Business Associate Addendum

1. Applicability and Precedence

1.1 When it applies. This Addendum applies only to the extent that (a) Firm is a Covered Entity, or a Business Associate of a Covered Entity, and (b) Comitie creates, receives, maintains or transmits Protected Health Information on Firm's behalf in providing the Covered Services.

1.2 Firm as a Business Associate. Where Firm is itself a Business Associate, this Addendum is the written agreement between a business associate and its subcontractor required by 45 CFR §164.502(e)(1)(ii) and §164.504(e)(5). Comitie's obligations then run to Firm as they would to a Covered Entity.

1.3 Precedence. If this Addendum conflicts with the Terms, an Order Form or any other agreement between the parties on the treatment of PHI, this Addendum controls.

2. Definitions

2.1 HIPAA terms. Capitalized terms used but not defined here have the meanings given in the HIPAA Rules, including Breach, Business Associate, Covered Entity, Designated Record Set, Individual, Minimum Necessary, Required by Law, Secretary, Security Incident, Subcontractor and Unsecured Protected Health Information.

2.2 Other terms used here:

• "HIPAA Rules" means the Privacy, Security, Breach Notification and Enforcement Rules at 45 CFR Parts 160 and 164, as amended, including by the HITECH Act.
• "PHI" means Protected Health Information, as defined at 45 CFR §160.103, that Comitie creates, receives, maintains or transmits on behalf of Firm through the Covered Services. It includes electronic PHI. It does not include information processed through Excluded Services.
• "Covered Services" has the meaning in Section 3.
• "Excluded Services" has the meaning in Section 4.
• "Discovery" means the first day on which a Breach or Security Incident is known to Comitie, or by exercising reasonable diligence would have been known to any workforce member or agent of Comitie, as described at 45 CFR §164.410(a)(2).

3. Covered Services

The Covered Services are the parts of the IntakeIQ service that Comitie operates on its own systems for Firm:

• (a) Web intake forms, including forms embedded on Firm's website, the AI intake chat, and follow-up forms reached from a link Comitie sends.
• (b) AI case scoring, summaries, the employment timeline and similar-case retrieval.
• (c) Documents and files uploaded to the Service.
• (d) The client portal and portal messages.
• (e) The scheduler, consultations and bookings.
• (f) Contracts and electronic signature performed within the Service.
• (g) Payment requests, as far as Comitie's own systems are concerned.
• (h) Email triage, for messages Comitie receives or reads on Firm's behalf.
• (i) The case AI assistant.
• (j) Notifications and emails that Comitie sends on Firm's behalf.
• (k) Inquiries from OrignIQ event pages that are delivered into IntakeIQ.

4. Excluded Services

4.1 The AI Phone Assistant

The phone assistant answers Firm's calls and takes messages. Its calls are carried by Twilio and its conversations are handled by ElevenLabs. Comitie does not have a business associate agreement with either company.

• What is excluded. Call audio, which is not recorded; live transcription; the transcript that ElevenLabs keeps for 7 days; the transcripts, messages, summaries, suggested next steps and intake records Comitie generates from a call; and test calls.
• How Comitie still protects them. Comitie applies the same security safeguards to those records once they are stored in its own systems, but they are not PHI under this Addendum.
• Callers may share health details anyway. Callers may volunteer health information, and the assistant may ask whether anyone was hurt or, when Firm turns on practice-area questions, whether a caller has seen a doctor.
• Firm's choice. Firm decides whether to switch the phone assistant on and which questions it asks.

Information a caller later submits through a web form, the client portal or another Covered Service is covered, even if the matter began with a call.

4.2 Third-Party Services Firm Connects

These are services Firm connects to its own account, including Google (Gmail, Google Calendar), Microsoft (Outlook mail and calendar), DocuSign, Clio, Docketwise, INSzoom, Lawmatics, and any other integration Firm enables. Comitie sends information to these services only at Firm's direction. Each is Firm's vendor, not Comitie's Subcontractor, and Firm is responsible for its own agreements with them. Comitie's handling of the information until it is transmitted is covered.

4.3 Payment Processing

Stripe processes payments. Comitie sends Stripe only the information needed to process a payment, consistent with Section 1179 of the Social Security Act.

4.4 Processing in Firm's Own Cloud Account

Some firms choose to run AI scoring in their own AWS account. That processing is under Firm's own agreement with AWS.

4.5 Email After Delivery

Once an email Comitie sends reaches the recipient's mail provider, it is outside the Covered Services. Firm chooses which of its members receive notifications.

4.6 OrignIQ Public Records and Comitie's Websites

These do not involve PHI.

5. Permitted and Required Uses and Disclosures

5.1 For the Service. Comitie may use and disclose PHI only to perform the Covered Services under the Terms, as this Addendum permits, or as Required by Law.

5.2 Management and administration. Comitie may use PHI for its proper management and administration and to carry out its legal responsibilities. It may disclose PHI for those purposes if either the disclosure is Required by Law, or Comitie obtains reasonable assurances that the recipient will hold the PHI confidentially, use or further disclose it only as Required by Law or for the purpose for which it was disclosed, and notify Comitie of any instance in which its confidentiality has been breached (45 CFR §164.504(e)(4)).

5.3 De-identification. Comitie may de-identify PHI in accordance with 45 CFR §164.514(a)–(c). It may use de-identified information as permitted by Section 5.3 of the Terms.

5.4 Minimum necessary. Comitie will request, use and disclose only the Minimum Necessary PHI for the purpose.

5.5 Prohibited uses. Comitie will not:

• (a) use or disclose PHI in a manner that would violate Subpart E of 45 CFR Part 164 if done by Firm, except as Sections 5.2 and 5.3 permit;
• (b) sell PHI, or use or disclose PHI for marketing;
• (c) use PHI to train or fine-tune any artificial intelligence model, or allow a Subcontractor to do so;
• (d) provide data aggregation services using Firm's PHI, unless the parties agree in writing.

5.6 Location. Comitie stores and processes PHI only in the United States.

5.7 Firm's Privacy Rule obligations. To the extent Comitie carries out an obligation of Firm under Subpart E of 45 CFR Part 164, Comitie will comply with the requirements of Subpart E that apply to Firm in performing that obligation.

6. Safeguards

6.1 Security Rule. Comitie will use appropriate administrative, physical and technical safeguards, and comply with Subpart C of 45 CFR Part 164 for electronic PHI, to prevent use or disclosure of PHI other than as this Addendum provides.

6.2 Current safeguards. These include, without limitation:

• encryption of PHI at rest and in transit;
• additional field-level encryption of intake contact details and answers under keys specific to Firm;
• access controls that limit each firm's users to that firm's data;
• audit logging;
• hosting on HIPAA-eligible services of Amazon Web Services;
• written security policies and a documented risk analysis.

Comitie may change specific safeguards, provided the overall level of protection is not reduced.

7. Subcontractors

7.1 Flow-down. In accordance with 45 CFR §164.502(e)(1)(ii) and §164.308(b)(2), Comitie will ensure that any Subcontractor that creates, receives, maintains or transmits PHI on Comitie's behalf agrees in writing to the same restrictions, conditions and requirements that apply to Comitie under this Addendum.

7.2 Current Subcontractors. Comitie's Subcontractors are listed in Schedule A.

7.3 New Subcontractors. Comitie will update Schedule A at least 30 days before a new Subcontractor begins to receive PHI.

8. Reporting

8.1 Breaches. Comitie will report to Firm any Breach of Unsecured PHI without unreasonable delay, and in no case later than ten (10) business days after Discovery. The report will include, to the extent known, the information required by 45 CFR §164.410(c):

• the identification of each Individual affected;
• a description of what happened, including the date of the Breach and the date of Discovery;
• the types of PHI involved;
• steps Individuals should take to protect themselves;
• what Comitie is doing in response;
• contact information.

Comitie will supplement the report as further information becomes available.

8.2 Security Incidents. Comitie will report to Firm any Security Incident that results in unauthorized access to, or use, disclosure, modification or destruction of, PHI, within the time in Section 8.1. The parties agree that this Section is notice of the ongoing existence of unsuccessful Security Incidents, for which no further report is required: for example, pings and port scans, blocked log-in attempts, and denial-of-service attempts that do not result in unauthorized access to PHI.

8.3 Other uses and disclosures. Comitie will report to Firm any use or disclosure of PHI not provided for by this Addendum, within the time in Section 8.1.

8.4 Mitigation. Comitie will mitigate, to the extent practicable, any harmful effect known to Comitie of a use or disclosure of PHI in violation of this Addendum.

8.5 Notices to Individuals, regulators and the media. Firm, or its Covered Entity, is responsible for deciding on and giving notices to Individuals, the Secretary and the media, unless Firm delegates that to Comitie in writing. Comitie will cooperate with and assist Firm in giving them.

8.6 Where reports go. Comitie sends reports to Firm's administrator users and to the contact email in Firm's account settings.

9. Individuals' Rights

9.1 Access. To the extent Comitie maintains PHI in a Designated Record Set, Comitie will, within fifteen (15) days of Firm's request, make that PHI available to Firm so that Firm can meet its obligations under 45 CFR §164.524. Firm's users can also view PHI and download uploaded files directly in the Service.

9.2 Amendment. Within fifteen (15) days of Firm's request, Comitie will make any amendment to PHI in a Designated Record Set that Firm directs under 45 CFR §164.526.

9.3 Accounting. Comitie will document the disclosures of PHI that 45 CFR §164.528 requires to be accounted for. It will give Firm the information Firm needs to respond to a request for an accounting within thirty (30) days of Firm's request.

9.4 Requests made to Comitie. If an Individual asks Comitie directly for access, amendment or an accounting, Comitie will forward the request to Firm within ten (10) business days and will not respond to the Individual except as Firm directs.

10. Term, Termination, and Return or Destruction

10.1 Term. This Addendum takes effect when Firm accepts it (Section 13). It continues until the Terms end and all PHI has been returned or destroyed under Section 10.3.

10.2 Termination for breach. Either party may terminate the Terms, and with them this Addendum, if the other party violates a material term of this Addendum and does not cure the violation within thirty (30) days of written notice. If a cure is not possible, the party may terminate immediately on written notice.

10.3 Return or destruction. When the Terms end:

• (a) During the Retrieval Period in Section 12.3 of the Terms, Firm may export its data, or ask Comitie to provide an export of its PHI in a commonly used electronic format.
• (b) Within ninety (90) days after the Retrieval Period ends, Comitie will destroy all PHI in its production systems, including all stored versions of Firm's files. PHI in Comitie's database backups is destroyed as those backups expire under Comitie's backup schedule.
• (c) Where returning or destroying PHI is infeasible (for example, audit records Comitie must keep, or records subject to a legal hold), Comitie will extend the protections of this Addendum to that PHI and limit further uses and disclosures to the purposes that make return or destruction infeasible, for as long as Comitie keeps it.
• (d) On Firm's written request, Comitie will certify the destruction in writing.

10.4 Survival. Sections 5.5, 8, 10.3 and 12 survive termination for as long as Comitie holds any PHI.

11. Firm's Obligations

Firm will:

• (a) tell Comitie of any limitation in a notice of privacy practices, any change in or revocation of an Individual's permission, and any restriction Firm or its Covered Entity has agreed to under 45 CFR §164.522, to the extent it affects Comitie's use or disclosure of PHI;
• (b) not ask Comitie to use or disclose PHI in any way that would not be permitted under the HIPAA Rules if done by Firm;
• (c) obtain any consents or authorizations needed to provide PHI to Comitie through the Service;
• (d) submit only the Minimum Necessary PHI to the Service;
• (e) not use the Excluded Services to create, receive, maintain or transmit PHI;
• (f) manage its users, their permissions and their notification settings;
• (g) maintain its own agreements with the third-party services it connects.

Comitie recommends that every user turns on two-factor authentication.

12. Access by the Secretary

Comitie will make its internal practices, books and records relating to the use and disclosure of PHI available to the Secretary for the purpose of determining compliance with the HIPAA Rules.

13. Acceptance

13.1 How Firm accepts.

• New accounts. Firm accepts this Addendum electronically when the person creating Firm's account checks the box at signup that refers to the Terms and this Addendum.
• Existing accounts. For accounts created before this Addendum was published, Firm accepts by accepting it in the Service, or by continuing to use the Covered Services after the notice period in Section 15.7 of the Terms.

13.2 Authority. The person accepting represents that they are authorized to bind Firm.

13.3 Binding effect. Electronic acceptance has the same effect as a signature.

13.4 Records and copies. Comitie records the version accepted, the account and the time of acceptance. Firm may ask for a countersigned copy at compliance@comitie.com.

14. Miscellaneous

14.1 Amendment. The parties will amend this Addendum as needed to comply with changes to the HIPAA Rules. Comitie may update this Addendum by publishing a new version and giving notice under Section 15.7 of the Terms.

14.2 Interpretation. Any ambiguity is resolved in favor of a meaning that permits compliance with the HIPAA Rules. References to the HIPAA Rules mean them as amended.

14.3 No third-party beneficiaries. Nothing in this Addendum confers any rights on any person other than the parties.

14.4 Notices. Notices to Comitie under this Addendum go to compliance@comitie.com. Reports of suspected security incidents go to support@comitie.com.

14.5 Other terms. Except as this Addendum provides, the Terms govern, including their limitation of liability.

Schedule A: Subcontractors

Twilio and ElevenLabs are used only for the phone assistant, which is an Excluded Service (Section 4.1). They are not Subcontractors under this Addendum.