KokuaOS — HIPAA / BAA Eligibility Notice

KokuaOS's public position on Protected Health Information: PHI is prohibited by default, and use is available only under an approved HIPAA-enabled deployment with a signed Business Associate Agreement.

Capitalized terms have the meanings in the KokuaOS Definitions Schedule (kokuaos.com/legal/definitions).

1. Summary and Purpose

This Notice explains when and how the Services may be used with Protected Health Information ("PHI") governed by the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations at 45 C.F.R. Parts 160, 162, and 164, as amended, including by the HITECH Act (together, the "HIPAA Rules").

KokuaOS is not universally "HIPAA-ready," and the Services are not designed or approved for PHI by default. KokuaOS offers configurable controls "designed to support" Customer compliance programs, but use of the Platform alone does not make any party compliant with the HIPAA Rules. PHI may be Processed through the Services only under an approved HIPAA-enabled deployment and a separate, signed Business Associate Agreement ("BAA"), as described below.

This Notice supplements the Compliance & Shared Responsibility Policy (kokuaos.com/legal/shared-responsibility) and the Agreement and does not modify either except as expressly stated.

2. Default Position — No PHI

2.1 PHI is prohibited by default. Unless and until Customer has an active, KokuaOS-approved HIPAA-enabled deployment and a signed BAA in effect, Customer must not submit, transmit, store, configure, or otherwise cause the Services to Process any PHI, and must not use the Services to create, receive, maintain, or transmit PHI on behalf of a covered entity or business associate.

2.2 Not a business associate by default. Absent a signed BAA, KokuaOS does not act as a "business associate" (as defined in 45 C.F.R. § 160.103) with respect to Customer, and no course of dealing, configuration, or use of the Services creates a business-associate relationship or a BAA by implication.

2.3 Customer responsibility for exclusion. Customer is responsible for configuring its use of the Services — including Knowledge Base content, prompts, Communication Channels, recording and transcription settings, and the Compliance Shield — so that PHI is not introduced into the Services outside an approved HIPAA-enabled deployment.

3. Requesting a HIPAA-Enabled Deployment

3.1 Customer must request eligibility. A Customer that requires the Services to Process PHI must request a HIPAA-enabled deployment in writing before submitting any PHI. Eligibility is not automatic and is not included in standard subscriptions.

3.2 KokuaOS approval required. A HIPAA-enabled deployment is available only where KokuaOS approves, in its discretion and in writing, each of the following for the specific deployment: (a) the intended use case; (b) the providers and Subprocessors involved; (c) the system architecture and data flows; (d) data retention and deletion configuration; (e) the security configuration and controls; and (f) the operating procedures applicable to the deployment. KokuaOS may decline, condition, or later withdraw eligibility where these requirements are not met or are no longer met.

3.3 Signed BAA required. Where KokuaOS approves a HIPAA-enabled deployment and the HIPAA Rules require a business-associate contract, the parties must execute a BAA before any PHI is Processed. The KokuaOS Business Associate Agreement template (kokuaos.com/legal/hipaa) is provided as a future / attorney-review template and becomes available for execution only when KokuaOS operations are HIPAA-ready for the applicable deployment; it is not offered generally. The signed BAA, once executed, governs the parties' respective obligations with respect to PHI.

4. Conditions of Eligibility

A HIPAA-enabled deployment is subject to the following conditions, each of which is continuing:

1. an approved architecture, provider set, retention configuration, and set of operating procedures, used without unapproved modification;
2. a signed BAA in effect for the deployment;
3. use of PHI limited to the approved Communication Channels, features, and data stores, and excluded from any feature, channel, or environment not approved for PHI;
4. configuration consistent with the minimum-necessary principle and with Customer's own HIPAA obligations; and
5. any additional technical, contractual, or operational requirements KokuaOS reasonably specifies for the deployment.

If any condition ceases to be met, KokuaOS may suspend the HIPAA-enabled deployment or require that PHI Processing stop, consistent with the Agreement and the suspension provisions of the Master Terms & Conditions.

5. BYO Providers and PHI

5.1 Independent HIPAA support required. Where a HIPAA-enabled deployment uses BYO Providers (for example, a Customer's own carrier, telephony/DID, LLM, speech, messaging, storage, or cloud provider), those BYO Providers must independently support HIPAA to the extent they create, receive, maintain, or transmit PHI, and Customer must enter into any business-associate agreement or other agreement required by the HIPAA Rules directly with each such BYO Provider.

5.2 Not KokuaOS Subprocessors. BYO Providers are selected and controlled by Customer, are Third-Party Services, and are not KokuaOS Subprocessors. KokuaOS is not responsible for the HIPAA compliance, security, availability, or acts or omissions of Customer's BYO Providers, and a KokuaOS BAA does not cover BYO Providers.

6. Shared Responsibility

6.1 Customer remains responsible for its HIPAA obligations. Compliance with the HIPAA Rules is a shared responsibility. Customer remains responsible for its own obligations as a covered entity or business associate, including its risk analysis and risk management, workforce training and sanctions, policies and procedures, notice of privacy practices, honoring individual rights, minimum-necessary determinations, obtaining any required authorizations, and its own breach-assessment and notification obligations.

6.2 KokuaOS role. KokuaOS provides configurable controls, including the Compliance Shield, "designed to support" Customer compliance programs. KokuaOS is not a covered entity, healthcare provider, health plan, healthcare clearinghouse, or legal or compliance advisor, and does not determine Customer's compliance obligations. Nothing in this Notice or the Services constitutes legal, medical, or compliance advice.

6.3 AI Output. AI Output is not medical advice and may be inaccurate, incomplete, or otherwise unsuitable. Customer must maintain qualified human review before relying on AI Output for any clinical, eligibility, or other high-risk or legally significant decision, consistent with the AI-output and human-oversight terms of the Agreement.

7. No Certification; Disclaimer

7.1 KokuaOS does not represent that it is HIPAA "certified" or that the Services, by themselves, satisfy the HIPAA Rules. Statements that the Services are "designed to support" HIPAA compliance are not warranties of compliance.

7.2 EXCEPT AS EXPRESSLY STATED IN A SIGNED BAA OR THE AGREEMENT, THE SERVICES AND ALL RELATED MATERIALS ARE PROVIDED "AS IS" AND "AS AVAILABLE," AND THE KOKUAOS PARTIES DISCLAIM ALL WARRANTIES TO THE FULLEST EXTENT PERMITTED BY LAW, AS SET OUT IN THE AGREEMENT. The KokuaOS Parties are intended third-party beneficiaries of the disclaimers and limitations in the Agreement.

7.3 Liability. Liability arising out of or related to this Notice is subject to the "Limitation of Liability" section of the Master Terms & Conditions (kokuaos.com/legal/master-terms) and, where a BAA is in effect, to the terms of that BAA, in each case except to the extent applicable law requires otherwise.

8. How to Request

To request a HIPAA-enabled deployment or a BAA, contact KokuaOS at compliance@kokuaos.com or through the Trust Center (/trust). Submitting a request does not create a HIPAA-enabled deployment, a BAA, or any obligation for KokuaOS to approve the request.

9. Changes to This Notice

KokuaOS may update this Notice from time to time as its capabilities and the HIPAA Rules evolve, in accordance with the Policy-update terms of the Master Terms & Conditions. The version in effect when the Services are used applies.