# Business Associate Agreement

URL: https://www.getdynamiq.ai/baa

> Dynamiq's standard Business Associate Agreement for HIPAA workspaces: Version 1.0, effective 28 October 2026, with a PDF copy to download.

Version 1.0, effective 28 October 2026

[Download PDF](https://www.getdynamiq.ai/legal/dynamiq-baa-v1.pdf)

This Business Associate Agreement (the “BAA”) is between Dynamiq Technologies, Inc., a Delaware corporation (“Dynamiq”), and the customer that agrees to it (“Customer”). It forms part of the agreement under which Dynamiq provides its platform and related services to Customer, including any order form, master agreement or terms of service (together, the “Agreement”).

## 1\. Application

1.1 **When this BAA applies.** Customer agrees to this BAA by signing an order form or agreement that refers to it. This BAA applies only to PHI that Dynamiq creates, receives, maintains or transmits on Customer’s behalf in a HIPAA Workspace.

1.2 **Customer’s status.** Customer represents that it is a covered entity under HIPAA, or a business associate of a covered entity. If Customer is a business associate, Dynamiq acts as Customer’s subcontractor, and Customer represents that its own business associate agreement with the covered entity permits the uses and disclosures described in this BAA.

1.3 **Version.** The version of this BAA that applies to Customer is the one in effect on the date Customer agrees to it, identified by its version number and effective date. Earlier versions remain available at [getdynamiq.ai/baa](https://www.getdynamiq.ai/baa).

## 2\. Definitions

2.1 “**HIPAA**” means the Health Insurance Portability and Accountability Act of 1996, the Health Information Technology for Economic and Clinical Health Act and their implementing regulations at 45 C.F.R. Parts 160 and 164, each as amended.

2.2 “**PHI**” means protected health information, as defined in 45 C.F.R. § 160.103, that Dynamiq creates, receives, maintains or transmits on behalf of Customer under the Agreement.

2.3 “**HIPAA Workspace**” means a workspace on the Dynamiq platform that Dynamiq configures for use with PHI, as described at [getdynamiq.ai/hipaa](https://www.getdynamiq.ai/hipaa) (the “**HIPAA Page**”).

2.4 “**Sub-processor Page**” means the list of Dynamiq’s subcontractors published at [getdynamiq.ai/sub-processors](https://www.getdynamiq.ai/sub-processors).

2.5 “**Breach**,” “**Designated Record Set**,” “**Individual**,” “**Required by Law**,” “**Secretary**,” “**Security Incident**,” “**Subcontractor**” and “**Unsecured Protected Health Information**” have the meanings given to them in HIPAA. Other capitalized terms not defined in this BAA have the meanings given to them in the Agreement.

## 3\. Permitted uses and disclosures

3.1 **Services.** Dynamiq may use and disclose PHI only (i) to provide the platform and services to Customer under the Agreement; (ii) as Required by Law; and (iii) as permitted by Section 3.2. Dynamiq shall not use or disclose PHI in a manner that would violate Subpart E of 45 C.F.R. Part 164 if done by Customer (or, if Customer is a business associate, by the covered entity), except as permitted by Section 3.2.

3.2 **Management and administration.** Dynamiq may use PHI for its proper management and administration or to carry out its legal responsibilities. Dynamiq may disclose PHI for those purposes if the disclosure is Required by Law, or if Dynamiq obtains reasonable assurances from the recipient that the PHI will be held confidentially and used or further disclosed only as Required by Law or for the purpose for which it was disclosed to the recipient, and that the recipient will notify Dynamiq of any instances of which it is aware in which the confidentiality of the PHI has been breached.

3.3 **Minimum necessary.** Dynamiq shall make reasonable efforts to limit its uses and disclosures of, and requests for, PHI to the minimum necessary to accomplish the intended purpose.

3.4 **Prohibited uses.** Dynamiq shall not (i) sell PHI; (ii) use or disclose PHI for marketing purposes; (iii) use PHI, or any data derived from it, to train, fine-tune or improve any artificial intelligence model; or (iv) de-identify PHI or use it to provide data aggregation services, except as Customer instructs in writing.

## 4\. Safeguards for the HIPAA Workspace

4.1 **Security Rule.** Dynamiq shall use appropriate safeguards, and comply with Subpart C of 45 C.F.R. Part 164 with respect to electronic PHI, to prevent use or disclosure of PHI other than as provided for by this BAA.

4.2 **Location.** Dynamiq and its [Subcontractors](https://www.getdynamiq.ai/sub-processors) shall store and process PHI only in the United States. Dynamiq personnel may access the HIPAA Workspace from outside the United States, subject to the safeguards described in this Section 4.

4.3 **Encryption.** PHI is encrypted with TLS 1.2 or higher in transit over public networks and with AES-256 at rest.

4.4 **AI processing.** AI model processing of PHI takes place only through providers listed on the [Sub-processor Page](https://www.getdynamiq.ai/sub-processors) as handling PHI, each under a business associate agreement with Dynamiq. Dynamiq shall not enable any feature that allows a third party to use PHI to train, fine-tune or improve an artificial intelligence model.

4.5 **HIPAA Workspace features.** The HIPAA Page lists the features available in a HIPAA Workspace. Dynamiq may update the HIPAA Page from time to time, provided that no update reduces the protections in this BAA.

## 5\. Subcontractors

5.1 **Same restrictions.** In accordance with 45 C.F.R. §§ 164.502(e)(1)(ii) and 164.308(b)(2), Dynamiq shall ensure that any [Subcontractor](https://www.getdynamiq.ai/sub-processors) that creates, receives, maintains or transmits PHI on behalf of Dynamiq agrees in writing to the same restrictions, conditions and requirements that apply to Dynamiq with respect to such PHI.

5.2 **Published list.** The [Sub-processor Page](https://www.getdynamiq.ai/sub-processors) lists all of Dynamiq’s subcontractors and identifies those that handle PHI. The list forms part of this BAA.

5.3 **Notice and objection.** Dynamiq shall notify Customer by email at least fourteen (14) days before a new [Subcontractor](https://www.getdynamiq.ai/sub-processors) begins handling Customer’s PHI. Customer may object in writing within that period on reasonable grounds relating to the protection of PHI. If the parties cannot resolve the objection, Customer may terminate the Agreement by written notice and receive a refund of any prepaid fees for the period after termination.

5.4 **Customer’s own providers.** The provider of any system or service that Customer connects to the HIPAA Workspace, and any consultant or other third party that Customer permits to access it, is Customer’s vendor and not a [Subcontractor](https://www.getdynamiq.ai/sub-processors) of Dynamiq. Customer is responsible for its agreements with them, including any business associate agreement, and for PHI after Dynamiq transmits it to them at Customer’s direction.

## 6\. Dynamiq’s obligations

Dynamiq shall:

6.1 not use or disclose PHI other than as permitted or required by this BAA or as Required by Law;

6.2 to the extent Dynamiq maintains PHI in a Designated Record Set, within ten (10) business days after Customer’s request, make that PHI available to Customer as necessary for Customer to meet its obligations under 45 C.F.R. § 164.524, and make any amendments to it that Customer directs under 45 C.F.R. § 164.526;

6.3 document such disclosures of PHI as would be required for Customer to respond to a request for an accounting of disclosures under 45 C.F.R. § 164.528 and, within ten (10) business days after Customer’s request, provide Customer with that information;

6.4 forward to Customer, within ten (10) business days after receipt, any request from an Individual for access to, amendment of or an accounting of disclosures of PHI that Dynamiq receives directly; Customer is responsible for responding to such requests;

6.5 to the extent Dynamiq carries out any of Customer’s obligations under Subpart E of 45 C.F.R. Part 164, comply with the requirements of Subpart E that apply to Customer in the performance of that obligation;

6.6 make its internal practices, books and records relating to the use and disclosure of PHI available to the Secretary for purposes of determining compliance with HIPAA; and

6.7 take reasonable steps to mitigate, to the extent practicable, any harmful effect known to Dynamiq of a use or disclosure of PHI by Dynamiq in violation of this BAA.

## 7\. Reporting

7.1 **Breaches.** Except as provided in 45 C.F.R. § 164.412, Dynamiq shall notify Customer of any Breach of Unsecured Protected Health Information without unreasonable delay, and in no event later than thirty (30) calendar days after discovery of the Breach (as determined under 45 C.F.R. § 164.410(a)(2)) or any shorter period required by applicable law. The notice shall include, to the extent known, the identification of each Individual affected and the other information that Customer needs to notify Individuals under 45 C.F.R. § 164.404(c), and Dynamiq shall promptly supplement it as further information becomes available.

7.2 **Other incidents.** Dynamiq shall report to Customer any other use or disclosure of PHI not provided for by this BAA, and any Security Incident other than an unsuccessful Security Incident described in Section 7.3, within thirty (30) calendar days after becoming aware of it.

7.3 **Unsuccessful Security Incidents.** This Section 7.3 is notice, for which no further notice is required, of the ongoing occurrence of unsuccessful Security Incidents, such as pings, port scans, attempted log-ins, denial-of-service attempts and similar events that do not result in unauthorized access to, or use, disclosure, modification or destruction of, electronic PHI.

7.4 **Notifications.** Customer is responsible for determining whether notification of a Breach is required and for notifying affected Individuals, the Secretary and the media, as applicable. Dynamiq shall not make any such notification without Customer’s prior written approval, except as Required by Law. A report under this Section 7 is not an admission of fault or liability.

7.5 **Contacts.** Dynamiq sends reports under this Section 7 to Customer’s notice contact under the Agreement. Customer shall report any suspected security incident affecting the HIPAA Workspace to [security@getdynamiq.ai](mailto:security@getdynamiq.ai).

## 8\. Customer’s obligations

Customer shall:

8.1 notify Dynamiq of (i) any limitation in its notice of privacy practices under 45 C.F.R. § 164.520; (ii) any change in, or revocation of, an Individual’s permission to use or disclose PHI; and (iii) any restriction on the use or disclosure of PHI that Customer has agreed to or must comply with under 45 C.F.R. § 164.522, in each case to the extent it may affect Dynamiq’s use or disclosure of PHI;

8.2 not request Dynamiq to use or disclose PHI in any manner that would not be permissible under Subpart E of 45 C.F.R. Part 164 if done by Customer (or, if Customer is a business associate, by the covered entity), except as permitted by Section 3.2;

8.3 provide PHI to Dynamiq only through the HIPAA Workspace, using only the features listed on the HIPAA Page, limit that PHI to the minimum necessary, and not include PHI in support requests, emails, chat messages or other communications outside the HIPAA Workspace. Dynamiq may delete any PHI that it receives outside the HIPAA Workspace;

8.4 obtain any consents or authorizations required for the uses and disclosures of PHI contemplated by the Agreement and this BAA; and

8.5 ensure that each of its users has an individual account, keeps their credentials confidential and loses access promptly when they should no longer have it.

## 9\. Term, termination and return of PHI

9.1 **Term.** This BAA starts when Customer agrees to it and continues until the Agreement ends and all PHI has been returned or destroyed under Section 9.3.

9.2 **Termination for cause.** If either party determines that the other has violated a material term of this BAA, it may give written notice of the violation. If the violation is not cured within thirty (30) days after that notice, the notifying party may terminate this BAA and the Agreement by written notice.

9.3 **Return or destruction of PHI.** For thirty (30) days after the Agreement ends, Dynamiq shall, at Customer’s written request, make PHI available to Customer for export in a commonly used, machine-readable format. Within thirty (30) days after that period ends, Dynamiq shall destroy all PHI that Dynamiq or its [Subcontractors](https://www.getdynamiq.ai/sub-processors) maintain in any form and retain no copies. If the return or destruction of any PHI is infeasible, including PHI held in backup systems pending deletion in the ordinary course, Dynamiq shall extend the protections of this BAA to that PHI and limit further uses and disclosures to the purposes that make its return or destruction infeasible, for as long as it is maintained.

9.4 **Survival.** Section 9.3, Section 10 and Dynamiq’s obligations with respect to any PHI that it retains survive the termination of this BAA.

## 10\. General

10.1 **Relationship to the Agreement.** This BAA forms part of the Agreement. If this BAA conflicts with the Agreement with respect to PHI, this BAA governs. Each party’s liability arising under or relating to this BAA is subject to the limitations and exclusions of liability in the Agreement.

10.2 **Changes in law.** The parties shall amend this BAA as necessary to comply with changes to HIPAA. If they cannot agree on an amendment within sixty (60) days after either party requests it, either party may terminate the Agreement by written notice.

10.3 **Interpretation.** Any ambiguity in this BAA shall be resolved to permit compliance with HIPAA. A reference to a section of HIPAA means that section as in effect or as amended.

10.4 **Independent contractor.** Dynamiq is an independent contractor and not an agent of Customer.

10.5 **No third-party beneficiaries.** Nothing in this BAA confers any rights or remedies on any person other than the parties.

10.6 **Governing law and notices.** This BAA is governed by the law that governs the Agreement or, if the Agreement does not specify one, by the laws of the State of Delaware, in each case except to the extent preempted by HIPAA. Notices under this BAA are given as provided in the Agreement.