China Data Access and Transfer Addendum

The U.S. operator organizes the Navelia platform and entrusted case services. The China operating partner acts only on written instructions for defined patient tasks. The parties must execute an applicable downstream BAA according to the actual PHI relationship and confirm upstream permission for subcontracting. A Chinese hospital delivering its own care is treated as an independent healthcare recipient. Different functions performed by one organization require separate role and access determinations. This addendum does not establish any unobtained HIPAA certification, professional license, or governmental approval.

Route A is remote access from China by named personnel to assigned case information in U.S. systems, where original platform records remain. Route B is transmission of a reviewed minimum-data package to a named recipient; permitted downloading or temporary processing may create recipient copies. Both require access and disclosure assessment. The absence of downloading in Route A does not eliminate overseas access. Route B transfers, temporary copies, independent hospital records, and platform backups must be documented separately rather than described as all copies residing only in the United States.

Each row is a review example, not pre-authorization to disclose.

Highly sensitive information, whole-genome or other omic data, psychotherapy notes, potentially Part 2-protected records, minors' information, and government-related data must not be sent under a generic task template without specific determination of applicable conditions. Coding data does not automatically remove PHI or other sensitive-data protections.

Before first access, disclosure to a new recipient, a new purpose, or expanded scope, record the patient and case, principal authority, required patient authorization, recipient organization and personnel, country, task, fields and files, version, time window, permitted actions, channel, copying and disposal arrangements, approver, execution, and result. Case permission does not authorize access to another case. Authorization must remain valid at execution; historical consent, an unverified chat message, or a contract template alone is not sufficient evidence of authorized disclosure.

Use named accounts, multi-factor authentication, case assignment, least privilege, and expiry-based revocation without shared credentials. Downloading, copying, printing, screenshots, clipboard, synchronization, and export permissions are controlled separately by task and prohibited without permission; visibility is not permission to retain. Work endpoints require appropriate device and security management. The China operator receives no platform-wide database, backup, key, complete identity mapping, or unrelated internal review access. Changes and abnormal access must be traceable, and material unresolved concerns suspend access.

Packages are assembled in the controlled U.S. environment and contain only approved versions and files. Verify recipient addresses or accounts before sending through channels with appropriate encryption, identity verification, and expiry controls. PHI must not be delivered through personal email, personal messaging, public links, or unapproved cloud drives, or uploaded to public AI for convenience. Record delivery and receipt outcomes; link creation or attempted sending is not confirmed receipt. Revoke revocable access to cancelled, expired, or misaddressed packages, investigate whether copies were obtained, and remediate.

If Route B requires temporary copies, identify the holder, protected environment, purpose, permitted duration, and deletion responsibility in advance. The China operator may not create a default long-term mirror database, back up copies into other regions, or retain them for possible future usefulness. On completion, expiry, or termination, return or delete under the applicable BAA and instructions and provide verifiable results. Required legal preservation must identify its basis, scope, and end condition, stop other uses, and notify the authorized party. Statutory records created by a hospital's independent care are governed by its separate notice, not misrepresented through promises about deletion of operational copies.

The China partner may not independently pass information to another hospital, contractor, software provider, or affiliate. New recipients or subprocessors require U.S. operator and applicable upstream review, required BAA, confidentiality, purpose, regional and security obligations, and necessary patient notices and permissions. Common group ownership is not automatic sharing authority. Sale, independent marketing, research, teaching, model training, and attempts to re-identify restricted-identity information are prohibited. Patient consent does not waive applicable legal prohibitions.

On discovering misdelivery, excessive access, credential compromise, unauthorized copying, or another potential information incident, the China party promptly contains the issue and notifies the U.S. operator without unreasonable delay under the stricter applicable BAA and contractual deadline. Initial reporting must not await a complete root cause or affected-person count. The parties specify initial content, updates, evidence preservation, recipient coordination, notification responsibilities, and remediation verification. Necessary evidence must not be destroyed or conflicting statements issued to patients. The executed contract must state an initial-reporting deadline and continuous escalation contacts.

On receiving withdrawal, access, correction, or deletion requests, the China party promptly forwards them to the U.S. operator and authorized principal and stops future relevant actions as instructed. It must not independently deny rights, promise deletion outside its authority, or disclose records directly to an unverified requester. Lawfully created medical records, legal holds, and BAA duties are handled separately; recovery of every prior authorized disclosure cannot be guaranteed. Forwarding does not reset legal deadlines. Retain minimum necessary evidence of suspension, return, or deletion outcomes.

The parties assess applicable U.S. and Chinese sensitive-data, medical, access, and cross-border requirements. U.S. Data Security Program applicability depends on data, parties, access, transaction type, scale, exceptions, and other facts. U.S. storage, case-by-case viewing, patient consent, or a BAA alone does not remove the need for assessment. Sending newly created Chinese medical information to the United States also requires separate assessment. Retain necessary contract, permission, training, access, transfer, deletion, and audit evidence and allow reasonable agreed review, with audit material itself minimized and protected.

Changes to purposes, personnel scope, recipients, regions, channels, or copying rules require review before implementation. At termination, revoke accounts, links, and task permissions and address return/deletion, required preservation, patient continuity, and surviving confidentiality duties. Continuing necessary hospital handoffs require separate lawful arrangements: contract termination must neither abandon patient records nor justify indefinite access in the name of continuity.

This template concerns a defined disclosure or limited period and is not signed merely by accepting the Terms or Privacy Policy. Where a HIPAA Authorization is required, the executed form must satisfy all applicable elements of 45 CFR 164.508 and other special protections. Research or marketing must not be bundled into an indivisible choice with this coordination activity.

Proposed confirmation

“I understand the information, recipient, purpose, access or transfer route, and possible controlled recipient copies described above. I authorize the identified discloser to provide the selected information to the recipient for the stated purpose and period. I understand how to revoke, the actual effect of refusal, and that lawfully disclosed information may not be fully recoverable. This authorization does not include other purposes, unlisted recipients, marketing, or general-purpose model training.”