Last updated: October 23, 2026
This Business Associate Agreement (“BAA”) is between Integrated Media Partners, LLC DBA: CLIKdata, a Florida limited liability company (“Business Associate”), and the customer identified in the Order Form or electronic acceptance record expressly incorporating this BAA (“Customer”). It becomes effective upon execution by both parties or completion of a mutually binding electronic acceptance process identifying Customer and this BAA version. Publication or viewing of this page alone does not constitute acceptance.
CLIKmed, CLIKsearch, CLIKAI, and app.CLIKdata.com are product or platform names provided by Integrated Media Partners, LLC DBA: CLIKdata, not separate parties to this BAA. Customer acts as a HIPAA covered entity or a business associate engaging Business Associate as its subcontractor, as identified in its Order Form. The Subscription Terms and Master Service Agreement, and the applicable Order Form constitute the “Service Agreement.”
1 Definitions and covered services
1.1. “HIPAA Rules” means the applicable Privacy, Security, Breach Notification, and Enforcement Rules at 45 C.F.R. Parts 160 and 164, as amended. Terms not otherwise defined, including Breach, Covered Entity, Designated Record Set, Individual, Protected Health Information, Required By Law, Security Incident, Subcontractor, Unsecured Protected Health Information, Use, and Disclosure, have the meanings assigned by the HIPAA Rules. “PHI” includes electronic PHI and is limited to information Business Associate creates, receives, maintains, or transmits on Customer’s behalf.
1.2. This BAA covers only CLIKmed and other accounts, features, and integrations expressly designated in the accepted Order Form or written service designation for PHI processing (“Covered Services”). Identifying a product in this BAA does not authorize PHI processing through that product. The non-medical platform at app.CLIKdata.com is not a Covered Service unless expressly designated in writing and the required safeguards and agreements are in place. Payment processing through that platform does not establish PHI-processing authorization.
1.3. Before PHI processing begins, the parties must identify the Covered Services and establish the required safeguards and provider agreements. No feature designation may authorize processing inconsistent with an underlying provider’s applicable BAA or technical restrictions. This BAA does not certify Customer’s overall compliance or establish that every available feature is suitable for PHI.
2 Permitted and prohibited uses
2.1. Business Associate may Use or Disclose PHI only as necessary to perform the Covered Services, as expressly permitted by this BAA, or as Required By Law. Except for the limited management and administration activities permitted below, it may not Use or Disclose PHI in a manner that would violate the Privacy Rule if performed by Customer as a Covered Entity. Applicable minimum-necessary requirements apply to requests, Uses, and Disclosures.
2.2. Business Associate may Use PHI for its proper management and administration or legal responsibilities. Disclosure for those purposes is permitted only if Required By Law or if the recipient provides reasonable assurances that it will maintain confidentiality, Use or further Disclose the information only as Required By Law or for the stated purpose, and report confidentiality breaches of which it becomes aware. This provision does not replace a required Subcontractor BAA.
2.3. Business Associate may not sell PHI, Use it for independent advertising or fundraising, or use it to train general-purpose AI models. Customer-directed communications involving PHI may be performed only through Covered Services and with legally required permissions or authorizations. Technical availability of an integration does not establish legal permission to send PHI to it.
2.4. Data aggregation across customers or de-identification of PHI for independent purposes requires a separate written agreement specifying the permitted purpose and complying with HIPAA. No general product-improvement or data-license provision expands the permitted Uses under this BAA. Customer retains its rights in PHI, subject to Individuals’ rights under applicable law.
3 Safeguards and reporting
3.1. Business Associate will implement appropriate administrative, physical, and technical safeguards to prevent impermissible Uses or Disclosures and comply with applicable Security Rule requirements in 45 C.F.R. Part 164, Subpart C for electronic PHI. It will maintain required workforce controls, policies, risk-management measures, and documentation appropriate to its obligations.
3.2. Business Associate will report to Customer impermissible Uses or Disclosures, Breaches of Unsecured PHI, and Security Incidents of which it becomes aware, without unreasonable delay and no later than five calendar days after discovery, or sooner where applicable law requires. Discovery is determined under applicable HIPAA standards, including 45 C.F.R. § 164.410(a). Initial notice will not be delayed pending completion of an investigation.
3.3. Initial notice will describe available facts and affected Services. Business Associate will promptly supplement it with information as it becomes available, including affected Individuals, the nature of PHI involved, relevant dates, mitigation and corrective actions, and information reasonably needed for Customer’s legally required notifications. Business Associate will reasonably cooperate in investigation and mitigation and mitigate harmful effects known to it to the extent practicable.
3.4. The parties acknowledge routine unsuccessful attempts, such as blocked network probes, port scans, and unsuccessful login attempts, that do not result in unauthorized access, Use, Disclosure, modification, or destruction of PHI or material interference with PHI systems. This paragraph constitutes notice of the occurrence of those routine unsuccessful incidents; separate event reports are not required unless Customer reasonably requests further information. Successful incidents, material interruptions, suspected impermissible PHI access, and reportable Breaches remain subject to Section 3.2. This acknowledgment does not eliminate safeguard or investigation obligations.
3.5. Customer remains responsible for notifications to Individuals, regulators, and the media for which Customer is legally responsible unless otherwise agreed in writing. Business Associate remains responsible for its own legally required notices and cooperation. Any legally authorized law-enforcement delay under 45 C.F.R. § 164.412 applies where required.
4 Subcontractors
Business Associate will ensure that each Subcontractor creating, receiving, maintaining, or transmitting PHI on its behalf enters into an appropriate written agreement imposing the same applicable restrictions, conditions, and requirements concerning PHI, including applicable Security Rule obligations. Business Associate will take reasonable steps to cure or end a known material Subcontractor violation and, if unsuccessful, terminate the affected arrangement if feasible, consistent with HIPAA. Use of a Subcontractor does not eliminate Business Associate’s obligations under this BAA.
5 Individual rights and regulatory access
5.1. Access. To the extent Business Associate maintains PHI in a Designated Record Set, it will make PHI available to Customer as necessary to meet 45 C.F.R. § 164.524. Business Associate will respond promptly, ordinarily within ten business days after a request, or sooner where reasonably necessary to meet an applicable legal deadline identified by Customer. Electronic information will be supplied in a readily producible format as required by law. Required PHI access will not be withheld because of a payment dispute.
5.2. Amendment. Business Associate will make PHI in a Designated Record Set available for amendment and incorporate amendments as directed or agreed by Customer under 45 C.F.R. § 164.526. It will act promptly, ordinarily within ten business days after instructions, or sooner where reasonably necessary to meet an identified legal deadline.
5.3. Accounting. Business Associate will maintain information needed for accountings of Disclosures under 45 C.F.R. § 164.528 for the legally required period and provide it promptly, ordinarily within ten business days after a request, or sooner where reasonably necessary to meet an identified legal deadline.
5.4. Direct requests. Business Associate will forward an Individual’s request for access, amendment, or accounting to Customer promptly and no later than five business days after receipt unless earlier action is legally required. Business Associate will not independently deny such a request on Customer’s behalf unless expressly authorized and legally permitted.
5.5. Delegated obligations and HHS access. To the extent Business Associate performs Customer’s obligations under the Privacy Rule, it will comply with the requirements applicable to those obligations. It will make relevant internal practices, books, and records available to the Secretary of the United States Department of Health and Human Services for determining HIPAA compliance.
6 Customer responsibilities
Customer will obtain required permissions and authorizations, maintain legally compliant notices, and promptly inform Business Associate of restrictions or revoked permissions affecting Covered Services. Customer will not request unlawful Uses or Disclosures. Customer must manage its Users, access controls, devices, workflows, and integrations appropriately and must not submit PHI to unapproved AI tools, public review responses, advertising audiences, social platforms, or other unapproved channels. Each party remains responsible for its own legal obligations. Additional restrictions applicable to specially protected records require the necessary additional terms and safeguards before processing; this BAA alone does not authorize otherwise prohibited processing.
7 Term and termination
7.1. This BAA remains effective while Business Associate processes PHI for Customer and thereafter as necessary to protect retained PHI under Section 8.
7.2. Customer may terminate this BAA and affected Covered Services if Business Associate materially violates this BAA. Where cure is feasible and continued processing is lawful, Customer may provide written notice and a reasonable cure period not exceeding 30 calendar days. Customer may terminate immediately if cure is infeasible, the breach is not timely cured, or immediate termination is legally required. The Service Agreement’s ordinary subscription commitment and cancellation provisions do not restrict this right.
7.3. If Business Associate knows of a material Customer violation affecting lawful performance, it will notify Customer and take reasonable steps to end the violation. If lawful performance cannot continue, Business Associate may suspend or terminate affected Services while meeting applicable PHI-protection and transition obligations.
8 Return destruction and retention
8.1. Upon termination of Covered Services or this BAA, Business Associate will return PHI to Customer or, as directed or agreed by Customer, destroy PHI maintained by it or its Subcontractors in any form, where feasible. PHI will be returned in a reasonably accessible format. Business Associate will retain no copies except as permitted below or Required By Law and will provide written confirmation of completed destruction upon reasonable request.
8.2. Where return or destruction of particular PHI is infeasible or retention is legally required, Business Associate will inform Customer of the basis, retain only necessary PHI, continue this BAA’s protections, and limit further Use or Disclosure to the purposes requiring retention or making return or destruction infeasible. Backup limitations do not authorize ordinary operational use of retained PHI. Retained PHI will be returned or destroyed when the basis for retention ends and doing so becomes feasible.
8.3. General deletion periods and payment conditions do not override this Section or legally protected access rights. These obligations survive termination for as long as PHI is retained.
9 Relationship to the Service Agreement
9.1. This BAA is incorporated into the Service Agreement and controls conflicts concerning PHI or HIPAA duties, including content licenses, confidentiality, security, suspension, retention, deletion, and termination. No Order Form, website policy, or fee schedule may override mandatory HIPAA duties.
9.2. Except as this BAA expressly provides otherwise, the Service Agreement’s commercial terms and contractual allocation of liability continue to apply to the extent lawful. No limitation restricts government enforcement, mandatory statutory duties, or liability that cannot lawfully be limited. This BAA creates no separate indemnity and does not guarantee a clinical or regulatory outcome.
9.3. The Service Agreement’s Florida law and venue provisions apply, subject to controlling federal law. Nothing grants a right to direct unlawful processing, prevents legally required disclosures, creates third-party contractual enforcement rights, or eliminates Individuals’ statutory rights.
10 Notices amendments and acceptance
10.1. Incident notices must be sent to Customer’s designated privacy or security contact in its Order Form or account record, with reasonable additional contact efforts for urgent incidents. Customer may send BAA notices to [email protected] and any separately designated privacy or security contact. PHI must not be included through an unapproved notice channel; secure transmission will be arranged as necessary.
10.2. The parties will cooperate in amendments needed for legal compliance. Website revisions do not retroactively modify an accepted BAA. Material amendments require written or electronic agreement identifying the applicable version except where law requires a different result. If compliant performance cannot continue and the parties cannot agree to a necessary amendment, either may terminate affected Covered Services, subject to Section 8.
10.3. Ambiguities will be resolved to permit compliance with HIPAA. Unenforceable provisions will be limited or severed to the extent lawful without impairing required safeguards. This BAA may be executed by signature or affirmative electronic acceptance expressly identifying Customer, the Covered Services and account, Customer’s HIPAA role, the applicable BAA version and effective date, and authorized acceptance by the parties. Ordinary subscription acceptance that does not incorporate this BAA is insufficient.