Business Associate Addendum

BUSINESS ASSOCIATE ADDENDUM

Version: 2026-07-10

This Business Associate Addendum ("Addendum") supplements and forms part of
the Agreement (as defined in the Terms of Service) between
the subscribing dental practice ("Covered Entity" or "Practice") and
SimplyRoots Limited, trading as SmadiDesk ("Business Associate" or
"SmadiDesk"), and applies where Business Associate creates, receives,
maintains, or transmits Protected Health Information on behalf of Covered
Entity in connection with the SmadiDesk AI receptionist service (the
"Services").

1. DEFINITIONS

1.1 Terms used but not otherwise defined in this Addendum have the meanings
given in the Health Insurance Portability and Accountability Act of 1996,
the Health Information Technology for Economic and Clinical Health Act, and
their implementing regulations at 45 C.F.R. Parts 160 and 164, each as
amended (together, "HIPAA").

1.2 "PHI" means Protected Health Information as defined in 45 C.F.R.
Section 160.103, limited to the information Business Associate creates,
receives, maintains, or transmits on behalf of Covered Entity under the
Agreement. PHI includes electronic PHI ("ePHI").

2. PERMITTED AND REQUIRED USES AND DISCLOSURES

2.1 Services. Business Associate may use and disclose PHI to provide the
Services described in the Agreement — answering and handling the Practice's
calls, recording and transcribing those calls, capturing caller details,
requests, and urgency indicators, and presenting them to the Practice for
staff review — and as otherwise permitted or required by this Addendum or
required by law. Except as permitted or required by this Addendum or as
required by law, Business Associate will not use or disclose PHI. Business
Associate will not use or disclose PHI in any manner that would violate
Subpart E of 45 C.F.R. Part 164 if done by Covered Entity, except as
permitted by Sections 2.2, 2.3, and 2.4.

2.2 Management and administration. Business Associate may use PHI for its
proper management and administration and to carry out its legal
responsibilities. Business Associate may disclose PHI for those purposes if
the disclosure is required by law, or if Business Associate obtains
reasonable assurances from the recipient that the PHI will be held
confidentially, used or further disclosed only as required by law or for
the purposes for which it was disclosed, and that the recipient will notify
Business Associate of any instance of which it is aware in which the
confidentiality of the PHI has been breached.

2.3 Data aggregation. Business Associate may use PHI to provide data
aggregation services relating to the health care operations of Covered
Entity as permitted by 45 C.F.R. Section 164.504(e)(2)(i)(B).

2.4 De-identification. Business Associate may de-identify PHI in accordance
with 45 C.F.R. Section 164.514(a)-(c). De-identified information is not PHI
and Business Associate may use it as described in the Agreement, including
Section 8.4 of the Terms of Service (to operate, secure, benchmark,
improve, and report on the Service).

2.5 Minimum necessary. Business Associate will limit its uses, disclosures,
and requests of PHI to the minimum necessary to accomplish the intended
purpose, in accordance with 45 C.F.R. Section 164.502(b) and Covered
Entity's minimum-necessary policies communicated to Business Associate.

2.6 No sale or marketing. Business Associate will not sell PHI, and will
not use or disclose PHI for marketing or fundraising, except as expressly
permitted by HIPAA and directed by Covered Entity in writing.

2.7 Covered Entity obligations carried out by Business Associate. To the
extent Business Associate is to carry out one or more of Covered Entity's
obligations under Subpart E of 45 C.F.R. Part 164, Business Associate will
comply with the requirements of Subpart E that apply to Covered Entity in
the performance of those obligations.

3. SAFEGUARDS

3.1 Business Associate will use appropriate administrative, physical, and
technical safeguards to prevent use or disclosure of PHI other than as
provided for by this Addendum, and will comply with Subpart C of 45 C.F.R.
Part 164 (the "Security Rule") with respect to ePHI.

3.2 Without limiting Section 3.1, Business Associate encrypts ePHI in
transit and at rest, restricts access on a role and tenancy basis, and
maintains logging, monitoring, and retention controls as described in the
Privacy Policy and US Privacy Notice Addendum.

4. REPORTING

4.1 Impermissible uses and disclosures. Business Associate will report to
Covered Entity any use or disclosure of PHI not provided for by this
Addendum of which it becomes aware.

4.2 Breach of Unsecured PHI. Business Associate will report any Breach of
Unsecured PHI to Covered Entity without unreasonable delay and in no event
later than thirty (30) days after discovery, in accordance with 45 C.F.R.
Section 164.410. The report will include, to the extent available, the
information Covered Entity reasonably requires to meet its own notification
obligations under 45 C.F.R. Sections 164.404 through 164.408. A report may
be delayed where required by a law-enforcement official in accordance with
45 C.F.R. Section 164.412.

4.3 Security Incidents. Business Associate will report Security Incidents
involving ePHI of which it becomes aware, without unreasonable delay and
in no event later than thirty (30) days after discovery. The parties agree
that this
Section 4.3 constitutes notice, and no further reporting will be made, of
Unsuccessful Security Incidents: routine and expected events that do not
result in unauthorized access, use, disclosure, modification, or
destruction of ePHI, such as pings, port scans, denial-of-service attempts
that do not disrupt the Services, failed log-in attempts, and malware
blocked at the perimeter.

5. SUBCONTRACTORS

Business Associate will ensure that any subcontractor that creates,
receives, maintains, or transmits PHI on behalf of Business Associate
agrees in writing to restrictions and conditions at least as restrictive as
those that apply to Business Associate under this Addendum, in accordance
with 45 C.F.R. Sections 164.502(e)(1)(ii) and 164.308(b). Business
Associate maintains its current list of PHI subcontractors and will provide
it to Covered Entity on written request.

6. INDIVIDUAL RIGHTS SUPPORT

6.1 The Services are not the Practice's record system, and Business
Associate does not maintain PHI in a Designated Record Set on behalf of
Covered Entity. If and to the extent Business Associate is determined to
maintain PHI in a Designated Record Set, Business Associate will make that
PHI available to Covered Entity as necessary for Covered Entity to meet its
obligations under 45 C.F.R. Section 164.524, and will incorporate
amendments as directed by Covered Entity in accordance with 45 C.F.R.
Section 164.526.

6.2 Business Associate will document and make available to Covered Entity
the information required for Covered Entity to provide an accounting of
disclosures in accordance with 45 C.F.R. Section 164.528, within thirty
(30) days of written request.

6.3 If an individual contacts Business Associate directly to exercise a
HIPAA right, Business Associate will forward the request to Covered Entity
promptly and will not respond on Covered Entity's behalf unless directed in
writing.

6.4 Business Associate will comply with any restriction on the use or
disclosure of PHI under 45 C.F.R. Section 164.522 that Covered Entity has
agreed to, to the extent Covered Entity notifies Business Associate of the
restriction in writing and Business Associate can reasonably implement it
within the Services.

7. HHS ACCESS

Business Associate will make its internal practices, books, and records
relating to the use and disclosure of PHI received from, or created or
received on behalf of, Covered Entity available to the Secretary of Health
and Human Services for purposes of determining compliance with HIPAA.

8. COVERED ENTITY OBLIGATIONS

8.1 Covered Entity will notify Business Associate in writing of any
limitation in its Notice of Privacy Practices, any change in or revocation
of an individual's permission to use or disclose PHI, and any restriction
agreed to under 45 C.F.R. Section 164.522, in each case to the extent the
change affects Business Associate's permitted uses or disclosures.

8.2 Covered Entity will not request Business Associate to use or disclose
PHI in any manner that would not be permissible under HIPAA if done by
Covered Entity, except as permitted for a business associate under Sections
2.2 and 2.3.

8.3 As between the parties, Covered Entity remains responsible for the
matters allocated to it in the Agreement, including compliance with call
recording, transcription, AI-disclosure, and consent laws applicable to its
operations, and for reviewing and confirming Service outputs through its
own staff and systems.

9. TERM AND TERMINATION

9.1 Term. This Addendum is effective from the date it is accepted by
Covered Entity and continues for as long as Business Associate creates,
receives, maintains, or transmits PHI on behalf of Covered Entity under the
Agreement.

9.2 Termination for cause. Either party may terminate this Addendum and the
affected Services if the other party materially breaches this Addendum and
fails to cure the breach within thirty (30) days of written notice, or
immediately on written notice if cure is not possible.

9.3 Return or destruction. On termination of the Agreement, Business
Associate will, within ninety (90) days, return or destroy all PHI it still
maintains, using industry-standard destruction methods, except where return
or destruction is infeasible (for example, PHI in scheduled backups or
subject to a legal hold). For PHI that cannot feasibly be returned or
destroyed, Business Associate will extend the protections of this Addendum
to that PHI and limit further uses and disclosures to the purposes that
make return or destruction infeasible, for as long as it is maintained. The
Services' standing retention behavior (including the scheduled purge of
call recordings) is described in the Privacy Policy and US Privacy Notice
Addendum.

9.4 Survival. The obligations of Business Associate under this Section 9
and Sections 2 through 7 survive termination with respect to PHI that
Business Associate continues to maintain.

10. AMENDMENT FOR CHANGES IN LAW

The parties will negotiate in good faith to amend this Addendum as needed
for either party to comply with changes to HIPAA or other applicable law.
If the parties are unable to agree on a required amendment by the
compliance date of the change, either party may terminate the portions of
the Services that cannot be performed in compliance with the changed law.

11. RELATIONSHIP TO THE AGREEMENT

11.1 Precedence. To the extent of a conflict between this Addendum and the
Agreement concerning PHI, this Addendum controls.

11.2 Liability. Except to the extent prohibited by applicable law, the
exclusions and limitations of liability in the Agreement (including Section
12 of the Terms of Service) apply to claims arising under or relating to
this Addendum.

11.3 Independent contractor. Business Associate is an independent
contractor of Covered Entity, and nothing in this Addendum creates an
agency relationship between the parties.

11.4 No third-party beneficiaries. Nothing in this Addendum confers any
rights on any person other than the parties.

11.5 Interpretation. Any ambiguity in this Addendum will be interpreted to
permit the parties to comply with HIPAA.

ACCEPTANCE. This Addendum is accepted electronically by an authorized
representative of the Covered Entity through the SmadiDesk dashboard.
Acceptance has the same force and effect as a written signature. The
acceptance record (practice, accepting administrator, timestamp, document
version, and document SHA-256 hash) is retained as evidence of execution.