All legal documents

Business Associate Agreement

Dappros Ltd, trading as Ethora. Template version 1.0, 10 November 2026.

This is the Business Associate Agreement ("BAA") that Ethora signs with customers who store or transmit protected health information on a Covered Deployment. It is published so that your compliance and legal teams can review it before you talk to us. To receive a copy for signature, or to have HIPAA enabled on your Ethora Cloud account, write to support@ethora.com. Legal questions about this document: legal@ethora.com.

Personal data that is not PHI (for example under the GDPR, UK GDPR or PIPEDA) is covered by the separate Data Processing Agreement. The settings a Covered Entity must apply before placing PHI on Ethora are in the HIPAA configuration guide. Annex C summarises them.

1. Parties and background

This BAA is between:

• Dappros Ltd, trading as Ethora, a company registered in England and Wales under company number 11455432, with its registered office at 38 Munden Grove, Watford, WD24 7EE, United Kingdom ("Business Associate", "Ethora", "we"); and
• the customer named in the signature block ("Covered Entity", "you"). If you are yourself a business associate of a covered entity and engage Ethora as a subcontractor, the references to Covered Entity in this BAA apply to you in that capacity and Ethora is your subcontractor business associate.

Ethora provides chat, messaging and AI agent software and services to Covered Entity under the agreement identified in the signature block (the "Services Agreement"): the Ethora Terms of Service for Ethora Cloud, an Enterprise agreement, or an order for a dedicated or Private Practice server. In providing the Services, Ethora may create, receive, maintain or transmit protected health information on behalf of Covered Entity. The parties enter into this BAA to comply with the HIPAA Rules.

2. Definitions

Capitalised terms not defined here have the meaning given in the HIPAA Rules.

• Breach, Business Associate, Covered Entity, Data Aggregation, Designated Record Set, Disclosure, Health Care Operations, Individual, Minimum Necessary, Notice of Privacy Practices, Required by Law, Secretary, Security Incident, Subcontractor, Unsecured Protected Health Information and Use have the meanings in 45 CFR 160.103, 164.304, 164.402 and 164.501.
• HIPAA Rules means the Privacy, Security, Breach Notification and Enforcement Rules at 45 CFR Part 160 and Part 164, as amended, including by the HITECH Act.
• Protected Health Information or PHI has the meaning in 45 CFR 160.103, limited to the information Ethora creates, receives, maintains or transmits on behalf of Covered Entity. It includes electronic PHI.
• Covered Deployment means an Ethora deployment listed in Annex B on which Covered Entity has been authorised in writing by Ethora to process PHI. The free and Small Business plans of Ethora Cloud, and any Ethora Core installation without an Enterprise agreement, are not Covered Deployments.
• Configuration Guide means the HIPAA configuration guide published at https://ethora.com/hipaa-compliant-chat-api/configuration-guide/, as updated from time to time, the mandatory items of which are listed in Annex C.
• Services means the services Ethora provides under the Services Agreement on a Covered Deployment.

3. Scope and order of precedence

This BAA applies to PHI on a Covered Deployment. Covered Entity agrees not to place PHI on any other Ethora service or plan. Where this BAA and the Services Agreement conflict on the handling of PHI, this BAA prevails. On every other matter, including fees, liability and termination of the Services, the Services Agreement applies.

4. Obligations of Business Associate

Ethora agrees to:

1. Permitted use only. Not use or disclose PHI other than as permitted or required by this BAA or as Required by Law.
2. Safeguards. Use appropriate administrative, physical and technical safeguards, and comply with Subpart C of 45 CFR Part 164 with respect to electronic PHI, to prevent use or disclosure of PHI other than as provided for by this BAA. The safeguards Ethora applies on each Covered Deployment, and those that remain with Covered Entity, are set out in Annex B.
3. Reporting. Report to Covered Entity, in writing, any use or disclosure of PHI not provided for by this BAA of which it becomes aware, any Security Incident of which it becomes aware, and any Breach of Unsecured PHI as required by 45 CFR 164.410, without unreasonable delay and in any event within 10 business days of discovery. The report will include, to the extent known, the identity of each Individual whose PHI was involved, the nature of the PHI, the date of the Breach and of its discovery, the steps Individuals should take to protect themselves, and what Ethora is doing to investigate, mitigate and prevent recurrence. Ethora will supplement the report as information becomes available. The parties agree that this clause is notice of attempted but unsuccessful Security Incidents that do not result in unauthorised access, use, disclosure, modification or destruction of PHI, such as port scans, failed sign-in attempts and blocked connection attempts; Ethora will provide a summary of such incidents on written request.
4. Mitigation. Mitigate, to the extent practicable, any harmful effect known to Ethora of a use or disclosure of PHI by Ethora in violation of this BAA.
5. Subcontractors. In accordance with 45 CFR 164.502(e)(1)(ii) and 164.308(b)(2), ensure that any Subcontractor that creates, receives, maintains or transmits PHI on behalf of Ethora agrees in writing to the same restrictions, conditions and requirements that apply to Ethora under this BAA. The Subcontractors that may handle PHI on each Covered Deployment are listed in Annex A. Ethora will give Covered Entity at least 30 days' written notice before adding a Subcontractor that will handle PHI. If Covered Entity objects on reasonable grounds related to the protection of PHI and the parties cannot resolve the objection, Covered Entity may terminate the affected Services under clause 8.
6. Access. Make available PHI in a Designated Record Set to Covered Entity, within 10 business days of a written request, as necessary to satisfy Covered Entity's obligations under 45 CFR 164.524. Ethora satisfies this through the export functions of the Services and, where needed, through support.
7. Amendment. Make any amendment to PHI in a Designated Record Set as directed or agreed by Covered Entity under 45 CFR 164.526, or take other measures as necessary to satisfy Covered Entity's obligations under that section, within 10 business days of a written request.
8. Accounting of disclosures. Maintain and make available to Covered Entity, within 10 business days of a written request, the information required to provide an accounting of disclosures to an Individual as necessary to satisfy Covered Entity's obligations under 45 CFR 164.528.
9. Covered Entity's obligations. To the extent Ethora is to carry out one or more of Covered Entity's obligations under Subpart E of 45 CFR Part 164, comply with the requirements of Subpart E that apply to Covered Entity in the performance of those obligations.
10. Books and records. Make its internal practices, books and records relating to the use and disclosure of PHI received from, or created or received by Ethora on behalf of, Covered Entity available to the Secretary for the purpose of determining Covered Entity's and Ethora's compliance with the HIPAA Rules.
11. Minimum necessary. Limit its uses and disclosures of, and requests for, PHI to the minimum necessary to accomplish the intended purpose, consistent with 45 CFR 164.502(b) and 164.514(d).
12. Workforce. Ensure that members of its workforce who may access PHI are trained on the requirements of this BAA and are bound by confidentiality obligations, and that access to PHI by Ethora personnel for support is limited to what the support request requires and is logged.

5. Permitted uses and disclosures by Business Associate

1. Ethora may use or disclose PHI only as necessary to perform the Services, as permitted by this BAA, or as Required by Law.
2. Ethora may not use or disclose PHI in a manner that would violate Subpart E of 45 CFR Part 164 if done by Covered Entity, except for the purposes in paragraphs 3 and 4 below.
3. Ethora may use PHI for the proper management and administration of Ethora or to carry out its legal responsibilities.
4. Ethora may disclose PHI for the proper management and administration of Ethora or to carry out its legal responsibilities, provided the disclosure is Required by Law, or Ethora obtains reasonable assurances from the person to whom the information is disclosed that it will remain confidential and be used or further disclosed only as Required by Law or for the purposes for which it was disclosed, and that the person will notify Ethora of any instance of which it is aware in which the confidentiality of the information has been breached.
5. Ethora may provide Data Aggregation services relating to the Health Care Operations of Covered Entity only if Covered Entity instructs it in writing.
6. Ethora will not de-identify PHI for its own purposes, will not sell PHI, and will not use PHI for marketing or to train or improve machine learning models.
7. AI features. AI agents, retrieval over uploaded content and message translation on Ethora Cloud are provided through third-party model providers that are not Subcontractors under this BAA unless listed in Annex A. Covered Entity will keep these features switched off for PHI, or run them against a model it hosts itself or a provider with which it has its own business associate agreement, as described in the Configuration Guide.

6. Obligations of Covered Entity

Covered Entity agrees to:

1. Notify Ethora of any limitation in its Notice of Privacy Practices under 45 CFR 164.520, of any change in or revocation of an Individual's permission to use or disclose PHI, and of any restriction on the use or disclosure of PHI that Covered Entity has agreed to or is required to abide by under 45 CFR 164.522, in each case to the extent the limitation, change or restriction may affect Ethora's use or disclosure of PHI.
2. Not request Ethora to use or disclose PHI in a manner that would not be permissible under Subpart E of 45 CFR Part 164 if done by Covered Entity, except as permitted by clause 5.
3. Place PHI only on a Covered Deployment, and apply and maintain the mandatory configuration in Annex C before PHI is placed on it. Ethora is not responsible for PHI placed on a plan or service that is not a Covered Deployment, or for the consequences of a configuration that departs from Annex C.
4. Be responsible for its own users, their devices, their credentials and the access decisions it makes in the Services (roles, memberships, invitations and integrations), and for the safeguards allocated to it in Annex B.
5. Obtain any consent or authorisation required for the Individuals whose PHI is processed, and provide any required notices to Individuals and to the Secretary following a Breach. Ethora will cooperate and provide the information in clause 4.3 to support those notices.

7. Term

This BAA takes effect on the date of the last signature below and continues for as long as Ethora maintains PHI on behalf of Covered Entity under the Services Agreement, unless terminated earlier under clause 8.

8. Termination

1. Termination for cause. Either party may terminate this BAA and the affected Services if the other party has materially breached this BAA and has not cured the breach within 30 days of written notice, or immediately if cure is not possible. Where Covered Entity determines that Ethora has violated a material term, Covered Entity may also report the violation to the Secretary.
2. Return or destruction. On termination of the Services Agreement or of this BAA, Ethora will, at Covered Entity's written election, return or destroy all PHI that Ethora maintains in any form, and retain no copies. Covered Entity has the data export window set out in the Services Agreement (30 days for Ethora Cloud) to export its PHI through the Services before destruction. On a self-hosted Covered Deployment, PHI sits on Covered Entity's own infrastructure and Ethora holds none, other than copies that Covered Entity shared with Ethora for support, which Ethora will destroy.
3. Return infeasible. Where return or destruction is infeasible, for example for audit log copies held under an immutable retention policy that Covered Entity itself required, Ethora will extend the protections of this BAA to that PHI, limit its further use and disclosure to the purposes that make return or destruction infeasible, and destroy it when the retention period ends.
4. Survival. Clauses 4, 5, 8 and 10 survive termination for as long as Ethora retains any PHI.

9. Sub-processors and support access

1. Annex A lists, for each Covered Deployment, the Subcontractors that may create, receive, maintain or transmit PHI, the service they provide, their location and the agreement under which they do so. Service providers that handle only account, billing, marketing or product-analytics data, and never PHI, are not Subcontractors under this BAA and are listed in the Ethora Privacy Policy instead.
2. Ethora personnel access a Covered Deployment that holds PHI only to provide support that Covered Entity has requested, to apply updates and fixes under the Services Agreement, or to respond to a Security Incident. Access is limited to the people and the duration the task needs, and is logged. On a self-hosted Covered Deployment, Covered Entity decides whether and how Ethora personnel can reach the server at all.

10. General

1. Regulatory references. A reference in this BAA to a section of the HIPAA Rules means the section as in effect or as amended.
2. Amendment. The parties will take the action necessary to amend this BAA from time to time as needed for compliance with the HIPAA Rules. Ethora may publish an updated template version on ethora.com; an update applies to an existing signed BAA only when both parties sign it.
3. Interpretation. Any ambiguity in this BAA will be resolved to permit compliance with the HIPAA Rules.
4. Governing law and disputes. This BAA is governed by the law that governs the Services Agreement and is subject to the same dispute resolution terms, except that nothing in either document limits a party's obligations under the HIPAA Rules. Where the Services Agreement is the Ethora Terms of Service, the parties may agree in the signature block that this BAA is governed instead by the law of the US state named there.
5. No third-party beneficiaries. Nothing in this BAA confers any right, remedy or obligation on any person other than the parties and their successors and permitted assigns.
6. Notices. Notices under this BAA are sent by email, to legal@ethora.com (with a copy to support@ethora.com for Security Incident reports) and to the Covered Entity address in the signature block, and are effective when sent, unless the sender receives a delivery failure.
7. Entire agreement on PHI. This BAA, with its Annexes, is the entire agreement between the parties on the handling of PHI and replaces any earlier business associate terms between them.
8. Counterparts and electronic signature. This BAA may be signed in counterparts and electronically, each of which is an original.

Signature block

Annex A. Subcontractors that may handle PHI

Providers that never receive PHI on a Covered Deployment configured under Annex C, and so are not Subcontractors under this BAA: Google Firebase Cloud Messaging and Apple Push Notification service (push notifications carry no message content in generic mode), Postmark (account and verification emails, no message content), Stripe (billing), HubSpot (customer relationship records), Microsoft Clarity, Google Analytics and PostHog (product analytics in the admin panel, disabled for HIPAA-enabled workspaces), OpenAI and other model providers (AI features are off for PHI unless Covered Entity brings its own covered model). The full list of Ethora's service providers is in the Privacy Policy.

Annex B. Covered Deployments and allocation of safeguards

A Covered Deployment is one of:

1. Self-hosted Ethora Enterprise on infrastructure Covered Entity controls (its own cloud account or on-premises), under an Enterprise agreement.
2. Dedicated server operated by Ethora for a single customer, including the Private Practice server, in the region named in the order.
3. Ethora Cloud account with HIPAA enabled by Ethora support on the shared Ethora Cloud, hosted in the United States (us-east-2).

Annex C. Mandatory configuration

Before PHI is placed on a Covered Deployment, Covered Entity will apply and keep the following, as described in the Configuration Guide:

1. Two-step verification required for administrators and owners (App Settings, Sign-on options).
2. Self-registration disabled, so that only users Covered Entity provisions can sign in (App Settings, Sign-on options).
3. Push notification content mode set to generic, so that no message content passes through Google or Apple servers; or encrypted push notifications in Covered Entity's own mobile app.
4. AI agents, retrieval and message translation switched off for PHI, unless they run against a model Covered Entity hosts itself or a provider with which Covered Entity has its own business associate agreement.
5. Webhooks and integrations pointed only at endpoints Covered Entity controls or at vendors with which Covered Entity has a business associate agreement.
6. Website chat widgets used only for conversations that do not involve PHI, or embedded behind Covered Entity's authenticated portal.
7. On a self-hosted Covered Deployment: TLS on every endpoint, encryption at rest for databases, file storage and backups, and the immutable audit log export enabled to a bucket with object lock.

End-to-end encrypted rooms are optional and are not required by this BAA. Covered Entity decides per app whether to enable them, understanding that server-side archive, search, moderation and export are not available for encrypted rooms.