This Business Associate Agreement (BAA) is entered into between the dental practice or other health care provider accepting this BAA (Customer or Covered Entity) and Claraview AI, LLC, an Arizona limited liability company (Claraview or Business Associate).

Customer may make Protected Health Information available to Claraview in connection with the Claraview website, Dashboard, Smile Simulation, patient profiles, communications, and related services (collectively, the Covered Services). The parties enter into this BAA to comply with the HIPAA Requirements defined below.

This BAA supplements the Claraview Platform Terms of Service, applicable order, or other services agreement between Customer and Claraview (Service Agreement). If this BAA conflicts with the Service Agreement regarding the use, disclosure, or protection of Protected Health Information, this BAA controls. Smile Virtual is not a party to this BAA, and any business associate agreement between Customer and Smile Virtual applies only to Smile Virtual's own services.

1. DEFINITIONS

Unless otherwise defined in this BAA, capitalized terms have the meanings assigned to them under the HIPAA Requirements.

Covered Services means the Claraview services described above, but only to the extent Claraview creates, receives, maintains, or transmits Protected Health Information on behalf of Customer.

HIPAA Requirements means the Health Insurance Portability and Accountability Act of 1996, the Health Information Technology for Economic and Clinical Health Act, and the Privacy, Security, Breach Notification, and Enforcement Rules at 45 C.F.R. Parts 160 and 164, each as amended from time to time.

Protected Health Information or PHI has the meaning assigned to protected health information at 45 C.F.R. § 160.103 and, when applicable, includes Electronic Protected Health Information or ePHI.

2. USES AND DISCLOSURES OF PROTECTED HEALTH INFORMATION

a. Covered Services

Claraview may use or disclose PHI only as reasonably necessary to provide the Covered Services, as expressly permitted by this BAA or the Service Agreement, or as Required by Law. Claraview will not use or disclose PHI in a manner that would violate the HIPAA Privacy Rule if done by Customer, except for uses or disclosures expressly permitted below.

b. Required by Law

Claraview may use or disclose PHI as Required by Law. To the extent legally permitted, Claraview will notify Customer before making a legally required disclosure and will reasonably cooperate with Customer's efforts to limit the disclosure.

c. Management and Administration

Claraview may use PHI for its proper management and administration or to carry out its legal responsibilities. Claraview may disclose PHI for those purposes only if the disclosure is Required by Law or Claraview obtains reasonable written assurances that the recipient will keep the PHI confidential, use or further disclose it only as Required by Law or for the purpose for which it was disclosed, and notify Claraview of any breach of confidentiality.

d. De-identification

Claraview may de-identify PHI in accordance with 45 C.F.R. § 164.514(a)-(c). Information that has been properly de-identified is not PHI under this BAA. Claraview will not attempt to reidentify information maintained as de-identified except as permitted by law to test its de-identification processes.

e. Prohibited Uses

Claraview will not sell PHI or use or disclose PHI for marketing, public advertising, social media, education, or promotional materials unless Customer and the applicable Individual have provided any authorization required by law.

f. Minimum Necessary

Claraview will limit its uses, disclosures, and requests for PHI to the minimum necessary to accomplish the intended purpose, consistent with the HIPAA Requirements and Customer's written minimum-necessary instructions provided to Claraview.

3. SAFEGUARDS FOR PROTECTED HEALTH INFORMATION

Claraview will implement and maintain appropriate administrative, physical, and technical safeguards to prevent the use or disclosure of PHI other than as permitted by this BAA. Claraview will comply with the provisions of the HIPAA Security Rule that apply to Business Associates and will protect the confidentiality, integrity, and availability of ePHI that Claraview creates, receives, maintains, or transmits on behalf of Customer.

Claraview will maintain policies and procedures reasonably designed to limit access to PHI to personnel who need access to perform the Covered Services, and will train applicable workforce members regarding their privacy and security obligations.

4. CLARAVIEW REPORTING OBLIGATIONS

a. Impermissible Use or Disclosure

Claraview will report in writing to Customer any use or disclosure of PHI not permitted by this BAA without unreasonable delay and no later than 15 business days after Claraview discovers the use or disclosure.

b. Security Incidents

Claraview will report in writing to Customer any successful Security Incident involving ePHI without unreasonable delay and no later than 15 business days after discovery. Routine unsuccessful attempts that do not result in unauthorized access, use, disclosure, modification, destruction, or interference, including pings, scans, failed login attempts, and similar events, are deemed reported through this provision. Claraview will provide aggregate information about such unsuccessful attempts upon reasonable written request, no more than once per month.

c. Breaches of Unsecured PHI

Claraview will report a Breach of Unsecured PHI to Customer without unreasonable delay and no later than 15 business days after discovery. Claraview will provide the information required by 45 C.F.R. § 164.410 to the extent known and will supplement the report as additional information becomes available.

d. Cooperation

Claraview will reasonably cooperate with Customer's investigation, risk assessment, mitigation, and legally required notifications. Unless the parties agree otherwise in writing, Customer is responsible for determining whether notification to Individuals, the Secretary, the media, or another authority is required and for providing those notifications.

5. SUBCONTRACTORS

Claraview does not currently use third-party Subcontractors to create, receive, maintain, or transmit PHI on Claraview's behalf. If Claraview later engages such a Subcontractor, Claraview will enter into a written agreement before providing access to PHI that requires the Subcontractor to comply with the same restrictions, conditions, and requirements that apply to Claraview under this BAA.

6. ACCESS TO PROTECTED HEALTH INFORMATION

a. Customer Requests

Within 15 business days after receiving Customer's written request, Claraview will make PHI in a Designated Record Set available to Customer as necessary for Customer to meet its obligations under 45 C.F.R. § 164.524.

b. Individual Requests

If Claraview receives a request from an Individual for access to PHI in a Designated Record Set, Claraview will forward the request to Customer within 15 business days and will not independently grant or deny the request unless Customer directs Claraview to do so in writing and the direction complies with the HIPAA Requirements.

7. AMENDMENT OF PROTECTED HEALTH INFORMATION

Within 15 business days after receiving Customer's written request, Claraview will make PHI available for amendment or incorporate an amendment into PHI in a Designated Record Set as directed or agreed to by Customer and as necessary for Customer to meet its obligations under 45 C.F.R. § 164.526.

If Claraview receives an amendment request directly from an Individual, Claraview will forward the request to Customer within 15 business days and will not independently grant or deny the request.

8. ACCOUNTING OF DISCLOSURES

Claraview will document disclosures of PHI that must be included in an accounting under 45 C.F.R. § 164.528 and will maintain the required information for the period required by the HIPAA Requirements.

Within 15 business days after receiving Customer's written request, Claraview will provide information reasonably necessary for Customer to respond to an accounting request. If Claraview receives a request directly from an Individual, Claraview will forward it to Customer and will not provide an accounting directly unless Customer directs Claraview to do so in writing.

9. RESTRICTIONS AND PERMISSIBLE REQUESTS

Customer will notify Claraview of any limitation in Customer's Notice of Privacy Practices, any change in or revocation of an Individual's permission, and any restriction on the use or disclosure of PHI that may affect Claraview's performance of the Covered Services.

Claraview will comply with Customer's written instructions regarding restrictions on the use or disclosure of PHI to the extent required by the HIPAA Requirements and reasonably capable of being implemented within the Covered Services.

Customer will not request or direct Claraview to use or disclose PHI in a manner that would violate the HIPAA Requirements if done by Customer, except for uses or disclosures expressly permitted for Claraview's management, administration, or legal responsibilities under this BAA.

10. ACCESS TO BOOKS AND RECORDS

Claraview will make its internal practices, books, and records relating to the use and disclosure of PHI received from, or created, maintained, or received by Claraview on behalf of Customer available to the Secretary of the U.S. Department of Health and Human Services for purposes of determining compliance with the HIPAA Requirements.

11. CUSTOMER OBLIGATIONS

Customer will:

• provide Claraview only PHI that Customer is legally authorized to disclose and that Claraview is legally permitted to process;

• obtain all notices, consents, and authorizations required for Customer's collection, use, and disclosure of PHI;

• limit PHI provided to Claraview to the minimum necessary for the Covered Services;

• ensure that Customer's Authorized Users are permitted to access PHI available through the Claraview Platform;

• use reasonable safeguards to protect account credentials, devices, networks, and PHI within Customer's control;

• notify Claraview promptly of any restriction, revocation, suspected unauthorized access, or other circumstance that may affect Claraview's permitted handling of PHI; and

• remain responsible for Customer's clinical decisions, patient relationship, medical-record obligations, and compliance with laws applicable to Customer's dental practice.

12. TERM AND TERMINATION

a. Term

This BAA becomes effective on the earlier of the date Customer accepts it electronically or the date of the last signature below. It remains in effect while Claraview creates, receives, maintains, or transmits PHI on behalf of Customer, unless terminated in accordance with this BAA.

b. Termination for Cause

If either party knows of a pattern of activity or practice by the other party that constitutes a material breach of this BAA, the non-breaching party will provide written notice and a reasonable opportunity to cure. Unless an immediate termination is required by law or necessary to address an urgent privacy or security risk, the cure period will be 30 days. If the breach is not cured within the cure period, the non-breaching party may terminate this BAA and the affected Covered Services. If termination is not feasible, the non-breaching party may report the violation to the Secretary.

c. Return or Destruction of PHI

Upon termination of this BAA, Claraview will, if feasible and as directed by Customer, return or destroy PHI received from Customer or created, maintained, or received by Claraview on Customer's behalf. Claraview will retain no copies except as provided below. Customer is responsible for exporting PHI it wishes to retain before access to the Covered Services ends.

d. Infeasible Return or Destruction

If Claraview determines that return or destruction is infeasible or that retention is Required by Law, Claraview will notify Customer in writing. Claraview will retain only the PHI necessary for the reason return or destruction is infeasible, continue to protect the retained PHI under this BAA, and limit further uses and disclosures to those purposes that make return or destruction infeasible. Claraview will return or destroy the retained PHI when it is no longer needed.

e. Survival

Claraview's obligations regarding PHI retained after termination will survive termination of this BAA.

13. MISCELLANEOUS

a. Regulatory References

A reference in this BAA to a section of the HIPAA Requirements means the section as in effect or as amended.

b. Amendment

The parties will take any action reasonably necessary to amend this BAA to comply with changes to the HIPAA Requirements or other applicable law. A legally required amendment will take effect when required by law even if the parties have not yet signed a written amendment.

c. Interpretation

Any ambiguity in this BAA will be interpreted to permit compliance with the HIPAA Requirements.

d. Order of Precedence

This BAA controls only with respect to PHI and the HIPAA Requirements. Except as expressly modified by this BAA, the Service Agreement remains in effect.

e. Assignment

Neither party may assign this BAA separately from the Service Agreement. Any permitted assignee must agree to the obligations that apply to the assigning party under this BAA.

f. No Third-Party Beneficiaries

This BAA is for the benefit of Customer and Claraview. It does not create rights in any other person, including Smile Virtual, except as required by the HIPAA Requirements.

g. Governing Law

This BAA is governed by applicable federal law and, to the extent state law applies and is not preempted, the laws of the State of Arizona, without regard to conflict-of-law principles.

h. Notices

Privacy, security, and breach notices to Claraview must be sent to hello@claraview.ai and to the address listed below. Claraview may send notices to the email address associated with Customer's account.

i. Electronic Acceptance and Counterparts

This BAA may be accepted electronically and executed in counterparts. Electronic signatures and electronic acceptance have the same effect as original signatures.

IN WITNESS WHEREOF, the parties have executed or accepted this BAA as of the Effective Date.

CUSTOMER (COVERED ENTITY)

Legal Name: __________________________________________

By: _________________________________________________

Name: _______________________________________________

Title: ________________________________________________

Date: _________________________________________________

CLARAVIEW AI, LLC

By: _________________________________________________

Name: _______________________________________________

Title: ________________________________________________

Date: _________________________________________________

Notices: Claraview AI, LLC, 4444 N 32nd St, Suite 235, Phoenix, AZ 85018

Email: hello@claraview.ai