Skip to content

Business Associate Agreement

Between [Pharmacy Partner] and Rx360 Inc.

This Business Associate Agreement (“Agreement”) is entered into as of ______, 2026 (“Effective Date”) by and between [Pharmacy Partner] (“Covered Entity” or “Partner”) and Rx360 Inc. (“Business Associate” or “Rx360”). [Pharmacy Partner] is a covered entity under HIPAA. Rx360 may receive, create, maintain, or transmit Protected Health Information (“PHI”) on behalf of [Pharmacy Partner] in connection with the Rx360 pilot program and related services expressly authorized by [Pharmacy Partner].

  1. Definitions

Capitalized terms not otherwise defined in this Agreement shall have the meanings assigned under HIPAA. “Underlying Services” means the services Rx360 performs for or on behalf of [Pharmacy Partner] in connection with the pilot program, limited to: (a) device onboarding and participant support; (b) medication schedule import, review, and configuration; (c) collection and processing of device- and app-generated medication-management signals; (d) retrospective analysis of up to three (3) years of dispensing and medication-profile data for pilot feasibility assessment, cohort selection, recruitment planning, and baseline adherence characterization, solely as approved by [Pharmacy Partner]; (e) preparation of de-identified data sets, limited data sets, and aggregate reports approved by [Pharmacy Partner]; and (f) other written tasks expressly authorized in advance by [Pharmacy Partner] through an amendment or signed written instruction. For clarity, Underlying Services do not include product development, algorithm training, commercialization, investor-facing use of PHI, or any independent use of [Pharmacy Partner] data except as expressly authorized in writing by [Pharmacy Partner]. For the avoidance of doubt, any de-identified, limited-data-set, aggregate, predictive, or analytic output derived from [Pharmacy Partner] data may be used by Rx360 only for the Underlying Services unless [Pharmacy Partner] separately authorizes additional use in writing.

  1. Permitted Uses and Disclosures

Rx360 may use and disclose PHI only as necessary to perform the Underlying Services for [Pharmacy Partner], as required by law, or as otherwise authorized in writing by [Pharmacy Partner]. Rx360 may use PHI for the proper management and administration of Rx360 only to the extent permitted by HIPAA and only where such use does not expand the scope of the Underlying Services. Rx360 shall not use or disclose PHI in any manner that would violate HIPAA if done by [Pharmacy Partner], except as expressly permitted for a business associate under HIPAA.

  1. Prohibited Uses

Rx360 shall not use [Pharmacy Partner] PHI for research, publication, marketing, product development, product training, algorithm development, model tuning, investor materials, commercial promotion, or any independent internal purpose unless such use is specifically authorized in writing by [Pharmacy Partner] and all required legal, regulatory, and ethical approvals have been obtained. Rx360 shall not sell PHI, target marketing using PHI, or derive independent datasets from [Pharmacy Partner] PHI for its own benefit without [Pharmacy Partner]’s prior written authorization.

  1. Safeguards

Rx360 shall implement appropriate administrative, technical, and physical safeguards and shall comply with the Security Rule with respect to ePHI. At a minimum, Rx360 shall maintain encryption in transit and at rest, role-based access controls, workforce confidentiality obligations, authentication controls, logging sufficient for auditability, and minimum-necessary access limitations.

  1. Subcontractors

Rx360 shall ensure that any subcontractor that creates, receives, maintains, or transmits PHI on behalf of Rx360 agrees in writing to the same restrictions, conditions, and requirements that apply to Rx360 under this Agreement. Rx360 remains responsible for the acts and omissions of its subcontractors to the extent provided by law.

  1. Reporting and Breach Notification

Rx360 shall report to [Pharmacy Partner], without unreasonable delay and in no event later than forty-eight (48) hours after discovery, any use or disclosure of PHI not provided for by this Agreement, any Security Incident of which it becomes aware, and any Breach of Unsecured PHI as required by law. Such report shall include, to the extent known at the time, a description of the incident, the types of information involved, the individuals potentially affected, corrective actions taken, and steps planned to mitigate harm and prevent recurrence. Rx360 shall not issue any notice to affected individuals, regulators, media, or third parties relating to [Pharmacy Partner] PHI without first providing [Pharmacy Partner] a reasonable opportunity to review and approve the content of such notice, except to the extent prohibited by law.

  1. Access, Amendment, and Accounting Support

To the extent Rx360 maintains PHI in a Designated Record Set on behalf of [Pharmacy Partner], Rx360 shall make such PHI available to [Pharmacy Partner] or, as directed by [Pharmacy Partner], to the Individual, and shall support amendments and any required accounting of disclosures in a manner sufficient for [Pharmacy Partner] to satisfy its HIPAA obligations.

  1. Audit Rights and Government Access

Rx360 shall make its internal practices, books, and records relating to [Pharmacy Partner] PHI available to the Secretary of Health and Human Services as required by HIPAA. In addition, upon reasonable prior notice and no more than once annually, or more frequently upon a suspected breach or material compliance concern, [Pharmacy Partner] may audit Rx360’s compliance with this Agreement, including reasonable review of policies, safeguards, subcontractor controls, and evidence of corrective actions. Except where the audit is triggered by Rx360’s breach, material noncompliance, or Security Incident, [Pharmacy Partner] shall bear its own internal audit costs and Rx360 shall provide reasonable cooperation at its own expense.

  1. Return or Destruction of PHI

Upon termination of this Agreement, completion of the Underlying Services, or [Pharmacy Partner]’s written request, Rx360 shall return or destroy all PHI received from [Pharmacy Partner], or created, maintained, or received by Rx360 on behalf of [Pharmacy Partner], and shall retain no copies except where return or destruction is infeasible or required by law. Any retained backup copies not readily accessible in the ordinary course of business shall remain subject to this Agreement until overwritten or destroyed pursuant to routine retention schedules.

  1. Assignment, Change of Control, and Successors

Rx360 may not assign this Agreement, nor transfer or delegate rights or obligations involving [Pharmacy Partner] PHI, whether voluntarily, by merger, acquisition, sale of assets, change of control, bankruptcy, receivership, or otherwise, without [Pharmacy Partner]’s prior written consent. All obligations relating to [Pharmacy Partner] PHI shall survive and bind any permitted successor, purchaser, trustee, receiver, or assignee.

  1. Term and Termination

This Agreement remains in effect until all [Pharmacy Partner] PHI handled by Rx360 is returned or destroyed, or until terminated in accordance with this section. [Pharmacy Partner] may terminate this Agreement immediately if Rx360 violates a material term and fails to cure within a reasonable period specified by [Pharmacy Partner], or immediately if cure is not possible.

  1. Indemnification

Rx360 shall defend, indemnify, and hold harmless [Pharmacy Partner] and its owners, pharmacists, employees, and agents from and against any third-party claims, regulatory penalties, fines, damages, costs, and reasonable attorneys’ fees arising out of or related to Rx360’s breach of this Agreement, violation of law, negligence, willful misconduct, or mishandling of [Pharmacy Partner] PHI, except to the extent caused by [Pharmacy Partner]’s own negligence or misconduct. This section survives termination.

  1. Miscellaneous

Nothing in this Agreement creates a partnership or joint venture other than the business associate relationship required by HIPAA. This Agreement shall be governed by California law to the extent not preempted by federal law. Any ambiguity shall be interpreted to permit compliance with HIPAA.

Signatures
[PHARMACY PARTNER] RX360 INC.
By: Gene Lang, PharmD Title: Owner / Pharmacist-in-Charge Signature: ______ By: Peyman Majd Title: President Signature: ______
Date: ______ Date: ______