Business Associate Agreement

Version 2026-11-03. Last updated November 3, 2026.

This agreement is between DigiMar Inc ("DigiMar", "we", "us"), which operates Acceptie, and the organization that accepts it in Acceptie ("you"). It applies whenever you use Acceptie to send, collect or store documents that contain protected health information. It adds to the Acceptie terms; where the two disagree about protected health information, this agreement wins.

You accept this agreement in Acceptie, under Settings, HIPAA mode, by an owner or admin of your organization who has two-step verification turned on. Acceptie records who accepted it, which version, and when. HIPAA mode turns on at that moment. Until then, do not send protected health information through Acceptie.

1. Words with a legal meaning

"Protected health information" (PHI), "electronic protected health information", "breach", "unsecured protected health information", "security incident", "subcontractor", "required by law" and "Secretary" have the meanings given in 45 CFR 160.103 and 164.402. "HIPAA Rules" means the Privacy, Security, Breach Notification and Enforcement Rules at 45 CFR Parts 160 and 164. In this agreement PHI means only the protected health information you give us or we create, receive, keep or send for you.

You may be a covered entity, or a business associate of one. If you are a business associate, we are your subcontractor under 45 CFR 164.504(e)(5), and we owe you for this PHI what you owe the covered entity.

2. What we may do with PHI

• Provide Acceptie to you. Store and encrypt your documents, deliver them to the recipients you name, collect signatures and the signing evidence that makes up the audit trail, produce sealed records, send the service emails and text messages the signing flow needs, keep backups, and support you when you ask. Signing emails never carry the document itself; in HIPAA mode the subject line is masked too.
• As required by law.
• Our own management and legal responsibilities, only if the use is necessary for them, and we disclose PHI for those purposes only when required by law or after the recipient gives us written assurances that it will keep the information confidential, use it only for the purpose it was given, and tell us of any breach of its confidentiality.

Nothing else. We do not sell PHI, use it for marketing, aggregate it, de-identify it for our own purposes, or use or disclose it in a way that would break Subpart E of 45 CFR Part 164 if you did it yourself. When we use or disclose PHI we limit it to the minimum necessary.

3. What we promise

• No other use or disclosure. We use and disclose PHI only as section 2 allows or as required by law.
• Safeguards. We keep the administrative, physical and technical safeguards the Security Rule (Subpart C of 45 CFR Part 164) requires for electronic PHI, and we comply with that Subpart. In practice: encryption in transit and at rest, access logging, no document content or field values in application logs, single-use expiring signing links, two-step verification for our own staff who could reach PHI, and tested backups. Our AWS account is covered by the AWS Business Associate Addendum.
• Reports to you. We tell you about any use or disclosure of PHI this agreement does not allow, any security incident that affects your PHI, and any breach of your unsecured PHI, without unreasonable delay and no later than 72 hours after we confirm it, and in every case within the 60 days 45 CFR 164.410 allows. The notice says what happened, when, which individuals we believe are affected, and the other details 45 CFR 164.410(c) lists, as we learn them, so you can make your own notifications. Unsuccessful attempts such as blocked log-in attempts, scans and pings are routine; we report them in summary if you ask in writing.
• Subcontractors. Anyone who creates, receives, keeps or sends PHI for us is bound in writing to the same restrictions and conditions as we are. Today that is Amazon Web Services, for hosting, storage, encryption keys and email delivery. Our text-message provider, Telnyx, delivers one-time signing codes. It receives only the phone number you gave for the recipient and the code itself, never a document, a name or the identity of your organization, so we treat it as a communications conduit rather than a business associate. Stripe handles billing and never receives documents, signers or PHI. We tell you at least 30 days before a new subcontractor starts handling PHI.
• Access. Your documents and audit trails are yours to view and export in Acceptie at any time. If an individual has a right of access under 45 CFR 164.524 to PHI we hold and you cannot reach it yourself, we give it to you within 10 business days of your written request. We do not answer individuals directly unless you ask us to.
• Amendment. A signed, sealed document is never altered. If you must amend PHI under 45 CFR 164.526, we keep the amendment you give us with the record and make it available to you within 10 business days of your written request.
• Accounting of disclosures. We keep the information 45 CFR 164.528 requires about our disclosures of PHI and give it to you within 10 business days of your written request. Delivering a document to a recipient you named is a disclosure you directed.
• Your obligations we carry out. Where we carry out one of your obligations under Subpart E of 45 CFR Part 164, we meet the requirements of that Subpart that apply to you when you perform it.
• Books and records. We make our internal practices, books and records about the use and disclosure of your PHI available to the Secretary of Health and Human Services to determine your compliance with the HIPAA Rules.

4. What you promise

• You send PHI only with HIPAA mode on, from a paid plan, and you require recipients to prove who they are before a document containing PHI opens (an email code or an access code you give them separately; Acceptie refuses "no verification" in HIPAA mode).
• You do not put PHI into the parts of a message that leave the service unprotected, such as the document title or the message to the recipient, and you name the correct recipient.
• You tell us about any limitation in your notice of privacy practices, any change in or revocation of an individual's permission, and any restriction you agreed to under 45 CFR 164.522, where it affects what we may do with PHI.
• You do not ask us to use or disclose PHI in a way that would break the HIPAA Rules if you did it yourself.
• You are responsible for your own compliance with the HIPAA Rules, for having the right to give us the PHI you send, and for your team members' use of your organization.

5. HIPAA mode and your plan

HIPAA mode is part of every paid Acceptie plan and is never available on Free. If your organization moves to Free or its subscription ends, HIPAA mode turns off and you must stop sending new PHI. Records you already sent keep their protections under this agreement. After you return to a paid plan, an owner or admin accepts the current version of this agreement again before HIPAA mode turns back on.

We never block your access to your own records to settle a payment dispute. While we hold PHI for you, you can always view and export it, whatever the state of your subscription.

6. Term and ending

This agreement starts when you accept it and lasts as long as HIPAA mode is on or we still hold PHI for you.

You may end it if you decide we have broken a material term and have not fixed it within 30 days of your written notice, or at once if a fix is not possible. We may stop you from sending new PHI if you use Acceptie in a way that breaks this agreement, but section 5 still applies to the records we hold.

When it ends, you export your records during the transition period the Acceptie terms give you. Then, where feasible, we return or destroy all PHI we still hold for you and keep no copies. Where that is not feasible, because of a retention lock you set on a record, a backup that is destroyed on its own schedule, or a record the law requires us to keep, this agreement continues to protect that PHI, we use and disclose it only for the purpose that makes return or destruction infeasible, and we destroy it when that purpose ends. The promises in section 3 survive for as long as we hold any PHI.

7. The rest

• A reference to a section of the HIPAA Rules means that section as amended and in force.
• We may change this agreement when the law or our service requires it. Each version is dated, the current version is always at this address, and a material change is emailed to your organization's owners 30 days before it takes effect; your owner or admin accepts the new version in Acceptie.
• Anything unclear is read in the way that lets both of us comply with the HIPAA Rules. Nothing here gives rights to anyone other than you and us.
• This agreement, the Acceptie terms and the privacy notice are the whole agreement about PHI. Florida law governs it, and disputes go where the terms say.
• We build Acceptie to the HIPAA standard and sign this agreement so that you can use it for PHI. We do not claim a HIPAA certification; none exists.

Contact

Notices under this agreement go to DigiMar Inc, 2079 Global Ct, Sarasota, FL 34240, and by email to help@acceptie.com. Security incidents: security@acceptie.com. Notices to you go to your organization's owners at the email addresses on their accounts.