Business Associate Agreement

Last updated: 13 June 2026. This BAA is provided for platform onboarding and should be reviewed by appropriate US HIPAA legal counsel before relying on it for regulated use.

1. Parties and purpose

This Business Associate Agreement (BAA) is between Private Therapy Network, a trading style of e-Volve Software Services Limited, and the professional or organisation creating a professional account. Where the professional is a US covered entity or business associate under HIPAA, this BAA governs Private Therapy Network's handling of protected health information (PHI) on that professional's behalf.

2. Definitions

Terms including Protected Health Information, Electronic Protected Health Information, Covered Entity, Business Associate, Subcontractor, Security Rule, Privacy Rule and Breach have the meanings given to them under HIPAA, HITECH and their implementing regulations.

3. Permitted uses and disclosures

Private Therapy Network may use or disclose PHI only as necessary to provide the platform, process client enquiries, support matching, manage professional accounts, communicate with users, maintain security, meet legal obligations and perform related administrative services. Private Therapy Network will not sell PHI or use PHI for unrelated marketing.

4. Safeguards

Private Therapy Network will use appropriate administrative, technical and physical safeguards designed to protect PHI from unauthorised access, use, disclosure, alteration or destruction. These safeguards include access controls, authentication, encryption where appropriate, secure hosting practices, role-based access, audit awareness, data minimisation and staff confidentiality expectations.

5. Reporting incidents

Private Therapy Network will report a confirmed breach of unsecured PHI to the professional without unreasonable delay after discovery, including information reasonably available at the time to support the professional's own assessment and notification obligations.

6. Subcontractors

Private Therapy Network may use subcontractors and service providers to operate the platform. Where a subcontractor may access PHI, Private Therapy Network will require appropriate written obligations designed to protect PHI in a manner consistent with this BAA.

7. Access, amendment and accounting support

Where required by HIPAA and reasonably requested by the professional, Private Therapy Network will provide support for access, amendment, restriction, disclosure accounting and related requests involving PHI held within the platform.

8. Minimum necessary

Private Therapy Network will make reasonable efforts to limit the PHI it uses, discloses or requests to the minimum necessary to perform the relevant platform function.

9. Return or destruction of PHI

On termination of the professional account, Private Therapy Network will return, delete or retain PHI in accordance with applicable law, platform retention requirements, backup practices and legitimate compliance obligations. Where deletion is not immediately feasible, protections will continue to apply to retained PHI.

10. Professional responsibilities

The professional remains responsible for their own HIPAA obligations, notices, consents, clinical records, patient communications, verification of client identity, authorisations, professional judgement and any onward use or disclosure of PHI outside the platform.

11. Termination for cause

If either party becomes aware of a material breach of this BAA, the non-breaching party may require reasonable cure. If cure is not possible or not completed within a reasonable period, the non-breaching party may terminate relevant platform access where permitted by law and contract.

12. Relationship with other terms

This BAA supplements the Terms of Service, Professional Terms, Privacy Policy and other applicable platform policies. If this BAA conflicts with another policy in relation to HIPAA-regulated PHI, this BAA controls for that PHI.