Business Associate Agreement

1. Parties and purpose

This Business Associate Agreement ("Agreement") is entered into between the organization identified at signing ("Covered Entity" or "Organization") and AllerLysis, 4422 N Ravenswood Ave, Chicago, IL 60640 ("Business Associate").

It applies to the extent the Organization is a covered entity or business associate under HIPAA and allergy or dietary information entered into AllerLysis is protected health information ("PHI"). If HIPAA does not apply to your organization, the privacy and security commitments below still apply as contractual terms.

2. Permitted uses and disclosures

AllerLysis will use and disclose PHI only to provide the food allergen screening service: screening items against allergy profiles, storing screening history, sending the compliance alerts the Organization configures, and producing reports for the Organization.

AllerLysis will not sell PHI, use it for marketing, or use it to train machine-learning models.

3. Safeguards

AllerLysis will maintain administrative, physical and technical safeguards appropriate to the information, including encryption in transit and at rest, per-organization access controls and role-based permissions so one organization's records are not visible to another.

Subcontractors that process PHI on AllerLysis's behalf (such as hosting and text-extraction providers) must agree to restrictions at least as protective as this Agreement.

4. Reporting incidents

AllerLysis will report to the Organization any use or disclosure of PHI not permitted by this Agreement, and any security incident or breach of unsecured PHI it discovers, without unreasonable delay and no later than 30 calendar days after discovery.

5. Individual rights

AllerLysis will make PHI available to the Organization so it can respond to requests for access, amendment and an accounting of disclosures, and will support the Organization in meeting those obligations.

6. Organization responsibilities

The Organization is responsible for obtaining any consents or authorizations required before entering allergy information about the individuals it serves, for entering only the minimum information necessary, and for keeping profiles current against official care plans.

The Organization remains responsible for its own compliance decisions. AllerLysis is not a medical service and screening results are not a guarantee of allergen absence.

7. Term and termination

This Agreement remains in effect while the Organization uses AllerLysis. On termination, AllerLysis will return or destroy PHI on request, or, if that is not feasible, extend these protections for as long as it is retained.

Data consent signed with this agreement

• I am authorized to sign on behalf of this organization.
• Our organization has obtained, or will obtain before entry, any consent or authorization required from each individual, parent or guardian whose allergy information we enter.
• We will enter only the allergy and dietary information needed to screen food, and we will keep it consistent with each person's care plan.
• We understand AllerLysis is an operational screening tool, not a guarantee of allergen absence, and does not replace staff review of the physical package.

How to sign

An organization administrator signs electronically in the workspace under Plan & policy. Allergy profiles can't be added until it is signed. Each signature records the signer's name, title, email, the agreement version and the time.

Sign in your workspace

Need a custom agreement? Email info@allerlysis.com.