Business Associate Agreement

Parties

**Business Associate:** SynxRx, Inc. ("Business Associate" or "SynxRx")

**Covered Entity:** , a -licensed pharmacy with its

principal place of business at ("Covered Entity")

**Underlying Services Agreement:** (the

services SynxRx provides the Covered Entity under this Agreement are the platform

services described there: prescription intake, order/fulfillment workflow,

communications via the SynxRx portal, email and SMS notifications, payment

facilitation via Stripe Embedded Checkout, and related support.)

Effective Date

1. Recitals; scope of PHI

1.1 The Covered Entity is a covered entity under HIPAA (a "provider of health

care" that transmits health information in electronic form in connection with a

covered transaction, 45 C.F.R. Sec. 160.103), and SynxRx is a business associate

as defined at 45 C.F.R. Sec. 160.103: SynxRx, on behalf of the Covered Entity and

other than as a member of its workforce, creates, receives, maintains, or

transmits Protected Health Information in order to provide the platform services.

1.2 The PHI covered by this Agreement is limited to the information SynxRx

creates, receives, maintains, or transmits on behalf of the Covered Entity

through the SynxRx platform services, including: physician prescriptions,

patient names and contact information, shipping addresses, order and refill

history, fulfillment status, payment status (not card numbers), and message

content between Covered Entity workforce members, prescribers, and patients.

1.3 Payment card data is out of scope: card presentment is handled inside Stripe

Embedded Checkout and the card industry standard (PCI) governs it; SynxRx does

not store card numbers or CVCs. (Vendor BAA/HIPAA eligibility for Stripe, Resend,

Twilio, and Telnyx was verified 2026-10-11, decision 15 research task

t_71a87aeb (`vendor-baa-hipaa-verification.md`); results are reflected in

Sections 4.2 and 6.2 and govern which vendors may carry PHI: Stripe ,

Resend , Twilio , Telnyx .)

2. Definitions

2.1 **Breach** — the acquisition, access, use, or disclosure of PHI in a manner

not permitted by the HIPAA Privacy Rule that compromises its security or

privacy, as defined at 45 C.F.R. Sec. 164.402. [164.402]

2.2 **Covered Entity** — as defined at 45 C.F.R. Sec. 160.103. [160.103]

2.3 **Designated Record Set** — as defined at 45 C.F.R. Sec. 164.501. [164.501]

2.4 **Electronic Protected Health Information (ePHI)** — PHI transmitted by

electronic media or maintained in electronic media, as defined at 45 C.F.R.

Sec. 160.103.

2.5 **HIPAA Rules** — the Privacy, Security, Breach Notification, and

Enforcement Rules at 45 C.F.R. Parts 160 and 164.

2.6 **Individual** — the person who is the subject of PHI, as defined at 45

C.F.R. Sec. 160.103; includes a personal representative under Sec. 164.502(g).

2.7 **Protected Health Information (PHI)** — individually identifiable health

information as defined at 45 C.F.R. Sec. 160.103, limited for purposes of this

Agreement to the information described in Section 1.2.

2.8 **Required by Law** — as defined at 45 C.F.R. Sec. 164.103. [164.103]

2.9 **Secretary** — the Secretary of the U.S. Department of Health and Human

Services ("HHS") or a designee.

2.10 **Unsecured PHI** — PHI not rendered unusable, unreadable, or

indecipherable to unauthorized persons through the use of a technology or

methodology identified by the Secretary in guidance (e.g., encryption of

ePHI at rest and in transit meeting NIST standards, per the HHS guidance at

https://www.hhs.gov/hipaa/for-professionals/breach-notification/index.html

). [164.402]

2.11 **Security Incident** — an attempted or successful unauthorized access,

use, disclosure, modification, or interference with system operation in an

information system containing ePHI, as contemplated at 45 C.F.R.

Sec. 164.304 (definitions) and Sec. 164.314(a)(2)(i)(C) [reporting of

security incidents by a BA is the subject of Sec. 164.314(a)(2)(i)(C)].

3. Permitted uses and disclosures; prohibited uses

3.1 **Service uses.** Business Associate may use and disclose PHI only to

perform the services in the Underlying Services Agreement, and only as

permitted or required by this Agreement or as Required by Law.

3.2 **Ceiling; no other uses.** Business Associate may not use or disclose PHI

in any manner that would violate the HIPAA Rules if done by the Covered

Entity, except as permitted by 45 C.F.R. Sec. 164.504(e)(2)(i):

(a) use or disclosure as necessary for the proper management and

administration of Business Associate or to carry out its legal

responsibilities, and (b) data aggregation services relating to the health

care operations of Covered Entity.

3.3 **Management/administration disclosures to third parties.** Where

Business Associate discloses PHI for its own management and administration

to a third party, such disclosure is permitted only where the disclosure is

Required by Law or the third party provides satisfactory assurances meeting

the requirements of 45 C.F.R. Sec. 164.504(e)(4).

3.4 **Data aggregation permitted**, as defined at 45 C.F.R. Sec. 164.501,

solely for the health care operations of the Covered Entity.

3.5 **De-identification and limited data sets.** Business Associate may not

de-identify PHI for any purpose other than providing the platform services and

the Covered Entity's health care operations. Product analytics by SynxRx is

permitted only on de-identified data meeting 45 C.F.R. Sec. 164.514, per

decision 6 of 2026-10-11, and the Privacy Policy discloses this to users.

45 C.F.R. Sec. 164.514 sets the

de-identification standard.

3.6 **Marketing and sale of PHI prohibited.** Business Associate shall not use

or disclose PHI for marketing (as defined at Sec. 164.501) or sell PHI (as

defined at Sec. 164.501/164.508(a)(4)) without the prior written authorization

of the Covered Entity, except as permitted by the HIPAA Rules.

3.7 **Minimum necessary.** When using or disclosing PHI or requesting PHI from

another party, Business Associate will use or disclose the minimum amount of

PHI necessary to accomplish the purpose, consistent with 45 C.F.R.

Sec. 164.502(b) and Sec. 164.514(d), except where the minimum-necessary

standard does not apply under Sec. 164.502(b)(2) (disclosures to or requests

by a health care provider for treatment; uses/disclosures to the individual;

uses/disclosures pursuant to a valid authorization; disclosures to HHS; and

uses/disclosures required by law).

4. Safeguards [164.504(e)(2)(ii)(B); 164.314(a)(2)(iv); 164.308(b)]

4.1 **Security Rule compliance.** Business Associate shall implement

administrative, physical, and technical safeguards that reasonably and

appropriately protect the confidentiality, integrity, and availability of

ePHI it creates, receives, maintains, or transmits on behalf of the Covered

Entity, in accordance with the HIPAA Security Rule, 45 C.F.R. Part 164

Subpart C, and shall comply with the applicable requirements of Subpart C

with respect to ePHI, per Sec. 164.314(a)(2)(iv)(A) and (B).

4.2 **Current technical and organizational measures (representation of

Business Associate as of the Effective Date; necessary for accurate signing —

and vendor BAA/HIPAA eligibility is verified before any

BAA is signed per decision 15 of 2026-10-11):**

| Area | Implementation |

| --- | --- |

| Encryption in transit | TLS 1.3 (Vercel/Convex endpoints) |

| Encryption at rest | AES-256 (Convex-managed storage) |

| Access control | Role-based access control (8 roles); server-side authorization checks on every query/mutation |

| Segmentation | Organization-level tenant isolation (org-scoped filters on all org-scoped data; superAdmin platform-operator access documented) |

| Audit | Audit log on every PHI read/write operation (`convex/auditLogs.ts`) |

| Authentication | Email one-time passcode (OTP) via Resend (OTP email message content is system-generated passcode only, no PHI) |

| Infrastructure | Vercel (US regions) hosting + Convex (US regions) data/execution |

| Rate limiting | Per-IP rate limiter + SMS cap |

| Subprocessors | See Section 6: executed BAA on file for Convex; Resend carries no PHI (no BAA available); Twilio used only under its BAA and HIPAA-eligible services |

| Payments | Stripe Embedded Checkout — PCI tokenized in the browser; no card data stored by SynxRx |

4.3 **Workforce.** Business Associate shall ensure that any workforce member

with access to PHI access it only as needed to perform their duties

(minimum necessary), and shall apply sanctions applicable to workforce

members who fail to comply (cf. 45 C.F.R. Sec. 164.308(a)(1)(ii)(D),

Sec. 164.308(a)(3) [workforce security]).

4.4 **Records access controls.** Business Associate will maintain a record of

access to PHI sufficient to respond to any Covered Entity audit, and will

produce records to the Covered Entity on reasonable request.

5. Reporting: security incidents and Breaches of Unsecured PHI

5.1 **Security incident reporting.** Business Associate shall report to

Covered Entity any Security Incident of which it becomes aware,

including Breaches of Unsecured PHI as required at 45 C.F.R.

Sec. 164.410, consistent with Sec. 164.314(a)(2)(i)(C).

5.2 **Breach notification timing (decision 14 of 2026-10-11).** Business

Associate shall notify the Covered Entity of any Breach of Unsecured PHI of

any Counterparty without unreasonable delay, and in any case within

seventy-two (72) hours of discovery, which is faster than the regulatory

maximum of sixty (60) calendar days after discovery (45 C.F.R. Sec. 164.410(b)

— "without unreasonable delay and in no case later than 60 calendar days

after discovery").

5.3 **Discovery.** A Breach is treated as discovered on the first day it is

known to Business Associate — or would have been known by exercising

reasonable diligence — including knowledge of any person other than the

person committing the Breach who is an employee, officer, or other agent of

Business Associate (determined per federal common law of agency), mirroring

45 C.F.R. Sec. 164.410(a)(2). [164.410(a)(2)]

5.4 **Content of Breach notification.** To the extent possible, notification

shall identify each individual whose unsecured PHI was accessed, acquired,

used, or disclosed, and shall include any other information the Covered

Entity is required to include in individual notification under 45 C.F.R.

Sec. 164.404(c) (nature of the breach, date(s), description of the events,

steps individuals should take, mitigation steps, contact procedures), per

45 C.F.R. Sec. 164.410(c)(1)-(2). [164.410(c)]

5.5 **Investigation cooperation.** Business Associate will cooperate with

Covered Entity's investigation, provide updates, and take steps to mitigate

harmful effects and prevent recurrence, consistent with the Covered

Entity's duties under Sec. 164.404 and Sec. 164.410.

6. Third parties and subcontractors

6.1 **Flow-down requirement.** Business Associate shall ensure any

subcontractor that creates, receives, maintains, or transmits PHI on behalf

of Business Associate is bound by written agreement to the same

restrictions, conditions, and requirements that apply to Business

Associate with respect to PHI — per 45 C.F.R. Sec. 164.504(e)(2)(ii)(D)

6.2 **Currently approved subcontractors (as of the Effective Date; vendor BAA posture

below reflects the completed verification of 2026-10-11 —

`vendor-baa-hipaa-verification.md`, decision 15 research task t_71a87aeb,

sources: resend.com/security, twilio.com/en-us/hipaa,

support.telnyx.com/en/articles/3347891, stripe.com/resources/more/

healthcare-embedded-payments):**

| Subprocessor | Role | BAA posture |

| --- | --- | --- |

| Convex | Database + serverless execution (US regions) | Executed BAA on file |

| Resend | Transactional email delivery | — official vendor position: "Resend is not HIPAA compliant and cannot sign a Business Associate Agreement" (resend.com/security). No PHI may flow through Resend; see 6.2.1 |

| Twilio | SMS delivery | — executes BAAs for HIPAA Eligible Products/Services, gated to Security or Enterprise Edition (twilio.com/en-us/hipaa; eligible list dated 2025-09-30). |

| Vercel | Web hosting / CDN (US regions) | |

| Stripe | Payment processing — PCI; card data tokenized in the browser, SynxRx does not store card numbers | — Stripe publishes no BAA program and positions payment processing outside the HIPAA business-associate definition (HIPAA payment-processing exemption, 42 U.S.C. Sec. 1179). Bare payments may proceed on that basis, but no health detail may reach Stripe: no patient names or health information in statement descriptors, metadata, invoice line items, or emailed receipts |

| Telnyx | (candidate SMS/voice vendor) | — BAA exists but is sales-gated ("commercial thresholds") and architecture-gated (US-only messaging HIPAA-eligible; Telnyx-hosted AI only; no PHI in support tickets). Do not route PHI until a BAA is executed and the architecture guide is followed |

6.2.1 **No PHI through non-BAA vendors.** Business Associate shall not route

PHI through any subcontractor that cannot provide satisfactory assurances under a

written agreement meeting Section 6.1. For vendors verified in 2026 as having no

BAA program (Resend; Stripe), any platform function served by that vendor must

remain free of PHI, or the function must be migrated to a vendor capable of

executing a BAA under this Section. Specifically: transactional email

(order confirmations, prescription/order status updates) is currently served by

Resend and must be limited to content containing no PHI — or Resend-capable

email must be replaced with a BAA-capable email vendor — before any PHI-bearing

email flows. Payment flows through Stripe rely on the HIPAA payment-processing

exemption and must remain clinically neutral.

6.3 New subprocessors may be added only after they are bound by a written

agreement meeting Section 6.1; Business Associate will give the Covered

Entity prior written notice of any new subprocessor handling PHI and an

opportunity to object ; Business Associate will maintain a current list of subprocessors

handling PHI and provide it to Covered Entity on request.

7. Individual rights: access, amendment, accounting

7.1 **Access.** Within ten (10) business days of a request by Covered

Entity (or by an Individual directly, when Covered Entity directs), Business

Associate shall make PHI in a Designated Record Set available for access as

necessary for Covered Entity to satisfy its obligation to provide access

under 45 C.F.R. Sec. 164.524. [164.504(e)(2)(ii)(E)]

7.2 **Amendment.** Within thirty (30) days of a request by Covered Entity,

Business Associate shall make any PHI in a Designated Record Set available

for amendment and incorporate any amendment(s) agreed by Covered Entity as

necessary for Covered Entity to satisfy its amendment obligation under 45

C.F.R. Sec. 164.526. [164.504(e)(2)(ii)(F)]

7.3 **Accounting of disclosures.** Business Associate shall maintain records

sufficient to support Covered Entity's obligation to account for certain

disclosures of PHI under 45 C.F.R. Sec. 164.528, and shall make those records

available to Covered Entity (or an Individual at Covered Entity's direction)

as necessary for Covered Entity to respond to an accounting request.

8. Requests by the Secretary; compliance

8.1 Business Associate shall make its internal practices, books, and

records relating to the use and disclosure of PHI received from, or created

or received by Business Associate on behalf of, the Covered Entity available

to the Secretary (or a designee) for purposes of the Secretary determining

Covered Entity's compliance with the HIPAA Rules, per 45 C.F.R.

Sec. 164.504(e)(2)(ii)(H). [164.504(e)(2)(ii)(H)]

8.2 Business Associate shall promptly provide to Covered Entity information

required for Covered Entity to respond to an audit or investigation by the

Secretary, and shall comply with the Secretary's directives.

9. Return or destruction of PHI at termination

9.1 Upon termination of this Agreement for any reason, Business Associate

shall return or destroy all PHI received from, or created or received by

Business Associate on behalf of, Covered Entity (including PHI in any

system of Business Associate and any backups), and shall not retain PHI in

any form, per 45 C.F.R. Sec. 164.504(e)(2)(ii)(J). [164.504(e)(2)(ii)(J)]

9.2 **Not feasible.** If return or destruction of PHI is not feasible, the

parties agree: (a) the restrictions in this Agreement apply to the retained

PHI for as long as Business Associate retains it; (b) Business Associate

shall limit further uses and disclosures to those purposes that make return

or destruction infeasible (if applicable); and (c) Business Associate shall

extend the protections of this Agreement to the retained PHI, all

consistent with 45 C.F.R. Sec. 164.504(e)(2)(ii)(J) and with Sec. 164.504(e)(2)(iii)

(the Privacy Rule's provision addressing BAA termination where the BA

does not cure and return/destruction is infeasible).

9.3 **Practical retention schedule.** The schedule follows the

NC compounding-retention requirement the platform cites elsewhere

(decision 12 of 2026-10-11): audit logs and prescription/order history are

retained while the Covered Entity organization is active and for the

pharmacy's required retention period (e.g., 3 years for compounded-preparation

records under 21 N.C.A.C. 46 .2801(h)); the `deleteMyAccount` flow anonymizes

the patient record but preserves prescription/order history for that required

retention. . See

Privacy Policy Section 7.

10. Term; termination for cause

10.1 **Term.** This Agreement is effective as of the Effective Date and

continues until all PHI is returned or destroyed under Section 9, or all

protections in Section 9.2 expire, whichever is later [cf. 45 C.F.R.

Sec. 164.504(e)(2)(ii)(J)].

10.2 **Termination for cause (decision 4 of 2026-10-11; parallel to ToS

Section 10).** Covered Entity may terminate the Underlying Services Agreement

(and/or this Agreement) if Covered Entity determines that Business Associate

has violated a material term of this Agreement, in accordance with 45 C.F.R.

Sec. 164.504(e)(2)(iii), after following the process below:

(a) Written notice of the violation and a seven (7) day cure period for a

curable breach, OR

(b) Immediate termination where the breach is not curable — including

fraud or misuse of PHI — or where cure is not feasible (e.g., a Breach

is discovered during the cure period and is not being remediated

diligently).

[Protected by the regulatory default at Sec. 164.504(e)(2)(iii): termination

where the BA has breached a material term and cure is not feasible; OR if

termination for cause is not feasible, report the violation to the

Secretary.]

10.3 **Regulatory fallback.** If Covered Entity knows of a pattern of

activity or practice of Business Associate that constitutes a material

breach or violation of this Agreement and neither party terminates,

Covered Entity shall take reasonable steps to cure the breach or end the

violation, and if that is not feasible, shall report the violation to the

Secretary per 45 C.F.R. Sec. 164.504(e)(2)(iii).

10.4 **Return of PHI on termination** is handled under Section 9.

11. Miscellaneous

11.1 **Relationship of the parties.** Business Associate is an independent

contractor, not an agent or employee of Covered Entity for the purposes of

this Agreement.

11.2 **Regulatory references.** References to "45 C.F.R." mean the current

version, as amended.

11.3 **Amendment.** This Agreement may be modified only in writing signed by

**both parties.**

11.4 **Survival.** The obligations of Business Associate relating to PHI

confidentiality and security survive termination as set out in Section 9.2.

11.5 **Interpretation.** Any ambiguity in this Agreement shall be resolved

in favor of a meaning that complies with and is consistent with the HIPAA

Rules.

11.6 **No waiver.** The failure of either party to enforce any provision is

not a waiver.

11.7 **Governing law.**

11.8 **Notices.**

11.9 **Assignment.**

11.10 **Entire agreement.** This Agreement (including the Underlying

Services Agreement) is the entire agreement regarding PHI between the

parties on its subject matter and supersedes prior drafts on that subject.

12. Signatures

**BY SIGNING BELOW, each party represents that it has authority to execute

this Agreement on behalf of the party named.**

For SynxRx, Inc. (Business Associate)

Name: ____________________ Title: ____________________

Date: ____________________

For (Covered Entity)

Name: ____________________ Title: ____________________

Date: ____________________

---

Appendix — Citation index (BAA)

Primary rule text (eCFR, current):

– 45 C.F.R. Part 164 (Privacy, Security, Breach Notification, Enforcement Rules):

https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164

– 45 C.F.R. Sec. 160.103 (definitions, business associate, covered entity):

https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160/subpart-A/section-160.103

– 45 C.F.R. Sec. 164.103 ("required by law"):

https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-A/section-164.103

– 45 C.F.R. Sec. 164.402 (breach definition):

https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-D/section-164.402

– 45 C.F.R. Sec. 164.410 (business associate notification):

https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-D/section-164.410

– 45 C.F.R. Sec. 164.502(e) (privacy-rule satisfactory assurances for BA

disclosures) and Sec. 164.504(e) (business associate contracts):

https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.504

– 45 C.F.R. Sec. 164.314(a) (Security Rule organizational requirements — BA

contracts) and Sec. 164.308(b) (business associate contracts and other

arrangements):

https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C/section-164.314

– 45 C.F.R. Sec. 164.524 (access), Sec. 164.526 (amendment), Sec. 164.528

(accounting of disclosures): https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.524

– 45 C.F.R. Sec. 164.501 ("designated record set", "marketing", "sale of PHI" definitions):

https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.501

– 45 C.F.R. Sec. 164.514 (de-identification; minimum necessary is

Sec. 164.514(d); minimum necessary standard is Sec. 164.502(b)).

North Carolina/state-law record-retention context (used in companion documents):

– 21 N.C.A.C. 46 .2801 (compounded-preparation 3-year record rule):

http://ncrules.state.nc.us/ncac/title%2021%20-%20occupational%20licensing%20boards%20and%20commissions/chapter%2046%20-%20pharmacy/21%20ncac%2046%20.2801.html

Note on BAA legal-effect citations: implementation/runtime claims in Sections 4.2

and 6 are representations of SynxRx (verified against the repo's production

readiness checklist and audit-log implementation as of 2026-10-05), not legal

citations; counsel should independently verify each claim before a BAA is signed.

Vendor BAA/HIPAA eligibility verification (decision 15) is complete

(t_71a87aeb).

Vendor BAA verification sources (2026-10-11 research, `vendor-baa-hipaa-verification.md`):

– Resend: "Resend is not HIPAA compliant and cannot sign a Business Associate

Agreement" — https://resend.com/security

– Twilio HIPAA program and BAA policy:

https://www.twilio.com/en-us/hipaa ; HIPAA Eligible Products and Services list

(2025-09-30): https://twil.io/HIPAA-eligible-products-and-services

– Telnyx BAA policy (sales- and architecture-gated):

https://support.telnyx.com/en/articles/3347891-hipaa-baas-and-the-conduit-exception

– Stripe (no BAA program; healthcare guidance):

https://stripe.com/resources/more/healthcare-embedded-payments