Business Associate Agreement (BAA)
Effective date: July 2026 · B3 Trinitas Media & Ventures, d/b/a BiomedDesk
BiomedDesk's HIPAA Position
BiomedDesk is a Computerized Maintenance Management System (CMMS) for biomedical and healthcare technology management (HTM) professionals. The platform is designed to manage equipment — not patients or clinical records.
Under normal usage, BiomedDesk does not store, process, or transmit Protected Health Information (PHI) as defined by HIPAA (45 CFR § 160.103). Equipment serial numbers, department names, repair descriptions, and PM records are operational data, not PHI.
Important Notice
BiomedDesk does not accept PHI on any tier, with or without a Business Associate Agreement. Do not enter patient names, medical record numbers, diagnoses, or any other PHI into any field. The Service is not designed to be a covered entity system under HIPAA for clinical data.
BAA Availability
A Business Associate Agreement is available on request for customers who require one — for example, where a BAA is required by your compliance team or legal counsel. B3 Trinitas Media & Ventures, d/b/a BiomedDesk, is willing to execute a mutually agreed Business Associate Agreement; contact hello@biomeddesk.com.
A signed BAA does not change the fundamental design of the platform — BiomedDesk still does not accept or process PHI. A BAA in this context provides contractual assurance for organizations whose procurement or compliance processes require one before deploying any software in a healthcare environment, regardless of actual PHI exposure.
What a BAA with BiomedDesk Does and Does Not Do
A BAA with BiomedDesk is a procurement instrument, not a change in what the Service accepts. It does not authorize you to enter PHI, and it does not make BiomedDesk a system of record for clinical data — the prohibition above continues to apply in full. Where executed, a BAA addresses each party's HIPAA obligations, safeguards and breach-notification procedures consistent with 45 CFR § 164.410 in the event PHI is received incidentally and contrary to these terms, data return and destruction on termination, and subcontractor provisions (Supabase, Anthropic, Stripe).
How to Request a BAA
A Business Associate Agreement is available on request for customers who require one. To request a BAA:
- Email hello@biomeddesk.com with subject line: "BAA Request — [Your Organization Name]"
- Include your organization name, primary contact, and any specific compliance requirements.
We typically respond within 2 business days and aim to execute BAAs within 5 business days of mutual agreement on terms.
Subprocessors
BiomedDesk relies on the following subprocessors. Enterprise customers requiring subprocessor BAAs should contact us:
- Supabase Inc. — Database and authentication hosting (SOC 2 Type II certified)
- Anthropic PBC — AI troubleshooting processing (enterprise data privacy agreements available)
- Stripe, Inc. — Payment processing (PCI DSS Level 1 certified)
Contact
B3 Trinitas Media & Ventures, d/b/a BiomedDesk
Email: hello@biomeddesk.com