HIPAA and BAAs — Exhibit A — scope of services (2)

Excluded from PHI scope unless the parties agree otherwise in writing: (a) Optional AI features. AI assistance is invoked per request and sends the content relevant to that request to the AI subprocessor listed on the compliance page. Unless AI coverage is expressly included in the executed copy, Covered Entity will not direct AI features at PHI, and Business Associate provides workspace-level controls to restrict their use. (b) Customer-configured outbound email. The content of emails Covered Entity itself configures the Services to send (automation emails, scheduled digests, notifications) is chosen by Covered Entity and processed by the email-delivery subprocessor. Covered Entity will not place PHI in the body or subject of such messages. (c) Support channels. Support tickets, emails to support addresses and sales conversations are not part of the Services. Covered Entity will not include PHI in them; Business Associate will delete PHI received that way on discovery and notify Covered Entity.