PSG Business Associate Agreement

PSG Business Associate Agreement Version: 2026-10-29-v1 | Date: October 29, 2026 1. Parties, offer and effective date Peptide Source Group, LLC (PSG) is the Business Associate. The Clinic is the legal business identified in the application and electronic acceptance record, acting as Covered Entity or, where applicable, as a business associate engaging PSG as its subcontractor. References to Clinic obligations mean the corresponding HIPAA duties in that capacity. PSG offers and agrees to these standard terms. This Agreement becomes effective upon express acceptance on Clinic's behalf by its authorized representative, with typed full name and title and electronic signature intent, at the server-recorded acceptance time. It continues during the covered services unless terminated under Section 10. The recorded Clinic legal name and acceptance particulars identify the Clinic party without requiring patient information in this document. 2. Definitions HIPAA means the Health Insurance Portability and Accountability Act, as amended including HITECH, and the Privacy, Security, Breach Notification and Enforcement Rules at 45 CFR Parts 160 and 164, as amended. Protected Health Information (PHI), electronic PHI (ePHI), Use, Disclosure, Individual, Designated Record Set, Minimum Necessary, Required by Law, Secretary, Subcontractor, Unsecured PHI, Breach and Security Incident have their meanings in those Rules, including 45 CFR 160.103, 164.304 and 164.402. PHI here is information PSG creates, receives, maintains or transmits on Clinic's behalf. A Breach is as defined by HIPAA, including its exceptions and required risk assessment; a Security Incident includes attempted or successful unauthorized access, use, disclosure, modification or destruction of information or interference with system operations. Secretary means the Secretary of the U.S. Department of Health and Human Services or designee. Discovery of a breach is determined under 45 CFR 164.410, including knowledge attributable to PSG's workforce or agents other than the person committing it. 3. Limited services and permitted uses PSG may use or disclose PHI only as necessary for Clinic-authorized administrative clinic order coordination, fulfillment coordination and related order support through PSG-designated enabled workflows, to fulfill this Agreement, or as Required by Law. PSG may not use or disclose PHI in a way that would violate the Privacy Rule if done by Clinic. This Agreement does not delegate treatment, prescribing, clinical decision-making or general marketing to PSG. PSG shall not sell PHI, use it for unauthorized secondary marketing, unrelated research, model training or its own commercial profiling, or de-identify it for independent secondary use under this Agreement. No general data aggregation or independent management/administration disclosure authority is granted. Requests, uses and disclosures shall be limited to the minimum necessary where applicable under HIPAA and consistent with Clinic's communicated lawful minimum-necessary policies. No acceptance establishes vendor/platform readiness, constitutes HIPAA certification, or enables a workflow otherwise held closed. PHI may be submitted only through PSG-designated enabled workflows subject to separate safeguards and readiness requirements. Inadvertent receipt does not excuse PSG's duties. 4. Safeguards and mitigation PSG shall implement appropriate administrative, physical and technical safeguards to prevent unauthorized use or disclosure, comply with applicable requirements of the Security Rule, Subpart C of 45 CFR Part 164, for ePHI, and maintain appropriate workforce training, access controls, risk analysis and risk management. PSG shall reasonably mitigate harmful effects of impermissible uses or disclosures of which it becomes aware, investigate incidents, and cooperate with Clinic on containment, risk assessment and corrective action. These obligations are not waived by Clinic acceptance or by any workflow restriction. 5. Reporting and breach cooperation PSG shall report to Clinic any impermissible use or disclosure, any Security Incident of which it becomes aware, and any Breach of Unsecured PHI without unreasonable delay. PSG shall provide initial notice within 10 business days after discovery and in all events no later than the applicable HIPAA deadline, including the maximum 60 calendar days under 45 CFR 164.410 for breach notification; the shorter applicable period controls. Notice shall not await completion of an investigation. PSG shall promptly supplement as information becomes available, identifying affected individuals to the extent known and providing the information needed for Clinic's notification obligations under 45 CFR 164.404, including incident and discovery dates, nature of PHI, mitigation, protective steps and contact information. PSG shall report attempted incidents as well as successful incidents; routine unsuccessful attempts may be reported in periodic summaries agreed with Clinic only if timely reporting duties are still satisfied. PSG will cooperate with Clinic's lawful notifications to individuals, HHS and media; Clinic retains those duties unless specifically delegated in writing. Notices use designated secure contacts and channels; if none is established, PSG shall promptly contact Clinic's account contact to arrange secure delivery, without delaying required notice. 6. Subcontractors Before a subcontractor creates, receives, maintains or transmits PHI on PSG's behalf, PSG shall obtain a written agreement imposing the same applicable restrictions, conditions and safeguard obligations as this Agreement, including applicable Security Rule compliance. PSG shall require appropriate reporting and cooperation and address known material subcontractor breaches in accordance with HIPAA. Listing or using a vendor does not itself establish such readiness or agreement. 7. Individual rights and delegated duties To the extent PSG holds PHI in a Designated Record Set, PSG shall make it available to Clinic, or to an Individual at Clinic's direction, in the form and manner needed to satisfy access obligations under 45 CFR 164.524. PSG shall make PHI available for amendment and incorporate amendments directed or agreed to by Clinic under 45 CFR 164.526. PSG shall maintain and provide disclosure information needed for accountings under 45 CFR 164.528. PSG shall forward requests received directly from individuals to Clinic promptly, normally within 5 business days, without independently denying their rights. PSG shall supply access, amendment and accounting assistance promptly, normally within 10 business days of Clinic's request or sooner when needed to meet Clinic's applicable statutory deadline; these contractual periods never extend a HIPAA deadline. Clinic shall communicate applicable deadlines and PSG shall cooperate to satisfy them. To the extent Clinic delegates a Privacy Rule duty to PSG, PSG shall comply with the requirements of Subpart E of 45 CFR Part 164 applicable to Clinic in performing that duty. No additional delegation is inferred from account signup. 8. HHS access PSG shall make its applicable internal practices, books and records concerning PHI received from or created, maintained or received on Clinic's behalf available to the Secretary for determining HIPAA compliance, in the time and manner required by the Secretary. This Agreement does not restrict lawful regulatory access or PSG's direct liability under HIPAA. 9. Clinic obligations Clinic shall provide only information it may lawfully disclose for the authorized services, obtain permissions required by law, and not request a use or disclosure that would violate HIPAA. Clinic shall notify PSG of relevant limitations in its notice of privacy practices, changes or revocations of individual permissions, and restrictions Clinic agrees to or must follow under 45 CFR 164.522, insofar as they affect PSG's permitted uses or disclosures. Clinic shall provide current authorized and secure contact details and promptly communicate individual-rights requests, amendments and applicable deadlines. Clinic shall not submit PHI before a PSG-designated workflow is enabled with independently required safeguards. Clinic's duties do not relieve PSG of its own obligations. 10. Termination and disposition Clinic may terminate this Agreement and the affected services if it determines PSG has violated a material term. Clinic may offer a reasonable cure period but is not required to delay termination where cure is not feasible or continued service presents unacceptable risk. PSG shall notify Clinic of a material breach it identifies and cooperate with cure or orderly termination. Either party may end the covered services by written notice, subject to continuing PHI protections and lawful obligations. On termination for any reason, PSG shall return all PHI to Clinic, or destroy it if Clinic agrees, including copies held by subcontractors, when feasible, and retain no copies. If return or destruction is infeasible, including a legal retention requirement, PSG shall notify Clinic of the reason, retain only the PHI necessary for that reason, continue this Agreement's safeguards and applicable Security Rule compliance, and restrict further use or disclosure solely to the purposes making return or destruction infeasible for as long as retained. PSG shall return or destroy retained PHI when the impediment ends and shall require corresponding subcontractor action. 11. Survival, interpretation and amendments PHI protection, reporting, individual-rights assistance, regulatory access and disposition obligations survive termination for as long as relevant PHI is retained or required obligations remain outstanding. The parties shall amend this Agreement as needed to comply with changes in HIPAA; revisions will be separately versioned and recorded without rewriting historical acceptance. Mandatory law controls regardless of an administrative delay in amendment. Ambiguities shall be interpreted to permit compliance with HIPAA, not waive required duties. This Agreement controls conflicting Clinic Terms concerning PHI. It contains no liability cap, indemnity or arbitration provision and does not waive PSG's statutory duties. Written notices and requests may start at info@peptidesourcegroup.com or Clinic's designated account contact without PHI, with secure delivery arranged as needed. Final legal enforceability should be reviewed by counsel; no counsel review or HIPAA certification is represented.