1. Who these terms are for, and what they do#

These terms govern your use of the Narbis Platform with your own clients or patients. They apply to Edge Pro, to NeuroPro, and to any other Narbis product or service you use in a professional capacity.

They are an agreement between you, the Practitioner, and Narbis, Corp., a Delaware corporation ("Narbis", "we", "us" or "our").

If you bought a Narbis product for your own personal use and are not using it with clients or patients, these terms do not apply to you. The Narbis Subscription Terms of Service and the Narbis Privacy Policy apply instead.

Read the section titled "HIPAA and the Business Associate Agreement" carefully. Where you are a covered entity, the Business Associate Agreement at Appendix B becomes binding between us automatically, with no separate signature and no request required.

2. Definitions#

"Neural Data" means information generated by measuring the activity of your central or peripheral nervous system, and that is not inferred from nonneural information. For Narbis this means the electroencephalographic (EEG) signal recorded by the Smart Glasses or by a compatible EEG headband, together with the frequency band values computed directly from that signal.

"Cardiac Data" means the photoplethysmographic (PPG) or electrocardiographic signal recorded by the Narbis ear clip or by a compatible heart rate sensor, the interbeat intervals derived from it, and heart rate variability values computed from those intervals.

"Derived Metrics" means the scores, indices, states and summaries that we compute from Neural Data or Cardiac Data, including coherence scores, engagement or focus indices, reward rate, session summaries and longitudinal trends.

"Neurophysiological Data" means Neural Data, Cardiac Data and Derived Metrics together.

"End User" means an individual whose Neurophysiological Data is collected through your use of the Platform. Your client or your patient.

"End User Data" means the personal information, health information, Neurophysiological Data, session and adherence records, questionnaire and assessment responses, and other information of an End User collected or generated through the Platform.

"Platform" means the Narbis practitioner facing dashboard and its associated cloud services, including live session viewing, protocol assignment, progress and adherence tracking, questionnaires and continuous performance tests, regional survey and band analysis, analytics and reports, data export, and the client roster.

"Sensor Device" means any Narbis or third party device that measures Neurophysiological Data for use with the Platform, including the Smart Glasses, Narbis Edge, the Narbis ear clip, and compatible third party EEG headbands and heart rate sensors.

"Apps" means the Narbis applications for iOS, watchOS, Android and the web.

"Covered Entity", "Business Associate", "Protected Health Information" and "PHI" have the meanings given to them in the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations at 45 C.F.R. Parts 160 and 164.

3. Eligibility and your professional standing#

You represent, on entering into these terms and on each occasion you use the Platform, that:

a. you are aged 18 or over and have authority to bind the practice or organization on whose behalf you are acting;

b. you hold every licence, registration, certification and professional qualification required for the services you provide in every jurisdiction where you provide them;

c. your use of the Platform is within your professional scope of practice; and

d. you will comply with all laws, professional rules and codes of ethics that apply to you, including those governing informed consent, record keeping, supervision and telehealth.

Narbis does not verify your credentials and does not hold itself out as doing so. Nothing in these terms creates a referral, endorsement, employment, partnership, joint venture or agency relationship between us.

Territories we do not serve. Since 1 October 2026, Narbis does not offer its products or services in the European Economic Area, the United Kingdom or Switzerland, and the Platform is not offered to Practitioners established in one of those territories. The European Economic Area means the 27 member states of the European Union together with Iceland, Liechtenstein and Norway. Switzerland is named separately because it is not part of the European Economic Area and has its own separate representative requirement under its revised data protection act. A Practitioner who held an account before that date may continue to use the Platform, we continue to support them, and their data and their End Users' data run down on the ordinary retention schedule. If Narbis ever decides to serve those territories again, the required representatives and arrangements will be in place before the first account is opened.

4. What the Platform is, and what it is not#

4.1 What it is#

The Platform lets you enrol End Users, assign and remotely update training protocols, watch a session in progress, review Neurophysiological Data and Derived Metrics, administer questionnaires and continuous performance tests, run regional survey and band analysis, track adherence and progress over time, generate reports, and export data.

4.2 What it is not#

THE PLATFORM DOES NOT PROVIDE MEDICAL ADVICE, DIAGNOSIS OR TREATMENT. IT IS NOT A DIAGNOSTIC DEVICE, IS NOT CLEARED OR APPROVED BY THE UNITED STATES FOOD AND DRUG ADMINISTRATION FOR ANY MEDICAL PURPOSE, AND IS NOT A MEDICAL DEVICE.

THE PLATFORM IS NOT A MONITORING, ALERTING OR EMERGENCY RESPONSE SERVICE. IT MUST NOT BE RELIED ON TO DETECT, ESCALATE OR RESPOND TO ANY CLINICAL EVENT, DETERIORATION OR EMERGENCY. LIVE SESSION VIEWING SHOWS YOU A SESSION WHEN YOU CHOOSE TO WATCH IT. IT DOES NOT WATCH FOR YOU, AND NO ONE AT NARBIS IS WATCHING.

Any safety flag, alert or indicator in the Platform is a convenience feature based on thresholds and adherence patterns. It is not a clinical judgment, it may not fire, and its absence means nothing.

4.3 Clinical responsibility is yours#

You remain responsible at all times for the assessment, diagnosis, treatment, supervision and care of your End Users. Data the Platform provides to you is informational. Deciding what it means, what to do about it and whether the Platform is appropriate for a given End User is your professional judgment, and it cannot be delegated to us or to the software.

You are responsible for determining whether a Narbis product is suitable for each End User, for screening for contraindications, for reviewing the Hardware Warnings and Safety Information with them, and for supervising use where supervision is appropriate.

5. Your obligations to your End Users#

This section is the heart of the arrangement, because you are the party with the relationship.

5.1 Consent and notice#

Before enrolling an End User you will:

a. obtain their informed consent, and the consent of a parent or legal guardian where the End User is a minor, to the collection and processing of their Neurophysiological Data through the Platform;

b. give them the Narbis document titled "Privacy Notice for End Users, Practitioner Context", or incorporate its substance into your own notice;

c. tell them what will be collected, why, who will see it and for how long it will be kept; and

d. obtain any additional consent, authorization or notice your own professional rules and local law require.

You may not enrol an End User who has not consented. Where consent is withdrawn you will stop collection promptly and tell us if deletion is required.

5.2 Minors#

Where an End User is a minor, a parent or legal guardian must consent. Where the End User is under 13, that consent must satisfy verifiable parental consent requirements. Where the End User is in the European Economic Area or the United Kingdom and is under the age of digital consent in their country, which ranges from 13 to 16, consent must come from the holder of parental responsibility. The minimum age for use of any Narbis product is 6.

You are responsible for verifying that an End User meets the age requirement of every device used in the session, including any compatible third party sensor. A third party sensor is subject to its own manufacturer's minimum age requirement, which may be higher than the Narbis minimum, and where it is higher, that higher age applies to use of that device. You may not enrol an End User below a manufacturer's minimum age for a device you intend to use with them.

5.3 Accuracy and access hygiene#

You will keep your roster accurate, remove End Users who are no longer in your care, keep your credentials secure, use individual accounts rather than shared logins for each member of your personnel, and revoke access promptly when someone leaves. You are responsible for everything done under your account.

5.4 Emotion and attention inference notice#

Where the Platform infers an affective or attentional state, you are the deployer of that system for the purposes of Article 50(3) of the European Union Artificial Intelligence Act and you must inform the people exposed to it of its operation. This applies to End Users in the European Union. We supply notification materials you can use. Using them does not transfer the obligation, which remains yours.

Separately, and importantly: deploying an emotion inference system in a workplace or an education institution is a prohibited practice in the European Union under Article 5(1)(f) of that Act, outside narrow medical and safety exceptions. If you intend to use the Platform in a school, a university or an employer wellness program with participants in the European Union, obtain your own legal advice before you do. Framing it as wellness does not satisfy the exception.

Why these two paragraphs stay, given that Narbis does not serve those territories. They are retained deliberately, and they are not dead text. They would apply directly if Narbis ever offered the Platform in the European Economic Area, the United Kingdom or Switzerland, and they can apply to you now even though we do not sell there, because a Practitioner established somewhere we do serve may have an End User who is in one of those territories. The Act follows the person exposed to the system, not only the place where the account was opened. Read both paragraphs as applying to any End User of yours who is in the European Union, wherever your own practice is established.

6. HIPAA and the Business Associate Agreement#

6.1 Not every Practitioner is a covered entity#

This matters, and it is widely misunderstood.

A licensed clinician who transmits health information electronically in connection with a transaction covered by HIPAA, such as billing a health plan, is generally a Covered Entity. A performance coach, breathwork practitioner, trainer or wellness professional who does not conduct those transactions generally is not, even though they may be using the same Platform with the same hardware.

If you are not a Covered Entity, there is no Protected Health Information in your use of the Platform and no Business Associate Agreement is required or created. Your End Users are still protected by everything else in these terms, by the practitioner Privacy Notice, and by the state consumer health data laws, which apply regardless of HIPAA.

6.2 Where you are a covered entity, the BAA applies automatically#

Where you are a Covered Entity, or are yourself a Business Associate of a Covered Entity, then in creating, receiving, maintaining or transmitting Protected Health Information on your behalf Narbis is your Business Associate, and the Business Associate Agreement at Appendix B to these terms is binding between us from the moment you first use the Platform.

No signature is required. No request is required. There is no sales process to go through and no separate document to negotiate before you can start. If you need a countersigned copy for your own compliance file, write to info@narbis.com and we will provide one.

If your organization requires a materially different BAA, write to info@narbis.com before enrolling any End User.

6.3 Your HIPAA obligations#

You will obtain any authorization, and provide any notice of privacy practices, that HIPAA requires. You will not request that Narbis use or disclose PHI in a way that would not be permitted if done by you. You will tell us of any restriction on use or disclosure, and of any revocation of an authorization, to the extent it affects our processing.

6.4 Part 2 programs#

If you are a program subject to 42 C.F.R. Part 2, tell us before enrolling any End User, so that the additional restrictions on substance use disorder records can be applied.

7. Data#

7.1 Who owns what#

End User Data belongs to the End User, and as between you and Narbis you control it. We do not claim ownership of it.

Narbis owns the Platform, the Apps, the firmware, the algorithms, the Derived Metric definitions and all intellectual property in them. Nothing in these terms transfers any of that to you.

7.2 What Narbis does with End User Data#

We process End User Data to provide the Platform to you, on your instructions, and for no independent purpose of our own, except as set out in the section titled "De-identified data".

Specifically, and this is a commitment not a description:

• We do not sell End User Data. Ever, to anyone, for any consideration.
• We do not use End User Data for advertising, and we do not share it with advertising networks or data brokers.
• We do not use identifiable End User Data to train models or to develop products.
• We access it only where necessary to deliver the service, to support you, or to investigate a security or integrity issue, under access controls and confidentiality obligations, and we log that access.

7.3 De-identified data#

We may de-identify End User Data and use the de-identified result to improve the Platform, to develop new features and for research.

De-identification is carried out to the standard at 45 C.F.R. 164.514, by Safe Harbor or by Expert Determination. We commit not to attempt re-identification, and to bind any recipient of de-identified data to the same prohibition.

We are stating this openly rather than burying it, because a bare grant of de-identification rights is where a lot of value quietly changes hands in this industry. If you or your professional body object to de-identified use, tell us at info@narbis.com and we will exclude your practice.

7.4 Separation of estates#

The practitioner data estate is kept logically and contractually separate from the Narbis direct to consumer data estate. PHI and End User Data do not flow into the consumer data set, and consumer data does not flow into the business associate environment.

7.5 Export and portability#

You can export End User Data through the Platform's export function, in a machine readable format, at any time during your subscription and for 30 days after it ends. Export is a product feature, not a concession, and we will not hold your data hostage to a renewal.

7.6 Retention and deletion#

We retain End User Data as follows, except where you instruct otherwise or where PHI is governed by Appendix B:

You can delete an End User's data at any time from the Platform. Deletion propagates to backups within 35 days.

7.7 Security#

We maintain administrative, physical and technical safeguards appropriate to the sensitivity of the data, including encryption in transit and at rest, multi factor authentication on administrative access, access controls, logging, monitoring, an annual risk analysis and a documented incident response process, and we require our subprocessors to do the same under written agreement. Where we are your Business Associate we comply with the HIPAA Security Rule and are directly liable for doing so.

7.8 Incidents#

We will notify you without undue delay, and in any event within 5 business days of determining that a security incident has resulted in unauthorized acquisition, access, use or disclosure of End User Data, and we will give you the information you need to meet your own notification obligations. Where the data is PHI, Appendix B governs and this timeframe applies to it.

8. Fees, billing and term#

8.1 Fees#

Fees are those set out at the point of subscription. Amounts are stated and payable in United States dollars. Onboarding fees are charged once. Dashboard access and per client fees are charged for each billing period in advance.

8.2 Renewal and cancellation#

Subscriptions renew automatically for successive billing periods unless cancelled before the end of the current period. You can cancel from within the Platform, and cancellation is never harder than subscribing was. Cancellation takes effect at the end of the current billing period. Onboarding fees are not refundable once onboarding has been delivered.

8.3 Changes to fees#

We will give at least 30 days notice before a fee change takes effect, and you may cancel before it does.

8.4 Taxes#

Fees are exclusive of taxes. You are responsible for any applicable taxes other than taxes on our income.

8.5 Non payment#

If fees are unpaid we may suspend Platform access after notice and a reasonable opportunity to cure. Suspension for non payment does not remove your right to export End User Data, and we will keep the export function available to you for 30 days.

9. Acceptable use#

You will not:

a. use the Platform with any person who has not consented;

b. use the Platform to make a clinical decision without the involvement of a qualified professional acting within their scope of practice;

c. represent the Platform, or any Narbis product, as a medical device, as diagnostic, or as cleared or approved by any regulator;

d. make any claim about outcomes that is not supported by evidence, or attribute any claim to Narbis that we have not made;

e. reverse engineer, decompile or attempt to derive the source code, algorithms or model weights underlying the Platform;

f. circumvent access controls or sensor pairing, or use automated means to extract data beyond the provided export function;

g. resell, sublicense or provide the Platform to a third party as a service, except to your own End Users in the ordinary course of your practice;

h. share credentials, or allow use of your account by anyone who is not your authorized personnel; or

i. use the Platform in a workplace or education deployment in the European Union in a manner prohibited by Article 5 of the European Union Artificial Intelligence Act.

10. Trademarks and publicity#

You may state factually that you use Narbis products in your practice. You may not use the Narbis name, logo or marks in a way that suggests endorsement, certification or partnership without our prior written consent, and you may not register any confusingly similar mark or domain.

We will not use your name or your practice's name in our marketing without your prior written consent.

11. Availability and support#

We aim to keep the Platform available and will give advance notice of planned maintenance where we reasonably can. We do not commit to a service level or uptime percentage under these terms. If your practice requires a contractual service level, write to info@narbis.com.

Support is provided by email during business hours.

12. Term, suspension and termination#

These terms run from your first use of the Platform until terminated.

Either party may terminate for convenience at the end of a billing period. Either party may terminate immediately for material breach that is not cured within 30 days of notice. We may suspend immediately, with notice as soon as practicable, where necessary to prevent harm to End Users, to protect the security of the Platform, or to comply with law.

On termination your access ends, the export function remains available for 30 days, and PHI is returned or destroyed in accordance with Appendix B. The sections titled "Data", "Indemnity", "Disclaimer of warranties", "Limitation of liability", "Disputes" and "Governing law" survive, together with Appendix B to the extent it provides for survival.

13. Indemnity#

You will defend, indemnify and hold harmless Narbis, its officers, directors, employees and contractors from and against any claim, damage, loss, cost or expense, including reasonable legal fees, arising out of or relating to:

a. your provision of professional services to an End User;

b. your failure to obtain a required consent, authorization or notice;

c. your breach of these terms or of any law or professional rule applicable to you;

d. any claim by an End User or a third party arising from your acts or omissions; or

e. any claim that a representation you made about a Narbis product was inaccurate or unauthorized.

We will defend, indemnify and hold you harmless against any third party claim that the Platform as supplied by us infringes that third party's intellectual property rights.

14. Disclaimer of warranties#

EXCEPT AS EXPRESSLY STATED IN THESE TERMS AND IN THE APPENDIX TITLED "PRACTITIONER HARDWARE WARRANTY", THE PLATFORM AND ALL NARBIS PRODUCTS ARE PROVIDED ON AN "AS IS" AND "AS AVAILABLE" BASIS. NARBIS DISCLAIMS ALL WARRANTIES, EXPRESS, IMPLIED AND STATUTORY, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE AND NON INFRINGEMENT. NARBIS DOES NOT WARRANT THAT THE PLATFORM WILL BE UNINTERRUPTED, ERROR FREE, OR THAT ANY DATA, METRIC OR ANALYSIS IT PRODUCES IS ACCURATE, COMPLETE OR SUITABLE FOR ANY CLINICAL PURPOSE.

SOME JURISDICTIONS DO NOT ALLOW THE EXCLUSION OF IMPLIED WARRANTIES, SO SOME OF THE ABOVE MAY NOT APPLY TO YOU. NOTHING IN THESE TERMS EXCLUDES OR LIMITS ANY LIABILITY THAT CANNOT LAWFULLY BE EXCLUDED OR LIMITED.

15. Limitation of liability#

TO THE MAXIMUM EXTENT PERMITTED BY LAW, NEITHER PARTY WILL BE LIABLE FOR ANY INDIRECT, INCIDENTAL, CONSEQUENTIAL, SPECIAL, EXEMPLARY, STATUTORY OR PUNITIVE DAMAGES, OR FOR LOST PROFITS, LOST REVENUE OR LOSS OF DATA, ARISING OUT OF OR RELATING TO THESE TERMS, EVEN IF ADVISED OF THE POSSIBILITY.

TO THE MAXIMUM EXTENT PERMITTED BY LAW, NARBIS'S TOTAL AGGREGATE LIABILITY ARISING OUT OF OR RELATING TO THESE TERMS WILL NOT EXCEED THE GREATER OF THE FEES YOU ACTUALLY PAID NARBIS IN THE TWELVE MONTHS PRECEDING THE EVENT GIVING RISE TO THE CLAIM, OR ONE THOUSAND UNITED STATES DOLLARS.

THESE LIMITS DO NOT APPLY TO: A PARTY'S INDEMNIFICATION OBLIGATIONS; YOUR PAYMENT OBLIGATIONS; A PARTY'S BREACH OF ITS CONFIDENTIALITY OBLIGATIONS; NARBIS'S OBLIGATIONS UNDER THE BUSINESS ASSOCIATE AGREEMENT AT APPENDIX B; OR LIABILITY ARISING FROM A PARTY'S GROSS NEGLIGENCE, WILFUL MISCONDUCT OR FRAUD.

Insurance. Each party will maintain insurance appropriate to its business, and you will maintain professional liability insurance covering the services you provide to your End Users.

16. Disputes#

PLEASE READ THIS SECTION CAREFULLY. IT AFFECTS HOW CLAIMS BETWEEN US ARE RESOLVED.

16.1 Talk to us first. Before starting formal proceedings, send a written description of the dispute to info@narbis.com. We will try to resolve it within 30 days.

16.2 Binding individual arbitration. IF WE CANNOT RESOLVE IT, ANY DISPUTE ARISING OUT OF OR RELATING TO THESE TERMS WILL BE RESOLVED BY BINDING INDIVIDUAL ARBITRATION ADMINISTERED BY A RECOGNIZED ARBITRATION PROVIDER UNDER ITS COMMERCIAL ARBITRATION RULES, RATHER THAN IN COURT.

16.3 Class action waiver. YOU AND NARBIS EACH WAIVE THE RIGHT TO BRING OR PARTICIPATE IN A CLASS, COLLECTIVE, CONSOLIDATED OR REPRESENTATIVE ACTION. IF THIS WAIVER IS HELD UNENFORCEABLE AS TO A PARTICULAR CLAIM, THAT CLAIM ALONE IS SEVERED AND PROCEEDS IN COURT.

16.4 Jury trial waiver. FOR ANY MATTER THAT PROCEEDS IN COURT, YOU AND NARBIS EACH WAIVE THE RIGHT TO A TRIAL BY JURY.

16.5 Your right to opt out. YOU MAY OPT OUT OF ARBITRATION AND THE CLASS ACTION AND JURY TRIAL WAIVERS BY EMAILING info@narbis.com WITHIN 30 DAYS OF FIRST ACCEPTING THESE TERMS, STATING YOUR NAME AND THAT YOU OPT OUT. OPTING OUT WILL NOT AFFECT YOUR ACCOUNT, YOUR PRICING OR YOUR SERVICE IN ANY WAY.

16.6 Carve outs. Either party may bring an individual claim in small claims court, and either party may seek injunctive relief in court to protect intellectual property or confidential information.

17. Governing law and venue#

These terms are governed by the laws of the State of Delaware, without regard to conflict of laws principles. For any matter not subject to arbitration, the state and federal courts located in the State of Delaware have jurisdiction. The United Nations Convention on Contracts for the International Sale of Goods does not apply.

Nothing in this section deprives you of the protection of mandatory provisions of the law of the country in which you practise.

18. General#

Changes. We may change these terms. For a material change we will give at least 30 days notice by email and in the Platform, and continued use after the change takes effect is acceptance. If you do not accept, you may terminate and we will refund the unused portion of any prepaid period. Changes to Appendix B that are required by law take effect on the date the law requires.

Notices. Notices to Narbis go to info@narbis.com and are deemed received on the next business day. Notices to you go to the email address on your account.

Assignment. You may not assign these terms without our prior written consent. We may assign to an affiliate or in connection with a merger, acquisition or sale of assets, and we will give you notice.

Independent parties. Nothing here creates a partnership, joint venture, employment or agency relationship.

Force majeure. Neither party is liable for failure to perform caused by events beyond its reasonable control, other than payment obligations.

Severability. If a provision is unenforceable, it is modified to the minimum extent necessary or severed, and the rest continues.

No waiver. A failure to enforce is not a waiver.

Entire agreement. These terms, including Appendix A and Appendix B, and the documents they reference by name, are the entire agreement between us about the Platform, and supersede any prior understanding. Where these terms conflict with the Narbis Subscription Terms of Service in relation to your professional use, these terms prevail. Where these terms conflict with Appendix B in relation to PHI, Appendix B prevails.

19. How to reach us#

How to reach us
Email: info@narbis.com
Web: narbis.com/contact

One mailbox handles everything. To help us route your message quickly, please begin your subject line with one of these words where it applies: Privacy, Legal, Practitioner, Security or Appeal. We read everything either way.

---#

Appendix A: Practitioner Hardware Warranty#

Effective Date: 1 September 2026

This appendix replaces the consumer Limited Warranty for hardware acquired for professional use with the Platform. Where hardware is supplied to an End User by a Practitioner, this appendix governs as between Narbis and the Practitioner.

A1. What is warranted. Narbis warrants that Narbis hardware supplied for professional use will be free from defects in materials and workmanship, under normal professional use, for 12 months from delivery. This covers the frame and hinges, the electrochromic lens assembly and its driver, the sensor electronics, the ear clip, the battery and the charging hardware.

A2. Professional use is contemplated. Unlike the consumer warranty, this appendix expressly contemplates use across multiple End Users, with cleaning between users, and higher session volume. Wear consistent with that pattern is not a defect, but nor is professional use a ground for refusing a claim.

A3. What is not covered. Accidental damage, liquid damage, cosmetic wear, consumables and worn accessories, damage from unauthorized repair or modification, use outside the Hardware Warnings and Safety Information, and third party sensors, which are covered by their own manufacturers.

A4. Remedy. At Narbis's option, repair, replacement or refund of the amount paid. Replacement units carry the remainder of the original period or 90 days, whichever is longer.

A5. Loaner and continuity. Where a unit in active clinical use fails within the warranty period, tell us at info@narbis.com and we will make reasonable efforts to keep your practice running while the claim is processed.

A6. How to claim. Email info@narbis.com with the serial number and a description. We will issue a return authorization and the service destination with it.

A7. Exclusivity. THIS IS THE SOLE WARRANTY FOR NARBIS HARDWARE SUPPLIED FOR PROFESSIONAL USE. ALL OTHER WARRANTIES, EXPRESS, IMPLIED AND STATUTORY, INCLUDING MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE, ARE DISCLAIMED TO THE MAXIMUM EXTENT PERMITTED BY LAW. SOME JURISDICTIONS DO NOT ALLOW SUCH EXCLUSIONS, IN WHICH CASE ANY IMPLIED WARRANTY IS LIMITED IN DURATION TO THE 12 MONTH PERIOD ABOVE.

---#

Appendix B: Business Associate Agreement#

Effective Date: 1 September 2026

B1. When this appendix applies, and how it takes effect#

B1.1 This Business Associate Agreement ("BAA") applies only where the Practitioner is a Covered Entity, or is a Business Associate of a Covered Entity, and Narbis creates, receives, maintains or transmits Protected Health Information on the Practitioner's behalf through the Platform.

B1.2 Where that condition is met, this BAA is binding between the parties automatically, from the Practitioner's first use of the Platform, without any further signature, request, negotiation or action by either party. The Practitioner is the Covered Entity and Narbis is the Business Associate.

B1.3 Where the Practitioner is not a Covered Entity and is not a Business Associate of one, this appendix does not apply, no Protected Health Information arises from the Practitioner's use of the Platform, and the parties' obligations are governed by the rest of these terms and by the Narbis privacy documents. A Practitioner who is uncertain of their status should take their own advice. Narbis does not determine a Practitioner's status.

B1.4 A Practitioner who requires a countersigned copy for their compliance file may request one at info@narbis.com.

B1.5 Capitalized terms not defined here have the meanings given in 45 C.F.R. Parts 160 and 164. "PHI" means Protected Health Information created, received, maintained or transmitted by Narbis for or on behalf of the Practitioner. References to a section of the Code of Federal Regulations include any successor provision.

B2. Permitted uses and disclosures#

B2.1 Narbis may use and disclose PHI only:

a. to perform the services described in these terms, on behalf of and as directed by the Practitioner;

b. for the proper management and administration of Narbis, or to carry out Narbis's legal responsibilities, provided that any disclosure to a third party for that purpose is either required by law or made on the third party's written assurance that the PHI will be held confidentially, used or further disclosed only as required by law or for the purpose disclosed, and that the third party will notify Narbis of any breach of confidentiality;

c. to provide Data Aggregation services relating to the health care operations of the Practitioner, as permitted by 45 C.F.R. 164.504(e)(2)(i)(B);

d. to de-identify PHI in accordance with 45 C.F.R. 164.514, subject to the section titled "De-identified information"; and

e. as Required by Law.

B2.2 Narbis will not use or further disclose PHI other than as permitted by this BAA or as Required by Law.

B2.3 Narbis will not use or disclose PHI in a manner that would violate Subpart E of 45 C.F.R. Part 164 if done by the Practitioner, except as permitted by section B2.1(b) and (c).

B2.4 Minimum necessary. Narbis will limit its uses, disclosures and requests for PHI to the minimum necessary to accomplish the intended purpose, consistent with 45 C.F.R. 164.502(b) and 164.514(d).

B2.5 No sale, no marketing. Narbis will not sell PHI, and will not use or disclose PHI for marketing or for fundraising, in each case within the meaning of 45 C.F.R. Part 164.

B3. De-identified information#

B3.1 Narbis may create de-identified information from PHI in accordance with 45 C.F.R. 164.514(a) to (c), using either the Safe Harbor method or Expert Determination.

B3.2 Narbis may use de-identified information to operate, evaluate and improve the Platform, to develop new features, and for research.

B3.3 Narbis will not attempt to re-identify de-identified information, will not disclose any re-identification code or mechanism, and will contractually bind any recipient of de-identified information to the same prohibitions and to a prohibition on onward disclosure without them.

B3.4 Narbis will not disclose de-identified information derived from a Practitioner's PHI to that Practitioner's competitors in a form that identifies the Practitioner or the Practitioner's practice, without the Practitioner's prior written consent.

B3.5 A Practitioner may opt out of the use permitted by section B3.2 by written notice to info@narbis.com, and Narbis will exclude that Practitioner's PHI from de-identification for those purposes going forward.

Note on why this section is written openly. A bare permission to de-identify is where substantial value can pass without the covered entity noticing. The parties intend the scope, the standard and the opt out to be plain on the face of the document.

B4. Safeguards#

B4.1 Narbis will use appropriate administrative, physical and technical safeguards, and will comply with Subpart C of 45 C.F.R. Part 164, the Security Rule, with respect to electronic PHI, to prevent use or disclosure of PHI other than as provided by this BAA.

B4.2 Without limiting section B4.1, Narbis will maintain:

a. encryption of electronic PHI in transit and at rest;

b. multi factor authentication for administrative and remote access;

c. unique user identification, role based access control and least privilege;

d. audit logging of access to PHI, and monitoring of those logs;

e. a written risk analysis, reviewed at least annually and on material change;

f. a technology asset inventory and network map, reviewed at least annually;

g. vulnerability scanning at least every six months and penetration testing at least annually;

h. a documented patch management process;

i. workforce security, sanction and training procedures;

j. contingency planning, backup and disaster recovery; and

k. a documented incident response plan, tested periodically.

Note. Several items in section B4.2 exceed what the Security Rule currently requires and anticipate the proposed revisions to it. They are stated as binding commitments because covered entity procurement will require them regardless of the rule's final form.

B4.3 Narbis will maintain policies, procedures and documentation as required by 45 C.F.R. 164.316, and will retain that documentation for six years from the later of its creation date and the date it was last in effect.

B5. Reporting#

B5.1 Narbis will report to the Practitioner:

a. any use or disclosure of PHI not provided for by this BAA of which it becomes aware;

b. any Security Incident of which it becomes aware; and

c. any Breach of Unsecured Protected Health Information.

B5.2 Timing. Narbis will make the report in section B5.1(a) or (c) without unreasonable delay and in no event later than 5 business days after Discovery. This is materially shorter than the 60 day outer limit in 45 C.F.R. 164.410 and is intended to give the Practitioner time to meet its own notification obligations.

B5.3 Content. The report will include, to the extent known and as it becomes known: the identification of each individual whose Unsecured PHI was or is reasonably believed to have been accessed, acquired, used or disclosed; the nature and timing of the incident; the types of PHI involved; what Narbis is doing to investigate, mitigate and prevent recurrence; and the contact for further information. Narbis will supplement the report as further information becomes available.

B5.4 Unsuccessful Security Incidents. The parties acknowledge that unsuccessful attempts at unauthorized access that do not result in unauthorized access, use, disclosure, modification or destruction of PHI, such as routine port scans, pings and blocked login attempts, occur frequently. This section B5.4 constitutes notice of them, and no separate report is required unless the Practitioner requests a summary, which Narbis will provide on reasonable request.

B5.5 Mitigation. Narbis will mitigate, to the extent practicable, any harmful effect known to it of a use or disclosure of PHI in violation of this BAA.

B5.6 Cooperation. Narbis will cooperate with the Practitioner in the Practitioner's investigation, notification and remediation, and will bear its own costs of doing so.

B6. Subcontractors#

B6.1 In accordance with 45 C.F.R. 164.502(e)(1)(ii) and 164.308(b)(2), Narbis will ensure that any subcontractor that creates, receives, maintains or transmits PHI on Narbis's behalf agrees in writing to restrictions and conditions at least as protective as those that apply to Narbis under this BAA.

B6.2 Narbis remains responsible to the Practitioner for the performance of its subcontractors.

B6.3 A current list of subprocessors that may handle PHI is published at narbis.com/legal/subprocessors. Narbis will give the Practitioner notice before adding a new subprocessor that will handle PHI, and the Practitioner may object on reasonable grounds relating to data protection, in which case the parties will discuss in good faith and the Practitioner may terminate if the objection cannot be resolved.

B7. Individual rights#

B7.1 Access. Narbis will make PHI in a Designated Record Set available to the Practitioner, or as directed by the Practitioner to an individual, as necessary to satisfy the Practitioner's obligations under 45 C.F.R. 164.524, within 10 business days of a written request. Where PHI is maintained electronically, it will be provided in the electronic form and format requested if readily producible.

B7.2 Amendment. Narbis will make PHI in a Designated Record Set available for amendment, and incorporate any amendment the Practitioner directs, as necessary to satisfy the Practitioner's obligations under 45 C.F.R. 164.526, within 10 business days of a written request.

B7.3 Accounting of disclosures. Narbis will document disclosures of PHI and information related to those disclosures as would be required for the Practitioner to respond to a request for an accounting under 45 C.F.R. 164.528, and will provide that information to the Practitioner within 15 business days of a written request.

B7.4 Restrictions and confidential communications. Narbis will comply with any restriction on the use or disclosure of PHI, and any confidential communication request, that the Practitioner notifies to Narbis in writing, to the extent it affects Narbis's processing.

B7.5 Practitioner obligations to Narbis. The Practitioner will notify Narbis of any limitation in its notice of privacy practices, any change in or revocation of an individual's permission, and any restriction agreed under 45 C.F.R. 164.522, in each case to the extent it affects Narbis's use or disclosure of PHI. The Practitioner will not request that Narbis use or disclose PHI in a manner that would not be permissible under Subpart E of 45 C.F.R. Part 164 if done by the Practitioner, except as permitted by section B2.1(b) and (c).

B8. Obligations of a Covered Entity's Privacy Rule duties#

To the extent Narbis is to carry out an obligation of the Practitioner under Subpart E of 45 C.F.R. Part 164, Narbis will comply with the requirements of Subpart E that apply to the Practitioner in the performance of that obligation.

B9. Availability to the Secretary#

Narbis will make its internal practices, books and records relating to the use and disclosure of PHI available to the Secretary of the United States Department of Health and Human Services for purposes of determining compliance with the HIPAA Rules. Narbis will notify the Practitioner of any such request, unless prohibited from doing so.

B10. Audit and assurance#

B10.1 On reasonable written notice and not more than once in any 12 month period, except following a Breach, Narbis will provide the Practitioner with a written summary of its security posture, including the results of its most recent risk analysis and penetration test at a level of detail that does not compromise security, and will respond to a reasonable security questionnaire.

B10.2 Narbis will provide any third party audit report or certification it holds, on request and under confidentiality.

B11. Term and termination#

B11.1 Term. This BAA takes effect as provided in section B1.2 and continues until all PHI is returned or destroyed, or until protections are extended under section B12.3.

B11.2 Termination for cause. The Practitioner may terminate these terms and this BAA immediately if Narbis materially breaches this BAA and fails to cure within 30 days of written notice, or if cure is not possible.

B11.3 Narbis may terminate this BAA if the Practitioner materially breaches a term of it and fails to cure within 30 days of written notice.

B12. Return or destruction of PHI#

B12.1 On termination, Narbis will return to the Practitioner or destroy all PHI that Narbis or its subcontractors maintain in any form, and will retain no copies.

B12.2 Default timing. Unless the Practitioner instructs otherwise in writing, Narbis will complete return or destruction within 30 days of termination, and will confirm completion in writing. The Practitioner's export function remains available for 30 days after termination so that the Practitioner can retrieve the data first.

B12.3 Where return or destruction is infeasible. Where return or destruction is not feasible, Narbis will extend the protections of this BAA to that PHI, limit further uses and disclosures to the purposes that make return or destruction infeasible, and continue to do so for as long as it retains the PHI. Narbis will tell the Practitioner in writing which PHI this applies to and why. Backup media are purged on the ordinary backup cycle, within 35 days.

B13. General#

B13.1 Interpretation. Any ambiguity in this BAA is resolved to permit compliance with the HIPAA Rules. Where this BAA conflicts with any other provision of these terms in relation to PHI, this BAA prevails.

B13.2 Amendment. The parties will take such action as is necessary to amend this BAA from time to time as is necessary for compliance with the HIPAA Rules. Amendments required by law take effect on the date the law requires.

B13.3 Regulatory references. A reference to a section of the HIPAA Rules means that section as in effect or as amended.

B13.4 No third party beneficiaries. Nothing in this BAA confers any right on any person other than the parties, their respective successors and permitted assigns.

B13.5 Survival. Sections B3.3, B4.3, B5, B9, B12 and B13 survive termination.

B13.6 Indemnity. Each party will indemnify the other against losses arising from its own breach of this BAA, including the reasonable costs of notification, credit monitoring and regulatory response attributable to that breach.

B13.7 Insurance. Narbis will maintain cyber liability insurance appropriate to the volume and sensitivity of PHI it processes, and will provide a certificate on reasonable request.

B13.8 Governing law. This BAA is governed by the laws of the State of Delaware, except to the extent preempted by federal law.

B13.9 How to reach us. Email: info@narbis.com Web: narbis.com/contact Please begin the subject line with Privacy, Legal, Practitioner, Security or Appeal where it applies.