Health Data Addendum

This Health Data Addendum ("Addendum") forms part of the Grovity Terms and Conditions, the Privacy Agreement, and any signed agreement between Grovity Services LLC ("Grovity") and the Client (collectively, the "Agreement"). It applies whenever the Client uses the Services in connection with health, medical, wellness, pharmaceutical, insurance, or similar activities, or otherwise causes Health Data to be processed through the Services. In the event of conflict regarding Health Data, this Addendum prevails over the Terms and Conditions, but not over a signed agreement or Business Associate Agreement that expressly addresses the matter.

• Health Data: any personal data relating to the physical or mental health of a natural person, including the provision of health-care services, that reveals information about their health status, such as symptoms, diagnoses, treatments, medications, appointments, test results, insurance claims, or disability information. Health Data is considered sensitive personal data under the laws listed in Section 9.
• Protected Health Information (PHI): has the meaning given in the U.S. Health Insurance Portability and Accountability Act of 1996 and its implementing regulations ("HIPAA").
• Clinical Decision: any diagnosis, prognosis, triage of medical urgency, prescription, dosage recommendation, or treatment decision.
• Health Client: a Client that uses the Services in connection with any activity described in the first paragraph.

2.1. General-purpose platform. The Services are a general-purpose platform for conversational and operational AI agents. They are not a medical device, software as a medical device, clinical decision-support system, electronic health record, or clinical record repository, and they have not been cleared or approved by the U.S. Food and Drug Administration, INVIMA, ANVISA, or any other health authority.

2.2. No medical advice. Grovity does not provide medical, clinical, pharmaceutical, or health advice. Outputs generated by AI agents are automated, may contain errors, and do not replace the judgment of a qualified health professional.

2.3. Permitted uses. Health Clients may use the Services for administrative and informational functions, such as scheduling and reminders, general information about the Client's services, locations and procedures, pre-registration and data collection, follow-up communications, customer service, billing, and routing conversations to qualified personnel.

2.4. Prohibited uses. Unless expressly agreed in a signed agreement that specifies the applicable controls, Health Clients shall not configure or use the Services to:

• make or communicate Clinical Decisions without the review of a qualified health professional;
• serve as the primary channel for medical emergencies;
• store the Client's official clinical record (historia clínica, prontuário, or medical record) in the Services as the record of reference;
• process PHI without a Business Associate Agreement executed with Grovity (Section 5);
• process genetic or biometric data for identification purposes.

The Health Client, as Data Controller (or Covered Entity, as applicable), is responsible for:

3.1. Legal basis and consent. Obtaining, before any Health Data is processed through the Services, the legal basis required by applicable law, including prior, express, and informed consent where required, and keeping evidence of it. Where required by law (for example, Colombian Law 1581 of 2012), informing data subjects that they are not obliged to answer questions about sensitive data.

3.2. AI disclosure. Configuring its AI agents so that end users are clearly informed that they are interacting with an automated system and not with a health professional.

3.3. Emergency and escalation rules. Configuring its AI agents so that, when an end user reports symptoms that may indicate an emergency, risk of self-harm, or a situation requiring urgent attention, the agent directs the user to local emergency services and to the Client's qualified personnel, and does not attempt to manage the situation. Grovity makes available human-handoff functionality for this purpose; the Client is responsible for staffing and responding to escalations.

3.4. Content and knowledge bases. Ensuring that agent instructions, knowledge bases, catalogs, and any clinical or health content provided to the Services are accurate, current, approved by qualified personnel, and compliant with applicable health-advertising and professional-practice rules.

3.5. Minimum necessary. Configuring agents and integrations to collect only the Health Data strictly necessary for the stated purpose, and not requesting full clinical histories, images of medical documents, or test results unless necessary and lawful.

3.6. Channel selection. Assessing whether the communication channels it enables (such as WhatsApp, SMS, web chat, or voice) are appropriate for the Health Data involved. Messaging platforms and carriers are independent third parties and are not covered by any Business Associate Agreement executed with Grovity.

3.7. Data subject requests and records. Responding to data subject requests and maintaining any clinical, regulatory, or retention records required of it, using its own systems of record.

3.8. Professional and sector rules. Complying with health-sector regulations applicable to it, including telehealth, health-advertising, and professional-secrecy rules in each jurisdiction where it operates.

With respect to Health Data processed on behalf of the Client, Grovity will:

4.1. Process Health Data only as a Data Processor (or Business Associate, where a BAA is in force), solely to provide the Services and in accordance with the Client's documented instructions.

4.2. Apply the safeguards described in the Description of the Security of the Services, including encryption in transit and at rest, tenant isolation, least-privilege access, and audit logging.

4.3. Not use Health Data, including in aggregated or de-identified form, to improve the Services, to train or tune any model, or for any purpose other than providing the Services to the Client, without the Client's prior written authorization.

4.4. Not sell Health Data or use it for advertising.

4.5. Only transmit Health Data to subprocessors that are bound by written data-protection and confidentiality obligations and that do not use Client Content to train their models.

4.6. Notify the Client of any security incident affecting Health Data in accordance with the Agreement and, in any case, without undue delay and within seventy-two (72) hours of becoming reasonably aware of it.

4.7. Delete or return Health Data upon termination or upon the Client's written instruction, subject to backup retention cycles and legal obligations, and confirm deletion upon request.

5.1. Grovity is not a Covered Entity under HIPAA. Grovity acts as a Business Associate only when it has executed a Business Associate Agreement ("BAA") with the Client.

5.2. Grovity may enter into a BAA on a case-by-case basis, for specific configurations of the Services, providers, and channels identified in the BAA. Requests should be sent to privacy@grovity.ai.

5.3. Unless and until a BAA is executed, the Client shall not transmit PHI to the Services, and Grovity shall have no obligations as a Business Associate. Any PHI transmitted in breach of this Section is transmitted at the Client's sole risk.

6.1. The Client acknowledges that AI outputs are probabilistic and may be inaccurate, incomplete, or inappropriate in a health context, and that the Client is solely responsible for supervising its agents and for any decision taken on the basis of their outputs.

6.2. Grovity is not responsible for the clinical accuracy of content provided by the Client, for Clinical Decisions made by the Client, its personnel, or end users, or for the outcome of any health-care service.

7.1. The Client will defend and indemnify Grovity against third-party claims, regulatory sanctions, and losses arising from: (i) the absence of a valid legal basis or consent for Health Data processed through the Services; (ii) the use of the Services for any purpose prohibited in Section 2.4; (iii) clinical, medical, or health content supplied or approved by the Client; or (iv) the transmission of PHI without an executed BAA.

7.2. The limitations of liability set out in the Terms and Conditions or the Agreement apply to this Addendum.

Unless the Client instructs otherwise, Grovity retains conversation data containing Health Data for the duration of the Agreement. The Client may request earlier deletion of specific conversations or data subjects at any time. The Client remains responsible for retaining any information it is legally required to keep in its own systems of record.

Without limiting the Client's obligation to identify the law applicable to its activities, the following laws treat Health Data as sensitive data or regulate its processing in jurisdictions where Grovity's Clients commonly operate:

• United States: HIPAA and the HITECH Act; the FTC Act and the FTC Health Breach Notification Rule; state consumer health data laws (such as Washington's My Health My Data Act).
• Colombia: Law 1581 of 2012 and Decree 1377 of 2013 (sensitive data); Resolution 1995 of 1999 and Law 2015 of 2020 (clinical records); Law 1419 of 2010 and Resolution 2654 of 2019 (telehealth).
• Brazil: LGPD (Law 13,709/2018), Article 11 (sensitive personal data), and Law 13,787/2018 (digital medical records).
• Mexico: Federal Law on the Protection of Personal Data Held by Private Parties (2025).
• Costa Rica: Law 8968 on the Protection of Persons Regarding the Processing of their Personal Data.
• Guatemala: constitutional protections of privacy and personal records, and applicable professional-secrecy rules.
• Jamaica: Data Protection Act, 2020.
• European Union / EEA: GDPR, Article 9.

Questions about this Addendum or requests for a BAA: privacy@grovity.ai.