1. Parties

This Business Associate Agreement ("BAA") is entered into between Tailwind, LLC, doing business as DocDraft ("Business Associate"), and the healthcare provider, practice, or organization using the DocDraft service ("Covered Entity"), as those terms are defined under the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") and its implementing regulations.

By using the DocDraft service ("Service"), Covered Entity agrees to the terms of this BAA. No separate signature is required.

2. Permitted Uses and Disclosures of PHI

Business Associate may use or disclose Protected Health Information ("PHI") solely as necessary to provide the document generation services offered through the Service. Business Associate will not use or disclose PHI other than as permitted by this Agreement or as required by law.

3. Safeguards

Business Associate implements the following safeguards to protect PHI:

• All PHI is processed via Amazon Web Services (AWS) Bedrock, which is covered under a Business Associate Agreement with AWS
• No PHI is stored, logged, cached, or persisted in any database or file system
• All data is encrypted in transit via TLS/SSL
• PHI is not used to train AI models
• DocDraft operates on a stateless architecture — documents are generated in real-time and are not retained after delivery to the user

4. Obligations of Business Associate

• Business Associate will report any security incident or breach of unsecured PHI to Covered Entity within 72 hours of discovery
• Business Associate will ensure that any subcontractors that handle PHI (including AWS) agree to substantially similar restrictions and conditions as contained in this BAA
• Business Associate will make its internal practices, books, and records relating to the use and disclosure of PHI available to the U.S. Department of Health and Human Services (HHS) upon request

5. Term and Termination

This BAA is effective upon the Covered Entity's first use of the Service and remains in effect for the duration of such use. The BAA terminates when the Covered Entity ceases all use of the Service. Upon termination, no PHI needs to be returned or destroyed because no PHI is stored by Business Associate.

6. Limitations

• Business Associate is not responsible for PHI after it has been displayed to, downloaded by, or otherwise made available to the user
• Covered Entity is solely responsible for the accuracy, completeness, and appropriate use of all generated documents
• The Service is a productivity tool and does not replace professional medical judgment, diagnosis, or treatment decisions

7. Miscellaneous

This BAA is governed by the laws of the State of Florida. Any ambiguity in this BAA shall be resolved in favor of a meaning that permits Business Associate to comply with HIPAA. This BAA constitutes the entire agreement between the parties regarding the subject matter herein and supersedes all prior agreements.

8. Contact

Questions regarding this Business Associate Agreement may be directed to:

Tailwind, LLC dba DocDraft
Email: support@docdraft.org