Provider Portal Terms and Conditions

1. Agreement
   • Practice and JOYA Health entered into a certain JOYA Health Provider Agreement (“Agreement”), which incorporates these Provider Portal Terms and Conditions (the “Terms and Conditions”) into the Agreement by reference. Practice, by executing the Agreement, is bound to all terms of the Agreement, including these Terms and Conditions. The capitalized terms not otherwise defined herein shall have the meanings given to them in the base Agreement.
   • Please read these Terms and Conditions carefully because they govern Practice’s use of JOYA Health’s Portal and the services that Practice renders under the Agreement.
   • WHEN PRACTICE AGREES TO THESE TERMS AND CONDITIONS, PRACTICE AGREES (WITH LIMITED EXCEPTION) TO RESOLVE ANY DISPUTE BETWEEN PRACTICE AND JOYA THROUGH BINDING, INDIVIDUAL ARBITRATION RATHER THAN IN COURT. PLEASE REVIEW CAREFULLY SECTION 9.2 BELOW FOR DETAILS REGARDING ARBITRATION.
   • These Terms and Conditions will expire or terminate in accordance with Section 3 of the base Agreement.
2. Definitions
   • “Clinician” means any User that is a physician or other licensed professional associated with Practice who utilizes the Services to deliver skincare services and products to Patients.
   • “Patients” mean the employees of JOYA Health’s employer customers who (i) subscribe to the Platform to access skincare products, services, and other offerings by JOYA Health and (ii) elect Practice and its Clinicians to render such skincare services and products.
   • “Services” means the access to individuals who may become Patients and the connection of certain functions on JOYA Health’s platform (the “Platform”), through which Patients will connect with and access the professional skincare and other related services and products of Practice and its Clinicians, including the Practice services described in Exhibit A of the base Agreement.
   • “User” means any employee, contractor, or other individual associated with Practice authorized by Practice to access and use the Services.
3. Services; Access and Use
   • Practice will ensure that each Clinician further complies with Exhibit A of the base Agreement. Practice will promptly notify JOYA Health of any additional information applicable to a Clinician’s practice, any changes with respect to any information provided to JOYA Health, or if at any point a Clinician is no longer in compliance with any of the warranties, representations, or covenants in Exhibit A of the base Agreement.
   • Use Restrictions. Practice will fully comply with JOYA Health’s Use Restrictions and Security Requirements in Exhibit A to these Terms and Conditions.
   • Users. Practice will ensure that each User complies with all applicable terms and conditions of this Agreement. Practice will be liable for all acts or omissions by Users in connection with their use of the Services and any violation of the terms and conditions of this Agreement by any User.
   • Access to certain functions on the Platform will be accomplished through APIs as agreed upon by JOYA Health and Practice to effectively and seamlessly sync and connect certain features of Practice’s own system(s) and platform(s) to that of the Platform, including appointment scheduling, telehealth visits, prescription renewals, and purchase of skincare products and services, as elected by Practice.
   • Practice shall provide JOYA Health a monthly invoice for the JOYA Health Cost due to Practice for related facials and sunscreen products provided to Patients in the prior month. JOYA Health will reimburse Practice for the monthly undisputed JOYA Health Cost within thirty (30) calendar days following receipt of the invoice from Practice.
4. Certain Obligations of Practice
   • No Telecommunications or Internet Services. Practice acknowledges and agrees that Practice’s and its Users’ use of the Services is dependent upon access to telecommunications and Internet services.  JOYA Health will not be responsible for any loss or corruption of data, lost communications, or any other loss or damage of any kind arising from any such telecommunications and Internet services.
   • Provision of Care Requirements. Prior to engaging in the provision of care (including telehealth services), Practice will (and will ensure that Clinicians) obtain informed consent from, provide applicable notices to (e.g., HIPAA Notice of Privacy Practices), and enter into any necessary agreement with patients, all of which must comply with all applicable state and federal laws and regulations.
   • Relationship with JOYA Health. JOYA Health acts solely as a technology platform to provide the Services. JOYA Health does not control or interfere with the practice of medicine or other licensed professional services by Practice or its Clinicians.  JOYA Health is not a health care provider, and the Services it provides does not include the provision of medical advice or the practice of medicine.  There is no provider-patient relationship between JOYA Health and any user of JOYA Health’ services. The Practice (and its Clinicians), and not JOYA Health, will be responsible for verifying the accuracy of all medical information and advice, making all diagnostic, treatment and clinical decisions, and complying with all applicable laws, regulations, licensing requirements, and the applicable standard of care in delivering health care services. JOYA Health will not be liable for timeliness of chat response, cancelled or otherwise unfulfilled appointments, information provided by patients, patient failure to pay or chargebacks, credits, or refunds associated with patient payments, inability to deliver health care services through use of the Services, diagnosis or treatment provided, the quality of care, the cost of care, or any other injury or loss resulting or arising from or related to Practice’s use of the Services.
   • Services Content. The content provided through the Services by JOYA Health, other users of the Services, or other third-party content providers is provided for informational and reference purposes only and may be generated through JOYA Health’ or its third-party licensors’ algorithms or artificial intelligence used in connection with providing the Services. Any content on the Services is not marketed, promoted or otherwise intended to be used to diagnose any disease or other condition, or to cure, mitigate, treat, or prevent any disease. JOYA Health does not refer, recommend or endorse any specific drug, test, procedure, physician, product, service, opinion, or other information that may be mentioned on the Platform or Services. Reliance on any content provided through the Platform by JOYA Health, other users of the Services, or other third-party content providers is at Practice’s own risk and may be subject to additional terms, conditions, and policies of the third-party content provider. JOYA Health and its third-party content providers do not warrant or guarantee that the content on the Services will be accurate, complete, relevant, or current.
   • Third-Party Services.
     • The Services may allow Practice and its Users to interface or interact with, access, or use third-party services, products, technology, websites, content, materials or other resources (including those made available by patients). JOYA Health provides access only as a convenience and is not responsible for the content, products or services on or available from those resources or links displayed on such websites. Practice acknowledges sole responsibility for and assumes all risk arising from, Practice’s use of any third-party resources. JOYA Health may incorporate third-party software or materials as part of certain of the Services, including open source third-party software. Practice’s use of such third-party software or materials is subject to any and all applicable additional terms and conditions governing such use provided by the third party. Where applicable, additional notices relating to the third party may be provided by JOYA Health, which for example may contain attribution and disclaimer notices applicable to the third-party software or content.
     • Practice acknowledges and agrees that JOYA Health incorporates, connects to, or integrates with certain services provided by its third-party providers and licensors (“Third-Party Providers”), and such services provided by them, as incorporated in, connected to, or integrated with the Services, the “Third-Party Services”). Practice agrees that the provisions set forth in Sections 4.4, 5, and 4.6 apply with respect to the Third-Party Providers and the Third-Party Services.  Each Third-Party Provider owns all rights and title in and to the intellectual property comprising its Third-Party Services.  Practice will not modify, copy, distribute, transmit, display, perform, reproduce, publish, license, create derivative works from, transfer, or sell or re-sell any information, software, products, or services obtained from or through the Third-Party Services.
   • Referrals. Nothing in this Agreement will create any obligation on the part of either party or any provider or other person employed by or contracted with either party (including Clinicians) to refer patients to any other party. Nothing in this Agreement will be interpreted as requiring either party to make referrals of any products, services, or other items to the other in violation of any federal, state or local law or regulation.
5. Survival. The following provisions of these Terms and Conditions shall survive termination or expiration of the Terms and Conditions: Sections 1, 3, 6, 7.4, 8, 9, 11.3, 11.4, 11.9, 11.10, 11.10, 11.12, 11.14, and any other provisions that by their nature are intended to survive termination or expiration of these Terms and Conditions.
6. Confidentiality

6.1               Confidential Information. “Confidential Information” means any information (either oral, written or digital) disclosed by one party (“Disclosing Party”) to the other party (including any director, officer, employee, agent, or representative thereof) (“Receiving Party”) including that which relates to research, product plans, products, services, clients, markets, software, algorithms, machine learning models, developments, inventions, processes, designs, drawings, engineering, technical data, know-how, protocols, hardware configuration information, marketing or finances of the Disclosing Party that: (i) if disclosed in writing or in the form of tangible materials, is marked “confidential” or “proprietary” at the time of such disclosure; (ii) if disclosed orally or by visual presentation, is identified as “confidential” or “proprietary” at the time of such disclosure; or (iii) due to its nature or the circumstances of its disclosure, a person exercising reasonable business judgment would understand to be confidential or proprietary. For clarity, the Services, the Platform and its components, and the underlying software provided in conjunction with the Services, are the Confidential Information of JOYA Health.

6.2               Obligations and Restrictions. The Receiving Party will maintain all Confidential Information in confidence using at least the same degree of care as it uses to protect the confidentiality of its own confidential information of similar importance, but no less than a reasonable degree of care. The Receiving Party agrees not to disclose the Disclosing Party’s Confidential Information to any third party and will to use it for the sole purpose of performing its obligations or exercising its rights under this Agreement (“Purpose”). The Receiving Party may disclose the Disclosing Party’s Confidential Information to its employees and consultants who have a bona fide need to know such Confidential Information for the Purpose, but solely to the extent necessary to pursue the Purpose and for no other purpose; provided, that each such employee and consultant is bound by a written agreement that contains use and nondisclosure restrictions at least as protective of the Disclosing Party’s Confidential Information as those set forth in this Agreement.

6.3               Return of Confidential Information. At the termination or expiration of this Agreement or upon the Disclosing Party’s request, the Receiving Party will either return the Disclosing Party’s Confidential Information and all copies thereof (including electronic copies), and any notes, analyses, compilations, studies, interpretations, memoranda or other documents (regardless of the form thereof) prepared by or on behalf of the Receiving Party that contain or are based upon the Disclosing Party’s Confidential Information or will, at the Disclosing Party’s direction, destroy the Disclosing Party’s Confidential Information (including all copies) and certify its secure destruction to the Disclosing Party, except that the Receiving Party may retain a copy for archival or evidentiary purposes or as otherwise required by applicable law.

6.4               Exceptions. The parties’ obligations and restrictions with respect to Confidential Information will not apply to any information or materials which:  (a) were, at the time of disclosure, or has subsequently become, generally known or available to the public through no fault of the Receiving Party; (b) the Receiving Party can demonstrate as already in its possession prior to disclosure hereunder, or is subsequently rightfully acquired by the Receiving Party, with no duty of confidentiality owed to Disclosing Party with respect to such information or materials; (c) is independently developed by the Receiving Party without use of the Disclosing Party’s Confidential Information; or (d) consists of personal information that is subject to JOYA Health’ privacy policy, data aggregation analyses, or de-identified data derived from PHI or personal information.

6.5               Equitable Relief. Each party agrees and acknowledges that any violation or threatened violation of this Section 5 will cause irreparable harm and significant damages, the degree of which may be difficult to ascertain to the Disclosing Party and that, in addition to any other remedies that may be available, in law, in equity or otherwise, the Disclosing Party will be entitled to seek equitable relief to enjoin any unauthorized use or disclosure of its Confidential Information, without the necessity of proving actual damages, in addition to any other rights and remedies that it may have at law or otherwise.

6.6               Confidentiality Term. The confidentiality obligations imposed by this Section 5 will survive expiration or termination of this Agreement, and will continue to apply for four (4) years following the termination of this Agreement; provided, that, (a) as to any PHI, the parties’ confidentiality obligations will be governed by the applicable requirements of HIPAA and (b) as to any Confidential Information that the Disclosing Party maintains as a trade secret, the Receiving Party’s obligations under this Section 4 will remain in effect for as long such Confidential Information remains a trade secret.

7. Practice Materials and Data

   • Practice Materials. “Practice Materials” means all information, data, content and other materials, in any form or medium, that is submitted, posted, collected, transmitted or otherwise provided by or on behalf of Practice through the Services or to JOYA Health in connection with Practice’s use of the Services and processed solely for the benefit of Practice under the Agreement. For clarity, Practice Materials expressly exclude User Data (as defined in Section 6.3), Usage Data (as defined in Section 6.4), and De-identified Data (as defined in Section 6.4) and any other information, data, data models, content or materials owned or controlled by JOYA Health and made available or processed through or in connection with the Services, including any information processed in connection with JOYA Health’ relationship with a patient independent of Practice or any information processed with the authorization of a patient.  JOYA Health acknowledges that, as between Practice and JOYA Health and except as set forth in this Section, Practice owns and retains all right, title and interest in and to all Practice Materials. Practice hereby grants JOYA Health a non-exclusive, worldwide, royalty-free right and license to access, use, host, reproduce, display, perform, modify the Practice Materials solely for the purposes of hosting, performing analytics on usage, operating, improving and providing the Services and JOYA Health’ other related products, services and technologies during the Term, and performing research and providing targeted recommendations to patients based on their interactions with the Practice and the Services.
   • HIPAA – Business Associate Agreement. To the extent applicable, Practice and JOYA Health agree to comply with the Health Insurance Portability and Accountability Act of 1996 and its implementing privacy and security regulations (“HIPAA”) and any applicable state data privacy laws. To the extent that JOYA Health processes protected health information that is subject to HIPAA (“PHI”) on behalf of Practice under this Agreement, the parties will comply with the terms of the Business Associate Agreement in Exhibit B of these Terms and Conditions.
   • Privacy Policy. Except where the Business Associate Agreement applies, JOYA Health may process personal information in accordance with its Privacy Policy. This includes personal information about Users and other users of JOYA Health’ websites, web and mobile applications, and other offerings (collectively, “User Data”).
   • Usage Data. JOYA Health and the Services may collect and record data regarding the usage and performance of the Services, including via certain mobile devices and applications compatible with the Services (such data, “Usage Data”). JOYA Health may collect, use and disclose Usage Data in accordance with the terms of this Agreement and JOYA Health’ Privacy Policy. Practice acknowledges and agrees that JOYA Health may use Usage Data to create de-identified and/or aggregated data that is: (a) not identifiable to any person and, to the extent derived from PHI, complies with 45 C.F.R. § 164.514(b), and (b) is not publicly distributed or conveyed in a context that identifies Practice’s identity (“De-identified Data”).  JOYA Health may retain and use De-identified Data without restriction for any purpose, including operating, analyzing, improving or marketing the Services and any related products and services.
   • Data and Reports. Practice will provide JOYA Health with access to the Practice EMR/EHR via (i) an API integration between JOYA Health’ systems and the Practice’s electronic medical records systems, or (ii) the delivery by the Practice to JOYA Health of a weekly report including certain information about patients’ usage of the Services, including procedures received, payment information for the Services and carrier information (such data, the “JOYA Health Patient Reporting Data”). JOYA Health may use the JOYA Health Reporting Data to perform analytics, for research purposes, to deliver targeted user portal information and skincare recommendations to Patients enrolled in JOYA Health and to communicate with Patients regarding JOYA Health’ products and services.
8. Indemnification Procedure. The party seeking defense and indemnity (the “Indemnified Party”) will promptly notify the other party (the “Indemnifying Party”) of the Claim for which indemnity is being sought and will follow the procedures set forth in the Terms and Conditions. reasonably cooperate with the Indemnifying Party in the defense and settlement thereof. The Indemnifying Party will have the sole right to conduct the defense of any Claim for which the Indemnifying Party is responsible hereunder; provided that the Indemnifying Party may not settle any Claim without the Indemnified Party’s prior written approval unless the settlement is for a monetary amount, unconditionally releases the Indemnified Party from all liability without prejudice, does not require any admission by the Indemnified Party, and does not place restrictions upon the Indemnified Party’s business, products or services.  The Indemnified Party may participate in the defense or settlement of any such Claim at its own expense and with its own choice of counsel or, if the Indemnifying Party refuses to fulfill its obligation of defense, the Indemnified Party may defend itself and seek reimbursement from the Indemnifying Party.
9. Governing Law; Dispute Resolution
   • Governing Law and Forum Choice. This Agreement and any action related thereto will be governed by the Federal Arbitration Act, federal arbitration law, and the laws of the State of Delaware, without regard to its conflict-of-law provisions. Except as otherwise expressly set forth in Section 8.2, the exclusive jurisdiction for all Disputes (defined below) between Practice and JOYA Health that are not required to be arbitrated will be the subject to the exclusive jurisdiction of the state and federal courts located in Delaware. Practice and JOYA Health each waive any objection to jurisdiction and venue in such courts.
   • Dispute Resolution.
     • Mandatory Arbitration of Disputes. The parties agree that any dispute, claim or controversy arising out of or relating to the use of the Services, this Agreement or the breach, termination, enforcement, interpretation or validity thereof (collectively, “Disputes”) will be resolved solely by binding, individual arbitration and not in a class, representative or consolidated action or proceeding. Practice and JOYA Health agree that the U.S. Federal Arbitration Act governs the interpretation and enforcement of this Agreement, and that Practice and JOYA Health are each waiving the right to a trial by jury or to participate in a class action. This arbitration provision will survive termination of this Agreement.
     • Exceptions. As a limited exception to Section 9.2.1, the parties each retain the right to seek injunctive or other equitable relief from a court to prevent (or enjoin) the infringement or misappropriation of our intellectual property rights.
     • Conducting Arbitration and Arbitration Rules. The arbitration will be conducted by the American Arbitration Association (“AAA”) under its Consumer Arbitration Rules (the “AAA Rules”) then in effect, except as modified by this Agreement. The AAA Rules are available at http://www.adr.org or by calling 1-800-778-7879. A party who wishes to start arbitration must submit a written Demand for Arbitration to AAA and give notice to the other party as specified in the AAA Rules. The AAA provides a form Demand for Arbitration at http://www.adr.org.

Any arbitration hearings will take place in Orange County, California, unless the parties agree to a different location. The parties agree that the arbitrator will have exclusive authority to decide all issues relating to the interpretation, applicability, enforceability and scope of this arbitration agreement.

• Arbitration Costs. Payment of all filing, administration and arbitrator fees will be governed by the AAA Rules, and JOYA Health will not seek to recover the administration and arbitrator fees JOYA Health is responsible for paying, unless the arbitrator finds Practice’s Dispute frivolous. Notwithstanding the foregoing, each Party shall share the costs of arbitration equally and bear its own attorneys’ fees and costs.
• Injunctive and Declaratory Relief. Except as provided in Section 9.2.2, the arbitrator will determine all issues of liability on the merits of any claim asserted by either party and may award declaratory or injunctive relief only in favor of the individual party seeking relief and only to the extent necessary to provide relief warranted by that party’s individual claim. To the extent that Practice or JOYA Health prevails on a claim and seeks public injunctive relief (that is, injunctive relief that has the primary purpose and effect of prohibiting unlawful acts that threaten future injury to the public), the entitlement to and extent of such relief must be litigated in a civil court of competent jurisdiction and not in arbitration. If Practice breaches the Agreement, JOYA Health may obtain injunctive relief without any requirement to prove actual monetary damage or post a bond or other security.
• Class Action Waiver. Practice and JOYA Health agree that each may bring claims against the other only in Practice’s or JOYA Health’ individual capacity, and not as a plaintiff or class member in any purported class or representative proceeding. Further, if the parties’ Dispute is resolved through arbitration, the arbitrator may not consolidate another person’s claims with Practice’s claims, and may not otherwise preside over any form of a representative or class proceeding. If this specific provision is found to be unenforceable, then the entirety of this Dispute Resolution section will be null and void.
• Severability. With the exception of any of the provisions in Section 9.2.2, if an arbitrator or court of competent jurisdiction decides that any part of this Agreement is invalid or unenforceable, the other parts of this Agreement will still apply.

10. Clinician and User Requirements. Practice will ensure that each Clinician, in addition to complying with the terms and conditions applicable to Users:
    • Has successfully completed JOYA Health’ clinician registration process, if applicable, which may include: (i) completing identification verification processes; (ii) if applicable, identifying any insurance plans for which the Clinician is considered “in network” and providing related fee information; (iii) providing requested fees information for Clinician’s services (e.g., membership fees, visit fees, costs for clinical services offered by Clinician, etc.); and (iv) any other information, data, and other materials reasonably requested by JOYA Health in the format and via the method reasonably designated by JOYA Health.
    • Possesses, verifies, and updates (upon any change) all valid, unexpired, unrevoked and unrestricted licenses, authorizations, registrations, and certifications (i) for all jurisdictions in which Clinician practices (free of any disciplinary actions by state medical boards or other applicable regulatory bodies), (ii) necessary to provide all patient services or treatment provided by Clinician, and (iii) regarding state and federal narcotic and controlled substances registrations, as applicable.
    • Has and maintains medical malpractice insurance and (if appropriate) other professional liability/errors & omissions liability insurance coverage and other insurance of the types and in the amounts that are at a minimum consistent with industry standards and applicable law, with respect to Clinician’s practice.
    • Adheres to all applicable rules, regulations and policies of governmental agencies having jurisdiction, including the U.S. Department of Health and Human Services and the Drug Enforcement Administration, and all federal and state regulations regarding confidentiality of patient information.
    • Adheres to and remains in compliance with all applicable terms and conditions governing use of third-party services, products, technology, websites, content, materials or other resources that it may interface or interact with, access, or use through the Services.
11. Additional Terms
    • Entire Agreement. This Agreement (including the referenced exhibits) constitutes the complete and exclusive agreement between the parties with respect to the subject matter hereof and supersedes all prior understandings and agreements, whether written or oral, with respect to the subject matter hereof. Except as otherwise stated in the Agreement, any modification, waiver, or amendment of any provision of this Agreement will be effective only if in writing and signed by authorized representatives of both parties. If any provision of this Agreement is held illegal, invalid or unenforceable by an arbitrator or a court of competent jurisdiction, that provision will be enforced to the maximum extent permissible and the other provisions of this Agreement will remain in full force and effect.
    • Non-Exclusive Relationship. This is a non-exclusive agreement. Nothing in this Agreement will be deemed to restrict or limit JOYA Health’ right to perform similar services for any other party or to assign any employees or subcontractors to perform similar services for any other party; provided that JOYA Health complies with its obligations under Section 5 with respect to Confidential Information of Practice. Notwithstanding the foregoing, during the Term of this Agreement, Practice will not: (i) enter into an agreement with a competitor of JOYA Health, (ii) use any system or platform of another service provider to perform functions or services similar to those provided by the Services as part of an employee benefit or other skin care offering or program, or (iii) initially access Patients or other employees of JOYA Health’s employer customers other than through the Services. 
    • Reservation of Rights. Subject to the limited rights expressly granted in the Agreement, JOYA Health reserves and, as between the parties will solely own, the JOYA Health IP and all rights, title and interest in and to the JOYA Health IP.  No rights are granted to Practice hereunder (whether by implication, estoppel, exhaustion or otherwise) other than as expressly set forth herein. Practice will not remove, alter or obscure any copyright, trademark, service mark or other proprietary rights notices incorporated in or accompanying the Services.  “JOYA Health IP” means the Services, the underlying software provided in conjunction with the Services, algorithms, interfaces, technology, databases, tools, know-how, processes and methods used to provide or deliver the Services, and Usage Data and De-identified Data (as defined in Section 6.4 of the Agreement), and all improvements, modifications or enhancements to, or derivative works of, the foregoing (regardless of inventorship or authorship), and all intellectual property rights in and to any of the foregoing.
    • Feedback. From time-to-time Practice, its Users, or its employees, contractors, or representatives may provide JOYA Health with suggestions, comments, feedback or the like with regard to the Services (collectively, “Feedback”). Practice hereby grants JOYA Health a perpetual, irrevocable, royalty-free and fully paid-up license to use and exploit all Feedback in connection with JOYA Health’ business purposes, including the testing, development, maintenance and improvement of the Services.
    • Enforcement. Practice will promptly notify JOYA Health of any suspected or alleged violation of the terms and conditions of the Agreement and will cooperate with JOYA Health with respect to: (a) investigation by JOYA Health of any suspected or alleged violation of the Agreement and (b) any action by JOYA Health to enforce the terms and conditions of the Agreement. JOYA Health may suspend or terminate any User’s access to the Services upon notice to Practice if JOYA Health reasonably determines that such User has violated the terms and conditions of the Agreement or that the security of the Services has been or likely will be compromised.
    • Insurance. At all times during the Term, Practice will obtain and maintain in full force and effect: Commercial General Liability, Workers’ Compensation, Employer’s Liability, Medical Malpractice Insurance and (if appropriate) other Professional Liability/Errors & Omissions Liability, and any such other insurance coverage conforming to applicable industry standards in amounts adequate to cover acts and omissions of Practice and its Clinicians. Practice will provide JOYA Health with evidence of such insurance coverage upon JOYA Health’ request.
    • Assignment. Practice may not assign or transfer the Agreement, by operation of law or otherwise, without JOYA Health’ prior written consent. Any attempt by Practice to assign or transfer the Agreement without such consent will be null and void. JOYA Health may freely assign or transfer the Agreement without restriction. Subject to the foregoing, the Agreement will bind and inure to the benefit of the parties, their successors and permitted assigns. The parties agree that JOYA Health may subcontract the performance of all or parts of its obligations pursuant to the Agreement to a third party.
    • Notices. Any notices or other communications provided by JOYA Health under the Agreement will be given: (i) via email; or (ii) by posting to the Services. For such notices made by email, the date of receipt will be deemed the date on which such notice is transmitted. All notices or other communications required or permitted under the Agreement to be provided by Practice will be in writing and delivered by confirmed email transmission, by overnight delivery service, or by certified mail, and the date of receipt will be deemed the date on which such notice is received.  All such notices or other communications provided by Practice will be sent to JOYA Health at [email protected] or to such other address as may be specified by JOYA Health in accordance with this Section.
    • Waiver of Rights. A party’s failure to enforce any right or provision of the Agreement will not be considered a waiver of such right or provision. The waiver of any such right or provision will be effective only if in writing and signed by a duly authorized representative of the applicable party. Except as expressly set forth in the Agreement, the exercise by either party of any of its remedies under the Agreement will be without prejudice to its other remedies under the Agreement or otherwise.
    • Independent Contractors. The parties are independent contractors for all purposes and at all times. Neither party nor any of its employees will be agents, employees, or representatives of the other party. All matters of compensation and benefits and terms of employment for each party’s employees will be solely a matter between that party and its employees. Nothing contained herein will be deemed or construed to create between the parties hereto a partnership or joint venture or employment relationship. No party will have the authority to act on behalf of any other party, or to commit, bind or contract the other party in any manner or cause whatsoever or to make any representations, guarantees, or warranties on behalf of the other party or to use any other party’s name in any way not expressly authorized by the Agreement or expressly consented to in writing signed by the parties.
    • Publicity. JOYA Health may make a public statement in the form of a press release announcing the execution of the Agreement and naming Practice as a customer of JOYA Health. JOYA Health may list Practice as a network provider in any JOYA Health marketing materials, such as, by way of example, representative client lists, press releases, screen shots, case studies and printed and digital sales material, and Practice consents to the inclusion of Practice’s name and logo on JOYA Health’ website. Except as set forth in this Section, neither party will disclose any terms or conditions of the Agreement to any third party, or issue any press release or public statement regarding the Agreement or the parties’ relationship, without the prior consent of the other party, except that either party may disclose the terms of the Agreement as required by law or to potential and actual acquirers, investors, underwriters and lenders, subject to reasonable non-use and non-disclosure requirement.
    • No Third-Party Beneficiaries. The Agreement is entered into solely between Practice and JOYA Health and will not be deemed to create any rights in any third parties or to create any obligations of either party to any third party, including any User.
    • Force Majeure. Neither party will be responsible for any failure or delay in its performance under the Agreement (except for the payment of money) due to causes beyond its reasonable control, including labor disputes, strikes, lockouts, shortages of or inability to obtain labor, energy, raw materials or supplies, war, acts of terror, riot, acts of God or governmental action. A party invoking this clause shall provide the other party with prompt written notice of any delay or failure to perform that occurs by reason of a force majeure event. If the force majeure event continues for a period of ten (10) days, the party unaffected by the force majeure event may terminate the Agreement upon notice to the other party.
    • Interpretation. Practice had the opportunity to have counsel of its choice examine the provisions of the Agreement, and no implication shall be drawn against any party by virtue of the drafting of the Agreement.
    • Without Limitation. The words “include”, “includes”, and “including” are not words of limitation and shall be deemed to be followed by the phrase “without limitation”.
    • Authority to Execute. The person agreeing to the Agreement, including these Terms and Conditions, on behalf of Practice warrants that they are duly authorized to accept the Agreement and that by accepting the Terms and Conditions, Practice is formally bound to the Agreement, including these Terms and Conditions. If Practice is comprised of a group of licensed providers, then the signatory warrants that they have the authority to bind each of the providers included in Practice’s roster and Practice agrees that the provisions of the Agreement, including these Terms and Conditions, bind all officers, members or employees of Practice who are similarly licensed and that such providers shall accept, as payment in full for the provision of Services, the reimbursement rates set forth in the Agreement.

Exhibit A

Use Restrictions and Security Requirements

These use restrictions and security requirements are incorporated into the JOYA Health Provider Agreement (“Agreement”) between JOYA Health and Provider, as such requirements may be amended from time to time by JOYA Health.

Practice will not, directly or indirectly:

1. Access or use the Services in any manner except as expressly permitted in the Agreement.
2. Make changes to, create derivative works of, or otherwise modify the Services, in whole or in part.
3. Sell or resell the Services, or rent, lease or loan use of the Services, or otherwise allow any person or entity to use the Services for any purpose other than for the benefit of Practice in accordance with the Agreement.
4. Use the Services in any manner or for any purpose that infringes, misappropriates or violates a third party’s patent, copyright, trademark, trade secret, moral rights or other intellectual property rights, or rights of publicity or privacy, or that violates, or encourages any conduct that would violate, any applicable law or regulation or would give rise to civil liability.
5. Use the Services to develop, commercialize, license or sell any product, service or technology that could, directly or indirectly, compete with the Services.
6. Post, upload, publish, submit or transmit through the Services any information, data, or content that: (i) infringes, misappropriates or violates a third party’s patent, copyright, trademark, trade secret, moral rights or other intellectual property rights, or rights of publicity or privacy; (ii) violates, or encourages any conduct that would violate, any applicable law or regulation or would give rise to civil liability; (iii) is fraudulent, false, misleading or deceptive; (iv) is defamatory, obscene, pornographic, vulgar or offensive; or (v) promotes illegal or harmful activities or substances.
7. Use, display, mirror or frame the Services or any individual element within the Services, JOYA Health’ name or any other name used by JOYA Health, any JOYA Health trademark, logo or other proprietary information, or the layout and design of any page or form contained on a page, without JOYA Health’ express written consent.
8. Access, tamper with, or use non-public areas of the Services, JOYA Health’ computer systems, or the technical delivery systems of JOYA Health’ providers.
9. Attempt to probe, scan or test the vulnerability of any JOYA Health system or network or breach any security or authentication measures.
10. Avoid, bypass, remove, deactivate, impair, descramble or otherwise circumvent any technological measure implemented by JOYA Health or any of JOYA Health’ providers or any other third party (including another user) to protect the Services.
11. Attempt to access or search the Services or download content from the Services using any engine, software, tool, agent, device or mechanism (including spiders, robots, crawlers, data mining tools or the like) other than the software and search agents provided by JOYA Health or other generally available third-party web browsers.
12. Use any meta tags or other hidden text or metadata utilizing a JOYA Health trademark, logo URL or product name without JOYA Health’ express written consent.
13. Forge any TCP/IP packet header or any part of the header information in any email or newsgroup posting, or in any way use the Services to send altered, deceptive or false source-identifying information.
14. Violate any applicable law or regulation.
15. Encourage or enable any other person or entity (including any User) to do any of the foregoing.

Exhibit B

Business Associate Agreement

This Business Associate Agreement (“BAA”) is entered into between Practice and JOYA Health, forms part of the Agreement, and is effective on the same date as the Agreement. Capitalized terms not defined herein will have the meaning set forth in the Agreement.

1. Definitions

The following terms used in this BAA will have the same meaning as those terms in the HIPAA Rules: Breach, Data Aggregation, Designated Record Set, Disclosure, Health Care Operations, Individual, Minimum Necessary, Notice of Privacy Practices, Protected Health Information, Required By Law, Secretary, Security Incident, Subcontractor, Unsecured Protected Health Information, and Use. In addition, the following definitions apply:

• “Business Associate” will generally have the same meaning as the term “Business Associate” at 45 CFR 160.103, and in reference to the party to this BAA, will mean JOYA Health.
• “Covered Entity” will generally have the same meaning as the term “Covered Entity” at 45 CFR 160.103, and in reference to the party to this BAA, will mean Practice.
• “HIPAA Rules” will mean the Privacy, Security, Breach Notification, and Enforcement Rules at 45 CFR Part 160 and Part 164.

2. Obligations and Activities of Business Associate

Business Associate agrees to:

• Not Use or disclose Protected Health Information (“PHI”) other than as permitted or required by the BAA or as Required By Law;
• Use appropriate safeguards, and comply with Subpart C of 45 CFR Part 164 with respect to electronic PHI, designed to prevent Use or Disclosure of PHI other than as provided for by the BAA;
• Report to Covered Entity any Use or Disclosure of PHI not provided for by the BAA of which it becomes aware, including Breaches of Unsecured Protected Health Information, as required at 45 CFR 164.410, and any Security Incident of which it becomes aware;
• In accordance with 45 CFR 164.502(e)(1)(ii) and 164.308(b)(2), if applicable, ensure that any Subcontractors that create, receive, maintain, or transmit PHI on behalf of Business Associate agree to restrictions, conditions, and requirements that are consistent with those that apply to Business Associate under this BAA with respect to such information;
• Within fifteen (15) business days of a written request from Covered Entity, make any PHI in a Designated Record Set available to the Covered Entity as necessary to satisfy Covered Entity’s obligations under 45 CFR 164.524;
• Within fifteen (15) business days of a written request from Covered Entity, make any amendment(s) to PHI in a Designated Record Set as directed or agreed to by the Covered Entity pursuant to 45 CFR 164.526, or take other measures as necessary to satisfy Covered Entity’s obligations under 45 CFR 164.526;
• Maintain and, within fifteen (15) business days of a written request from Covered Entity, make available the information required to provide an accounting of Disclosures to the Covered Entity as necessary to satisfy Covered Entity’s obligations under 45 CFR 164.528;
• To the extent that Business Associate is to carry out one or more of Covered Entity’s obligation(s) under Subpart E of 45 CFR Part 164, comply with the requirements of Subpart E that apply to the Covered Entity in the performance of such obligation(s); and
• Make its internal practices, books, and records available to the Secretary for purposes of determining compliance with the HIPAA Rules.

3. Permitted Uses and Disclosures by Business Associate
   • Business Associate may only Use or disclose PHI as specified in this BAA or as necessary to perform the Services provided under the Agreement between the parties.
   • Business Associate may Use or disclose PHI as Required By Law.
   • Covered Entity hereby grants to Business Associate an irrevocable, non-exclusive, royalty-free, worldwide license to: (i) use any such PHI to create de-identified information in accordance with 45 C.F.R. § 164.514(b) that will remain the exclusive property of JOYA Health; and (ii) combine any such PHI disclosed by Covered Entity to Business Associate with the PHI of other covered entities received by Business Associate in its capacity as a business associate of those other covered entities, to permit data analyses that relate to the health care operations of the respective covered entities (Data Aggregation).
   • Business Associate may ask patients for their authorization or consent for the collection, use, and sharing of their PHI for Business Associate’s purposes or other purposes. Any information that is provided or made available by the patient pursuant to such authorization or consent is no longer PHI and is not subject to the Agreement (including this BAA).
   • Business Associate agrees to make Uses and Disclosures and requests for PHI consistent with the Minimum Necessary policies and procedures required by HIPAA.
   • Business Associate may provide Data Aggregation services relating to the Health Care Operations of the Covered Entity.
   • Business Associate may not Use or disclose PHI in a manner that would violate Subpart E of 45 CFR Part 164 if done by Covered Entity, except for the specific Uses and Disclosures set forth below.
     • Business Associate may Use PHI for the proper management and administration of the Business Associate or to carry out the legal responsibilities of the Business Associate.
     • Business Associate may disclose PHI for the proper management and administration of Business Associate or to carry out the legal responsibilities of the Business Associate, provided the Disclosures are Required By Law, or Business Associate obtains reasonable assurances from the person to whom the information is disclosed that the information will remain confidential and Used or further disclosed only as Required By Law or for the purposes for which it was disclosed to the person, and the person notifies Business Associate of any instances of which it is aware in which the confidentiality of the information has been Breached.
   • Covered Entity will notify Business Associate of any limitation(s) in the Notice of Privacy Practices of Covered Entity under 45 CFR 164.520, to the extent that such limitation may affect Business Associate’s Use or Disclosure of PHI.
   • Covered Entity will notify Business Associate of any changes in, or revocation of, the permission by an Individual to Use or disclose his or her PHI, to the extent that such changes may affect Business Associate’s Use or Disclosure of PHI.
   • Covered Entity will notify Business Associate of any restriction on the Use or Disclosure of PHI that Covered Entity has agreed to or is required to abide by under 45 CFR 164.522, to the extent that such restriction may affect Business Associate’s Use or Disclosure of PHI.
4. Permissible Requests by Covered Entity

Covered Entity will not request Business Associate to Use or disclose PHI in any manner that would not be permissible under Subpart E of 45 CFR Part 164 if done by Covered Entity.

5. Termination
   • Obligations of Business Associate Upon Termination. Upon termination of this BAA for any reason, Business Associate, with respect to PHI received from Covered Entity, or created, maintained, or received by Business Associate on behalf of Covered Entity, will:
     • Retain only that PHI which is necessary for Business Associate to continue its proper management and administration or to carry out its legal responsibilities;
     • Return to Covered Entity or destroy, if feasible, the remaining PHI that the Business Associate still maintains in any form;
     • Continue to Use appropriate safeguards and comply with Subpart C of 45 CFR Part 164 with respect to electronic PHI to prevent Use or Disclosure of the PHI, other than as provided for in this Section, for as long as Business Associate retains the PHI;
     • Not Use or disclose the PHI retained by Business Associate other than for the purposes for which such PHI was retained and subject to the same conditions set out herein which applied prior to termination; and
     • Return to Covered Entity or, if agreed to by Covered Entity, destroy the PHI retained by Business Associate when it is no longer needed by Business Associate for its proper management and administration or to carry out its legal responsibilities.

6. Miscellaneous
   • Regulatory References. A reference in this BAA to a section in the HIPAA Rules means the section as in effect or as amended.
   • Amendment. The Parties agree to take such action as is necessary to amend this BAA from time to time as is necessary for compliance with the requirements of the HIPAA Rules and any other applicable law.
   • Interpretation. Any ambiguity in this BAA will be interpreted to permit compliance with the HIPAA Rules.