Version 3.0 | Effective from 20 September 2026 · Replaces version 2 · Entered into by contract, on request.
This Business Associate Agreement ("BAA") is entered into between F2W Brasil Ltda., CNPJ 60.943.300/0001-36, operator of the AutoJus services ("Business Associate" or "AutoJus"), and the customer that is a Covered Entity or a Business Associate under HIPAA and uses the Platform with Protected Health Information ("Customer"). It supplements the Terms of Use and the Data Processing Agreement (DPA) and prevails over them with respect to PHI. Where this BAA is silent, the DPA applies.
1.1. This BAA applies only when the Customer is subject to HIPAA and elects to process PHI on the Platform. It is executed by written contract; it is not implied by use of the Platform. 1.2. AutoJus is a Business Associate solely for PHI stored and processed in the Customer's workspace on the Platform (the "Console"). It is not a Business Associate for processing carried out by the AI providers contracted by the Customer (Section 4).
"HIPAA" means the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations at 45 CFR Parts 160 and 164, as amended, including the HITECH Act. "PHI" means Protected Health Information, including electronic PHI, as defined at 45 CFR 160.103, received from or created, maintained or transmitted on behalf of the Customer. "Breach", "Security Incident", "Subcontractor", "Unsecured PHI" and other capitalized terms not defined here have the meanings given in HIPAA.
3.1. AutoJus uses and discloses PHI only to provide the Platform services to the Customer, as permitted by this BAA, or as required by law. 3.2. AutoJus does not use PHI to train, fine-tune, evaluate or improve AI models (DPA §3.3), does not sell PHI, and does not use it for marketing. 3.3. AutoJus does not de-identify PHI and does not aggregate PHI across customers. 3.4. AutoJus will not use or disclose PHI in a manner that would violate Subpart E of 45 CFR Part 164 if done by the Customer.
4.1. The Platform sends content, including any PHI the Customer submits, to the AI provider (LLM, embeddings, OCR, web search) chosen by the Customer, using the Customer's API key and account (DPA §3.2). That provider is contracted by the Customer, not by AutoJus, and is not a Subcontractor of AutoJus. 4.2. The Customer is responsible for having a BAA, or an equivalent HIPAA-compliant arrangement, with each AI provider it uses with PHI — not only the language model: the OCR provider receives the whole file, and the embeddings and reranking provider receives passages of the document — and for selecting provider tiers and settings appropriate to PHI. AutoJus gives no assurance about any provider's handling of PHI. 4.3. The onboarding interview (Scan), which precedes contracting, transcribes media with an AutoJus API key at OpenAI. The Scan is outside this BAA; the Customer must not submit PHI to the Scan. 4.4. The Platform produces research and drafts; it does not file, send to third parties or sign (DPA §3.4, Terms §2.2). Any disclosure of PHI outside the Console is an act of the Customer.
5.1. AutoJus implements administrative, physical and technical safeguards that reasonably and appropriately protect the confidentiality, integrity and availability of ePHI, in accordance with Subpart C of 45 CFR Part 164, including: encryption in transit (TLS) and at rest; API keys encrypted (AES-256-GCM) and decrypted only in memory; logical isolation per workspace; role-based access control; and an audit log with named events and a per-record checksum (DPA §10.1). 5.2. Processing and storage of the Console take place in a single region in São Paulo, Brazil (Vercel gru1, Supabase sa-east-1). Content sent to AI providers under Section 4 leaves that region to wherever the provider contracted by the Customer processes it. No PHI passes through an account of AutoJus at any AI provider. 5.3. AutoJus does not, at this date, hold third-party certification (SOC 2, HITRUST, ISO 27001). Evidence of safeguards is provided on request, within 30 business days (DPA §10.3).
6.1. AutoJus ensures that any Subcontractor that creates, receives, maintains or transmits PHI on its behalf agrees in writing to restrictions and conditions at least as stringent as those in this BAA. The Subcontractors that may handle PHI are Supabase (database and storage, sa-east-1) and Vercel (application execution, gru1, PHI in transit only). Stripe, Resend, GitHub and, if enabled with visitor consent, Google Analytics do not receive PHI (DPA §6). 6.2. Changes to Subcontractors are notified 30 days in advance; the Customer may object and terminate (DPA §6.2).
7.1. AutoJus reports to the Customer any Security Incident of which it becomes aware, and any Breach of Unsecured PHI, without unreasonable delay and no later than 10 business days after discovery, with the information required by 45 CFR 164.410(c) as then available, supplemented as it becomes known. 7.2. The parties agree that unsuccessful attempts that do not result in unauthorized access, use, disclosure, modification or destruction of PHI (such as pings, port scans and blocked login attempts) are reported in aggregate on request rather than individually. 7.3. AutoJus cooperates with the Customer's risk assessment and, if requested, with notifications to individuals, HHS and media that are the Customer's responsibility.
8.1. The Customer has direct access, through the Platform, to the PHI in its workspace and can correct or delete it itself. Where the Customer needs AutoJus's assistance to respond to a request for access (45 CFR 164.524), amendment (164.526) or an accounting of disclosures (164.528), AutoJus responds within 15 business days. 8.2. If an individual contacts AutoJus directly, AutoJus forwards the request to the Customer within 5 business days and does not respond on the Customer's behalf.
AutoJus makes its internal practices, books and records relating to the use and disclosure of PHI available to the Secretary of HHS for purposes of determining the Customer's compliance with HIPAA.
10.1. This BAA is effective while the Customer's agreement with AutoJus is in force and PHI remains on the Platform. 10.2. Either party may terminate on material breach not cured within 30 days of written notice. Where cure is not feasible, the Customer may terminate immediately. 10.3. Return. On request, before or after termination, AutoJus delivers a full export of the Customer's files, skills and history in open formats (DOCX/PDF; JSON for metadata and history), at no cost, within 30 days (DPA §11.2). 10.4. Destruction. After termination, AutoJus deletes all PHI under its direct responsibility within 90 days and confirms in writing (DPA §11.3). Where return or destruction is infeasible because of a legal retention obligation, AutoJus extends the protections of this BAA to that PHI, limits further uses and disclosures to the purposes that make return or destruction infeasible, and destroys it when the obligation ends. 10.5. Media files (audio and video) are removed when transcription completes or, at most, 60 days after upload, by a daily routine; at this date the routine does not reach media whose processing failed. Transcripts remain in the workspace until deletion under 10.4.
This section states what exists today so that the obligations above are read against it. Export (10.3) and deletion (10.4) are procedures carried out by a person on request to admin@autojus.com; there is no self-service routine. The audit log records named events with a per-record checksum; it does not, at this date, record login and logout, nor individual read or download access to documents by the Customer's users or by AI processes. It records access to the Client Portal, chat messages in it and downloads made by third parties through it, without the file name. AutoJus holds no third-party certification. This section is updated whenever any of these facts changes, and the version number of this BAA changes with it.
12.1. Any ambiguity is resolved to permit compliance with HIPAA. References to HIPAA include amendments in force. If HIPAA is amended in a way that requires changes to this BAA, the parties amend it accordingly. 12.2. This BAA is governed, as to the contractual relationship, by the Terms of Use (Section 9); HIPAA terms are construed under United States federal law. 12.3. This BAA is published in English, Portuguese and Spanish. The English version prevails for the interpretation of HIPAA terms.
Privacy, Security Incidents and Breaches: privacy@autojus.com Operations, export and deletion: admin@autojus.com F2W Brasil Ltda. — CNPJ 60.943.300/0001-36 — Florianópolis, Brazil