This De-Identification & Data Use Addendum (the "Addendum") supplements the Business Associate Agreement (the "BAA") between TrichoMap LLC ("Business Associate," "TrichoMap," "we," "us") and the practice identified at signup ("Covered Entity," "Practice," "you"). Capitalized terms not defined here have the meanings given in the BAA or in the HIPAA Rules (45 C.F.R. Parts 160 and 164).
The Practice is a Covered Entity. TrichoMap provides software services to the Practice and, in doing so, acts as the Practice's Business Associate with respect to Protected Health Information ("PHI"). This Addendum sets out the Practice's express authorization for TrichoMap to create and use De-Identified Data, as permitted by 45 C.F.R. § 164.502(d) and § 164.514(a)-(b).
The Practice expressly authorizes TrichoMap to de-identify PHI that TrichoMap creates, receives, maintains, or transmits on the Practice's behalf, in accordance with the de-identification standard in Section 3. This authorization is granted under 45 C.F.R. § 164.502(d)(1), which permits a Business Associate to de-identify PHI where the BAA expressly so provides.
Once data has been de-identified in accordance with Section 3, it is no longer PHI and is no longer subject to the HIPAA Rules. The Practice expressly authorizes TrichoMap to retain, use, disclose, commercialize, and sublicense the resulting De-Identified Data for any lawful purpose, including:
(a) improving, developing, and training TrichoMap's products, services, algorithms, and models; (b) research, analysis, and publication; (c) licensing the De-Identified Data, in whole or in part, to third parties, including pharmaceutical and medical-device companies and research institutions.
This authorization survives termination of the BAA and of the Practice's subscription, as set out in Section 6.
TrichoMap de-identifies data using the Safe Harbor method under 45 C.F.R. § 164.514(b)(2), removing or reducing all eighteen (18) categories of identifiers with respect to the individual and the individual's relatives, employers, and household members. Without limiting that standard, TrichoMap specifically:
(a) strips file metadata (including EXIF data, GPS/geolocation, device identifiers, and embedded timestamps) from all images in the De-Identified Data set; (b) removes or reduces dates such that no date element more specific than year is retained in the De-Identified Data (visit timing is expressed as year and/or interval from a baseline, not as a calendar date); (c) severs linkage between the De-Identified Data and any direct identifier, record number, or contact information, so that the De-Identified Data cannot be readily linked back to an individual; and (d) retains no actual knowledge that the De-Identified Data could be used, alone or in combination with other reasonably available information, to identify an individual.
TrichoMap maintains an internal de-identification standard operating procedure documenting this process. TrichoMap may, in the future, additionally or alternatively use the Expert Determination method under 45 C.F.R. § 164.514(b)(1).
To the extent any rights in the De-Identified Data, the underlying de-identified images, the trichoscopy annotations, or the clinical scale data would otherwise vest in the Practice, the Practice grants TrichoMap a perpetual, irrevocable, worldwide, royalty-free, fully sublicensable and transferable license to use, reproduce, modify, create derivative works from, distribute, publish, and commercialize that data for the purposes described in Section 2.
As between the parties, TrichoMap exclusively owns all derivative and aggregated work product it creates from the De-Identified Data, including trained models, normalized or aggregated datasets, statistical and analytic outputs, and benchmarks. Nothing in this Addendum transfers ownership of the Practice's own clinical records or the source PHI to TrichoMap.
The authorizations and licenses in Sections 2, 4, and 5 are perpetual and irrevocable with respect to De-Identified Data created during the term, and survive termination or expiration of the BAA, this Addendum, and the Practice's subscription. Termination obligations in the BAA requiring return or destruction of PHI do not apply to De-Identified Data, which is not PHI.
The Practice represents that it has obtained, and will maintain, all patient authorizations, consents, and notices required under applicable law (including its Notice of Privacy Practices) sufficient to permit TrichoMap's de-identification and use of data as described in this Addendum.
This Addendum, and all authorizations and licenses granted in it, bind and benefit the parties' successors and permitted assigns. TrichoMap may assign this Addendum and the rights granted in it, including to a successor entity or in connection with a financing, merger, reorganization, or sale of assets, without the Practice's further consent.
If this Addendum conflicts with the body of the BAA on the subject of de-identification or use of De-Identified Data, this Addendum controls.