business Associate, with respect to PHI received from Covered Entity, or created, maintained, or received by Business Associate on behalf of Covered Entity, shall:

(a) Retain only that PHI that is necessary for Business Associate to continue its proper management and administration or to carry out its legal responsibilities.

(b) Return to Covered Entity or, if agreed to by Covered Entity, destroy the remaining PHI that the Business Associate still maintains in any form.

(c) Continue to use appropriate safeguards and comply with Subpart C of 45 C.F.R. Part 164 with respect to ePHI to prevent use or disclosure of the PHI, other than as provided for in this Section 7, for as long as Business Associate retains the PHI.

(d) Not use or disclose the PHI retained by Business Associate other than for the purposes for which such PHI was retained and subject to the same conditions set out at paragraphs (2) and (3) above which applied prior to termination.

(e) Return to Covered Entity or, if agreed to by Covered Entity, destroy the PHI retained by Business Associate when it is no longer needed by Business Associate for its proper management and administration or to carry out its legal responsibilities.

7.4 The obligations of Business Associate under this Section 7 shall survive the termination of this BAA.

8. MISCELLANEOUS.

8.1 The parties agree to take such action as is necessary to amend this BAA to comply with the requirements of the HIPAA, ARRA, the HITECH Act, the Consolidated Appropriations Act, 2021 (CAA-21), the HIPAA Rules, and any other applicable law.

8.2 The respective rights and obligations of Business Associate under Section 6and Section 7 of this BAA shall survive the termination of this BAA.

8.3 This BAA shall be interpreted in the following manner:

(a) Any ambiguity shall be resolved in favor of a meaning that permits Covered Entity to comply with the HIPAA Rules.

(b) Any inconsistency between the BAA’s provisions and the HIPAA Rules, including all amendments, as interpreted by the HHS, a court, or another regulatory agency with authority over the Parties, shall be interpreted according to the interpretation of the HHS, the court, or the regulatory agency.

(c) Any provision of this BAA that differs from those required by the HIPAA Rules, but is nonetheless permitted by the HIPAA Rules, shall be adhered to as stated in this BAA.

8.4 This BAA constitutes the entire agreement between the parties related to the subject matter of this BAA, except to the extent that the Agreement imposes more stringent requirements related to the use and protection of PHI upon Business Associate. This BAA supersedes all prior negotiations, discussions, representations, or proposals, whether oral or written. This BAA may not be modified unless done so in writing and signed by a duly authorized representative of both parties. If any provision of this BAA, or part thereof, is found to be invalid, the remaining provisions shall remain in effect.

8.5 This BAA will be binding on the successors and assigns of the Covered Entity and the Business Associate. However, this BAA may not be assigned, in whole or in part, without the written consent of the other party. Any attempted assignment in violation of this provision shall be null and void.

8.6 This BAA may be executed in two or more counterparts, each of which shall be deemed an original.

8.7 Except to the extent preempted by federal law, this BAA shall be governed by and construed in accordance with the laws of the state of Delaware.

IN WITNESS WHEREOF, the parties hereto have executed this BAA as of the date first above written.

Exhibit 2 to Appendix C

Combined Business Associate and Data Use Agreement

This Combined Business Associate and Data Use Agreement ("Agreement") is entered into by and between Juvo Care, Inc. ("Covered Entity") and the Customer identified in the business associate signature block below ("Business Associate"), effective as of the date of last execution hereof ("Effective Date").

RECITALS

•Covered Entity is a "covered entity" as defined under the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") and its implementing regulations (45 C.F.R. Parts 160 and 164).

•Business Associate provides certain services to Covered Entity that involve the use, disclosure, creation, or receipt of Protected Health Information ("PHI").

•The Parties also intend for Business Associate to use or disclose a Limited Data Set ("LDS") derived from the PHI for specific purposes permitted under HIPAA.

•The Parties desire to enter into this Agreement to satisfy the requirements of both a Business Associate Agreement (45 C.F.R. § 164.504(e)) and a Data Use Agreement (45 C.F.R. § 164.514(e)).

SECTION 1: DEFINITIONS

Terms used, but not otherwise defined, in this Agreement shall have the same meaning as those terms in the HIPAA Privacy, Security, Breach Notification, and Enforcement Rules (45 C.F.R. Parts 160 and 164).

SECTION 2: BUSINESS ASSOCIATE TERMS (BAA)

2.1 Permitted Uses and Disclosures

Business Associate may use or disclose PHI only as necessary to perform the services set forth in the underlying Service Agreement, as permitted or required by this Agreement, or as Required By Law.

2.2 Safeguards

Business Associate shall use appropriate safeguards, and comply with Subpart C of 45 C.F.R. Part 164 with respect to electronic PHI, to prevent use or disclosure of PHI other than as provided for by this Agreement.

2.3 Reporting of Unauthorized Uses, Disclosures, or Breaches

Business Associate shall report to Covered Entity any use or disclosure of PHI not provided for by this Agreement of which it becomes aware, including breaches of unsecured PHI as required at 45 C.F.R. § 164.410, and any security incident of which it becomes aware, within [Number, e.g., 5] business days of discovery.

2.4 Subcontractors

In accordance with 45 C.F.R. §§ 164.502(e)(1)(ii) and 164.504(e)(1)(ii), Business Associate shall ensure that any subcontractors that create, receive, maintain, or transmit PHI on behalf of the Business Associate agree to the same restrictions and conditions that apply to the Business Associate with respect to such information.

2.5 Access to Books and Records

Business Associate shall make its internal practices, books, and records available to the Secretary of the Department of Health and Human Services (HHS) for purposes of determining compliance with the HIPAA Rules.

SECTION 3: DATA USE TERMS (DUA)

3.1 Permitted Uses and Disclosures of the Limited Data Set

Business Associate is authorized to create, use, and disclose a Limited Data Set (LDS) in compliance with 45 C.F.R. § 164.514(e) solely for the purposes of [Specify purposes, e.g., research, public health, or health care operations].

3.2 Prohibited Identification and Contact

The Business Associate shall not re-identify the information in the LDS or contact the individuals who are the subjects of the PHI.

3.3 LDS Safeguards

Business Associate shall use appropriate safeguards to prevent use or disclosure of the LDS other than as provided for by this Agreement.

3.4 Subcontractors and Agents

Business Associate shall ensure that any agent or subcontractor to whom it provides the LDS agrees to the same restrictions and conditions that apply to the Business Associate under this Section 3.

SECTION 4: TERM AND TERMINATION

4.1 Term

The Term of this Agreement shall be effective as of the Effective Date and shall terminate when all PHI and LDS provided by Covered Entity, or created or received by Business Associate, is destroyed or returned to Covered Entity.

4.2 Termination for Cause

Upon Covered Entity’s knowledge of a material breach by Business Associate, Covered Entity shall provide an opportunity to cure the breach. If Business Associate does not cure the breach within [Number, e.g., 30] days, Covered Entity may terminate this Agreement and the underlying Service Agreement.

4.3 Effect of Termination

Upon termination of this Agreement for any reason, Business Associate shall return or destroy all PHI and LDS received from Covered Entity, or created/maintained by Business Associate. If return or destruction is infeasible, Business Associate shall extend the protections of this Agreement to such information and limit further uses and disclosures to those purposes that make the return or destruction infeasible.

IN WITNESS WHEREOF, the Parties hereto have executed this Agreement as of the Effective Date.

COVERED ENTITY:

Signature: __________________________

Name/Title: _________________________

Date: _____________________________

BUSINESS ASSOCIATE:

Signature: __________________________

Name/Title: _________________________

Date: _____________________________

APPENDIX D

Security Measures

Juvo Care, Inc. Security Policy

Introduction

At Juvo Care, Inc. (“Company”), protecting our data and the data of our customers and suppliers (collectively “Company Data”) is a top priority. This Information Security Policy outlines how we safeguard sensitive information, the responsibilities of our employees, and the key security practices we follow. By adhering to this policy, we aim to minimize security risks and ensure that our business operates safely and securely.

Scope

This policy applies to all employees, contractors, vendors, and anyone else with access to Company Data.

Objectives

The purpose of this Information Security Policy is to ensure that we:

●Protect the confidentiality, integrity, and availability of sensitive information.

●Prevent unauthorized access to Company Data and systems.

●Provide clear guidelines on how employees and contractors should manage and protect Company Data.

●Ensure compliance with relevant US federal and state privacy laws and regulations (e.g., CCPA).

●Build a strong culture of security awareness within the Company.

Definitions

At Company, we handle various types of sensitive information, which must be protected at all times. Below are the key categories of sensitive information:

●Personally Identifiable Information (PII): Information that can be used to identify an individual, such as names, addresses, email addresses, phone numbers, and in certain circumstances identification numbers.

●Financial Data: Information related to financial transactions, including bank account details, credit card information, and payment history.

●Customer Data: Any data provided by our customers, including their personal, financial, or business information.

●Company Confidential Information: Internal business data, such as contracts, business plans, pricing models, proprietary information, and employee records.

Employee Responsibilities

Every employee at Company has a role to play in protecting sensitive data. Employees must:

●Follow Security Practices: Adhere to all company security practices, including the guidelines in this policy.

●Report Security Incidents: Promptly report any suspected security incidents (e.g., data breaches, unauthorized access) to the IT team or manager using the appropriate communication channels.

●Handle Data with Care: Treat sensitive information with caution, avoiding accidental exposure or sharing with unauthorized individuals.

●Use Strong Passwords: Follow the password management guidelines in this policy to ensure passwords are secure and not easily guessed or hacked.

●Limit Data Sharing: Only share sensitive information with authorized team members or external partners who have a legitimate need to know.

●Avoid Unauthorized Software: Do not download or install unauthorized software or applications on company devices, as these may introduce security vulnerabilities.

Failure to comply with these responsibilities can result in disciplinary action, including potential termination of employment.

Access Control Guidelines

We implement access controls to ensure that sensitive information is only accessible to authorized employees. Here's how we manage access:

●Role-Based Access: Employees and contractors are granted access to systems and data based on their specific roles within the Company. Access to sensitive data (e.g., financial, PII) is limited to employees and contractors who need it to perform their job duties.

●Least Privilege: Employees and contractors are only given the minimum level of access necessary to complete their work. This minimizes the risk of unauthorized data access or modification.

●Access Review: Access levels are reviewed regularly to ensure that employees and contractors only have access to the systems and data they need. When an employee’s or contractor’s role changes or they leave the Company, their access is updated or revoked immediately.

●Multi-Factor Authentication (MFA): For systems containing sensitive information, we require multi-factor authentication to add an additional layer of security.

●Remote Access: Employees and contractors accessing Company systems remotely must do so through a secure, encrypted connection (e.g., VPN).

Security Practices

At Company, we implement a range of security practices to protect our systems and data. These practices help reduce the risk of unauthorized access, data breaches, and cyberattacks.

●Data Encryption: All sensitive data must be encrypted when stored or transmitted (TLS 1.2+). This ensures that even if data is intercepted, it cannot be easily read or used.

●Regular Software Updates: We regularly update software and systems to patch security vulnerabilities and protect against the latest threats. Employees and contractors with access must ensure their devices are up to date at all times.

●Access controls (least privilege, passwordless single-use authentication for Users, multi-factor authentication for Company employees and contractors);

●Logical separation between User content and Buyer-facing billing data, enforced at the database layer;

●Separation between production, staging, and development environments;

●Continuous vulnerability scanning and third-party penetration testing — most recent third-party penetration test with no unresolved critical or high finding;

●Logging and monitoring of access to systems that store Company Data;

●Endpoint Security: Company devices (e.g., laptops, phones) must be protected by security software such as antivirus programs and firewalls. Employees and contractors should not disable or bypass these protections.

●Data Backup: Sensitive data is regularly backed up to ensure that we can recover it in case of hardware failure, ransomware, or accidental deletion.

●Incident Response: In the event of a security incident, our incident response process outlines the steps we take to contain, investigate, and resolve the issue, including providing User notification.

●Employee Training: We provide regular security training to employees and contractors to ensure they understand the risks and best practices for protecting sensitive information.

●No User passwords are created, transmitted, or stored, which removes password reuse and credential-database compromise as attack paths.

Company is pursuing SOC 2 Type I audit-readiness as part of our initial launch which should be available [insert a date].

Password Management

Strong passwords are essential to protecting access to our systems and data. Here are our password management guidelines:

●Password Complexity: Passwords must be at least [INSERT MINIMUM LENGTH] characters long and contain a mix of uppercase letters, lowercase letters, numbers, and special characters.

●Password Storage: Employees and contractors must not share their passwords or store them in unsecured places (e.g., on sticky notes, in plain text files). We recommend using a password manager to store passwords securely.

●Password Changes: Passwords must be changed regularly, at least every [INSERT FREQUENCY]. If an employee or contractor suspects their password has been compromised, they must change it immediately.

●Account Lockout: After a certain number of failed login attempts, user accounts will be locked to prevent unauthorized access. Employees and contractors should contact IT to unlock their account if this happens.

●Multi-Factor Authentication (MFA): For systems containing sensitive data, we require employees to use multi-factor authentication (e.g., a password plus a text message code or authentication app).