Aesthetix CRM Business Associate Agreement

Version 2026.11.1. Published November 12, 2026. This is the current form of the Aesthetix CRM Business Associate Agreement. It is executed by e-signature (request a signing link from support@aesthetixcrm.com) or by execution of an order form or addendum that identifies this version. Prior versions are listed at the end of this page.

THIS AGREEMENT is made effective as of the date of the last signature below (the “Effective Date”) by and between the entity identified on the signature page, hereinafter referred to as “Covered Entity,” and Aesthetix CRM LLC, 2541 N Pleasantburg Dr, Ste 338, Greenville, South Carolina 29609, hereinafter referred to as “Business Associate.” The individuals or entities executing this agreement shall collectively be referred to as the “Parties.”

The Covered Entity and Business Associate mutually agree to comply with the requirements of the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) and its implementing regulations (45 C.F.R. Parts 160-64), the requirements of the Health Information Technology for Economic and Clinical Health Act, as incorporated in the American Recovery and Reinvestment Act of 2009 (the “HITECH Act”), and the 2013 final ruling from the U.S. Department of Health and Human Services (HHS) Office for Civil Rights that modifies and strengthens a number of provisions of the HITECH Act (“Omnibus Ruling”). The Covered Entity and Business Associate agree to incorporate into this Agreement any regulations issued with respect to HIPAA that relate to the obligations of Business Associates. Business Associate recognizes and agrees that it is obligated by law to meet the applicable HIPAA provisions.

1. Definitions

The “HIPAA Rules” mean, collectively, the Standards for Privacy of Individually Identifiable Health Information (the “Privacy Rule”), the Security Standards for the Protection of Electronic PHI (the “Security Rule”), the Notification for Breach of Unsecured Protected Health Information (the “Breach Notification Rule”), and the Enforcement Rule and the Transactions Rule all as set forth at 45 C.F.R. Parts 160, 162 and 164 and as the same may be amended from time to time. Capitalized terms used herein without definition shall have the meaning as set forth in the HIPAA Rules.

The term “Secretary” means the Secretary of the Department of Health and Human Services.

“Security Incident” means the attempted or successful unauthorized access, use, disclosure, modification, or destruction of information, or interference with system operations, that may compromise the confidentiality, integrity, or availability of Protected Health Information. Reporting of Security Incidents is governed by Section 4.

“Discovery” of a Breach or Security Incident by Business Associate occurs on the first day on which it is known to Business Associate or, through the exercise of reasonable diligence, would have been known to Business Associate, consistent with 45 C.F.R. 164.410(a)(2). Knowledge of an Infrastructure Provider or Subcontractor is not imputed to Business Associate; Business Associate’s knowledge of an incident originating with an Infrastructure Provider or Subcontractor begins on the earlier of Business Associate’s own Discovery or its receipt of that provider’s report.

“Underlying Agreement” means the Aesthetix CRM Terms of Service published at aesthetixcrm.com/terms (the “Terms”), the Aesthetix CRM Data Processing Addendum, any master services agreement or order form between the Parties, and any addendum to this Agreement that the Parties execute (including the Aesthetix Activate Business Associate Agreement Addendum, where applicable), under which Business Associate provides the Services. “Services” and “Platform” have the meanings given in the Terms.

“Infrastructure Providers” means the third-party providers identified in the table in Section 2A, together with any provider that Business Associate’s sub-processor list at aesthetixcrm.com/sub-processors identifies as creating, receiving, maintaining, or transmitting Protected Health Information. Each Infrastructure Provider is a Subcontractor of Business Associate under 45 C.F.R. 160.103. A provider engaged by an Infrastructure Provider rather than by Business Associate is a subcontractor of that Infrastructure Provider and is covered by that Infrastructure Provider’s business associate agreements, not by Section 2(f). Other vendors on the sub-processor list that do not handle Protected Health Information are not Infrastructure Providers for purposes of this Agreement. A provider that Section 2A or the sub-processor list identifies as serving only customers enrolled in a particular service (such as CorralData for Aesthetix Activate) is an Infrastructure Provider only for a Covered Entity enrolled in that service.

2. Obligations and Activities of Business Associate

a. Business Associate shall apply the HIPAA “minimum necessary” standard to its use, disclosure, access, or request of Covered Entity’s Protected Health Information, to the extent applicable and consistent with the Services provided under the Underlying Agreement. Where the Parties agree a limited data set is appropriate for a particular use case, Business Associate will support such use to the extent practicable. In addition, Business Associate shall implement and follow appropriate Minimum Necessary policies in the performance of its obligations under this Agreement.

b. Business Associate agrees to not use or further disclose Protected Health Information other than as permitted or required by this Agreement and the Underlying Agreement or as required by law.

c. Business Associate agrees to use appropriate safeguards, including without limitation administrative, physical, and technical safeguards, to prevent use or disclosure of the Protected Health Information other than as provided for by this Agreement and to reasonably and appropriately protect the confidentiality, integrity, and availability of any electronic Protected Health Information that it may receive, maintain, or transmit on behalf of the Covered Entity.

d. Business Associate agrees to mitigate, to the extent practicable, any harmful effect known to Business Associate of a use or disclosure of Protected Health Information by Business Associate in violation of the requirements of this Agreement.

e. Business Associate agrees to comply with the Security Rule, as required, in a manner consistent with the Security Rule and regulations that may be adopted by relevant federal agencies, to keep all Electronic Protected Health Information in a secure manner, as required under federal law.

f. Business Associate agrees to ensure that any agent, including a Subcontractor, to whom it provides Protected Health Information received from, or created or received by Business Associate on behalf of Covered Entity agrees in writing to the same restrictions and conditions that apply through this Agreement to Business Associate with respect to such information, in accordance with 45 C.F.R. 164.502(e)(1)(ii) and 164.308(b)(2).

g. Business Associate agrees to provide access, at the written request of Covered Entity and within fifteen (15) business days after that request, to Protected Health Information in a Designated Record Set, to Covered Entity or, as directed by Covered Entity, to an Individual in order to meet the requirements under 45 C.F.R. 164.524. Covered Entity acknowledges that the Platform is a customer relationship management system and that Covered Entity’s electronic medical record system ordinarily remains the Designated Record Set for patient information.

h. Business Associate agrees to make any amendment(s) to Protected Health Information in a Designated Record Set that the Covered Entity directs or agrees to pursuant to 45 C.F.R. 164.526, at the written request of Covered Entity and within fifteen (15) business days after that request.

i. Business Associate agrees to make internal practices, books, and records relating to the use and disclosure of Protected Health Information received from, or created or received by Business Associate on behalf of, Covered Entity available to the Covered Entity, or at the request of the Covered Entity and/or to the Secretary, for purposes of the Secretary determining Covered Entity’s compliance with the Privacy and Security Rules.

j. Business Associate agrees to document such disclosures of Protected Health Information and information related to such disclosures as would be required for Covered Entity to respond to a request by an Individual for an accounting of disclosures of Protected Health Information in accordance with 45 C.F.R. 164.528.

k. Business Associate agrees to provide to Covered Entity, within fifteen (15) business days after written request, information collected in accordance with this Agreement to permit Covered Entity to respond to a request by an Individual for an accounting of disclosures of Protected Health Information in accordance with 45 C.F.R. 164.528. Disclosures to Infrastructure Providers for the purpose of providing the Services are disclosures to Covered Entity’s business associates for its health care operations and are not subject to an accounting.

l. Authentication Support and MFA Controls. Business Associate will make available authentication controls for the Services, including two-factor authentication, and will provide documentation regarding recommended account security configurations. Business Associate may, at its discretion, enforce additional authentication requirements for access to the Services (including for administrative users) and may restrict or suspend access where Business Associate reasonably determines an account is at elevated risk of unauthorized access.

m. Business Associate hereby acknowledges and agrees that Covered Entity has notified Business Associate that it is required to comply with the confidentiality, disclosure, breach notification, compliance, and re-disclosure requirements of the Privacy Rule and the Security Rule to the extent such requirements may be applicable.

n. Business Associate acknowledges that if it becomes aware of a “pattern of activity or practice” by a Subcontractor that constitutes a material breach of the Subcontractor’s obligations, and the Subcontractor fails to cure the breach, Business Associate shall terminate the relevant arrangement if feasible or, if not feasible, report the non-compliance to the Secretary.

o. Business Associate acknowledges that it is subject to compliance audits by the United States Department of Health and Human Services’ Office for Civil Rights.

p. Business Associate acknowledges that, in the event of any unauthorized acquisition, access, use or disclosure of Protected Health Information, Business Associate shall fully comply with the breach notification requirements of 45 C.F.R. Part 164, Subpart D, as set out in Section 4.

q. Business Associate shall comply with any and all regulatory requirements that may arise in the future to comply fully with the Privacy Rule and Security Rule.

r. Business Associate acknowledges that pursuant to the Privacy and Security Rules, Business Associate, its employees and contractors, and any third party who may have access to or possession of the Covered Entity’s Protected Health Information, are subject to regulatory oversight and may be subject to both civil and criminal penalties which may arise from violations of this Agreement, the Privacy Rule or the Security Rule.

s. To the extent Business Associate carries out any of Covered Entity’s obligations under the Privacy Rule, Business Associate will comply with the requirements of the Privacy Rule that apply to Covered Entity in the performance of those obligations.

2A. Infrastructure Providers

Business Associate utilizes the following Infrastructure Providers in the provision of Services. Business Associate maintains a Business Associate Agreement with each, and has enabled HIPAA compliance configuration across all Covered Entity sub-accounts on the HighLevel and Twilio platforms. The current list, including any provider added after the version date of this Agreement, is maintained at aesthetixcrm.com/sub-processors.

a. Disclosure of Provider Reporting Windows. Covered Entity acknowledges that each Infrastructure Provider reports Breaches and Security Incidents to Business Associate on the timeline in its own Business Associate Agreement, summarized above as of the version date of this Agreement. Business Associate’s reporting obligations to Covered Entity under Section 4 run from Business Associate’s Discovery as defined in Section 1, and knowledge of an Infrastructure Provider is not imputed to Business Associate.

b. Limitation to Own Acts. Business Associate’s obligations under this Agreement are limited to Business Associate’s own acts and omissions in configuring, deploying, and supporting the Platform, and to its selection of and contractual flow-down to its Infrastructure Providers. Business Associate does not own, operate, or control the underlying systems, servers, APIs, processing logic, or infrastructure maintained by Infrastructure Providers and does not warrant or accept liability for the acts, omissions, or security practices of Infrastructure Providers, except to the extent arising from Business Associate’s own breach of this Agreement.

c. Changes. Business Associate will notify Covered Entity, by email to the notice email on the signature page or by update to the sub-processor list with email notice, at least thirty (30) days before engaging a new Infrastructure Provider that will create, receive, maintain, or transmit Protected Health Information, and will notify Covered Entity if it becomes aware of a material change in its BAA relationship with any Infrastructure Provider that could affect the handling of PHI. Covered Entity’s remedy if it objects to a new Infrastructure Provider is to terminate the Underlying Agreement without penalty before the change takes effect.

d. Platform Retention Behavior. Covered Entity acknowledges that the Platform is a hosted service and that Covered Entity is responsible for exporting Client Data it wishes to retain before cancellation and before any extended period of account inactivity, as described in Section 15 of the Terms.

3. Permitted Uses and Disclosures by Business Associate

Except as otherwise limited in this Agreement, Business Associate may use or disclose Protected Health Information to perform functions, activities, or services for, or on behalf of, Covered Entity as specified in the Underlying Agreement, provided that such use or disclosure would not violate the Privacy and Security Rule if done by Covered Entity.

a. Except as otherwise limited in this Agreement, Business Associate may use Protected Health Information for the proper management and administration of the Business Associate or to carry out the legal responsibilities of the Business Associate.

b. Except as otherwise limited in this Agreement, Business Associate may disclose Protected Health Information for the proper management and administration of the Business Associate, provided that disclosures are required by law, or Business Associate obtains reasonable assurances from the person to whom the information is disclosed that it will remain confidential and used or further disclosed only as required by law or for the purpose for which it was disclosed to the person, and the person notifies the Business Associate of any instances of which it is aware in which the confidentiality of the information has been breached.

c. De-Identification and Data Aggregation. Covered Entity authorizes Business Associate, and its Infrastructure Providers acting on Business Associate’s instruction, to de-identify Protected Health Information in accordance with 45 C.F.R. 164.514(a) through (c), and to provide data aggregation services relating to the health care operations of Covered Entity as permitted by 45 C.F.R. 164.504(e)(2)(i)(B). Information de-identified in accordance with this Section is not Protected Health Information, and Business Associate may use and disclose it to operate, support, benchmark, improve, and market the Services, provided that no such use or disclosure identifies Covered Entity or any individual, and provided that Business Associate does not attempt to re-identify the information or permit any recipient to do so. Nothing in this Section authorizes the sale of Protected Health Information within the meaning of 45 C.F.R. 164.502(a)(5)(ii).

d. Artificial Intelligence Features. Where the Services include artificial intelligence features that process Protected Health Information, Business Associate will require that Protected Health Information is not used to train, fine-tune, or improve any model for the benefit of any party other than Covered Entity, and that any model provider is bound by a business associate agreement or processes Protected Health Information only on a zero-retention basis.

4. Business Associate’s Mitigation and Breach Notification Obligations

a. Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a use or disclosure of Protected Health Information by Business Associate in violation of the requirements of this Agreement. Business Associate agrees to be financially responsible for reasonable, documented costs and penalties assessed by a governmental authority to the extent directly resulting from Business Associate’s material violation of this Agreement, except to the extent caused by Covered Entity’s acts or omissions, configuration choices, instructions, or violations of law; provided that such responsibility is subject to the Limitation of Liability in this Agreement.

b. Breach Notification. Following Discovery of a Breach of Unsecured Protected Health Information, Business Associate shall notify Covered Entity of such Breach without unreasonable delay and within seventy-two (72) hours after Discovery.

c. Security Incident Reporting. Business Associate shall report to Covered Entity any use or disclosure of Protected Health Information not provided for by this Agreement, and any Security Incident involving successful unauthorized access to, or acquisition, use, disclosure, modification, or destruction of, Protected Health Information, without unreasonable delay and within seventy-two (72) hours after Discovery. Unsuccessful Security Incidents that do not result in unauthorized access to Protected Health Information or interference with system operations, such as pings, port scans, and blocked login attempts, occur routinely; this Section constitutes notice of them, and Business Associate will provide aggregate information about them on written request no more than once per calendar quarter.

d. Law Enforcement Delay. Notwithstanding Sections 4(b) and 4(c), if a law enforcement official states to Business Associate that notification of a Breach would impede a criminal investigation or cause damage to national security, then: (1) if the statement is in writing and specifies the time for which a delay is required, Business Associate shall delay such notification for the time period specified by the official; or (2) if the statement is made orally, Business Associate shall document the statement, including the identity of the official making it, and delay such notification for no longer than thirty (30) days from the date of the oral statement unless the official submits a written statement during that time. (3) Following the period of time specified by the official, Business Associate shall promptly deliver a copy of the official’s statement to Covered Entity.

e. Content of Notice. The Breach notification provided shall include, to the extent possible: (1) the identification of each individual whose Unsecured Protected Health Information has been, or is reasonably believed to have been, accessed, acquired, used, or disclosed during the Breach; (2) a brief description of what happened, including the date of the Breach and the date of Discovery; (3) a description of the types of Unsecured Protected Health Information involved; (4) any steps individuals should take to protect themselves; (5) a brief description of what Business Associate is doing to investigate the Breach, mitigate harm, and prevent further Breaches; and (6) contact procedures for individuals to ask questions or learn additional information.

f. Supplementation. Business Associate shall provide the information specified in Section 4(e) to Covered Entity at the time of the Breach notification if possible or promptly thereafter as information becomes available. Business Associate shall not delay notification to Covered Entity that a Breach has occurred in order to collect the information described in Section 4(e). Where an incident originates with an Infrastructure Provider, Business Associate’s initial notice may be limited to the information then in its possession, and Business Associate will supplement it as the Infrastructure Provider furnishes additional information.

g. Cooperation. Business Associate will cooperate with Covered Entity in Covered Entity’s risk assessment, notification to individuals, regulators, and media where required, and remediation. Business Associate will not notify individuals, regulators, or media of a Breach of Covered Entity’s Protected Health Information without Covered Entity’s prior written consent unless required by law.

5. Obligations of the Covered Entity

a. Covered Entity shall provide Business Associate with any changes in, or revocation of, permission by Individual to use or disclose Protected Health Information if such changes affect Business Associate’s permitted or required uses and disclosures.

b. Covered Entity shall notify Business Associate in writing of any restriction to the use or disclosure of Protected Health Information that Covered Entity has agreed to in accordance with 45 C.F.R. 164.522, and Business Associate will apply any such restriction that is implementable through the Services within ten (10) business days after the notice.

c. Account Credentials. Covered Entity is responsible for maintaining the confidentiality of its users’ credentials and ensuring only authorized users access the Services. Covered Entity will promptly notify Business Associate of any suspected compromise.

d. User Access Controls and Permissions. Covered Entity is responsible for administering and controlling user access to the Services, including (i) provisioning and deprovisioning users promptly (including removing access for terminated personnel), (ii) assigning roles and permissions using the principle of least privilege, and (iii) regularly reviewing user access rights. Covered Entity will limit access to high-risk functions to authorized personnel only, including contact and patient data imports, exports, bulk list management, and mass messaging (including SMS and email campaigns), and will use available Service features to restrict, approve, or disable such functions where appropriate. Failure to maintain appropriate access controls may increase the risk of unauthorized access and is solely within Covered Entity’s administrative control.

e. External Email Security and MFA. Covered Entity is responsible for enabling multi-factor authentication on the external email provider used for login and account recovery for all users with access to PHI and for maintaining the security of those email accounts (including promptly removing access for terminated personnel).

f. Credential Compromise Notification. Covered Entity shall promptly notify Business Associate upon becoming aware of any suspected or actual unauthorized access to the Services, compromise of user credentials, or compromise of the external email accounts used for login or account recovery.

g. Third-Party and Agency Access. Covered Entity is responsible for the acts and omissions of any agency, consultant, or other third party to which Covered Entity grants access to the Services, as if they were Covered Entity’s own workforce.

h. Multiple Legal Entities. If more than one legal entity uses Covered Entity’s account on the Platform, Covered Entity represents either that those entities have designated themselves as a single affiliated covered entity under 45 C.F.R. 164.105(b), with documentation available to Business Associate on request, or that the signer is authorized to execute this Agreement on behalf of each of them, each of which is bound as a Covered Entity, consistent with Section 21 of the Terms.

i. Covered Entity-Configured Integrations. Any third-party application or automation service that Covered Entity connects to the Services under its own account (for example, Zapier or a similar integration platform) is engaged by Covered Entity, not by Business Associate. Such a service is not an Infrastructure Provider or a Subcontractor of Business Associate, Covered Entity is responsible for any business associate agreement with it and for the Protected Health Information it moves, and Business Associate’s obligations under this Agreement do not extend to it.

6. Documentation

a. Inspection of Internal Practices, Books, and Records. Business Associate shall make its internal practices, books, and records relating to its use and disclosure of Covered Entity’s Protected Health Information available to Covered Entity and to Health and Human Services to determine Covered Entity’s compliance with the Privacy Rule and Security Rule.

b. Security Documentation. Upon Covered Entity’s written request no more than once per calendar year, Business Associate will provide Business Associate’s standard security controls attestation describing its administrative, physical, and technical safeguards for PHI, and a summary of any independent assessment of its Infrastructure Providers that Business Associate is permitted to share. Covered Entity acknowledges that certain details may be redacted for security reasons and that Infrastructure Providers’ own audit reports are subject to those providers’ confidentiality terms.

7. Permissible Requests by the Covered Entity

Covered Entity shall not request Business Associate to use or disclose Protected Health Information in any manner that would not be permissible under the Privacy and Security Rule if done by Covered Entity, except as permitted under Section 3 for the proper management and administration of Business Associate and for data aggregation services.

8. Term and Termination

a. Term. The Term of this Agreement shall be effective as of the Effective Date, and shall terminate when all of the Protected Health Information provided by Covered Entity to Business Associate, or created or received by Business Associate on behalf of Covered Entity, is destroyed or returned to Covered Entity, or, if it is infeasible to return or destroy Protected Health Information, protections are extended to such information, in accordance with the termination provisions in this Section.

b. Termination for Cause. Upon Covered Entity’s knowledge of a material breach by Business Associate, Covered Entity may, in its sole discretion, either (1) provide Business Associate with written notice and an opportunity to cure the breach within thirty (30) days, and then terminate the Underlying Agreement if Business Associate does not cure the breach within that period, or (2) terminate the Underlying Agreement immediately where cure is not feasible. A termination under this Section is not a termination for convenience under the Underlying Agreement.

c. Effect of Termination; Transition Period. Upon termination of this Agreement or the Underlying Agreement for any reason:

(1) Covered Entity may export Client Data, including Protected Health Information, from the Platform for ninety (90) days after the effective date of termination (the “Export Window”), as provided in Section 15 of the Terms. Use of the Platform during the Export Window, including messaging, is subject to the Terms.

(2) Business Associate will retain Protected Health Information in a secure, access-restricted state during the Export Window and will return or destroy all Protected Health Information received from Covered Entity or created or received by Business Associate on behalf of Covered Entity within thirty (30) days after the Export Window closes, that is, no later than one hundred twenty (120) days after the effective date of termination, including Protected Health Information in the possession of Subcontractors or agents of Business Associate, and will cause deletion from backup media in the ordinary course of its Infrastructure Providers’ backup rotation, not to exceed ninety (90) days after that deletion. Protected Health Information in backup media pending rotation remains subject to this Agreement and will not be restored to active use. Business Associate will provide written certification of destruction within fifteen (15) business days after Covered Entity’s written request.

(3) Covered Entity may request earlier destruction in writing at any time after the Export Window closes, and Business Associate will complete it within thirty (30) days after the request.

(4) In the event that Business Associate determines that returning or destroying the Protected Health Information is infeasible, Business Associate shall provide to Covered Entity notification of the conditions that make return or destruction infeasible. Upon mutual agreement that return or destruction is infeasible, Business Associate shall extend the protections of this Agreement to such Protected Health Information and limit further uses and disclosures to those purposes that make the return or destruction infeasible, shall continue to use appropriate safeguards and comply with Subpart C of 45 C.F.R. Part 164 with respect to such Protected Health Information for as long as Business Associate retains it, and shall not use or disclose the Protected Health Information retained other than for the purposes for which it was retained.

(5) Where an addendum to this Agreement sets different transition or deletion periods for a specific service (for example, the Aesthetix Activate Business Associate Agreement Addendum for data held in the Activate environment), the addendum governs that service.

d. Prior Agreements. This Agreement supersedes all previous business associate agreements between Business Associate and Covered Entity. Addenda to this Agreement executed by the Parties remain in effect and form part of this Agreement.

e. Survival. The obligations of Business Associate under this Section shall survive the termination of this Agreement.

9. Miscellaneous

a. Regulatory References. A reference in this Agreement to a section in the Privacy and Security Rule means the section as in effect or as amended, and for which compliance is required.

b. Indemnification. Each Party (the “Indemnifying Party”) shall indemnify, defend, and hold harmless the other Party and its officers, directors, employees, and agents (the “Indemnified Party”) from and against any third-party claims, fines, penalties, and reasonable costs and expenses (including reasonable attorneys’ fees) to the extent arising from the Indemnifying Party’s material breach of this Agreement or its gross negligence or willful misconduct. The Indemnified Party shall provide prompt written notice of any claim, reasonably cooperate with the Indemnifying Party, and permit the Indemnifying Party to control the defense and settlement of the claim; provided that no settlement that admits fault on behalf of the Indemnified Party or imposes non-monetary obligations on the Indemnified Party may be entered without the Indemnified Party’s prior written consent (not to be unreasonably withheld). This Section is subject to the Limitation of Liability set forth in this Agreement.

c. Limitation of Liability. EXCEPT FOR LIABILITY ARISING FROM A PARTY’S GROSS NEGLIGENCE OR WILLFUL MISCONDUCT, IN NO EVENT WILL EITHER PARTY’S AGGREGATE LIABILITY ARISING OUT OF OR RELATING TO THIS AGREEMENT, ANY ADDENDUM TO IT, AND THE UNDERLYING AGREEMENT, TAKEN TOGETHER, EXCEED THE TOTAL FEES PAID OR PAYABLE BY COVERED ENTITY TO BUSINESS ASSOCIATE UNDER THE UNDERLYING AGREEMENT DURING THE TWELVE (12) MONTHS PRECEDING THE EVENT GIVING RISE TO THE CLAIM. THIS IS A SINGLE AGGREGATE CAP AND NOT A SEPARATE CAP FOR EACH AGREEMENT OR SERVICE. IN NO EVENT WILL EITHER PARTY BE LIABLE FOR ANY INDIRECT, SPECIAL, INCIDENTAL, CONSEQUENTIAL, EXEMPLARY, OR PUNITIVE DAMAGES, INCLUDING LOST PROFITS, LOSS OF GOODWILL, OR BUSINESS INTERRUPTION, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

d. Remedies. The parties acknowledge that breach of this Agreement may cause irreparable harm for which there is no adequate remedy at law. In the event of a breach, Covered Entity shall be entitled to a remedy of specific performance and/or injunction refraining Business Associate from violating this Agreement. The election to seek injunctive relief does not foreclose any right to recover damages.

e. Amendment; Published Versions. The Parties agree to take such action as is necessary to amend this Agreement from time to time as is necessary for Covered Entity to comply with the requirements of the Privacy and Security Rules, HIPAA and HITECH. Business Associate publishes the current and all prior versions of this Agreement at aesthetixcrm.com/baa. The version identified on the signature page governs the Parties until they execute a later version, which may be done by signature or by Covered Entity’s execution of an order form or addendum that identifies the later version. No amendment is valid unless made in a writing executed or electronically accepted by both Parties, except that Business Associate may update Section 2A and the sub-processor list in accordance with Section 2A(c), and except as an addendum to this Agreement provides for its own revision. Where this Agreement is executed through an order form or addendum that identifies its version, references in this Agreement to the signature page mean that order form or addendum, the Effective Date is the effective date stated in it, and this Agreement supersedes any earlier business associate agreement between the Parties under Section 8(d).

f. Survival. The respective rights and obligations of the Parties under Sections 2, 3, 4, 8(c), and 9 of this Agreement shall survive the termination of this Agreement and/or the Underlying Agreement.

g. Interpretation. Any ambiguity in this Agreement shall be resolved in favor of a meaning that permits Covered Entity to comply with the Privacy and Security Rules.

h. Material Breach. The parties acknowledge that in the event the Covered Entity learns of a pattern or activity or practice of the Business Associate that constitutes violation of a material term of this Agreement, then the parties promptly shall take reasonable steps to cure the violation. If such steps are unsuccessful or not feasible, the Covered Entity may terminate the Underlying Agreement upon written notice to the Business Associate, if feasible, and if not feasible, shall report the violation to the Secretary.

i. Governing Law; Conflict. This Agreement shall be enforced and construed in accordance with the laws of the State of South Carolina. In the event of a conflict between the terms of this Agreement and the terms of the Underlying Agreement with respect to Protected Health Information, the terms of this Agreement shall control, and in the event of a conflict between this Agreement and an addendum to it with respect to the service the addendum covers, the addendum shall control. Section 8(c) of this Agreement restates the export and deletion periods in Section 15 of the Terms; in the event of any inconsistency, Section 8(c) controls as to Protected Health Information.

j. Notices. Any notice given under this Agreement must be in writing and delivered by email with confirmation of receipt, by first class mail, by reputable overnight courier service, or in person to the parties’ respective addresses on the signature page or to such other address as the parties may from time to time designate in writing. Notices to Business Associate regarding Breaches or Security Incidents must be sent to legal@aesthetixcrm.com with a copy to support@aesthetixcrm.com.

k. Assigns. Neither this Agreement nor any of the rights, benefits, duties, or obligations provided herein may be assigned by Business Associate without providing (1) written consent by the Covered Entity, which shall not be unreasonably withheld or (2) written notice to the Covered Entity in the event of the sale, merger or other business transaction involving the Business Associate, provided the assignee assumes this Agreement in writing.

l. Third Party Beneficiaries. Nothing in this Agreement shall be deemed to create any rights or remedies in any third party.

m. Counterparts and Electronic Signature. This Agreement may be executed in counterparts and by electronic signature, each of which is an original and all of which together are one instrument.

Version History