SLP Nova Business Associate Agreement
Version 2026-10-launch-baa-v5 · Last updated October 19, 2026. Effective at the Covered Entity's express electronic acceptance.
1. Parties, formation and precedence
The Business Associate is Sebastian Gonzalez, an individual carrying on business as SLP Nova, service address 4125 Hastings Street, Burnaby, BC V5C 2J3, Canada. Public seller: SLP Nova. Notices: hello@slpnova.com ("Nova").
The Covered Entity is the customer identified by the account name and verified account email recorded at acceptance. The individual accepting is identified by the same account name and email and confirms authority to bind that customer. The record includes the account identifier, uses the verified email for privacy and security notices, and records the effective time. The customer is responsible for keeping the account name and email accurate for this purpose. A person without authority to bind the customer must obtain acceptance by an authorized representative.
Español (Chile): La Entidad Cubierta es el cliente identificado por el nombre de la cuenta y el correo electrónico verificado registrados al aceptar. La persona que acepta se identifica con el mismo nombre y correo y confirma que tiene facultades para obligar a ese cliente. El registro incluye el identificador de la cuenta, utiliza el correo verificado para los avisos de privacidad y seguridad, y deja constancia del momento en que entra en vigor. El cliente es responsable de mantener actualizados el nombre y el correo de la cuenta para estos fines. Quien no tenga facultades para obligar al cliente debe obtener la aceptación de un representante autorizado.
This Agreement supplements the Terms and governs PHI handled for the Covered Entity. Separate, express electronic acceptance is required before the PHI workflow is enabled; product use, an unchecked box and Privacy Policy acknowledgement are not acceptance. The customer can download its executed text and evidence. This Agreement controls conflicting Terms, retention or processing-addendum clauses for PHI. A business associate engaging Nova as a subcontractor uses the separate Subcontractor BAA.
2. Definitions and covered services
HIPAA Rules means applicable 45 CFR Parts 160 and 164. PHI, Electronic PHI, Breach, Unsecured PHI, Security Incident, Designated Record Set, Individual, Secretary, Required By Law and other HIPAA terms have their regulatory meanings. PHI includes information Nova creates or receives on the customer's behalf; an alias, voice or session reference can remain PHI.
Covered services are the private professional workspace, minimal child profiles/goals, planning, session evidence/notes, optional private audio, requested transcription/speaker review, AI-assisted report drafts/planning, clinician review/editing, secure rights/exports, support, access/security, retention and deletion. Machine outputs do not replace clinical decisions or the customer's final medical record.
3. Permitted uses and disclosures
Nova uses or discloses PHI only to provide these services on lawful instructions, perform this Agreement or act when Required By Law. Minimum-necessary limits apply where required. Nova will not follow an instruction it knows violates applicable law and will explain the conflict. Nova will not use or disclose PHI in a way that would violate the Privacy Rule if done by the Covered Entity, except a use expressly required by law.
No sale, advertising, general-purpose model training, unrelated research, cross-customer aggregation, voiceprint identification or independent commercial reuse is authorized. There is no separate de-identification or discretionary third-party business-administration disclosure right. Legally compelled disclosure is limited to what law requires and reported when law permits.
PHI stays on the clinical-processing path. Neither party puts clinical content in Stripe metadata, ordinary email, authentication metadata, game-prompt synthesis, marketing tools or public game storage. Nova enforces its own boundaries; customer instructions do not relieve Nova of its duties.
4. Safeguards and personnel
Nova implements administrative, physical and technical safeguards and complies with HIPAA's Security Rule for Electronic PHI, including risk analysis/management, authorized access, activity review, confidentiality/training, incident response, recovery, device/media protection and evaluation. Workforce access is limited to authorized personnel with a need to know. Required security documentation is retained for six years from creation or last effective date, whichever is later.
Core clinical hosting is Microsoft Azure East US 2, United States, using application hosting, PostgreSQL, private Blob Storage and security services, with Azure OpenAI/Speech for requested functions. Model processing and safety retention are separate from core storage. Default Microsoft monitoring can retain flagged content and allow authorized human review. The Privacy Policy and Subprocessor List govern disclosure of these paths; there is no zero-retention or blanket certification representation.
5. Subcontractors
Before a subcontractor creates, receives, maintains or transmits PHI for Nova, Nova obtains written restrictions, safeguards and assurances required by 45 CFR 164.502(e), 164.504(e) and 164.314. Nova addresses known material downstream noncompliance, obtains cure or ends the affected arrangement when required, and protects information through transition.
Microsoft clinical functions are subject to applicable DPA/Product Terms HIPAA assurances and actual service/feature scope. Vendors performing nonclinical functions do not become PHI subcontractors merely by appearing on the provider list. Nova discloses material clinical-subprocessor changes before use, allows substantiated protection concerns and provides safe return/export if an affected workflow must end.
6. Incidents and breach reporting
Nova reports uses/disclosures outside this Agreement, Breaches of Unsecured PHI and Security Incidents of which it becomes aware. We notify the Covered Entity without unreasonable delay and within 24 hours of discovering an actual or suspected incident involving unauthorized access, use, disclosure, loss, alteration or material disruption of PHI, even when investigation is incomplete.
Breach notification also complies with 45 CFR 164.410, including discovery attribution and its outside deadline of 60 calendar days. The contractual 24-hour initial notice is not extended by that outside deadline. Nova supplies affected Individual identities and available notification facts securely, with timely supplements, containment, mitigation and investigation cooperation. Investigation completion, final counts or liability review do not delay initial notice. Any shorter applicable deadline controls.
Routine unsuccessful scans/login attempts without known PHI access or disruption are logged and included in a monthly authenticated summary. Patterns indicating compromise or material risk receive the incident notice above. The Covered Entity retains patient, HHS and media notices unless it expressly delegates a specific duty lawfully; Nova assists with required facts. Ordinary email notices contain no PHI.
7. Access, amendment, accounting and HHS
Nova makes PHI in a Designated Record Set available to support 45 CFR 164.524, including usable electronic copies and retained recordings requested through secure delivery. Nova implements amendments directed/agreed by the Covered Entity or supplies necessary support under 164.526, preserving appropriate correction history. Nova maintains/provides information needed for an accounting under 164.528; convenience product logs are not presumed a complete accounting.
We provide rights assistance within 10 calendar days of a verified request, sooner when required by an identified legal deadline. We promptly explain any lawful restriction and provide an expedited lawful route; communication does not extend statutory time. Direct Individual requests are forwarded to the Covered Entity within two business days while Nova fulfils independent duties.
When Nova carries out a delegated Privacy Rule obligation, it complies with the requirements applicable to the Covered Entity for that obligation. No treatment or general notice-of-privacy-practices role is delegated here. Nova makes its relevant internal practices, books and records available to the Secretary as required; confidentiality clauses and commercial audit limits do not restrict that access.
8. Customer duties
The Covered Entity provides PHI for lawful services, communicates relevant restrictions/changes in permissions, obtains recording authority, authorizes personnel and reviews/corrects report drafts. It retains its legally required final record and does not request impermissible uses. Required record access/export remains available when billing or feature access ends, subject to lawful security restrictions.
9. Termination, return and destruction
This Agreement continues while Nova holds PHI for the Covered Entity. The Covered Entity may terminate affected services for Nova's material violation, with a reasonable cure opportunity where appropriate or immediate termination for unlawful or material security risk. Renewal periods and cancellation fees do not prevent that right. Nova promptly identifies inability to perform an essential protection duty and arranges safe transition.
We return PHI in a reasonably usable form within 10 calendar days of verified instructions and destroy remaining active-system copies within 30 calendar days of the return or authorized-destruction instruction. We provide meaningful return/export opportunity before irreversible destruction and identify any specific lawful retention exception.
If return/destruction of a particular copy is infeasible or law requires retention, Nova identifies its data, reason, location and expiry to the Covered Entity. Safeguards continue; further use/disclosure is restricted to that justification, routine product use is prevented and the copy is destroyed when the reason ends. Backups expire under their restricted cycle, and deletions are reapplied after recovery. Difficulty is not an indefinite retention right. Nova obtains corresponding downstream handling and supplies completion evidence on request. Minimal necessary security/contract evidence is retained separately without unnecessary clinical content. These protections survive termination.
10. Interpretation
The parties interpret and update this Agreement to meet applicable HIPAA requirements. Governing-law provisions in the Terms remain subject to nonwaivable law and HIPAA. No liability clause excuses required PHI safeguards, regulatory powers or this Agreement's controlling duties.
11. Electronic execution
I confirm I can act for the practice identified by the account name and verified account email in this acceptance record. It is a HIPAA covered entity. I received and agree to the SLP Nova Business Associate Agreement, version 2026-10-launch-baa-v5, with SLP Nova's individual operator. I agree to electronic execution by selecting the separate Business Associate Agreement checkbox and choosing “Agree and continue,” and I can download the agreement and acceptance record.The execution record forms part of this Agreement and identifies both parties, the accepting account name and verified email, the confirmation of authority, the account identifier, the effective timestamp, the exact version and text hash, the displayed button and authority text, and the separate BAA checkbox selection, with proportionate IP/browser evidence. Necessary evidence is protected separately from clinical account erasure. Later text changes do not replace the executed version.
Español (Chile) — ejecución electrónica:
Confirmo que tengo autorización para actuar en nombre de la consulta identificada por el nombre de la cuenta y el correo electrónico verificado en este registro de aceptación. Es una entidad cubierta por HIPAA. Recibí y acepto el Acuerdo de Asociado Comercial de SLP Nova, versión 2026-10-launch-baa-v5, con la persona natural que opera SLP Nova. Acepto la firma electrónica al marcar la casilla independiente del acuerdo y seleccionar «Aceptar y continuar», y puedo descargar el acuerdo y el registro de aceptación.El registro de ejecución forma parte de este Acuerdo e identifica a ambas partes, el nombre de la cuenta y el correo verificado de quien acepta, la confirmación de facultades, el identificador de la cuenta, la fecha y hora de entrada en vigor, la versión exacta y la huella digital del texto, el texto del botón y la confirmación de facultades mostrados, y la selección de la casilla independiente del BAA, junto con evidencia proporcional de IP y navegador. La evidencia necesaria se protege por separado de la eliminación de la cuenta clínica. Los cambios posteriores del texto no reemplazan la versión firmada.