BUSINESS ASSOCIATE AGREEMENT

Omi Health B.V. -- Version 2.0 -- Effective date: 5 August 2026

This page publishes the standard text of the Omi Business Associate Agreement. The published text is informational. A BAA takes effect only when it is executed through the Omi console. The console generates the completed agreement with Customer's legal-entity details, the recorded capacity of Customer, the signatures, the document version and SHA-256 hash, and the UTC execution time. Customer changes to this text are not accepted unless separately agreed in writing.

1. PARTIES, CAPACITY, AND DEFINITIONS

1.1 Parties. This Business Associate Agreement ("BAA") is between Omi Health B.V., a company registered in the Netherlands, with its seat in Eindhoven, the Netherlands ("Business Associate"), and the customer executing it through the Omi console ("Customer"). It applies to the speech-to-text services Business Associate provides to Customer under the underlying service terms (the "Service").

1.2 Capacity. At execution, Customer records whether it enters into this BAA as a Covered Entity or as a Business Associate of one or more Covered Entities. Where Customer is itself a Business Associate, this BAA is the subcontractor agreement required by 45 CFR 164.502(e)(1)(ii) and 164.308(b)(2), and its requirements apply under 45 CFR 164.504(e)(5) in the same manner as between a Covered Entity and a Business Associate. References in this BAA to obligations of a Covered Entity then refer to Customer's obligations to its upstream Covered Entity.

1.3 Definitions. The following terms used in this BAA have the same meaning as in the HIPAA Rules: Breach, Data Aggregation, Designated Record Set, Disclosure, Health Care Operations, Individual, Minimum Necessary, Notice of Privacy Practices, Protected Health Information, Required By Law, Secretary, Security Incident, Subcontractor, Unsecured Protected Health Information, and Use. "HIPAA Rules" means the Privacy, Security, Breach Notification, and Enforcement Rules at 45 CFR Part 160 and Part 164. "PHI" means Protected Health Information that Business Associate creates, receives, maintains, or transmits for or on behalf of Customer through the Service. "Job Content" means submitted audio, job-scoped custom vocabulary and job options, and the transcripts and results generated from them.

2. PERMITTED USES AND DISCLOSURES

2.1 Service provision. Business Associate may use or disclose PHI only as necessary to provide the Service under the underlying service terms: to process submitted audio, return transcripts and results, and operate and secure the Service.

2.2 Required By Law. Business Associate may use or disclose PHI as Required By Law.

2.3 Management and administration. Business Associate may use PHI as necessary for its proper management and administration or to carry out its legal responsibilities. Business Associate may disclose PHI for those purposes only if the disclosure is Required By Law, or if Business Associate obtains reasonable assurances from the recipient that the information will be held confidentially, will be used or further disclosed only as Required By Law or for the purposes for which it was disclosed, and that the recipient will notify Business Associate of any instance of which it is aware in which the confidentiality of the information has been breached.

2.4 Minimum Necessary. Business Associate limits its uses, disclosures, and requests of PHI to the Minimum Necessary. By architecture, Job Content is processed transiently to produce the requested transcript and is not otherwise accessed; human access occurs only for security or abuse investigation, under role-based access control, and is logged.

2.5 Prohibited uses. Except as permitted by Sections 2.2 and 2.3, Business Associate will not use or disclose PHI in a manner that would violate Subpart E of 45 CFR Part 164 if done by Customer. Business Associate will not: de-identify PHI for any independent use; aggregate PHI beyond operation of the Service; provide Data Aggregation services; sell PHI; use PHI for marketing; or use PHI to train, fine-tune, or evaluate any model.

3. OBLIGATIONS OF BUSINESS ASSOCIATE

3.1 No impermissible use or disclosure. Business Associate will not use or disclose PHI other than as permitted or required by this BAA or as Required By Law.

3.2 Safeguards. Business Associate will use appropriate safeguards, and will comply with Subpart C of 45 CFR Part 164 with respect to electronic PHI, to prevent use or disclosure of PHI other than as provided for by this BAA. These safeguards include: encryption in transit (TLS) and at rest (managed keys); access controls and least privilege; audit controls through an immutable audit log whose schema is designed to contain no Job Content; integrity and transmission security; and a written workforce training and sanctions program.

3.3 Data minimisation and deletion. Submitted audio is deleted automatically upon completion or terminal failure of processing. Transcripts from synchronous requests are not stored. Results of asynchronous requests are stored solely for retrieval and deleted automatically at the end of the retention period selected by Customer (1 to 72 hours; default 24 hours). Job-scoped custom vocabulary is deleted with the job. Content is never written to operational logs or backups. The retention period selected by Customer is Customer's documented instruction. Persistent custom vocabulary that Customer saves to its account outside an individual job is account configuration, not Job Content: it may contain PHI, it is covered by this BAA, Customer may delete it in the console at any time, and it is deleted on account termination. Retention particulars, including the effective minimum retention for jobs configured with webhook delivery, are stated in the Service documentation.

3.4 Reporting.

(a) Impermissible uses and disclosures. Business Associate will report to Customer any use or disclosure of PHI not provided for by this BAA of which it becomes aware.

(b) Security Incidents. Business Associate will report to Customer any successful Security Incident of which it becomes aware without unreasonable delay. The parties acknowledge that unsuccessful attempts that do not compromise electronic PHI (such as routine scans, pings, and failed log-in attempts) occur routinely; this Section is notice of such attempts, and no further reporting of them is required.

(c) Breach of Unsecured PHI. Business Associate will notify Customer of any Breach of Unsecured PHI. Business Associate will provide an initial notice within five (5) business days of discovery, based on the information then known, and will supplement it on a rolling basis as the investigation proceeds, so that Customer receives the information required by 45 CFR 164.410. A Breach is treated as discovered as of the first day on which it is known to Business Associate or, by exercising reasonable diligence, would have been known to Business Associate, including knowledge of any person, other than the person committing the breach, who is a workforce member or agent of Business Associate. If a law enforcement official states that a notification would impede a criminal investigation or damage national security, notice may be delayed as provided in 45 CFR 164.412.

3.5 Subcontractors. In accordance with 45 CFR 164.502(e)(1)(ii) and 164.308(b)(2), Business Associate will ensure that any Subcontractor that creates, receives, maintains, or transmits PHI on behalf of Business Associate agrees in writing to the same restrictions, conditions, and requirements that apply to Business Associate with respect to such information, including compliance with Subpart C of 45 CFR Part 164 for electronic PHI. Current chain: Amazon Web Services, under a HIPAA business associate agreement accepted through AWS Artifact; only HIPAA-eligible AWS services are used in the PHI path. The current subcontractor and sub-processor list, and the mechanism for at least thirty (30) days' advance notice of changes, are published at /legal/sub-processors.

3.6 Individual access. To the extent Business Associate maintains PHI in a Designated Record Set, Business Associate will make that PHI available to Customer in the time and manner reasonably requested so that Customer can meet its obligations under 45 CFR 164.524. Because Job Content is ordinarily returned and deleted under Section 3.3, Business Associate may hold no responsive PHI when a request is received; it will promptly confirm that fact. Nothing in this BAA requires Business Associate to recreate PHI deleted in accordance with Customer's retention instruction. If an Individual makes a request directly to Business Associate, Business Associate will forward the request to Customer within five (5) business days.

3.7 Amendment. To the extent Business Associate maintains PHI in a Designated Record Set, Business Associate will make that PHI available for amendment and will incorporate any amendment as directed or agreed by Customer under 45 CFR 164.526, or will take other measures reasonably necessary to support Customer's obligations under that section.

3.8 Accounting of disclosures. Business Associate will maintain and make available to Customer the information required to provide an accounting of disclosures under 45 CFR 164.528. Business Associate records the disclosure metadata required by that section (including date, recipient, and a description of the PHI and purpose) for any disclosure outside Section 2.1, retains it for the period required by law without retaining Job Content, and will provide it to Customer in the time and manner reasonably requested.

3.9 Delegated obligations. To the extent Business Associate is to carry out one or more of Customer's obligations under Subpart E of 45 CFR Part 164, Business Associate will comply with the requirements of Subpart E that apply to Customer in the performance of such obligations.

3.10 Access by the Secretary. Business Associate will make its internal practices, books, and records relating to the use and disclosure of PHI available to the Secretary for purposes of determining compliance with the HIPAA Rules.

4. CUSTOMER OBLIGATIONS

4.1 Notice of restrictions. Customer will notify Business Associate of any limitation in its Notice of Privacy Practices, any change in or revocation of an Individual's permission, and any restriction agreed to or required under 45 CFR 164.522, in each case to the extent it may affect Business Associate's use or disclosure of PHI.

4.2 Permissible requests. Customer will not request Business Associate to use or disclose PHI in any manner that would not be permissible under Subpart E of 45 CFR Part 164 if done by Customer, except as permitted for Business Associate's management and administration under Section 2.3.

4.3 Customer responsibilities. Customer remains responsible for its own obligations under the HIPAA Rules, for not submitting PHI through the Service before this BAA is executed, and for retrieving results within the retention period it selects.

5. TERM AND TERMINATION

5.1 Term. This BAA is effective when its execution is confirmed in the console and continues until the underlying Service relationship between the parties terminates.

5.2 Termination for cause. Customer may terminate this BAA and the affected Service if Business Associate has violated a material term of this BAA and has not cured the violation within a reasonable period specified by Customer, or immediately if cure is not possible or immediate termination is reasonably necessary.

5.3 Return or destruction. At termination of this BAA for any reason, Business Associate will, if feasible and as directed by Customer, return or destroy all PHI received from Customer, or created, maintained, or received by Business Associate on behalf of Customer, that Business Associate or its Subcontractors still maintain in any form, and will retain no copies. Retrieval of results through the API before termination constitutes return of Job Content. Any remaining Job Content is destroyed by the standing deletion mechanics in Section 3.3, and in no event later than the end of the retention period selected by Customer. Persistent custom vocabulary is deleted on account termination under Section 3.3. Written confirmation of destruction is available on request. If return or destruction of particular PHI is infeasible, Business Associate will notify Customer of the PHI concerned and the conditions that make return or destruction infeasible, will extend the protections of this BAA to that PHI, and will limit further uses and disclosures to those purposes that make its return or destruction infeasible, for so long as it is maintained.

5.4 Survival. The obligations of Business Associate under Section 5.3 survive termination of this BAA.

6. MISCELLANEOUS

6.1 Regulatory references. A reference in this BAA to a section in the HIPAA Rules means the section as in effect or as amended.

6.2 Amendment. This BAA may be amended only by written or electronic agreement of the parties. Where an amendment is reasonably necessary for compliance with the HIPAA Rules or other applicable law, Business Associate may issue an updated version with notice to Customer; Customer may terminate the affected Service before a materially adverse change takes effect. The parties agree to take such action as is necessary to amend this BAA from time to time as required for compliance with the HIPAA Rules.

6.3 Interpretation. Any ambiguity in this BAA shall be interpreted to permit compliance with the HIPAA Rules.

6.4 Governing law; HIPAA. This BAA is governed by the law of the Netherlands, as provided in the underlying service terms. HIPAA and the HIPAA Rules govern the interpretation of the duties this BAA defines by reference to them, and nothing in this BAA limits the enforcement authority of the U.S. Department of Health and Human Services.

6.5 No third-party beneficiaries. Nothing in this BAA confers any right or remedy on any person other than the parties and their permitted successors and assigns.

6.6 Precedence. For the use and disclosure of PHI, this BAA prevails over any conflicting term of the underlying service terms.

END OF STANDARD TEXT. The console-generated executed copy appends: Customer legal name, registered address, and jurisdiction; Customer's recorded capacity (Covered Entity or Business Associate); signatory name, title, and email; the authority representation; this document's version and SHA-256 hash; and the UTC execution timestamp.