Business Associate Agreement

This Business Associate Agreement ("BAA") is available for healthcare organizations, wellness providers, and other covered entities that require HIPAA compliance when using TalentCafe's coaching platform. A BAA is required when Protected Health Information (PHI) may be created, received, maintained, or transmitted through the TalentCafe platform. This includes health coaching, wellness coaching, and any coaching engagement involving patient health data. The BAA is available exclusively to Enterprise tier customers and requires execution by both parties before PHI processing begins.

"Covered Entity" means a health plan, healthcare clearinghouse, or healthcare provider that transmits health information electronically. "Business Associate" means TalentCafe, as a person or entity that performs functions or activities on behalf of a Covered Entity involving the use or disclosure of PHI. "Protected Health Information (PHI)" means individually identifiable health information transmitted or maintained in any form or medium. "Electronic Protected Health Information (ePHI)" means PHI that is transmitted or maintained in electronic media. "Security Incident" means the attempted or successful unauthorized access, use, disclosure, modification, or destruction of ePHI.

TalentCafe may use or disclose PHI only as permitted by this BAA and as required to perform services under the underlying service agreement, including: Treatment, Payment, and Healthcare Operations: - Facilitating coaching sessions for health and wellness purposes - Processing payments for healthcare-related coaching services - Quality assurance and improvement activities Management and Administration: - Internal management and administration of the Business Associate - Legal responsibilities requiring disclosure of PHI Data Aggregation: - De-identified data aggregation for benchmarking and analytics (with no individual identification)

TalentCafe implements the following safeguards to protect ePHI: Administrative Safeguards: - Security Officer designation - Workforce security training - Access management procedures - Security incident response procedures Physical Safeguards: - Facility access controls (data centers managed by Google Cloud) - Workstation security policies - Device and media controls Technical Safeguards: - Access controls with unique user IDs - Automatic session timeout - AES-256 encryption at rest - TLS 1.3 encryption in transit - Audit logging and monitoring

TalentCafe will report to the Covered Entity any use or disclosure of PHI not permitted by this BAA, including any Security Incident or Breach, within 24 hours of discovery. The notification will include: - Identification of individuals affected (if known) - Description of the type of PHI involved - Description of what happened - Steps taken to mitigate harm - Steps taken to prevent future breaches - Contact information for follow-up

TalentCafe ensures that any subcontractors with access to PHI agree to the same restrictions and conditions that apply to TalentCafe. Current Subcontractors with Potential PHI Access: - Google Cloud Platform (Infrastructure hosting) - BAA Executed - Supabase (Database services) - BAA Executed - Stream (Video conferencing) - BAA Executed TalentCafe will obtain satisfactory assurances from subcontractors and provide notice of new subcontractors to the Covered Entity.

Individual Access Rights: TalentCafe will make PHI available to the Covered Entity within 15 days of request to fulfill individual access requests. Amendment Rights: TalentCafe will make PHI available for amendment within 15 days of request and incorporate amendments as directed by the Covered Entity. Accounting of Disclosures: TalentCafe will maintain an accounting of disclosures and make it available within 30 days of request.

This BAA is effective upon execution and continues until the underlying service agreement terminates. Either party may terminate this BAA if the other party materially breaches this BAA and fails to cure within 30 days of written notice. Upon termination, TalentCafe will return or destroy all PHI within 30 days and provide certification of destruction. Obligations regarding PHI protection survive termination.