1 Agreement and parties

These Terms govern access to ReferralFlow.Health and its related agency workspaces, referral forms, status features, messaging, and subscribed services, collectively the Platform. ILP Technologies LLC, a Texas limited liability company based in Houston, Texas, United States, operates the Platform under the ReferralFlow.Health name. “Company,” “we,” and “us” mean ILP Technologies LLC.

“Customer” means the legal entity identified in the accepted order, checkout, or account registration. A person accepting for Customer represents that they are authorized to bind that entity. “User” means a person accessing the Platform. An individual acting for Customer is also subject to the provisions applicable to Users. Each agency subscription covers only the agency identified in its order unless an accepted order expressly includes other entities or branches.

An “Order” is the plan selection, checkout record, or other written subscription arrangement accepted by both parties that identifies the Customer and commercial terms. These Terms become binding through affirmative electronic acceptance or a signed Order expressly incorporating them. Subscription fees apply to Customers under an Order. Referral sources may submit and track referrals without a subscription fee; their acceptance of applicable use terms does not make them paying Customers or parties to an agency BAA.

The Business Associate Agreement (BAA), Data Processing Addendum (DPA), and Data Retention Policy are incorporated for their respective subject matter. Mandatory law controls. For PHI, the BAA takes priority over conflicting provisions. The DPA then controls other processing obligations. An Order controls commercial details, but does not diminish BAA protections. The Privacy Policy describes information practices and does not independently authorize a broader use of PHI.

2 Eligibility and territory

The Platform may be used by healthcare organizations and other persons with a lawful purpose and authority to process the information they submit. Each Customer must accurately identify its role and legal entity. A person must have legal capacity to enter an agreement to subscribe; access by a patient or representative does not make that person a healthcare professional.

The standard service is offered for U.S. operations. Use for non-U.S. operations or records governed by non-U.S. privacy requirements requires the Company's prior written approval and any necessary additional terms. This restriction does not state where servers are located or where authorized personnel work; those facts must be addressed separately in the DPA schedule. Access from a country does not by itself establish that its laws do or do not apply.

3 Services and availability of features

Depending on the accepted plan and enabled features, the Platform provides referral intake and tracking, document exchange, referral-source communication, referral transfers, AI document extraction and analysis, assistance preparing start-of-care and OASIS documentation, insurance eligibility inquiries, and authorized email-based referral imports.

Only features expressly included and made available in Customer's accepted plan are part of its purchased service. Features described as planned, preview, or optional are not delivery commitments unless stated in an Order. Trials and annual or monthly plans apply only when their material terms are disclosed and accepted. Additional written terms apply to beta features if offered; beta status does not waive PHI obligations.

The Platform provides technology services. The Company does not act as Customer's nurse, clinician, insurer, utilization reviewer, billing agent, or source of clinical orders merely by providing the Platform. It does not monitor patients for emergencies. Users must use appropriate clinical and emergency channels for urgent care.

4 Accounts and access

Customer is responsible for identifying its authorized users, assigning appropriate permissions, protecting credentials, promptly removing obsolete access, and keeping account and notice details current. Users must use their assigned credentials and promptly report suspected unauthorized access. The Company remains responsible for the safeguards applicable to the systems it operates.

Submitting a referral does not confer authority to retrieve records. Users may access status, documents, messages, or other patient information only for an authorized purpose and an authorized recipient. A link or referral ID must not be shared with an unauthorized person. The Company will apply access restrictions appropriate to the information disclosed. Customer must confirm intended recipients before directing disclosures and investigate submissions it has reason to believe are inaccurate or unauthorized.

Electronic acceptance records identify the accepting account and its stated authority; they are not a representation that the Company performed government-ID verification or verified a professional license. The Company may request proportionate evidence of identity or authority when needed for access, account ownership, exports, deletion, or legal requests.

5 Customer information and responsibilities

Customer retains its rights in information it supplies or directs the Company to process, subject to patient and third-party rights. Customer authorizes the Company to process that information only to deliver and secure the contracted services, follow lawful documented instructions, and meet applicable legal obligations, as limited by the BAA and DPA. This permission is not a sale or transfer of ownership of patient information.

Customer is responsible for a lawful basis for submissions, transfers, messaging, and connected-account access, including consent or authorization where required. A separate patient authorization is not required by these Terms where applicable law permits the activity without it. Customer must provide accurate instructions and communicate known restrictions that affect the Company's processing.

The Platform stores records in Customer's workspace. Customer remains responsible for its clinical recordkeeping decisions and legally required retention. The Company will meet its contracted storage, export, and BAA obligations. Storing a document does not by itself make it a complete, signed, or approved clinical record. ReferralFlow is not designated as Customer's sole or official medical-record system. Customer must preserve required records in its designated clinical record system.

Customer must identify records subject to special restrictions and communicate applicable requirements before directing their processing. The parties will implement any necessary additional arrangements for records subject to 42 CFR Part 2 or other enhanced protections. Neither party may authorize an otherwise unlawful disclosure through these Terms.

6 AI assistance and review

AI features assist with extracting supplied information and preparing analysis or draft documentation from the materials available to the Platform. They do not perform a nurse's assessment, observe the patient, establish facts absent from source records, or supply an authorized clinician's signature. Customer must require an appropriately qualified person to review and correct outputs against source records, the actual assessment, and applicable documentation requirements before using them for care, final documentation, coding, billing, or admission decisions.

Automated extraction or import may save preliminary information in a workspace. Saving preliminary information does not constitute clinical approval. Customer must check imported identity, payer, diagnosis, and other relevant fields and address duplicate or incomplete records. Eligibility results reflect information supplied by the responding source at the inquiry time and do not establish payment, authorization, network participation, or future coverage. Customer must resolve discrepancies with the payer.

The Company will not use PHI, patient documents, or their patient-specific inputs and outputs to train AI models, for advertising, or for independent product-development datasets. Authorized personnel may review specific records for Customer-requested technical assistance, or as necessary for security and other permitted service operations, subject to confidentiality, access limitations, and the BAA. This does not authorize clinical review services.

7 Integrations and directed sharing

Customer may authorize available email, eligibility, messaging, and other integrations. The enabled scope and settings constitute instructions for the associated processing. Customer must hold the necessary rights to connect an account and should limit the scope to information needed for the service. Revoking an integration stops future access through that connection, subject to technical processing already underway and applicable law; it does not by itself remove records already imported.

Referral transfers to another agency require an authorized instruction identifying the intended recipient. Another agency receiving records for its own healthcare activities is responsible for its own use of those records. The Company's subcontractors remain subject to the Company's applicable contractual obligations. An external-service disclaimer does not release the Company from its own BAA duties.

Customer must check import status and address failed, duplicate, or incomplete imports. Transmission, a delivery receipt, or a status update does not establish a recipient's clinical acceptance or timely clinical response. Customer should maintain a suitable alternative workflow for time-sensitive referrals during interruptions.

8 Fees and renewal

Each Order must state the plan, price, billing period, included allowances, usage measurement and reset rules, and any overage rate. Fees and usage charges are payable through the accepted billing method, together with applicable taxes other than taxes on the Company's net income. Customer authorizes recurring charges for its accepted subscription and properly disclosed usage. An undisclosed overage rate does not authorize an overage charge.

Subscriptions renew automatically for the same billing period unless Customer cancels before renewal. A trial converts to a paid subscription only if its duration, conversion date, price, renewal terms, and cancellation method were clearly disclosed and affirmatively accepted. An annual subscription renews annually; cancellation during it does not convert it to a monthly subscription.

Customer may cancel at any time by emailing info@ilptechnology.com or using an available cancellation control. An email cancellation takes effect based on receipt, rather than the date staff processes it. The Company will acknowledge it and stop future renewals. Access continues through the paid subscription period. Fees are nonrefundable and unused time or allowances receive no credit, except where applicable law requires a remedy or an express provision of this agreement provides one. Billing errors will be corrected.

The Company will provide at least 30 days' advance email notice of price increases or material reductions in purchased service. A price increase takes effect at a renewal occurring after that notice period, not during a prepaid fixed-price term. A reduction will not remove material prepaid functionality before term end without Customer's agreement or an appropriate remedy. Customer may cancel renewal before the change applies.

9 Failed payments and suspension

After notifying Customer of a failed payment, the Company may suspend paid processing features if the payment remains unresolved for 48 hours. This period begins when the failed-payment notice is sent. Suspension for nonpayment does not extinguish PHI safeguards or permit withholding records in violation of law or the BAA. Customer will have a secure way to access or obtain its retained records during payment suspension.

The Company may immediately restrict affected access where reasonably necessary to address suspected account compromise, unauthorized patient-data access, malicious activity, unlawful use, a binding legal directive, or a material threat to service security. It will limit the restriction to what is reasonably necessary and provide notice and restoration steps when lawful and practicable. For other material breaches, the breaching party has 15 calendar days after written notice to cure before termination, unless a different period is required by law or the BAA.

Either party may terminate for an uncured material breach. The Company may decline renewal with at least 30 days' notice and may terminate for convenience on 30 days' notice with a prorated refund of prepaid unused subscription fees. The no-refund policy for voluntary Customer cancellation does not waive remedies for the Company's breach or required refunds. Retention and BAA duties survive termination as specified in those documents.

10 Acceptable use and intellectual property

Users must not submit unlawful information, impersonate another person, access another workspace without authority, send unlawful marketing, probe or disrupt the service without authorization, introduce malicious code, or use the Platform to fabricate clinical findings or support fraudulent claims. Customer must not resell access unless the Company agrees in writing.

The Company and its licensors retain all rights in the Platform software, source and object code, architecture, databases, nonpublic workflows, interface, screen designs, visual elements, documentation, text, graphics, branding, and underlying technology. During the subscription, the Company grants Customer a limited, revocable, nonexclusive, nontransferable right to use the purchased service only for Customer's authorized internal operations. No ownership right or implied license is transferred.

Customer and Users must not, directly or indirectly, for themselves or another person: (a) copy, reproduce, republish, imitate, modify, translate, or create derivative works from protected elements of the Platform; (b) build, commission, assist, market, or operate a product or service using the Platform's protected expression, nonpublic functionality, confidential information, or trade secrets; (c) use Platform access, demonstrations, screenshots, recordings, documentation, workflows, output structures, or nonpublic information to specify, train, benchmark, design, procure, or improve a competing product or service; (d) reverse engineer, decompile, disassemble, decode, or attempt to discover source code, architecture, models, logic, security controls, or nonpublic APIs, except to the limited extent applicable law prohibits this restriction; (e) scrape, crawl, systematically capture, frame, mirror, or extract Platform content or functionality except through an authorized export or integration; (f) remove or alter proprietary notices; (g) share access or nonpublic materials with a competitor or a person developing a competing product; or (h) enable, direct, or assist another person to do any prohibited act. Customer may use and export its own records as authorized by the agreement. This Section does not prohibit lawful independent development that does not use the Company's protected materials, confidential information, or trade secrets, and it does not claim ownership of general ideas, methods, or skills that applicable law leaves unprotected.

Unauthorized access or use outside the purchased scope may be billed at the Company's then-current applicable plan and usage rates for the period and scope of that use. For unauthorized copying, competitive use, or misappropriation, the Company may pursue the remedies available under the agreement and applicable law, including suspension or termination, temporary and permanent injunctive relief, specific performance, preservation and return or destruction of copies, an accounting of copies and resulting revenue or benefits, actual damages, proven lost profits, unjust enrichment, and a reasonable royalty or license fee. Where allowed by law, the Company may also seek statutory or exemplary damages and reasonable attorneys' fees and enforcement costs. These remedies are cumulative only to the extent they do not create a double recovery.

Customer acknowledges that prohibited copying, disclosure, or competitive use may cause harm that is difficult to measure and for which money alone may be inadequate. The Company may therefore seek prompt equitable relief without waiving other remedies; a court retains authority to determine whether such relief is appropriate. After receiving credible notice of a suspected violation, Customer must stop the challenged activity, preserve relevant records, reasonably cooperate in identifying affected persons and systems, and return or destroy unauthorized copies as lawfully directed. A delay in discovering or enforcing a violation is not a waiver unless the Company signs an express written waiver. Applicable statutes of limitation and other mandatory law continue to control.

11 Confidentiality and support

Each party will protect nonpublic business information received from the other, use it only for the agreement, and disclose it only to personnel or service providers with a need to know and appropriate confidentiality duties. Exceptions apply to information independently developed, lawfully received without restriction, already lawfully known, or publicly available without breach. Legally compelled disclosure must be limited to what is required, with notice where permitted. PHI remains governed by the BAA even if a general confidentiality exception might otherwise apply.

Routine support is provided by email Monday through Friday, 9 a.m. to 5 p.m. America/Chicago time, excluding U.S. federal holidays. The Company aims to acknowledge ordinary requests within two business days. This is a service target, not a fixed resolution deadline. Security reports are escalated outside routine support as needed to meet the BAA. No numerical uptime commitment or service-credit program applies unless an Order states one. The Company will use reasonable efforts to announce planned material downtime and communicate significant service interruptions.

12 Disclaimers and liability

EXCEPT FOR EXPRESS COMMITMENTS IN THIS AGREEMENT AND RIGHTS THAT CANNOT LAWFULLY BE EXCLUDED, THE PLATFORM IS PROVIDED AS AVAILABLE. TO THE EXTENT PERMITTED BY LAW, THE COMPANY DISCLAIMS IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NONINFRINGEMENT. THESE DISCLAIMERS DO NOT REDUCE EXPRESS SECURITY, CONFIDENTIALITY, DATA-RETURN, OR BAA OBLIGATIONS.

TO THE EXTENT PERMITTED BY LAW, NEITHER PARTY IS LIABLE TO THE OTHER FOR INDIRECT, SPECIAL, INCIDENTAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES, OR LOST PROFITS ARISING FROM THIS AGREEMENT. THIS EXCLUSION DOES NOT APPLY TO FRAUD, WILLFUL MISCONDUCT, GROSS NEGLIGENCE, LIABILITY THAT CANNOT BE EXCLUDED, AMOUNTS PAYABLE UNDER SECTION 13, OR REASONABLE DIRECT COSTS TO INVESTIGATE, CONTAIN, RESTORE DATA AFTER, AND PROVIDE LEGALLY REQUIRED NOTICE OF AN INCIDENT TO THE EXTENT ALLOCATED UNDER SECTION 13.

NO AGGREGATE MONETARY LIABILITY CAP IS CREATED BY THESE TERMS. LIABILITY MUST STILL BE ESTABLISHED UNDER THE AGREEMENT AND APPLICABLE LAW. NOTHING LIMITS A REGULATOR'S AUTHORITY OR EXCUSES A PARTY'S OWN STATUTORY DUTIES.

13 Responsibility for incidents and third party claims

Each party is responsible to the other for reasonable, documented, necessary incident-response costs to the extent caused by that party's breach, negligence, or wrongful acts, including those of personnel or subcontractors for whom it is responsible. Shared fault is allocated proportionately. Recoverable costs may include reasonable investigation, containment, data restoration, required notices, and legally required mitigation. Optional services or settlements require reasonable prior consultation, except when urgent action is needed to meet law or contain harm. There is no double recovery.

Each party will defend and indemnify the other against third-party claims to the extent caused by the indemnifying party's unlawful processing, breach of confidentiality or data-protection duties, or willful misconduct. The Company will also defend claims that the Platform as supplied infringes a U.S. patent, copyright, or trade secret; this obligation excludes infringement caused by unauthorized modifications, Customer content, or combinations not supplied or required by the Company. For a covered IP claim, the Company may procure continued rights, modify the affected service without materially reducing its function, or terminate it and refund prepaid unused fees.

The indemnified party must give prompt notice, reasonable cooperation at the defending party's expense, and reasonable control of the defense. Delayed notice reduces protection only to the extent it prejudices the defense. No settlement may admit the other party's fault, impose nonmonetary obligations, or omit a full release without that party's consent. Government penalties are allocated only to the extent legally indemnifiable and attributable to the responsible party. These provisions do not shift a party's own misconduct to the other.

14 Notices changes and disputes

Legal, cancellation, privacy, and security notices to the Company go to info@ilptechnology.com. Customer must designate an administrative and security contact in its account. The Company sends formal notices to those contacts as appropriate; in-platform notices may supplement email. Customer must keep those details current.

Material revisions to these Terms receive at least 30 days' advance email notice and apply prospectively. The Company will identify the effective date and provide a copy. Changes to charges follow Section 8. Changes requiring renewed assent will be presented for acceptance. Changes urgently required by law or security may take effect sooner to the necessary extent with prompt notice. Website revisions do not retroactively alter accrued claims or silently expand permitted PHI use. Amendments to a BAA must meet its amendment provision.

Texas law governs, without displacing mandatory applicable law. Before litigation, each party will give written notice describing a dispute and allow 30 days for good-faith resolution. This does not delay urgent injunctive relief, legally required action, or a filing needed to preserve a claim. Subject to mandatory jurisdiction rules, disputes will be heard in state courts in Harris County, Texas, or federal courts in the Southern District of Texas, Houston Division. Mediation may be agreed in writing; arbitration is not required.

15 General provisions

The parties are independent contractors. Neither may bind the other solely by this agreement. Neither party may assign the agreement without consent, except to a successor in a merger, reorganization, or sale of substantially all relevant assets that assumes the obligations and meets applicable data-transfer requirements. Such a transaction does not authorize independent commercial use of PHI.

Events beyond a party's reasonable control may excuse delayed performance only to the extent affected and permitted by law; the affected party must mitigate and communicate. This does not waive security safeguards, incident reporting, lawful record access, or accrued payment obligations. If a provision is unenforceable, the remaining provisions continue where legally possible. A failure to enforce is not a waiver. The accepted Order and incorporated agreements comprise the agreement on their subject matter. Confidentiality, accrued payments, relevant liability and dispute provisions, and required data protections survive termination.

1 Scope and roles

ILP Technologies LLC, based in Houston, Texas, United States, operates ReferralFlow.Health. This policy describes information practices for our website, agency workspaces, referral forms, messaging, and related services. Contact us at info@ilptechnology.com.

We process patient information on behalf of the agency or other organization using the service, under its instructions and applicable agreements. That organization is ordinarily the primary contact for patient-record requests. We also handle business account, billing, website, and security information for our own service administration. Our BAA governs PHI processing and takes priority over conflicting general policy language. This policy is not an agency's HIPAA Notice of Privacy Practices or patient authorization.

2 Information collected

Account and business information includes organization and representative names, professional contact details, account roles, agency branding, subscription selections, payment and transaction records, and referral-source business contacts. Payment and billing information may be processed by the payment provider presented at checkout. The Company retains subscription status, transaction references, invoices, amounts, and related business records needed to administer the account.

Referral and care-related information may include patient identifiers and contact information, demographic information, insurance details, medical and referral documents, clinical notes, requested services, referral status, communications, AI-assisted outputs, and corrections. This information is supplied by Customers, their authorized users, referral sources, and enabled integrations. Some records may concern minors or contain information with additional legal protections.

Technical information includes information needed to operate and secure the service, such as account activity, login and access records, timestamps, IP addresses, and relevant device or browser information. Support communications may include information provided to resolve a technical issue. We use session, authentication, security, diagnostic, and similar technologies needed to operate and protect the service. We do not authorize advertising trackers to receive PHI or patient documents from patient workflows.

3 How information is used

We use information to operate accounts; route, store, and manage referrals; exchange authorized messages and documents; run enabled extraction and documentation-assistance features; process authorized eligibility inquiries and email imports; provide technical support; administer subscriptions; protect the service; and meet applicable law. Enabling an integration determines the scope of its authorized processing; describing an integration here does not mean every Customer uses it.

Patient records and patient-specific AI inputs and outputs are not used to train AI models or for advertising. Customer-requested review of specific documents for technical troubleshooting is limited to the relevant service purpose and authorized personnel. We do not sell patient information or other personal information, or share it for purposes unrelated to service delivery and the limited legal and business disclosures described here. We do not claim a general right to build independent datasets from patient records.

We may send administrative, billing, security, and service-change messages. Where we send optional marketing or product promotions, recipients may opt out through the offered method or by contacting us. Opting out of marketing does not stop necessary account or security notices. We do not authorize advertising trackers to receive PHI or patient documents from referral, status, messaging, or clinical-assistance workflows.

4 Disclosures and service providers

Information may be available to Customer's authorized personnel, authorized referral sources or recipient organizations, and service providers needed to deliver the service. Customers direct the recipients and scope of referral transfers. Customer-requested sharing is not permission to disclose another agency's unrelated information.

We use contracted infrastructure and processing providers, including services identified by the owner under Google/Firebase and Amazon Web Services. The exact services, legal entities, functions, and countries must be identified in the completed provider schedule. Providers that handle PHI on our behalf must be covered by appropriate agreements and service configurations. Authorized personnel may access information for necessary support, maintenance, or security duties subject to applicable restrictions.

We may disclose information when required by applicable law or valid legal process, and otherwise only as permitted by the governing BAA or data-protection terms. In a corporate transaction, personal information may transfer to a successor subject to applicable confidentiality, privacy, and contractual restrictions. A transaction does not authorize sale of PHI for an unrelated purpose.

5 Notifications and public forms

Referral notifications may contain a referral ID and shortened patient-name information. These details may still identify a patient and are treated as potentially protected information. A shortened name is not represented as de-identification. Do not forward referral messages or access links to unauthorized recipients.

Referral forms may accept submissions without an account. Submission does not authorize access to patient information. A public status lookup may request a referral identifier and limited patient-name characters; this is an access-control step, not formal identity verification. Status views must be limited to the minimum information needed for the workflow and must not expose uploaded clinical documents through the public lookup. Customers and referral sources must protect lookup information and report suspected unauthorized access promptly.

6 Storage retention and international processing

Information is retained according to the Data Retention Policy, subject to Customer instructions and applicable law. Active workspace records are maintained during the subscription under the agreed policy. After service ends, the transition provides 30 days for available self-service exports, followed by support-assisted access to retained records until production deletion 90 days after service ends. Backups and legally required records may have different, specifically documented retention periods.

The standard service is offered for U.S. operations. The Company does not promise that every processing operation occurs in a particular state. Company-authorized providers and personnel may process information only as needed to provide, secure, and support the service and subject to applicable contractual safeguards. Non-U.S. customer operations require prior written approval and any required additional terms.

7 Choices requests and security

Patients and their representatives should contact the agency responsible for their records for access, corrections, or other requests. If we receive a request concerning information processed for an agency, we route it to that agency and assist as required. Deletion may be limited by clinical recordkeeping and other legal duties. Patients should not send medical records or sensitive identifiers to a general contact mailbox to establish their identity.

Account holders and other individuals may contact us to request access, correction, or deletion of information for which we act on our own behalf, or to exercise other applicable privacy rights. We verify identity and authority proportionately, respond within applicable legal periods, and provide an explanation where a request cannot lawfully be fulfilled. Where applicable law provides an appeal, contact us at the same address with the original request and the reason for appeal. We will not discriminate for exercising applicable rights. A generic statement here does not substitute for any jurisdiction-specific notice or consent that must be provided.

We use administrative, physical, and technical safeguards appropriate to our obligations. The completed security schedule describes verified measures; no specific certification or independent audit is claimed by this policy. Users should protect their credentials and promptly report suspicious activity. The service is intended for organizational workflows rather than a child-directed consumer service; medical records about minors are handled under the responsible organization's authority and applicable law.

8 Policy updates

We will identify the effective date of revisions and provide notice of material changes through email and/or the Platform, with additional notice or consent where required. Contractual restrictions on PHI use and required BAA amendments cannot be changed solely through this policy. Questions may be sent to info@ilptechnology.com.

1 Scope and priority

This policy covers Customer workspace records, uploaded documents, AI-assisted outputs, messages, account records, logs, and associated copies handled by ILP Technologies LLC and its relevant service providers. The BAA controls PHI where there is a conflict. The policy does not reduce a Customer's separate clinical recordkeeping obligations or an Individual's legal rights.

2 Active accounts

Customer workspace records are retained while the subscription remains active, subject to authorized deletion instructions, agreed limits, and applicable law. The present policy does not impose an automatic age-based purge of active clinical records. Any future age-based retention change requires a defined schedule, advance notice, and an opportunity to export affected records; it must not conflict with the BAA or applicable legal obligations.

The Company may process properly authorized deletion or amendment instructions, but will distinguish deletion from corrections that must preserve clinical history. Customer must consider its retention duties before directing destruction. The Company will seek clarification of instructions that conflict with a known legal preservation duty.

3 Subscription end and exports

Cancellation becomes effective at the end of the paid subscription period. The transition periods below run from that service-end date, including termination, rather than from the date a cancellation request was submitted.

For the first 30 days after service ends, Customer may export available key referral data and OASIS analysis through the existing export function. Customer must contact the Company for additional retained records not included in that function, such as applicable uploaded documents, messages, and records required for access requests or BAA return. The available export must not be described as a complete clinical-record export unless verified.

After 30 days and until the final deletion deadline, Customer may request retained records by emailing info@ilptechnology.com. The Company will verify authority and arrange secure delivery. Ordinary required PHI access or return is not conditioned on payment of disputed subscription charges. Any requested custom conversion or extraordinary migration charges must be agreed in advance and must not interfere with mandatory access rights.

The final production deletion deadline is 90 days after service ends. Continued storage during this transition is a limited service under the BAA, not permission for independent PHI use or indefinite retention. Customer may request earlier return or agreed destruction where feasible and lawful.

4 Production deletion backups and exceptions

Production deletion covers the relevant database entries, stored files, generated patient-specific outputs, and other active copies. The Company will coordinate deletion of relevant subcontractor copies as required by their agreements. Removing one database row does not by itself establish that attachments, logs, replicas, caches, or backups have been destroyed.

Deletion instructions are applied to production systems no later than 90 days after service ends. Backup, replica, cache, and disaster-recovery copies are maintained only for security and continuity. Where selective deletion from a protected backup is infeasible, the Company will document the reason and expected expiration, keep the copy protected and unavailable for ordinary use, and reapply the deletion if the copy is restored. Retained copies will be destroyed or overwritten when the infeasibility ends. A deletion confirmation will distinguish production deletion from any protected backup exception.

The Company may retain narrowly limited information where law, a binding preservation duty, or a documented infeasibility under the BAA requires it. It will document the scope and reason and notify Customer where permitted. A lack of current litigation does not remove a future preservation duty. Exceptions do not authorize routine commercial reuse of patient information.

5 Logs and business records

Ordinary operational and security logs are retained for up to one year and then deleted or de-identified, unless a longer period is required for an active investigation, legal preservation duty, or compliance record. Required incident documentation, disclosure-accounting information, and other compliance records must be preserved separately for their legally required periods even when ordinary logs expire. PHI within retained records remains protected.

HIPAA Security Rule documentation required by 45 CFR 164.316 is retained for six years from creation or the date it was last in effect, whichever is later. This rule is not a general statement that every patient document must be stored for six years. Contract acceptance, billing, tax, and other business records may be retained for up to seven years, or longer when required by law or an active legal preservation duty, without retaining unnecessary clinical content.

6 Requests and confirmations

Contact info@ilptechnology.com for access, export, return, or deletion requests. The Company will verify the requester's authority, clarify the scope, and use an appropriate secure delivery process. It will acknowledge ordinary requests under the support process and meet the BAA or applicable statutory deadline where one applies. Written deletion confirmation will identify completed actions and any remaining protected copies, reason for retention, and scheduled expiration where known.

1 Parties effective date and definitions

This BAA is between ILP Technologies LLC, a Texas limited liability company based in Houston, Texas, United States (Business Associate), and the Customer legal entity identified in the associated acceptance record (Customer). That record must identify Customer's legal name, representative, title, business email, date, time, and accepted BAA version. It is incorporated into this BAA. Business Associate offers this BAA as part of the service agreement and agrees to be bound upon Customer's authorized acceptance.

This BAA takes effect on that acceptance date before Business Associate begins processing PHI under the service agreement. Customer acts as a Covered Entity or, where applicable, as a Business Associate to an identified upstream Covered Entity. In the latter case, ILP Technologies LLC acts as a subcontractor Business Associate and references to Customer's obligations are read consistently with that relationship. Customer must identify its role and any upstream requirements it needs incorporated. The parties must agree to additional requirements expressly; neither may perform unlawful processing while doing so.

Capitalized HIPAA terms, including Business Associate, Covered Entity, PHI, Electronic PHI, Unsecured PHI, Breach, Security Incident, Designated Record Set, Individual, Secretary, Required By Law, and Subcontractor, have their meanings in 45 CFR Parts 160 and 164. “HIPAA Rules” means the applicable Privacy, Security, Breach Notification, and Enforcement Rules, as amended. PHI under this BAA is PHI created, received, maintained, or transmitted by Business Associate on Customer's behalf.

2 Permitted processing

Business Associate may process PHI only as necessary to provide the purchased and enabled services and follow Customer's lawful documented instructions, or as Required By Law. Services may include referral intake and storage, document exchange, authorized communication and transfers, AI extraction and documentation assistance, eligibility inquiries, authorized email imports, and technical support. Listing a feature does not establish that it is enabled for Customer.

Business Associate will not use or disclose PHI in a manner that would violate the Privacy Rule if done by Customer, except a use expressly permitted by this BAA and HIPAA for Business Associate's proper management and administration or legal responsibilities. For those limited purposes, disclosures may be made only when Required By Law or after obtaining reasonable assurances that the recipient will preserve confidentiality, limit use to the disclosed purpose or law, and report confidentiality breaches. This provision is not permission to retain entire clinical datasets for convenience.

Business Associate will apply the minimum-necessary requirements where applicable. It will not sell PHI, use it for advertising or model training, or use patient records and outputs for independent product-development datasets. It receives no general right to de-identify PHI for its own purposes or aggregate PHI across customers. Any later such activity requires a separate lawful written agreement describing its scope and safeguards. Customer-requested technical troubleshooting is permitted service processing, subject to appropriate access limits.

3 Safeguards and workforce

Business Associate will comply with the applicable requirements of the HIPAA Security Rule, 45 CFR Part 164 Subpart C, and implement appropriate administrative, physical, and technical safeguards for PHI. It will maintain a documented risk analysis and risk-management process, security policies, appropriate access restrictions and authentication, audit controls, incident response, and contingency measures as required by applicable law.

Workforce access will be limited to authorized duties and subject to confidentiality obligations, appropriate training, supervision, and sanctions. Technical support access will be limited to the service need. The security measures and allocation of Customer responsibilities are described in the DPA security schedule. Customer's security responsibilities do not waive Business Associate's own duties.

4 Subcontractors

Before allowing a subcontractor to create, receive, maintain, or transmit PHI on its behalf, Business Associate will obtain a written agreement satisfying applicable HIPAA requirements, including restrictions and conditions no less protective for that information and compliance with applicable Security Rule requirements. Business Associate will use only services and configurations permitted for PHI under its relevant vendor agreements.

Business Associate will take reasonable steps to cure or end a known material violation by a subcontractor and terminate the arrangement if those steps are unsuccessful and termination is feasible, as required by HIPAA. Subcontracting does not remove Business Associate's responsibilities under this BAA. Current material subprocessor families and their functions are described in the DPA schedule, with additional current information available to Customer upon request.

5 Incident and breach reporting

Business Associate will notify Customer without unreasonable delay and within 24 hours after discovery of a Breach of Unsecured PHI, an impermissible use or disclosure of PHI, or a Security Incident affecting Customer's Electronic PHI, except routine unsuccessful attempts addressed below. Discovery of a Breach is determined under 45 CFR 164.410(a), including knowledge that reasonable diligence would have revealed, and is not postponed until an investigation is complete.

The initial notice may be preliminary and will describe what is then known: the event and discovery dates, nature of the event, categories of information involved, known affected persons, containment steps, and an incident contact. Business Associate will promptly provide additional available information, including identification of persons whose Unsecured PHI was or is reasonably believed to have been affected and information Customer needs for notices under 45 CFR 164.404(c). Information not available initially will be supplied promptly when available. Applicable statutory limits, including 45 CFR 164.410, remain controlling if stricter in a particular case; the contractual 24-hour deadline does not extend them.

The parties acknowledge continuing routine unsuccessful incidents such as blocked scans and failed login attempts that result in no unauthorized access, use, disclosure, modification, destruction, or material interference. This paragraph constitutes notice that such attempts may occur. Business Associate will monitor and document them as appropriate and provide a summary on reasonable request. This provision does not cover successful access, suspected compromise requiring investigation, or materially disruptive events, and does not waive legally required reporting.

Business Associate will investigate, mitigate harmful effects to the extent practicable, preserve appropriate evidence, and cooperate with Customer. Customer ordinarily directs notices to Individuals, HHS, and other authorities, unless law imposes a direct duty on Business Associate or Customer delegates a task in writing. Neither party may delay mandatory notice while disputing responsibility or cost. A permitted law-enforcement delay under 45 CFR 164.412 applies only to the extent supported by that provision.

Notices go to Customer's designated security contact and administrative contact. If delivery fails, Business Associate will use other available reasonable contact methods. Customer may report an issue to info@ilptechnology.com and must maintain current contact information.

6 Individual rights and Customer assistance

Business Associate will make PHI in a Designated Record Set available to Customer as necessary to meet obligations under 45 CFR 164.524. It will make PHI available for amendment and incorporate amendments as directed or agreed under 45 CFR 164.526. It will maintain and supply the information needed for accountings under 45 CFR 164.528, including required disclosure information for the applicable lookback period. Ordinary security-log deletion will not destroy information required for an accounting or another legal duty.

Business Associate will forward requests it receives directly from Individuals to Customer within two business days and ordinarily respond substantively through Customer's instructions. It will provide access assistance within five business days after a sufficiently specific Customer request, and amendment or accounting assistance within ten business days. When a shorter legal deadline applies and is communicated, the parties will cooperate promptly to meet it. These operational deadlines do not alter an Individual's statutory rights.

Access assistance is not limited to fields offered by a self-service export. Business Associate will assist with applicable PHI that it maintains, including source documents and other records within scope. Customer decides requests and their legal disposition unless law requires Business Associate to act directly. Assistance does not constitute permission to erase accurate clinical history instead of applying a required amendment process.

To the extent Business Associate performs a Customer Privacy Rule obligation, it will comply with the requirements applicable to that obligation. Business Associate will make its relevant internal practices, books, and records available to the Secretary to determine HIPAA compliance. Contractual confidentiality or dispute clauses do not restrict that access.

7 Customer obligations and specially protected records

Customer will use the Platform lawfully, maintain necessary permissions, identify authorized recipients, and notify Business Associate of applicable limitations in privacy notices, revocations, agreed restrictions, or other requirements that affect the processing it directs. Customer will not request an impermissible use or disclosure. Business Associate will notify Customer if it believes an instruction conflicts with applicable law and suspend the affected instruction as appropriate while the issue is resolved.

Where PHI is also protected by 42 CFR Part 2 or another more protective law, each party will meet the duties applicable to its role. Customer will communicate applicable consent scope, redisclosure notices, and handling restrictions. Business Associate will not use or disclose Part 2 records in proceedings against an Individual except as law permits. Additional required provisions and procedures must be agreed and implemented before any processing requiring them; this BAA alone is not a patient consent or a declaration of readiness for every category of restricted data.

8 Term termination and return of PHI

This BAA continues while Business Associate holds PHI on Customer's behalf. Customer may terminate the BAA and affected services for a material violation. If cure is feasible, Customer may provide a reasonable cure period; it is not required to do so where immediate termination is warranted by the violation or applicable law. Business Associate may terminate affected processing if Customer insists on an unlawful instruction after notice and reasonable opportunity to resolve it, while preserving applicable access and return duties.

Upon termination, Business Associate will return PHI to Customer or, as agreed with Customer, securely destroy it, including copies held by its subcontractors, where feasible. Customer may elect return followed by destruction. The Data Retention Policy provides the agreed transition process, including production deletion 90 days after service ends. A payment dispute does not authorize unlawful withholding of PHI.

If return or destruction of specific information is infeasible, Business Associate will document and inform Customer of the reason, retain only what the reason requires, continue this BAA's protections, and limit uses and disclosures to purposes that make return or destruction infeasible. Protected backup retention must follow a defined verified expiration schedule. Retained PHI will be returned or destroyed when the condition ends. A general preference for indefinite retention is not an infeasibility exception. Business Associate will provide written confirmation of completed destruction on request and identify any remaining protected exceptions.

9 Contract relationship and amendment

This BAA controls conflicting PHI provisions in the Terms, DPA, orders, and policies. Incident-cost allocation in the Terms may apply between the parties but cannot diminish reporting, cooperation, safeguards, access, return, or other legal obligations. No term limits HHS authority or creates an aggregate monetary liability cap.

The parties will cooperate in amendments needed for applicable legal changes. Material BAA amendments require mutual written or recorded electronic acceptance. An update to a public webpage alone does not establish Customer's assent. Interpret the BAA consistently with applicable HIPAA requirements. The record-protection provisions survive for as long as the relevant PHI is retained.

1 Scope roles and instructions

This DPA is incorporated into the accepted service agreement between ILP Technologies LLC (Company) and the Customer named in the acceptance record. It covers personal information the Company processes on Customer's behalf. Customer determines the purposes and authorized scope of that processing. The Company acts as processor or service provider, or as a subprocessor where Customer itself acts for another organization, to the extent those roles exist under applicable law.

Information the Company handles for its own account administration and legally permitted business purposes is described in the Privacy Policy and is not automatically treated as Customer-controlled clinical information. PHI remains governed by the BAA; where both apply, the BAA controls any conflict concerning PHI. This DPA does not assert that the same privacy statute applies to every data category or every Customer.

The Company will process Customer personal information only under lawful documented instructions in the agreement, enabled workflows, Orders, and authorized support requests, or as required by law. It will notify Customer before legally required processing unless prohibited, and notify Customer if an instruction appears unlawful. The parties will resolve that issue before the affected processing continues where required.

2 Processing limits and confidentiality

The Company will not sell Customer personal information or share it for cross-context behavioral advertising, nor retain, use, or disclose it outside the contracted purposes except as applicable law permits. It will not combine Customer personal information with another customer's patient records for independent advertising, profiling, or model training. Necessary service operations do not authorize independent commercial use of clinical data.

Personnel processing the information will be authorized for their duties and bound by confidentiality. Customer-requested technical review of records is limited to that purpose. The Company will make personnel access and service-provider use proportionate to the processing need and the applicable law.

3 Security and personal data incidents

The Company will maintain measures appropriate to the information, risk, and applicable legal requirements. Schedule 2 describes the security measures and the parties' responsibilities. Use of a major cloud provider does not relieve either party of its own duties.

For PHI, the BAA incident process applies. For other Customer personal information, the Company will notify Customer without unreasonable delay and within 24 hours after becoming aware of an incident involving unauthorized access, acquisition, use, disclosure, alteration, destruction, or loss. Notices may be preliminary and will be supplemented promptly with information needed for Customer's legal obligations. The Company will investigate, mitigate, and cooperate. Required notices are not delayed by cost disputes; allocation follows the Terms without limiting statutory duties.

4 Subprocessors and transparency

Customer authorizes the subprocessors described in Schedule 3 and any current register incorporated into it. The Company will impose written data-protection duties appropriate to their function and applicable law; PHI subcontractors require the BAA protections. The Company remains responsible for the obligations it undertakes even when a subprocessor performs a task.

The Company will provide at least 30 days' prior notice of a material new subprocessor that will handle Customer personal information, except where an urgent security or continuity need requires shorter notice. Customer may object on reasonable data-protection grounds within 15 days of notice. The parties will seek a practical resolution; if none is available, Customer may terminate the affected service before the change and receive a prorated refund of prepaid unused fees for it. Applicable law may require additional steps. An urgent substitute must still meet the required agreements and safeguards.

5 Assistance and review

The Company will reasonably assist Customer with applicable individual-rights requests, security assessments, impact assessments, regulator inquiries, and incident obligations in light of the information and service available to it. It will route requests received directly to Customer and act on lawful instructions, except where it must respond directly by law. The BAA sets PHI assistance duties and service deadlines.

On reasonable request, the Company will provide information necessary to demonstrate its processing obligations, subject to protection of other customers' information and legitimate security interests. Where required by applicable law or reasonably necessary following evidence of a material failure, it will permit a proportionate assessment by Customer or a qualified independent assessor bound by confidentiality. Ordinary review should begin with relevant documents and questionnaires. Frequency or confidentiality arrangements do not restrict regulator powers, mandatory audit rights, or an urgent legally required review.

6 Return deletion and processing locations

On termination or a lawful instruction, the Company will return or delete information under the Data Retention Policy and BAA, except narrowly limited retention required by law or permitted documented infeasibility. The production deletion deadline and protected-backup treatment are defined in the Data Retention Policy. Required protections continue throughout retention, and restored backups remain subject to deletion instructions.

Schedule 3 describes current provider families and the process for obtaining additional current service-location information. Before authorizing processing subject to non-U.S. privacy laws, the parties must determine the applicable countries, notices, roles, and transfer requirements and execute any required additional agreements. This DPA is a U.S. baseline; it does not itself supply EU Standard Contractual Clauses, a UK transfer addendum, or all country-specific terms. A contractual service restriction cannot waive a law that actually applies.

7 Schedule 1 Processing description

Subject matter: provision and support of Customer's purchased ReferralFlow services.

Duration: the subscription and the defined transition and permitted retention periods, subject to the BAA and confirmed deletion schedule.

Purposes and operations: collection, transmission, hosting, organization, retrieval, customer-directed exchange, extraction, AI-assisted documentation preparation, enabled eligibility inquiries and email imports, technical support, security monitoring, export, amendment assistance, and deletion.

Data subjects: patients, including minors where lawfully submitted; patient representatives and caregivers; Customer staff; referral-source contacts; and other persons lawfully included in Customer records.

Data categories: patient and contact identifiers, demographics, health and referral records, insurance details, documents and messages, patient-specific AI outputs, professional contact information, and associated account and activity information. Sensitive records require applicable additional protections.

Instructions: the accepted service agreement, authorized Customer settings, directed transfers and integrations, and documented lawful requests. International and specially restricted processing remains subject to the review provisions above.

8 Schedule 2 Security measures

The Company maintains administrative, physical, and technical safeguards appropriate to the Platform and the information it processes. These include role-based workspace access; restricted administrator access; credential controls; encrypted network transport; encryption at rest for supported production storage; audit and security logging; backup and recovery processes; incident escalation; workforce confidentiality requirements; and access removal when personnel no longer require access.

The Company limits workforce access to personnel with a service, support, security, or legal need. Customer-requested document review is technical rather than clinical and is limited to the relevant request. The Company maintains a designated incident-response contact and will use its access and audit information to investigate suspected unauthorized activity.

Customer controls its users, permissions, recipient information, lawful submissions, connected accounts, and export handling. Customer must promptly remove obsolete users, protect credentials and lookup information, and notify the Company of suspected compromise. No certification, independent audit, penetration-test result, or numerical uptime commitment is represented unless expressly stated in an Order or separate written report.

9 Schedule 3 Subprocessors and service locations

Customer authorizes the Company to use subprocessors needed to provide the enabled Platform services. Current infrastructure provider families include Google services, including Firebase and Google Cloud, and Amazon Web Services. Depending on configuration, they may support authentication, application hosting, databases, file storage, delivery, backups, security, or related cloud operations.

AI analysis, eligibility, email import, messaging, payment, diagnostics, and similar optional services are used only when enabled or needed for the subscribed service. Before a provider creates, receives, maintains, or transmits PHI on the Company's behalf, the Company will require an appropriate written agreement and use a configuration permitted for PHI. A current functional subprocessor list and additional service-location information are available to Customers upon request at info@ilptechnology.com.

The Company will give at least 30 days' notice before a material new subprocessor begins handling Customer personal information, except when an urgent security or continuity need requires shorter notice. Customer may object on reasonable data-protection grounds within 15 days. If the parties cannot resolve the objection, Customer may terminate the affected service before the change and receive a prorated refund of prepaid unused fees for that service.