BUSINESS ASSOCIATE AGREEMENT

This Business Associate Agreement ("Agreement") is entered into as of the date
last signed below ("Effective Date") between:

COVERED ENTITY:
  Organization Name: _______________________________________
  Address: _________________________________________________
  Authorized Representative: ________________________________
  Title: ___________________________________________________
  ("Covered Entity")

BUSINESS ASSOCIATE:
  Organization Name: CaseFlow (operated by Polsia, Inc.)
  Address: 548 Market St, San Francisco, CA 94105
  Authorized Representative: Compliance Officer
  ("Business Associate")

RECITALS

Covered Entity is a Covered Entity or Business Associate subject to the Health
Insurance Portability and Accountability Act of 1996 ("HIPAA"), as amended by
the Health Information Technology for Economic and Clinical Health (HITECH) Act.
Business Associate provides certain services to Covered Entity that may involve
the creation, receipt, maintenance, or transmission of Protected Health
Information ("PHI"). This Agreement establishes the permitted and required uses
and disclosures of PHI by Business Associate.

1. DEFINITIONS

"PHI" means Protected Health Information as defined in 45 C.F.R. § 160.103.
"Security Rule" means the HIPAA Security Standards at 45 C.F.R. Parts 160 and 164.
"Breach" means the acquisition, access, use, or disclosure of PHI in a manner
not permitted under the Privacy Rule.

2. OBLIGATIONS OF BUSINESS ASSOCIATE

Business Associate agrees to:
(a) Use or disclose PHI only as permitted or required by this Agreement or
    required by law;
(b) Implement appropriate administrative, physical, and technical safeguards
    to protect the confidentiality, integrity, and availability of PHI;
(c) Report to Covered Entity any Breach of Unsecured PHI without unreasonable
    delay, and no later than 60 days following discovery;
(d) Notify Covered Entity of any Security Incident (as defined in 45 C.F.R.
    § 164.304) without unreasonable delay;
(e) Make its internal practices, books, and records available to the Secretary
    of HHS for purposes of determining compliance;
(f) Upon termination, return or destroy all PHI and retain no copies.

3. PERMITTED USES AND DISCLOSURES

Business Associate may use and disclose PHI as necessary to perform services
under the underlying service agreement, including:
  - Sending appointment reminders and scheduling communications to patients
    via SMS and email on behalf of Covered Entity;
  - Auto-fill waitlist matching using anonymized scheduling metadata;
  - De-identified analytics and quality improvement.

Business Associate shall not use PHI for marketing, sale, or any purpose
incompatible with the Covered Entity's treatment, payment, or operations.

4. MINIMUM NECESSARY

Business Associate shall request, use, and disclose only the minimum necessary
PHI to accomplish the intended purpose.

5. SUBCONTRACTORS

Business Associate uses the following subprocessors that may handle PHI:
  - Twilio Inc. (SMS delivery) — BAA on file
  - Postmark / Wildbit LLC (transactional email) — BAA on file
  - Render Services, Inc. (cloud hosting / compute) — BAA on file

Business Associate shall ensure each subprocessor is subject to equivalent
obligations as those imposed on Business Associate under this Agreement.

6. INDIVIDUAL RIGHTS

Business Associate agrees to support Covered Entity in meeting individuals'
rights to access, amend, and receive an accounting of disclosures of their PHI.

7. BREACH NOTIFICATION

In the event of a Breach:
  - Business Associate will notify Covered Entity within 72 hours of discovery;
  - Notice will include: nature of PHI involved, individuals affected,
    description of what occurred, mitigation steps taken;
  - Business Associate will cooperate fully with notification to affected
    individuals and HHS as required.

8. TERM AND TERMINATION

This Agreement is effective as of the Effective Date and continues until the
underlying service agreement terminates. Either party may terminate for material
breach upon 30 days written notice if breach is not cured.

9. MISCELLANEOUS

This Agreement is governed by federal HIPAA regulations and the laws of the
State of California. It supersedes any prior BAA between the parties.

IN WITNESS WHEREOF, the parties have executed this Agreement as of the dates
indicated below.

COVERED ENTITY:

Signature: ___________________________ Date: ___________
Name: _______________________________
Title: ______________________________

BUSINESS ASSOCIATE (CaseFlow / Polsia, Inc.):

Signature: ___________________________ Date: ___________
Name: Compliance Officer
Title: VP, Operations

---
For questions or to initiate counter-signature, contact: hipaa@surgeoncaseflow.com