Business Associate Agreement

Version 1.0 · Effective October 21, 2026 · Multos Annos, Inc. d/b/a LongevityGraph

This Business Associate Agreement (“Agreement”) is between Multos Annos, Inc. d/b/a LongevityGraph (“Business Associate”) and the health care practice that accepts it (“Covered Entity”).

Covered Entity accepts this Agreement electronically when its Account Owner checks the acceptance box in the LongevityGraph EMR. Business Associate records the accepting user, practice, date and time, IP address and the version accepted. This Agreement is incorporated into the LongevityGraph Provider Terms of Service. If the two conflict on Protected Health Information, this Agreement controls.

1. Definitions

Terms used but not defined here have the meanings given in the HIPAA Rules (45 CFR Parts 160 and 164), including Breach, Data Aggregation, Designated Record Set, Disclosure, Health Care Operations, Individual, Minimum Necessary, Notice of Privacy Practices, Required by Law, Secretary, Security Incident, Subcontractor, Unsecured Protected Health Information and Use.

“HIPAA Rules” means the Privacy, Security, Breach Notification and Enforcement Rules at 45 CFR Parts 160 and 164, as amended.
“Protected Health Information” or “PHI” has the meaning in 45 CFR 160.103, limited to PHI that Business Associate creates, receives, maintains or transmits on behalf of Covered Entity. It includes electronic PHI.
“Services” means the LongevityGraph EMR and related services provided under the Provider Terms of Service.

2. Permitted uses and disclosures

Services. Business Associate may use and disclose PHI to provide the Services to Covered Entity, as described in the Provider Terms of Service.
Required by law. Business Associate may use and disclose PHI as Required by Law.
Our own management. Business Associate may use PHI for its proper management and administration and to carry out its legal responsibilities. It may disclose PHI for these purposes only if the disclosure is Required by Law, or it obtains reasonable written assurances that the recipient will keep the PHI confidential, use or disclose it only as Required by Law or for the purpose it was disclosed, and report any breach of confidentiality it learns of.
De-identification. Business Associate may de-identify PHI in accordance with 45 CFR 164.514(a)–(c) and may use and disclose de-identified information for any lawful purpose.
Data aggregation. Business Associate may use PHI to provide Data Aggregation services relating to the Health Care Operations of Covered Entity, as permitted by 45 CFR 164.504(e)(2)(i)(B).
Minimum necessary. Business Associate will limit its uses, disclosures and requests of PHI to the minimum necessary, consistent with Covered Entity’s minimum-necessary policies.
Limits. Business Associate will not use or disclose PHI in a way that would violate Subpart E of 45 CFR Part 164 if done by Covered Entity, except as allowed in items 3, 4 and 5. Business Associate will not sell PHI or use it for marketing, and will not use PHI to train general-purpose AI models.

3. Safeguards

Business Associate will use appropriate safeguards, and comply with Subpart C of 45 CFR Part 164 (the Security Rule) with respect to electronic PHI, to prevent use or disclosure of PHI other than as this Agreement allows.

4. Reporting breaches and security incidents

What we report. Business Associate will report to Covered Entity any use or disclosure of PHI not allowed by this Agreement, any Breach of Unsecured PHI as required by 45 CFR 164.410, and any Security Incident it becomes aware of.
When. Without unreasonable delay and no later than 10 business days after discovery. A Breach is treated as discovered on the first day it is known, or by exercising reasonable diligence would have been known, to Business Associate.
What the report includes. To the extent known: the identity of each affected Individual, a description of what happened, the dates of the event and its discovery, the types of PHI involved, and the steps taken to investigate and mitigate. Business Associate will add information as it becomes available.
Unsuccessful attempts. This section is notice, given now and ongoing, of unsuccessful Security Incidents that do not result in unauthorized access, use or disclosure of PHI, such as pings, port scans, blocked log-in attempts and denial-of-service attempts. No further notice of these is required.
Mitigation and cooperation. Business Associate will take reasonable steps to mitigate, to the extent practicable, harmful effects it knows of, and will reasonably cooperate with notices Covered Entity is required to give.
Notice costs. If a Breach results from Business Associate’s breach of this Agreement, Business Associate will reimburse Covered Entity’s reasonable, documented out-of-pocket costs of the notices that the HIPAA Rules or state breach-notification law require, up to the total fees Covered Entity paid Business Associate in the 12 months before the Breach. This is Business Associate’s only obligation to pay Covered Entity’s costs of responding to a Breach.

5. Subcontractors

Under 45 CFR 164.502(e)(1)(ii) and 164.308(b)(2), Business Associate will ensure that any Subcontractor that creates, receives, maintains or transmits PHI on its behalf agrees in writing to the same restrictions, conditions and requirements that apply to Business Associate under this Agreement. Business Associate lists the Subcontractors that handle PHI in its Privacy Policy and keeps that list current.

6. Patient rights

Covered Entity can view, print and correct its patients’ records directly in the Services. Where Covered Entity cannot meet a request itself using the Services, Business Associate will, on Covered Entity’s written request:

Access. make PHI in a Designated Record Set available to Covered Entity in time for Covered Entity to meet 45 CFR 164.524;
Amendment. make amendments to PHI in a Designated Record Set as Covered Entity directs, in time for Covered Entity to meet 45 CFR 164.526;
Accounting of disclosures. provide information about the disclosures of PHI Business Associate has made that require an accounting, in time for Covered Entity to meet 45 CFR 164.528. Business Associate will document those disclosures.

If an Individual asks Business Associate directly for access, amendment or an accounting, Business Associate will forward the request to Covered Entity within 10 business days.

7. Other Business Associate obligations

Where Business Associate carries out an obligation Covered Entity has under Subpart E of 45 CFR Part 164, it will comply with the requirements of Subpart E that apply to Covered Entity in performing it.
Business Associate will make its internal practices, books and records relating to PHI available to the Secretary of HHS to determine compliance with the HIPAA Rules.

8. Practice obligations

Covered Entity will:

tell Business Associate of any limitation in its Notice of Privacy Practices, any change or revocation of an Individual’s permission, and any restriction it agrees to under 45 CFR 164.522, to the extent it affects Business Associate’s use or disclosure of PHI;
obtain any consent or authorization required for the Services it directs, including messaging patients and using AI-assisted features;
not ask Business Associate to use or disclose PHI in any way that would not be permitted under Subpart E of 45 CFR Part 164 if done by Covered Entity, except as allowed in Section 2;
be responsible for disclosures that it or its Users direct through the Services, including messages to patients, orders and results exchanged with laboratories and pharmacies, and third-party systems Covered Entity chooses to connect. These disclosures are made on Covered Entity’s instruction, and Business Associate is not responsible for how a recipient handles PHI after delivery;
keep its own copy of its records for as long as law requires it to. The Services are not a records-retention archive after this Agreement ends.

9. Term and termination

Term. This Agreement starts when Covered Entity accepts it and continues while the Provider Terms of Service are in effect, then until all PHI is returned or destroyed under item 3.
Termination for cause. If either party materially breaches this Agreement, the other may give written notice. If the breach is not cured within 30 days, the non-breaching party may terminate this Agreement and the Provider Terms of Service.
Return or destruction. When this Agreement ends, Business Associate will make Covered Entity’s PHI available for export, in an electronic format Business Associate reasonably chooses, for 60 days, then destroy it, retaining no copies except as item 4 allows. Copies in encrypted backups are destroyed as those backups expire on Business Associate’s normal schedule.
Where return or destruction is not feasible. For PHI that cannot feasibly be returned or destroyed (for example, data in backups before they expire, or audit records Business Associate must keep by law), Business Associate will extend this Agreement’s protections to it and limit further uses and disclosures to the purposes that make return or destruction infeasible.
Survival. Business Associate’s obligations under this section survive termination.

10. General terms

Patient accounts. Information an Individual gives Business Associate through their own LongevityGraph account, outside Covered Entity’s practice, is governed by Business Associate’s Privacy Policy and its agreement with that Individual, not by this Agreement, until the Individual shares it into Covered Entity’s chart.
Changes in law. Business Associate may update this Agreement as needed to comply with changes in the HIPAA Rules. It will post the new version and ask Covered Entity to accept it in the EMR.
Interpretation. Any ambiguity is resolved in favor of a meaning that complies with the HIPAA Rules. A reference to a section of the HIPAA Rules means that section as in effect or amended.
Independent contractor. Business Associate is an independent contractor and not an agent of Covered Entity.
Limitation of liability. Each party’s liability under this Agreement is subject to the limitation of liability in the Provider Terms of Service. The only exception is the notice-cost reimbursement in Section 4, which is capped as stated there.
No third-party beneficiaries. Nothing in this Agreement gives any right to anyone other than the parties.
Governing law. Texas law governs, except where federal law controls.

Business Associate: Multos Annos, Inc. d/b/a LongevityGraph, by Rob Davis, Founder. Covered Entity: accepted electronically by its Account Owner, as recorded in the EMR.

Questions about this Agreement: [email protected]