Business Associate Agreement

Effective June 10, 2026

This Business Associate Agreement (“BAA” or “Agreement”) is entered into between Relvema (“Business Associate”) and the licensed therapist, counselor, psychologist, or covered entity (“Covered Entity”) who accepts this Agreement by creating a Relvema account. This BAA satisfies the requirements of 45 C.F.R. § 164.504(e) of the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations, as amended (“HIPAA”).

By creating an account and using the Relvema platform, the Covered Entity agrees to the terms of this Agreement. This Agreement supersedes any prior oral or written representations regarding HIPAA compliance between the parties.

1. Definitions

Capitalized terms used in this Agreement have the meanings set forth in HIPAA (45 C.F.R. Parts 160 and 164), including:

• Protected Health Information (PHI) means individually identifiable health information created, received, maintained, or transmitted by Relvema on behalf of the Covered Entity in connection with the Services. Within the Relvema platform, PHI includes: patient names and email addresses; session audio recordings; AI-generated session transcripts; clinical notes (SOAP, DAP, and BIRP formats); session summaries and AI insights; mood scores and emotional pattern data; journaling content; homework assignments and completion records; and appointment and scheduling data linked to identified patients.
• Electronic PHI (ePHI) means PHI that is created, received, maintained, or transmitted in electronic form, which describes all PHI in the Relvema platform.
• Services means the Relvema therapist portal (therapist.relvema.com) and supporting backend infrastructure, including AI-assisted note generation, session recording and transcription, video sessions, scheduling, homework management, and patient connection features.
• Breach has the meaning set forth at 45 C.F.R. § 164.402.
• Sub-Business Associate means a subcontractor of Relvema that creates, receives, maintains, or transmits PHI on behalf of Relvema in order to provide the Services.

2. Permitted Uses and Disclosures

Relvema may use or disclose PHI only as follows:

• To provide the Services. Relvema may use PHI to operate, maintain, and improve the platform features that the Covered Entity has enabled — including transcribing session audio, generating AI-assisted clinical notes and summaries, delivering patient homework, and displaying session history in the therapist dashboard.
• For proper management and administration. Relvema may use or disclose PHI for its own proper management and administration or to carry out its legal responsibilities, provided that any disclosure is required by law or Relvema obtains reasonable assurances that the recipient will maintain the confidentiality of the PHI.
• As required by law. Relvema may use or disclose PHI to the extent required by applicable federal, state, or local law, including a valid court order, subpoena, or regulatory demand. Relvema will promptly notify the Covered Entity of any such requirement to the extent permitted by law.

Relvema will not use or disclose PHI in any manner that would violate the Privacy Rule if done by the Covered Entity, except as permitted under this Agreement. Relvema will not sell PHI, use PHI for advertising or marketing, or use PHI to train any artificial intelligence or machine-learning model — including Relvema’s own AI systems.

3. Safeguards

Relvema will implement and maintain appropriate administrative, technical, and physical safeguards to protect the confidentiality, integrity, and availability of PHI, in accordance with 45 C.F.R. §§ 164.308, 164.310, and 164.312.

Technical safeguards include:

• Encryption at rest: All PHI stored in Google Cloud Firestore and Google Cloud Storage is encrypted using AES-256 encryption managed by Google Cloud Key Management Service (KMS).
• Encryption in transit: All data transmitted between clients and Relvema servers uses TLS 1.2 or higher.
• Access control: Firestore security rules enforce row-level access — a therapist’s session data is accessible only to that therapist and the patient explicitly connected to their account. No cross-therapist data access is possible at the data layer.
• Audio access control: Session audio files are never exposed directly to browsers. Access requires a signed, time-limited URL (15-minute expiry) generated server-side through the Firebase Admin SDK.
• AI processing boundary: All AI processing (transcription, note generation, session insights) is performed exclusively on Google Vertex AI within Relvema’s Google Cloud infrastructure. PHI never leaves the Google Cloud boundary and is never transmitted to any third-party AI service.
• Secret management: Service account credentials and API keys are stored exclusively in Google Secret Manager. No credentials are stored in source code, environment files, or version control.
• Audit logging: Google Cloud Data Access audit logs are enabled on all Relvema GCP projects, recording every read and write to Firestore and Cloud Storage that involves PHI.

Administrative safeguards include:

• A designated Security Officer responsible for developing and implementing security policies.
• Workforce access management — only personnel with a legitimate need to access PHI are granted access, and all access is logged.
• Incident response and reporting procedures, including breach identification, containment, and notification.
• Business associate agreements with all Sub-Business Associates (see Section 5).

Physical safeguards include:

• All PHI is stored in Google Cloud data centers that maintain SOC 2 Type II, ISO 27001, and FedRAMP certifications. Relvema has no physical servers and no physical access to PHI storage infrastructure.

4. Reporting

Relvema will report to the Covered Entity any use or disclosure of PHI not provided for by this Agreement that Relvema becomes aware of, including Breaches of Unsecured PHI as required by 45 C.F.R. § 164.410.

Relvema will provide notice of any confirmed Breach of Unsecured PHI without unreasonable delay and in no case later than 60 days after discovery. The notice will include, to the extent possible: the identity of affected individuals, a description of the Breach, the types of PHI involved, steps individuals should take to protect themselves, a description of Relvema’s investigation and mitigation steps, and contact information for follow-up questions.

To report a potential security incident, contact security@relvema.com immediately. For general compliance inquiries, contact compliance@relvema.com.

5. Sub-Business Associates

Relvema will ensure that any Sub-Business Associate that creates, receives, maintains, or transmits PHI on Relvema’s behalf agrees to the same restrictions and conditions regarding PHI that apply to Relvema under this Agreement, in accordance with 45 C.F.R. § 164.504(e)(2)(ii)(D).

Relvema’s current Sub-Business Associates are:

• Google LLC (Google Cloud Platform) — provides the cloud infrastructure underlying all Relvema services, including Firestore (structured data), Cloud Storage (audio files), Cloud Functions (server-side processing), Vertex AI (AI processing), Firebase App Hosting, Firebase Authentication, and Secret Manager. Google maintains a signed BAA with Relvema covering all applicable services. Google Cloud’s HIPAA compliance resources are available at cloud.google.com/security/compliance/hipaa.

Stripe, Inc. processes subscription payments on behalf of Relvema but does not access, store, or process any PHI. Stripe is not a Sub-Business Associate under HIPAA.

Relvema will update this section as Sub-Business Associates are added or removed. Material changes that reduce the protection of PHI will be communicated to Covered Entities with reasonable advance notice.

6. Access and Amendment

To the extent Relvema holds PHI in a Designated Record Set, Relvema will make such PHI available to the Covered Entity within 30 days of a written request, to enable the Covered Entity to fulfill its obligations under 45 C.F.R. §§ 164.524 (individual access) and 164.526 (amendment).

Therapists may access all session data, transcripts, notes, and patient records through the Relvema portal at any time during their subscription. Data export or deletion requests should be submitted to support@relvema.com.

7. HHS Availability

Relvema will make its internal practices, books, and records related to the use and disclosure of PHI available to the Secretary of the U.S. Department of Health and Human Services (HHS) for purposes of determining compliance with HIPAA, as required by 45 C.F.R. § 164.504(e)(2)(ii)(H).

8. Term and Termination

This Agreement is effective upon the Covered Entity’s acceptance (by creating a Relvema account) and remains in effect for as long as the Covered Entity maintains an active Relvema subscription or Relvema holds PHI on the Covered Entity’s behalf.

Either party may terminate this Agreement immediately upon written notice if the other party has materially breached a provision of this Agreement and has not cured the breach within 30 days of written notice of the breach.

Upon termination for any reason, Relvema will, at the Covered Entity’s election, return or destroy all PHI received from, or created or received on behalf of, the Covered Entity. If return or destruction is not feasible, Relvema will extend the protections of this Agreement to the PHI and limit further uses and disclosures to those purposes that make the return or destruction infeasible. PHI deletion will be completed within 60 days of account termination unless an applicable law requires a longer retention period.

9. Amendments

Relvema may amend this Agreement at any time to comply with changes in HIPAA regulations or guidance issued by HHS. Relvema will provide at least 30 days’ advance notice of material changes by posting the updated Agreement at relvema.com/legal/baa and, where practicable, by email to the address associated with the Covered Entity’s account. Continued use of the Services after the effective date of any amendment constitutes acceptance of the amended Agreement.

10. Governing Law

This Agreement is governed by the laws of the State of Florida, without regard to its conflict-of-law provisions. Any disputes arising under this Agreement will be resolved in the state or federal courts located in Miami-Dade County, Florida.

For questions about this Agreement, contact compliance@relvema.com.