Business Associate Agreement

Sindi Inc. (“Sindi”) receives patient information from prescribers, hospitals, dental practices, and other providers of healthcare (each a, “Provider”) in the course of performing its services. Such information is submitted via various methods and technologies, including, without limitation, web portals and software platforms. Where that information constitutes Protected Health Information as defined in the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), and HIPAA requires that Sindi enter into a business associate agreement (“BAA”) with the Provider, and either (i) Sindi has not agreed to a different BAA, including, without limitation, via registration, click-wrap, reference, or similar mechanism or (ii) a valid authorization for the patient is not on file applicable to the disclosure (including, without limitation, with the Provider), the below BAA will apply. By sending patient information in the absence of any of the foregoing, and where required by HIPAA, the Provider sending the information agrees to the below BAA. Questions about the BAA may be submitted using the form below.

BUSINESS ASSOCIATE AGREEMENT

This Business Associate Agreement (BAA) between Sindi Inc. and you (“Covered Entity”) is entered into for the purposes of complying with the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), Public Law 104-191, the Health Information Technology for Economic and Clinical Health Act (the “HITECH Act”), Public Law 111-005, and the regulations promulgated thereunder; 45 C.F.R. Parts 160 and Part 164, Subparts A, C, D and E (Subpart E, together with the definitions in Subpart A is known as the “Standards for Privacy of Individually Identifiable Health Information” (the “Privacy Rule”) and Subpart C, together with the definitions in Subpart A, is known as the “Security Standards for the Protection of Electronic Protected Health Information” (the “Security Rule”) Subpart D, together with the definitions in Subpart A is known as the “Breach Notification Rule” (“Breach Notification Rule”) (the Privacy Rule, Breach Notification Rule and the Security Rule are collectively called the “Privacy and Security Rules”). Use of Sindi’s tools and services by Covered Entity indicate Covered Entities acceptance of the terms and conditions of this BAA, and delivery of such tools and performance of such services to Covered Entity by Sindi indicate acceptance of the same by Sindi.

SINDI’S PERMITTED USES AND RESPONSIBILITIES WITH RESPECT TO USE AND DISCLOSURE OF PROTECTED HEALTH INFORMATION (PHI)

Sindi may Use and Disclose PHI for the purposes of performing patient insurance eligibility, benefit verification, prior authorization services, patient eligibility for financial support services, to perform the other services accessed in this site or portal, and as otherwise permitted under this BAA or required by law. Sindi shall not Use or Disclose PHI in any manner that would constitute a violation of Subpart E of 45 C.F.R. Part 164 if so Used or Disclosed by Covered Entity. Without limiting the generality of the foregoing, Sindi is permitted to (i) Use PHI for the proper management and administration of Sindi; and (ii) Use and Disclose PHI to carry out the legal responsibilities of Sindi, provided that with respect to any such disclosure either: (a) the disclosure is required by law; or (b) Sindi obtains reasonable assurances from the person to whom the PHI is to be disclosed that such person will hold the PHI in confidence and will not Use and further Disclose such PHI except as required by law and for the purpose(s) for which it was disclosed by Sindi to such person, and that such person will notify Sindi of any instances of which it is aware in which the confidentiality of the PHI has been breached.

Sindi may also use PHI: (i) report to Covered Entity, in writing, any material use and/or disclosure of PHI by Sindi that is not permitted or required by this agreement of which Sindi becomes aware; or (ii) to use commercially reasonable efforts to maintain the security of the PHI and to prevent its Use and/or Disclosures contrary to this BAA.

To the extent that Sindi creates, receives, maintains or transmits electronic protected health information (ePHI) as that term is defined by the security rule, on behalf of Covered Entity, Sindi may use PHI and ePHI to report to Covered Entity any security incident of which Sindi becomes aware to the extent such incidents represent successful unauthorized access, use, disclosure, modification, or destruction of information or interference with system operations in an information system that contains or has access to the ePHI of Covered Entity. Sindi is not required to report “pings” on Sindi’s firewall, broadcast attacks, unsuccessful login attempts, or similar unsuccessful security incidents provided that they do not result in the unpermitted access, use, or disclosure of ePHI or PHI.

Sindi will require any subcontractors and agents utilized in providing the services which use and/or Disclose the PHI to agree, in writing, to adhere to substantially similar restrictions and conditions on the Use and/or Disclosure of the PHI that apply to Sindi pursuant to this BAA

SAFEGUARDS

Sindi shall employ appropriate administrative, technical and physical safeguards, consistent with the size and complexity of Sindi’s operations, to protect the confidentiality of PHI and to prevent the Use or Disclosure of PHI in any manner inconsistent with the terms of this BAA, including meeting the requirements of 45 C.F.R. §§ 164.308, 164.310, 164.312, 164.314, and 164.316, which includes Sindi’s obligation to have written policies and procedures in place to document its administrative, technical and physical safeguards.

ACCESS REQUESTS

Sindi shall process Covered Entity’s requests to access records in the Designated Record Set and identified by Covered Entity so that Covered Entity can comply with 45 C.F.R. § 164.524.

AMENDMENT REQUESTS

Sindi shall process Covered Entity’s requests for amendment of the PHI in Sindi’s possession, solely upon Covered Entity’s request and in a manner that allows Covered Entity to comply with 45 C.F.R. § 164.526 and in a manner that is consistent with the manner in which Covered Entity is amending the PHI in Covered Entity’s possession.

ACCOUNTING OF DISCLOSURES

The Parties agree that Sindi shall track and keep a record of all Disclosures of PHI, and that Sindi shall provide to Covered Entity the information necessary for Covered Entity to provide an accounting of Disclosures, in a manner compliant with 45 C.F.R. §164.528, to individuals who request an accounting. In each case Sindi shall provide at least the following information with respect to each such Disclosure: (a) the date of the Disclosure; (b) the name of the entity or person who received the PHI; (c) a brief description of the PHI disclosed; (d) a brief statement of the purpose of such Disclosure which includes an explanation of the basis for such Disclosure. In the event that Sindi receives a request for an accounting directly from an individual, Sindi shall forward such request to Covered Entity in writing.

MEET COVERED ENTITY OBLIGATIONS WHERE APPROPRIATE

If Sindi will perform a service for Covered Entity that is an obligation of Covered Entity under the Privacy Rule, to meet the applicable requirements in the performance of that service.

DE-IDENTIFICATION/DATA AGGREGATION

Sindi may de-identify PHI for lawful purposes, so long as such de-identification conforms to the requirements of 45 C.F.R. § 164.514, as may be amended from time to time. Additionally Sindi may provide data aggregation services relating to the health care operations of Covered Entity.

REQUESTS FROM SECRETARY OF HEALTH AND HUMAN SERVICES

If Sindi receives a request, made by or on behalf of the Secretary of the United States Department of Health and Human Services (the “Secretary”), requiring Sindi to make its internal practices, books, and records relating to the Use and Disclosure of the PHI created or received by Sindi on behalf of Covered Entity available to the Secretary for the purpose of determining Covered Entity’s and/or Sindi’s compliance with HIPAA, then Sindi shall make its internal practices, books and records available to the Secretary or the Secretary’s authorized representative.

MINIMUM NECESSARY

Covered Entity shall provide, and Sindi shall request, Use and Disclose, only the minimum amount of PHI necessary to accomplish the purpose of the request, Use or Disclosure. The Parties acknowledge that the Secretary may issue guidance with respect to the definition of “minimum necessary” from time to time, and agree to stay informed of any relevant changes to the definition.

REPORTING OF SECURITY BREACHES

In the event of a “Breach” of any “Unsecured” PHI that Sindi accesses, maintains, retains, modifies, records, stores, destroys, or otherwise holds or uses on behalf of Covered Entity, Sindi shall report such Breach to Covered Entity as soon as practicable, but in no event later than ten (10) business days after the date on which the Breach is discovered. “Breach” shall mean the unauthorized acquisition, access, Use, or Disclosure of PHI which compromises the security or privacy of such information, except where an unauthorized person to whom the information is disclosed would not reasonably have been able to retain such information. “Unsecured PHI” shall mean PHI that is not rendered unusable, unreadable, or indecipherable to unauthorized individuals through the use of a technology or methodology specified by the Secretary (e.g., encryption). Notice of a Breach shall include, to the extent such information is available: (i) the identification of each individual whose PHI has been, or is reasonably believed to have been, accessed, acquired, or disclosed during the Breach, (ii) the date of the Breach, if known, and the date of discovery of the Breach, (iii) the scope of the Breach, and (iv) Sindi’s response to the Breach.

RESPONSIBILITIES OF COVERED ENTITY

With regard to the Use and/or Disclosure of the PHI by Sindi, Covered Entity hereby agrees:

that the Uses and Disclosures of the PHI by Sindi pursuant to this BAA are, at the time of execution and throughout the term of this BAA will be, consistent with the form of notice of privacy practices (the “Notice”) that Covered Entity provides to individuals pursuant to 45 C.F.R. § 164.520.

1. To notify Sindi, in writing and in a timely manner, of any arrangements permitted or required of Covered Entity under 45 C.F.R. parts 160 and 164 that may impact in any manner the Use and/or Disclosure of the PHI by Sindi under this BAA including, but not limited to, restrictions on Use and/or Disclosure of the PHI as provided for in 45 C.F.R. § 164.522 agreed to by Covered Entity, and to hold Sindi harmless from the financial impact of any such agreement by Covered Entity; and

2. To obtain any consent or authorization that may be required under HIPAA or state law prior to furnishing the PHI to Sindi.

TERM

Unless otherwise terminated as provided below, this BAA shall become effective on the Effective Date and shall have a term that shall run concurrently with that of any oral or written agreement by Sindi to provide services to Covered Entity and will terminate without any further action of the Parties upon the termination of all such agreements.

TERMINATION

If either Party determines that the other Party has engaged in a pattern of activity that constitutes a material breach of the other Party’s obligations under this BAA, the non-breaching Party shall, within twenty (20) days of that determination, notify the breaching Party and the breaching Party shall have thirty (30) days from receipt of that notice to cure the breach or end the violation. If the breaching Party fails to take reasonable steps to effect such a cure within such a time period, the non-breaching Party may terminate all or part of the service relationship. In no event shall such termination have any effect on sums due from Covered Entity for any services provided by Sindi under the engagement.

Where either Party has knowledge of a material breach by the other Party, and cure is not possible, the nonbreaching Party shall terminate the portion of the arrangement for Services affected by the breach.

EFFECT OF TERMINATION

Upon the event of termination of this BAA, Sindi agrees, where feasible, to return or destroy the PHI, which Sindi still maintains in any form. Prior to doing so, Sindi further agrees, to the extent feasible, to request the destruction of the PHI that is in the possession of its subcontractors or agents. If in Sindi’s opinion, itis not feasible for Sindi or any subcontractors to return or destroy portions of the PHI, Sindi shall, upon Covered Entity’s written request, inform Covered Entity as to the specific reasons that make such return or destruction infeasible and limit any further use or disclosures to the purposes that make the return or destruction of those portions of the PHI infeasible and provide the protections described herein to that PHI.

THIRD PARTY BENEFICIARIES

Nothing in this BAA shall be construed to create any third party beneficiary rights in any person.

COUNTERPARTS

This BAA may be executed in any number of counterparts, each of which shall be deemed an original. Electronic copies thereof shall be deemed to be originals.

INFORMAL RESOLUTION

If any controversy, dispute or claim arises between the Parties with respect to this BAA, the Parties shall make good faith efforts to resolve such matters informally.

LIMITATION ON LIABILITY

Neither Party shall be liable to the other party for any incidental, consequential or punitive damages of any kind or nature, whether such liability is asserted on the basis of contract, tort (including negligence or strict liability), or otherwise, even if the other Party has been advised of the possibility of such loss or damages.

NOTICES

All notices, requests, approvals, demands and other communications required or permitted to be given under this BAA shall be in writing and delivered either personally, or by certified mail with postage prepaid and return receipt requested, or by overnight courier to the party to be notified. All communications will be deemed given when received. The addresses of the parties shall be as follows; or as otherwise designated by any party through notice to the other party:

If to Sindi:

Sindi Inc.

337 El Dorado Street, Suite A-1 Monterey, CA 93940

Notices to Sindi may also be sent via e-mail to info@sindireferrals.com.

INTERPRETATION

The provisions of this BAA shall prevail over any provisions in any other agreements between Sindi and Covered Entity that may conflict or appear inconsistent with any provision of this BAA. This BAA shall be interpreted as broadly as necessary to implement and comply with HIPAA and the HITECH Act. The Parties agree that any ambiguity in this BAA shall be resolved in favor of a meaning that complies with and is consistent with HIPAA and the HITECH Act.

Last Updated: January 8, 2026

1. WHO WE ARE & WHAT THIS IS

At Sindi Inc. ("Sindi"), our mission is to facilitate referrals and the sharing of patient information between general practice dentists and specialist dentists by using our software platform and proprietary technology (the "Service"). To fulfil this mission, we collect information about (1) general dental health providers and dental specialists that use Sindi to support their dental practices, who we refer to collectively as "Dentists,"; (2) the patients who are referred from or to Dentists using Sindi, who we refer to as "Patients," and (3) our visitors to the Sindi website, or anyone contacting Sindi support, who we refer to as "Visitors." Collectively, we refer to Dentists, Patients, and Visitors in this policy as User, Users, or you. The websites and software applications governed by this policy include sindireferrals.com.

Your privacy is important to us. This privacy policy (this “Privacy Policy”) outlines:

Why we collect personal information
What personal information we collect and when it is collected
How your information is used and protected
When and with whom your information is shared
Your choices regarding your personal information

We encourage you to read this Privacy Policy and our Terms of Use and Cookie Policy carefully. Capitalized terms used but not defined in this Privacy Policy have the meaning given them in the Terms of Use. We will post notices of all changes that materially affect the way in which your personally identifiable information may be used or shared in updates to our Privacy Policy.

Sindi reserves the right to modify this Privacy Policy at any time, in our sole discretion. We may modify this Privacy Policy by providing notice via one of the following methods. For material modifications, we provide notice by email to the email account used by you to access the Services. For other modifications, we update the ‘last updated’ date listed above. By continuing to use the Service you confirm that you agree to the modified Privacy Policy.

If you have any questions about this Privacy Policy, please contact us at:

Email address: info@sindireferrals.com

Postal address: Sindi Inc. 337 El Dorado Street, Suite A-1 Monterey, CA 93940

2. INFORMATION WE COLLECT

We get information about you in a range of ways.

Information You Give Us. We collect the following personal information when you sign up for Sindi, when you use our Services, or when you otherwise provide us information. Generally, we need this information for you to be able to use our Services. Information we collect from you may include:

Personally identifiable information such as your and your employees or contractors’ names, email addresses, postal addresses, and telephone numbers.
Financial information, such as your zip code, the last four digits of your credit card, and bank account information; and
Feedback and correspondence, such as information you report a problem with Service, receive support or otherwise correspond with us.

Information We Get From Others. We may get information about you from other third-party sources and we may add this to information we get from your use of the Services. Such information may include:

Payment using Third Party Payment Platform: To pay the fees associated with the Service, payment is processed using a Third-Party Payment Platform. By using a Third-Party Payment Platform, we never receive your complete financial information, such as your complete credit card number. We currently use Stripe to process payments and the processing of your payment is subject to Stripe's Privacy Policy.
Personal Health Information: The Service allows Dentists to refer patients through the Service, and accordingly Dentists give us a Patient's insurance information, health records and other health-related content such as x-rays or diagnoses. These Patient health records may be uploaded to the Service for the purpose of a Dentist referral. While we are not a Covered Entity, as defined by the Health Insurance Portability and Accountability Act of 1996, Public Law No. 104-191 ("HIPAA"), the Dentist uploading Patient personal health information is and will be bound by HIPAA. We recommend reviewing our Business Associate Agreement in place with all Dentists BAA for more information.

Information Automatically Collected. We may automatically record certain information about how you use our Service. This may include information such as a User’s Internet Protocol (IP) address, device and browser type, operating system, the pages or features of our websites to which a User browsed and the time spent on those pages or features, the frequency with which the websites are used by a User, search terms, the links on our websites that a User clicked on or used, and other statistics. We use this information to administer the Service and we analyze (and may engage third parties to analyze) this information to improve and enhance the Service by expanding its features and functionality and tailoring it to our Users’ needs and preferences.

We also use cookies, local storage, or similar technologies to analyze trends, administer the websites, track Users’ movements around the websites, and to gather demographic information about our User base as a whole. Users can control the use of cookies and local storage at the individual browser level.

We also may use Google Analytics to help us offer you an optimized User experience. You can find more information about Google Analytics’ use of your personal data here.

For detailed information on the information we automatically collect, please see our Cookie Policy.

Others’ Personal Information.In using our Service, you may provide us with the personal information of others (for example, the names and addresses of your employees). Legally speaking, we are only a “service provider” of such information.

As your service provider, we only process (collect, use, disclose, etc.) such information as directed by you for the exclusive purpose of providing you our Service. For example, we will never use your employees’ information to independently market or advertise to them unless they are also using our Service directly. We also do not and will not “sell” information.

You are responsible for the personal information of others that you disclose to us via our Service and for ensuring that your instructions regarding the processing of such information complies with applicable data protection laws.

3. HOW WE USE AND SHARE THE INFORMATION WE COLLECT

Use: We use the personal information we collect from you to provide you with our Service, to fulfill a contractual obligation, to improve our Services or where we need your personal information for a legitimate business interest. These legitimate interests include:

verifying your or your business’ identity;
contacting you as needed to provide with the Service (including by sending you text or SMS messages, if you have opted in to receiving them);
preventing risk and fraud (for example, to detect and protect Sindi and other third parties against error, negligence, breach of contract, fraud, theft and other illegal activity, and to audit compliance with Sindi’s policies and contractual obligations);
answering questions or providing other types of support;
providing, securing, debugging and improving our Services and website;
providing reporting and analytics;
testing out features or additional services;
understanding your needs and eligibility for products and services;
complying with legal and regulatory requirements; and
enforcing our Terms of Use and / or compliance with this Privacy Policy.

We may also collect and use your personal information for any other purpose to which you consent. We only collect the personal information we consider necessary for achieving these purposes.

We may use information that is aggregated or de-identified so that it is no longer reasonably associated with an identified or identifiable natural person for any business purpose.

Share:We will not share your personal information or User data except to perform the Services as described herein or unless you authorize us to. We may provide aggregate usage and demographic reports and information to service partners to help them understand our audience and target their communications accordingly, but not in a way that could identify our Users personally.

In the normal course of business Sindi may share your information with individuals (such as employees, contractors and lawyers) and companies (such as consultants, partners, vendors, or service providers such as our hosting service provider, text messaging service provider, and compliance management provider) to perform tasks on our behalf and may need to share certain information, including your name and email address, with them in order to provide improved products or services to our Users. However, our agents do not have any right to use the information we share with them beyond what is necessary to assist us in providing the service to you as described in this Privacy Policy.

Sometimes we may be required to share your information in response to a regulation, court order or subpoena. We may also share information when we believe it's necessary to comply with the law or to respond to a government request or when we believe disclosure is necessary or appropriate to protect the rights, property or safety of Sindi, our Dentists, or others; to prevent harm or loss; or in connection with an investigation of suspected or actual unlawful activity.

We may also share your information in the event of a corporate sale, merger, acquisition, dissolution or similar event.

4. HOW WE STORE AND PROTECT THE INFORMATION WE COLLECT

Sindi uses reasonable security measures to store and protect the information under our control and appropriately limit access to it. However, we cannot ensure or warrant the security of any information you transmit to us, and you do so at your own risk.

We use a variety of information security measures to protect your online transactions with us. The Service uses encryption technology, such as Secure Sockets Layer (SSL), to protect your sensitive personal information during data transport.

We want you to feel confident using the Services. However, no system can be completely secure. Therefore, although we take steps to secure your information, we do not promise, and you should not expect, that your personally identifiable information, usage data or other communications will always remain secure. We will notify you by email if we have reason to believe that your personal information has been compromised due to a security breach or used in an unauthorized manner, but by using this Service, in accordance with the Terms of Use you agree to release us from any and all claims arising out of unauthorized use of your information.

5. YOUR CHOICES REGARDING THE INFORMATION WE COLLECT

You may choose to:

Update and correct your personal information;
Object to the processing of your personal information;
Request to have your personal information or usage data deleted or restricted from our Service;
Request for portability of your personal information;
Cancel your account; and/or
Stop receiving text or SMS messages or email communications from us.

To do any of these, simply notify us of this decision by one of these methods:

Follow the unsubscribe link in any marketing email or following the directions included in any other promotional material received from Sindi;
Send an email to us at info@sindireferrals.com; and/or
To stop receiving text or SMS messages, follow the instructions in the text or SMS message (i.e., reply “STOP” to the text message) or at the bottom of the applicable email communication (i.e., click the “Unsubscribe” button).

We reserve the right to refuse to accommodate a request to change information if we believe the change would violate any law or legal requirement or cause the information to be incorrect.

Data Retention

We will retain your profile information and usage data for as long as your account is active or as needed to provide you services, comply with our legal obligations, resolve disputes, and enforce our agreements. If you close your account, we may still retain certain information associated with your account for a limited period of time thereafter unless you request that we delete it sooner in accordance with data privacy laws. We retain this information for analytical purposes and recordkeeping integrity, as well as to prevent fraud, collect any fees owed, enforce our terms and conditions, take actions we deem necessary to protect the integrity of our web site or our Users, or take other actions otherwise permitted by law. Deactivating your account does not automatically delete your account or usage data from our database, but regardless of any retention policy we will make reasonable efforts to enable you to delete your profile and personally identifiable information from our database upon request. To request that we delete your information, please contact us at info@sindireferrals.com.

6. THIRD PARTY SERVICES AND LINKS TO OTHER WEBSITES

Our website may contain links to other websites including those of our service partners and other service providers, many of which have their own privacy policies. Be sure to review the privacy policy on any site you are visiting, whether directly or through the Service.

Additionally, we integrate third party services into our Service. This policy only covers the collection and use of information by Sindi. Integrations may include, but are not limited to, the following:

For payment processing: As noted above, we currently use Stripe to process payments, which is subject to Stripe's Privacy Policy.

Other third party services are provided by Twilio, Slack, Auth0, Vanta and any other third party services.

8. NOTICE TO CALIFORNIA RESIDENTS

This Privacy Notice for California Residents supplements the information contained in this Privacy Policy and applies solely to all visitors, users, and others who reside in the State of California. We adopt this notice to comply with the California Consumer Privacy Act of 2018 (the “CCPA”) and any terms defined in the CCPA have the same meaning when used in this Notice.

For more details about the personal information we collect from you, please see the “What We Collect” section above. We collect this information for the business and commercial purposes described in the “Information We Collect” section above. We share this information with the categories of third parties described in the “Share” section above. Sindi does not sell (as such term is defined in the CCPA) the personal information we collect (and will not sell it without providing a right to opt out).

Subject to certain limitations, the CCPA provides California consumers the right to request to know more details about the categories or specific pieces of personal information we collect (including how we use and disclose this information), to delete their personal information, to opt out of any “sales” that may be occurring, and to not be discriminated against for exercising these rights. Please see the “Your Choices” section above or contact us at info@sindireferrals.com for more information about these rights or to exercise these rights.

Non-Discrimination:

We will not discriminate against you for exercising any of your CCPA rights. Unless permitted by the CCPA, we will not:

Deny you goods or services;
Charge you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties;
Provide you a different level or quality of goods or services; or
Suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services.

California's "Shine the Light" law (Civil Code Section § 1798.83) permits users of our Website that are California residents to request certain information regarding our disclosure of personal information to third parties for their direct marketing purposes. To make such a request, please send an email to info@sindireferrals.com.

9. ADDITIONAL INFORMATION

Children's privacy

We restrict use of the Service to individuals age 18 and above, and do not knowingly seek or collect personal information from anyone under the age of 18.

Using the Services from outside the United States

This Privacy Policy is intended to cover collection of information from residents of the United States and is not intended for Users located outside the United States. If you are accessing the Service from outside the United States, please be aware that your information may be transferred to, stored, and processed in the United States where our servers are located, and our central database is operated. The data protection and other laws of the United States and other countries might not be as comprehensive as those in your country. By using the Service, you understand that your information may be transferred to our facilities and those third parties with whom we share it as described in this Privacy Policy.

Ready to try it out? Join for free today

Sindi exists because communication is now the bottleneck.

Join for Free

Ready to try it out? Join for free today

Sindi exists because communication is now the bottleneck.

Join for Free

Ready to try it out? Join for free today

Sindi exists because communication is now the bottleneck.

Join for Free