Aesthetix Activate Business Associate Agreement Addendum

Version 2026.11.1. Published November 12, 2026. This Addendum is incorporated by reference into every Aesthetix Activate Order Form. The Order Form identifies the version executed by each Covered Entity. Prior versions and a change log are listed at the end of this page.

This Aesthetix Activate Business Associate Agreement Addendum (the “Addendum”) is entered into as of the Effective Date stated on the Aesthetix Activate Order Form (the “Order Form”) by and between Aesthetix CRM LLC, 2541 N Pleasantburg Dr, Ste 338, Greenville, SC 29609 (“Business Associate” or “Aesthetix”), and the customer identified on the Order Form (“Covered Entity”). Covered Entity’s execution of the Order Form constitutes execution of this Addendum in the version identified on the Order Form.

Recitals

A. Covered Entity and Business Associate are parties to the Aesthetix CRM Business Associate Agreement (the “Standard BAA”) governing Business Associate’s creation, receipt, maintenance, and transmission of Protected Health Information in connection with the Aesthetix CRM platform.

B. Covered Entity is enrolling in Aesthetix Activate under the Order Form and the Aesthetix Activate Service Terms published at aesthetixcrm.com/activate-terms (together, the “Service Agreement”) and Section 12B of the Aesthetix CRM Terms of Service (the “Terms”), under which patient data is extracted from Covered Entity’s electronic medical record system, warehoused and analyzed in a managed data environment operated by Business Associate’s data infrastructure providers, and synced into Covered Entity’s Aesthetix CRM account to power reporting dashboards and patient reactivation campaigns.

C. Because Activate involves a data flow, a set of infrastructure providers, and a data retention model that differ from the core Aesthetix CRM platform, the parties wish to supplement the Standard BAA with terms specific to Activate.

NOW, THEREFORE, the Parties agree as follows.

1. Definitions

Capitalized terms used but not defined in this Addendum have the meanings given in the Standard BAA or, if not defined there, in HIPAA. In addition:

a. “Activate” means the Aesthetix Activate data activation service described in Section 12B of the Terms and the Service Agreement, including the standard dashboards, data models, audience definitions, and reactivation campaign templates deployed as part of the service.

b. “Activate Data Set” means the categories of data elements extracted from the EMR Source for Activate, as listed in the Activate Data Set appendix to this Addendum.

c. “Activate Environment” means the logically segregated data warehouse, analytics, and audience segmentation environment provisioned for Covered Entity by the Data Infrastructure Providers, including the dashboards and reporting interfaces made available to Covered Entity through that environment.

d. “Data Infrastructure Providers” means CorralData, Inc. (“CorralData”), which provides data warehousing, analytics, and audience segmentation infrastructure for Activate; Fivetran, Inc., CorralData’s downstream data pipeline and reverse-synchronization provider; and the cloud hosting, content delivery, and model subcontractors engaged by CorralData and disclosed on the Aesthetix sub-processor list at aesthetixcrm.com/sub-processors. CorralData is an Infrastructure Provider under the Standard BAA. Fivetran and CorralData’s other downstream subcontractors are subcontractors of CorralData under Section 1 of the Standard BAA. Section 2(c) of this Addendum extends Section 2A of the Standard BAA, and Section 2 of the Terms applies, to each Data Infrastructure Provider.

e. “EMR Source” means the electronic medical record, practice management, or point-of-sale system of Covered Entity from which the Activate Data Set is extracted, as identified for each Enrolled Location on the Order Form.

f. “Enrolled Location” means each physical practice location of Covered Entity enrolled in Activate, as listed on the Order Form and as updated by written enrollment of additional locations.

g. “Reactivation Campaign” means an automated messaging sequence configured in Covered Entity’s Aesthetix CRM account that sends communications to patients included in an audience generated by Activate.

h. “Synced Records” means the contact records, tags, custom field values, and audience memberships written from the Activate Environment into Covered Entity’s Aesthetix CRM account.

2. Relationship to the Standard BAA

a. Supplement. This Addendum supplements and forms part of the Standard BAA. Except as expressly modified by this Addendum, the Standard BAA remains in full force and effect and applies to all Protected Health Information processed through Activate. In the event of a conflict between this Addendum and the Standard BAA with respect to Activate, this Addendum controls. In the event of a conflict between this Addendum and the Service Agreement, Section 12B of the Terms, or the Data Processing Addendum with respect to Protected Health Information, this Addendum controls.

b. Standard BAA Version. Covered Entity’s execution of the Order Form constitutes execution of the Aesthetix CRM Business Associate Agreement published at aesthetixcrm.com/baa in the version identified on the Order Form, which is incorporated by reference and supersedes any earlier business associate agreement between the Parties under its Section 8(d). Business Associate will deliver a countersigned PDF copy of that Standard BAA to Covered Entity’s notice email with the countersigned Order Form, and no patient data will be extracted from the EMR Source until the Order Form is countersigned, consistent with Section 12B.3 of the Terms. If the Order Form identifies a separately negotiated business associate agreement between the Parties, that agreement remains in effect and is not superseded, the Standard BAA is not executed by the Order Form, references in this Addendum to the Standard BAA mean that negotiated agreement, and any provision of the Standard BAA that this Addendum relies on and the negotiated agreement does not contain applies to the Activate Environment only.

c. Infrastructure Provider Provisions Extended. All provisions of Section 2A of the Standard BAA that apply to Infrastructure Providers, including the limitation of Business Associate’s obligations to its own acts and omissions and the notice of material changes in Business Associate’s BAA relationships, apply equally to each Data Infrastructure Provider.

3. Permitted Uses and Disclosures for Activate

a. Scope. In addition to the uses and disclosures permitted under the Standard BAA, Business Associate may, and may direct the Data Infrastructure Providers to, use and disclose Protected Health Information as necessary to:

(i) extract the Activate Data Set from the EMR Source on a recurring schedule using the access credentials, API keys, or integration authorizations furnished by Covered Entity;

(ii) transform, normalize, warehouse, and maintain the Activate Data Set in the Activate Environment, including retention of historical snapshots reasonably necessary for trend reporting;

(iii) generate dashboards, reports, and analyses for Covered Entity and for Business Associate’s account management, onboarding, and support personnel;

(iv) segment patients into audiences based on treatment history, appointment history, purchase history, and other elements of the Activate Data Set;

(v) write Synced Records into Covered Entity’s Aesthetix CRM account and update them as audiences change;

(vi) configure Reactivation Campaigns in Covered Entity’s Aesthetix CRM account and activate them upon Covered Entity’s approval; and

(vii) perform the management and administration functions, and the de-identification and aggregation activities, described in Sections 7 and 8.

b. Minimum Necessary. Business Associate will limit extraction from the EMR Source to the data elements within the Activate Data Set and will not expand the Activate Data Set to include additional categories of Protected Health Information without Covered Entity’s prior written approval, which may be given by email from an authorized user. Categories expressly excluded from the Activate Data Set are listed in the Activate Data Set appendix. Where the EMR Source or its connector does not permit field-level exclusion, excluded categories may be transferred to the Activate Environment, but will not be used for segmentation or synchronization, will be access-restricted, and will be deleted with the Activate Environment under Section 12. Business Associate will tell Covered Entity at onboarding which excluded categories, if any, cannot be excluded at the source for its EMR Source. Data that Covered Entity or its users independently connect, upload, or configure in the Activate Environment is outside the Activate Data Set and is Covered Entity’s responsibility.

c. No Designated Record Set. The Activate Environment is a derived analytical copy of information maintained in the EMR Source. It is not a designated record set of Covered Entity, and the EMR Source remains the system of record for all patient information. Business Associate will nonetheless assist Covered Entity as described in Section 10 with respect to Protected Health Information held in the Activate Environment.

4. Data Infrastructure Providers

a. Business Associate Agreements. Business Associate maintains a written business associate agreement with CorralData under which CorralData is a subcontractor business associate of Business Associate, and CorralData maintains written business associate agreements with Fivetran, Inc. and with each of its other downstream subcontractors that create, receive, maintain, or transmit Protected Health Information for Activate. Business Associate will not permit any Data Infrastructure Provider to process Protected Health Information for Activate unless a business associate agreement is in place.

b. Disclosure of Upstream Reporting Windows. Covered Entity acknowledges that each Data Infrastructure Provider reports Security Incidents and Breaches to Business Associate on the timeline set in its own business associate agreement. As of the Effective Date, CorralData is required to report to Business Associate within seventy-two (72) hours after it confirms an incident. Knowledge of a Data Infrastructure Provider is not imputed to Business Associate, and Business Associate’s reporting obligations under Section 9 run from the earlier of Business Associate’s own discovery or its receipt of a report from a Data Infrastructure Provider.

c. Data Location. The Activate Environment and all Protected Health Information stored in it, including backups, are hosted in data centers located in the United States, and Business Associate will not permit Protected Health Information in the Activate Environment to be stored outside the United States. Authorized support personnel of the Data Infrastructure Providers located outside the United States may access the Activate Environment remotely, solely to perform the services, through provider-managed systems with multi-factor authentication, without local download, storage, or printing of Protected Health Information, with access logged, and under written confidentiality obligations. Where Covered Entity’s own obligations require it, Covered Entity may request in writing that support access for its Activate Environment be performed only from within the United States, and Business Associate will pass that request to the Data Infrastructure Providers for accommodation where commercially reasonable.

d. Changes. Business Associate will give Covered Entity at least thirty (30) days’ prior notice, by email to the notice address on file for Covered Entity, before engaging a new Data Infrastructure Provider that will process Protected Health Information for Activate. Covered Entity’s remedy if it objects to a new Data Infrastructure Provider is to cancel Activate without penalty before the change takes effect.

e. Responsibility. Business Associate is responsible for its own acts and omissions and for its selection of, and contractual flow-down to, the Data Infrastructure Providers. Consistent with Section 2A of the Standard BAA and Section 12B.2 of the Terms, Business Associate does not own, operate, or control the Data Infrastructure Providers’ systems and is not liable for an outage, refresh failure, data loss, or Security Incident attributable solely to a Data Infrastructure Provider, except to the extent caused by Business Associate’s breach of this Addendum or the Standard BAA.

5. EMR Source Access and Covered Entity Authorizations

a. Authority to Grant Access. Covered Entity represents that it has the right under its agreement with the EMR Source vendor to authorize Business Associate and the Data Infrastructure Providers to access and extract the Activate Data Set through the API, export, or integration method used for the Enrolled Locations, and that granting such access does not breach any obligation Covered Entity owes to the EMR Source vendor.

b. Credentials. Covered Entity will furnish, and keep current, the credentials, API keys, integration authorizations, and vendor-side configuration required for extraction. Covered Entity will promptly notify Business Associate when it changes EMR Source vendors, rotates credentials, changes the scope of an integration authorization, or closes or adds an Enrolled Location. Business Associate is not responsible for gaps in extraction, reporting, or campaigns caused by lapsed, revoked, or changed credentials.

c. Source Data Accuracy. Business Associate does not validate the clinical, financial, or contact accuracy of information in the EMR Source. Dashboards, audiences, and Reactivation Campaigns reflect the EMR Source as extracted. Covered Entity is responsible for the accuracy of information entered into the EMR Source, including service mappings, appointment status, deceased and do-not-contact flags, and patient opt-out status.

d. Access to the Activate Environment. Covered Entity is responsible for the users it authorizes to access dashboards and reports in the Activate Environment on the same terms that apply to Aesthetix CRM users under Section 5 of the Standard BAA, including credential confidentiality, least-privilege provisioning, prompt deprovisioning, multi-factor authentication where offered, and prompt notice of any credential compromise.

6. Reactivation Campaigns and Patient Communications

a. Covered Entity Determination. Covered Entity is responsible for determining that each Reactivation Campaign is a permissible communication under HIPAA. Communications about a treatment, product, or service that Covered Entity itself provides, including recall and reminder communications about treatments a patient has previously received, are generally excluded from the definition of marketing under 45 C.F.R. 164.501 provided Covered Entity does not receive financial remuneration from a third party for making the communication. Covered Entity will not direct Business Associate to configure a Reactivation Campaign that promotes a third party’s product or service, or for which Covered Entity receives remuneration from a third party, without first obtaining any authorization required under 45 C.F.R. 164.508(a)(3).

b. Approval as Instruction. Business Associate configures Reactivation Campaigns for activation only upon Covered Entity’s approval, and that approval constitutes Covered Entity’s instruction to send. Covered Entity is the sender and initiator of all messages transmitted by Reactivation Campaigns and is solely responsible for patient consent, message content, sending times and quiet hours, opt-out honoring, exclusion of patients who should not be contacted, and compliance with the TCPA and all other applicable communications laws, as set forth in Sections 12B.6, 18, and 19 of the Terms.

c. Exclusions. Covered Entity is responsible for maintaining in the EMR Source, or communicating to Business Associate in writing, the categories of patients to be excluded from audiences, such as deceased patients, patients with an active complaint or dispute, patients under a treatment plan that should not be interrupted, and patients who have revoked consent to be contacted. Business Associate will apply exclusions that are communicated in writing and that are supportable from the Activate Data Set.

7. Management and Administration

Business Associate may use Protected Health Information in the Activate Environment for the proper management and administration of Business Associate and to carry out its legal responsibilities, and may disclose it for those purposes if the disclosure is required by law or Business Associate obtains reasonable assurances from the recipient that the information will be held confidentially, used or further disclosed only as required by law or for the purpose for which it was disclosed, and that the recipient will notify Business Associate of any instance of which it becomes aware in which confidentiality has been breached. Management and administration includes onboarding, support, quality assurance, troubleshooting of extractions and syncs, and internal review of campaign performance for Covered Entity’s account.

8. De-Identified and Aggregated Data

a. Authorization. Covered Entity authorizes Business Associate, and the Data Infrastructure Providers acting on Business Associate’s instruction, to de-identify Protected Health Information in the Activate Environment in accordance with 45 C.F.R. 164.514(a) through (c), and to aggregate Protected Health Information with the data of other customers for data aggregation services relating to the health care operations of Covered Entity and other covered entity customers of Business Associate, as permitted by 45 C.F.R. 164.504(e)(2)(i)(B). Covered Entity further authorizes the Data Infrastructure Providers to use and disclose information de-identified in accordance with this Section for their own lawful business purposes, including benchmarking and product improvement, provided that such information does not identify Covered Entity, any Enrolled Location, Business Associate, or any individual, and that the Data Infrastructure Providers are contractually prohibited from re-identifying it.

b. Use of De-Identified Data. Information that has been de-identified in accordance with Section 8(a) is not Protected Health Information, and Business Associate may use and disclose it to operate, benchmark, improve, and market the Aesthetix CRM services, consistent with Section 12B.7 of the Terms, provided that no such use or disclosure identifies Covered Entity, any Enrolled Location, or any individual, and provided that Business Associate does not attempt to re-identify the information or permit any recipient to do so.

c. No Sale. Nothing in this Section authorizes the sale of Protected Health Information within the meaning of 45 C.F.R. 164.502(a)(5)(ii).

9. Security Incident and Breach Reporting

a. Timeline. Business Associate will report to Covered Entity any use or disclosure of Protected Health Information in the Activate Environment not permitted by this Addendum or the Standard BAA, any Security Incident affecting the Activate Environment, and any Breach of Unsecured Protected Health Information in the Activate Environment, within seventy-two (72) hours after discovery by Business Associate, as discovery is described in Section 4(b). The content of each report, the treatment of unsuccessful Security Incidents, the law enforcement delay provisions, and the cooperation obligations of Section 4 of the Standard BAA apply.

b. Provider-Originated Incidents. Where an incident originates with or is first identified by a Data Infrastructure Provider, Business Associate’s initial report may be limited to the information then in Business Associate’s possession, and Business Associate will supplement the report as the Data Infrastructure Provider furnishes additional information. Business Associate will not delay an initial report in order to complete an investigation.

c. Activate-Specific Safeguards. Business Associate will require the Data Infrastructure Providers to maintain, and will confirm through its own vendor due diligence, at least the following safeguards for the Activate Environment: encryption of Protected Health Information in transit using TLS 1.2 or higher and at rest using AES-256 or an equivalent standard; logical segregation of Covered Entity’s data from the data of other customers; role-based access controls with multi-factor authentication for administrative access; logging of access to Protected Health Information; and an independent security assessment or audit report (SOC 2 Type I upon issuance, then Type II when issued, or equivalent, renewed annually thereafter), a summary of which Business Associate will make available to Covered Entity under Section 6(b) of the Standard BAA.

d. Artificial Intelligence Features. The Activate Environment may include natural-language query and analysis features that operate on Covered Entity’s own data within the Activate Environment. Business Associate will require that Protected Health Information in the Activate Environment is not used to train, fine-tune, or improve any artificial intelligence or machine learning model for the benefit of any party other than Covered Entity, and that any model provider engaged for such features is bound by a business associate agreement or processes Protected Health Information only on a zero-retention basis.

10. Individual Rights

a. Access and Amendment. Because the EMR Source is the designated record set, Covered Entity will ordinarily satisfy requests for access under 45 C.F.R. 164.524 and amendment under 45 C.F.R. 164.526 from the EMR Source. Where Covered Entity determines that Protected Health Information in the Activate Environment is needed to respond to such a request, Business Associate will make that information available, or reflect an amendment made in the EMR Source through the next scheduled extraction, within fifteen (15) business days after Covered Entity’s written request.

b. Accounting of Disclosures. Business Associate will document disclosures of Protected Health Information from the Activate Environment that would be subject to an accounting under 45 C.F.R. 164.528 and will provide that information to Covered Entity within fifteen (15) business days after written request. Disclosures to the Data Infrastructure Providers for the purpose of providing Activate, and the writing of Synced Records into Covered Entity’s own Aesthetix CRM account, are disclosures to Covered Entity’s business associates for its health care operations and are not subject to an accounting.

c. Restrictions. If Covered Entity agrees to a restriction under 45 C.F.R. 164.522 that affects a patient’s inclusion in audiences or Reactivation Campaigns, Covered Entity will communicate the restriction to Business Associate in writing, and Business Associate will apply it within ten (10) business days.

11. Term, Suspension, and Cancellation of Activate

a. Term. This Addendum takes effect on the Effective Date and continues for so long as any Enrolled Location remains enrolled in Activate, and thereafter until all Protected Health Information in the Activate Environment has been returned or destroyed in accordance with Section 12. Cancellation of Activate does not terminate the Standard BAA, which continues to govern Covered Entity’s Aesthetix CRM account.

b. Suspension. If Covered Entity’s Aesthetix CRM subscription or EMR integration for an Enrolled Location is cancelled, suspended, or lapses, extraction and syncing for that location will stop concurrently under Section 12B.3 of the Terms. During any suspension, the Data Infrastructure Providers will continue to protect Protected Health Information already in the Activate Environment in accordance with this Addendum.

c. Termination for Cause. Covered Entity may terminate this Addendum, and Covered Entity’s enrollment in Activate, in accordance with Section 8 of the Standard BAA. Business Associate may suspend extraction and syncing immediately if it reasonably determines that continued processing would violate HIPAA, this Addendum, or the Standard BAA, or that Covered Entity has lost the right to authorize access to the EMR Source, and will notify Covered Entity of the suspension and the reason.

12. Disposition of Data on Cancellation

a. Cessation of Extraction. Business Associate will cause extraction from the EMR Source and syncing into Covered Entity’s Aesthetix CRM account to cease within two (2) business days after the effective date of cancellation of Activate for the affected Enrolled Location or Locations.

b. Export Window. Covered Entity may request, in writing before the effective date of cancellation as provided in Section 12B.8 of the Terms, or within thirty (30) days after that date, an export of the Activate Data Set and any custom data models built for Covered Entity in a commercially reasonable, machine-readable format. Business Associate will deliver the export within thirty (30) days after the request. Standard dashboards, data models, audience definitions, queries, and campaign templates are Provider intellectual property under Section 12B.5 of the Terms and are not included in an export.

c. Deletion. Business Associate will cause all Protected Health Information in the Activate Environment for the affected Enrolled Locations to be deleted within thirty (30) days after the later of the effective date of cancellation or the delivery of any export requested under Section 12(b), and will cause deletion from backup and disaster recovery media in the ordinary course of the Data Infrastructure Providers’ backup rotation, not to exceed ninety (90) days after the initial deletion. Protected Health Information held in backup media pending rotation remains subject to this Addendum and will not be restored to active use. Business Associate will provide written certification of deletion within fifteen (15) business days after Covered Entity’s written request.

d. Synced Records. Synced Records in Covered Entity’s Aesthetix CRM account are Client Data under the Terms and remain subject to the Standard BAA and to the export and retention provisions of Section 15 of the Terms. Cancellation of Activate does not delete Synced Records, and Covered Entity may retain or delete them at its discretion.

e. Infeasibility. If Business Associate determines that return or destruction of any Protected Health Information is infeasible, Section 8 of the Standard BAA applies to that information. This Section 12 sets the transition and retention periods that govern Activate and supersedes any provision of the Standard BAA that would require immediate destruction without an export window.

13. Multiple Locations and Affiliated Covered Entities

a. Single Legal Entity. If all Enrolled Locations are operated by the legal entity executing this Addendum, this Addendum covers each Enrolled Location listed on the Order Form and each location later enrolled in writing.

b. Multiple Legal Entities. If any Enrolled Location is operated by a legal entity other than the entity executing this Addendum, then either (i) the executing entity represents that it and each such entity have designated themselves as a single affiliated covered entity under 45 C.F.R. 164.105(b) and that the designation is documented in writing and available to Business Associate on request, or (ii) the executing entity represents that it is authorized to execute this Addendum and the Standard BAA on behalf of each such entity, each of which is listed on the Order Form and is bound as a Covered Entity. Business Associate will not extract Protected Health Information for an Enrolled Location until one of these conditions is satisfied for the entity operating that location, consistent with Section 21 of the Terms.

14. Liability and Indemnification

a. Standard BAA Governs. Section 9 of the Standard BAA, including the mutual indemnification, the limitation of liability, and the exclusion of consequential damages, applies to this Addendum and to all Protected Health Information processed through Activate.

b. Measurement of the Cap. For the avoidance of doubt, the limitation of liability in Section 9(c) of the Standard BAA is measured by the total fees paid or payable by Covered Entity to Business Associate under the Underlying Agreement (as defined in the Standard BAA, which includes this Addendum and the Service Agreement) during the twelve (12) months preceding the event giving rise to the claim, and is a single aggregate cap. Activate fees are included in that measurement and do not create a separate cap.

c. Infrastructure Providers. Consistent with Section 4(e), Business Associate has no liability for the acts or omissions of a Data Infrastructure Provider except to the extent arising from Business Associate’s own breach of this Addendum or the Standard BAA. Business Associate will, at Covered Entity’s reasonable request and expense, use commercially reasonable efforts to enforce its contractual rights against a Data Infrastructure Provider for Covered Entity’s benefit.

15. General

a. Order of Precedence. With respect to Protected Health Information processed through Activate, the following order of precedence applies in the event of conflict: (i) this Addendum; (ii) the Standard BAA; (iii) the Order Form, then any master services agreement between the parties, then the Service Terms; (iv) the Data Processing Addendum; and (v) Section 12B of the Terms and the remainder of the Terms.

b. Regulatory Amendment. The parties will amend this Addendum as necessary to comply with changes in HIPAA or other applicable law. Business Associate may update the Activate Data Set appendix to remove data elements, and may update the identity of Data Infrastructure Providers in accordance with Section 4(d), by written notice. Business Associate may otherwise publish a revised version of this Addendum on at least thirty (30) days’ notice by email to Covered Entity’s notice email; a revision applies to Covered Entity from its effective date unless Covered Entity cancels Activate before that date, and no revision reduces the protections of Sections 3, 4, 9, or 12 for Protected Health Information already in the Activate Environment without Covered Entity’s written agreement.

c. Notices. Notices under this Addendum are given in the manner set out in the Standard BAA. Notices to Business Associate regarding Security Incidents or Breaches must be sent to legal@aesthetixcrm.com with a copy to support@aesthetixcrm.com.

d. Execution. This Addendum is executed by the Parties’ execution of the Order Form, which may be signed in counterparts and by electronic signature. Covered Entity may request a countersigned PDF copy of this Addendum in the executed version at any time by emailing legal@aesthetixcrm.com.

Appendix. Activate Data Set

The following categories of data elements may be extracted from the EMR Source for each Enrolled Location. Elements not listed are excluded unless added by written approval of Covered Entity under Section 3(b). Where the EMR Source or its connector does not permit field-level exclusion, Section 3(b) governs the handling of excluded categories.

Version History