Business Associate Agreement

Version 1.0 · Last Updated: July 29, 2026

1. What This Covers

This BAA governs the patient name and contact information (email, and, once available, phone number) that you upload to FlameGrower so we can send review requests on your behalf and include you in your monthly report. It is written for that specific, narrow purpose. Nothing in the Service is designed to collect diagnosis, treatment, or billing information, and you should never upload any of that — keep uploads to name and contact information only.

2. Permitted Uses of PHI

FlameGrower will use and disclose PHI only to: (a) send review requests on your behalf, (b) generate your reports, (c) provide you customer support related to those functions, and (d) as otherwise required by law. FlameGrower will not use PHI for its own marketing, will not sell it, and will not use it to train an AI model.

3. Our Obligations as Business Associate

• We will not use or disclose PHI other than as permitted by this BAA or required by law.
• We will use appropriate administrative, physical, and technical safeguards to prevent unauthorized use or disclosure of PHI, including encryption in transit and at rest, and access controls limiting who at FlameGrower can view raw contact lists.
• We will apply the "minimum necessary" standard — we only handle name and contact information, and the Service is not built to accept anything more.
• We will report to you any use or disclosure of PHI not permitted by this BAA, including a breach of unsecured PHI, without unreasonable delay and in any case within the timeframe required by the HIPAA Breach Notification Rule (currently no later than 60 days after discovery).
• We will ensure that any subcontractor that receives PHI from us to help operate the Service agrees, in writing, to the same restrictions and conditions that apply to us under this BAA.
• We will make PHI available to you as needed for you to respond to a patient's HIPAA access, amendment, or accounting-of-disclosures request, to the extent we hold information responsive to that request.
• We will make our internal practices, books, and records relating to our use and disclosure of PHI available to the Secretary of Health and Human Services, if requested, for purposes of determining your compliance with HIPAA.

4. Your Obligations as Covered Entity

• You will not upload any PHI beyond patient name and contact information — no diagnosis, treatment, or billing detail belongs in this Service.
• You will notify us if you know of a use or disclosure of PHI by you that would materially affect our ability to meet our obligations under this BAA.
• You represent that you have, or will obtain, the appropriate authorization or other permissible basis under HIPAA to disclose this patient contact information to us for the purposes described here.

5. Term and Termination

This BAA is effective for as long as FlameGrower processes PHI on your behalf. If either party breaches a material term of this BAA and does not cure it within a reasonable time after notice, the other party may terminate this BAA and the underlying Service relationship, to the extent it involves PHI.

When this BAA ends, FlameGrower will, at your direction, either return or destroy all PHI it still holds, to the extent feasible. If return or destruction isn't feasible, we will continue to protect the PHI under the terms of this BAA for as long as we retain it, and limit further use or disclosure to the purposes that make return or destruction infeasible.

6. Subcontractors

FlameGrower uses subcontractors to operate parts of the Service that may involve PHI, including our email-sending provider and our infrastructure host. We will not permit a subcontractor to create, receive, maintain, or transmit PHI on our behalf until that subcontractor has agreed in writing to protections at least as restrictive as those in this BAA.

7. Relationship to HIPAA

This BAA is intended to satisfy the requirements of 45 CFR §§ 164.502(e) and 164.504(e). If a provision of this BAA conflicts with an amendment to HIPAA after the date it's accepted, the parties agree it will be interpreted, and amended if needed, to remain consistent with HIPAA as amended.

8. Contact

FlameGrower LLC, 1300 W 19th St #7042, Houston, TX 77008. Email: [email protected].