Business Associate Agreement

Version 2026-10-01. Subscribers accept this agreement when they sign up; the exact text accepted is kept with their account.

BUSINESS ASSOCIATE AGREEMENT — SmartMeet (version 2026-10-01)

This Business Associate Agreement ("Agreement") is entered into between the subscriber accepting it ("Covered Entity") and AthleticsMD (IPMS) ("Business Associate"), which provides the SmartMeet video meeting and recording service ("Service").

1. Definitions. Terms used but not defined here have the meanings given in the HIPAA Rules at 45 C.F.R. Parts 160 and 164. "PHI" means protected health information that Business Associate creates, receives, maintains or transmits on behalf of Covered Entity through the Service.

2. Permitted uses and disclosures. Business Associate may use and disclose PHI only to provide the Service to Covered Entity, as required by law, or for its proper management and administration as permitted by 45 C.F.R. § 164.504(e)(4). Business Associate will not use or disclose PHI in any way that would violate Subpart E of 45 C.F.R. Part 164 if done by Covered Entity, will not sell PHI, and will not use PHI for marketing.

3. Safeguards. Business Associate will use appropriate administrative, physical and technical safeguards, and comply with Subpart C of 45 C.F.R. Part 164, to prevent use or disclosure of electronic PHI other than as provided by this Agreement. Meeting audio and video travel encrypted between participants (DTLS-SRTP) and, where a relay is needed, through a relay operated under its own business associate agreement; recordings kept in the Service are stored on access-controlled servers in the United States.

4. Reporting. Business Associate will report to Covered Entity any use or disclosure of PHI not provided for by this Agreement, and any security incident, of which it becomes aware, and will notify Covered Entity of any breach of unsecured PHI without unreasonable delay and in no case later than 60 calendar days after discovery, with the information required by 45 C.F.R. § 164.410.

5. Subcontractors. Business Associate will ensure that any subcontractor that creates, receives, maintains or transmits PHI on its behalf agrees in writing to the same restrictions and conditions that apply to Business Associate.

6. Individual rights. To the extent Business Associate maintains PHI in a designated record set, it will make PHI available for access and amendment, and provide the information needed for an accounting of disclosures, as required by 45 C.F.R. §§ 164.524, 164.526 and 164.528. Recordings and attendance records can be downloaded and deleted by Covered Entity from its account at any time.

7. Government access. Business Associate will make its internal practices, books and records relating to PHI available to the Secretary of Health and Human Services for purposes of determining compliance with the HIPAA Rules.

8. Term and termination. This Agreement lasts for as long as Covered Entity's subscription, and ends when it ends. Covered Entity may terminate this Agreement if Business Associate materially breaches it and does not cure the breach within 30 days of notice. On termination, Business Associate will return or destroy all PHI it maintains for Covered Entity, retaining no copies, or, where that is infeasible, extend the protections of this Agreement to that PHI for as long as it is retained.

9. Covered Entity's obligations. Covered Entity is responsible for obtaining any consent required for recording a meeting, and for not placing PHI in parts of the Service not intended to hold it (such as meeting titles visible to guests).

10. Miscellaneous. This Agreement is interpreted to permit compliance with the HIPAA Rules. Nothing in it confers rights on any third party. It is accepted electronically; the name typed, the time, and the network address of the acceptance are kept as the record of signature.