Business Associate Agreement

Version 1 — October 23, 2026

Note: This BAA becomes part of the Supabase Terms of Service or such other agreement between Customer and Supabase governing Customer's use of the Services, applies to Customer, and is binding on Supabase only if Customer has subscribed to the Supabase HIPAA Add-On, unless Customer and Supabase have otherwise agreed in writing.

This Business Associate Agreement Addendum ("Addendum" or "BAA") is entered into by and between Supabase Pte. Ltd. or, where the Agreement designates Supabase, Inc. as the contracting Supabase entity, Supabase, Inc. (as applicable, "Supabase" or "Business Associate") and the entity that has accepted the Agreement (as defined below) as the customer ("Customer") and is hereby incorporated by reference into, and forms a part of, the Supabase Terms of Service available at https://supabase.com/terms, or such other agreement entered into between Customer and Supabase governing the provision of, and use of, the Services together with the Supabase HIPAA Add-On ("Agreement"). This BAA, pursuant to which Supabase is a Business Associate of Customer, is applicable only where Customer is a Covered Entity or a Business Associate and only when Supabase is acting as a Business Associate as defined in 45 CFR § 160.103. This BAA is effective as of the date Customer first subscribes to the Supabase HIPAA Add-On.

1. Definitions.#

Except as otherwise defined in this BAA and in the Agreement, capitalized terms shall have the definitions set forth in 45 CFR Part 160 and Part 164 ("HIPAA Rules"), as amended from time to time.

"Supabase HIPAA Add-On" or "HIPAA Add-On" means the add-on to the Services, as made available by Supabase from time to time, that Customer subscribes to in order to store and process PHI using the Services in accordance with this BAA, whether through an Order or Supabase's online ordering process.

"Protected Health Information" or "PHI" shall have the same meaning as the term "protected health information" in 45 CFR § 160.103 of the HIPAA Rules, provided that it is limited to such protected health information that is included in Customer Data.

"Shared Responsibility Model" allocates security responsibilities between Supabase and Customer and is available at https://supabase.com/docs/guides/deployment/shared-responsibility-model, and may be updated by Supabase from time to time.

"Unsuccessful Security Incidents" means, without limitation, pings and other broadcast attacks on Supabase's firewall, port scans, unsuccessful log-on attempts, denial of service attacks, and any combination of the above, as long as no such incident results in unauthorized access, acquisition, use, or disclosure of PHI.

2. Use and Disclosure of PHI.#

2.1 Supabase will not use or disclose PHI in a manner other than as permitted or required by the Agreement, this BAA, or by law.

2.2 Except as otherwise limited in this BAA, Supabase may use or disclose PHI as reasonably necessary to provide the Services to Customer and to undertake other activities permitted or required of Supabase by the Agreement or this BAA; provided that such use or disclosure would not violate the HIPAA Rules if done by Customer, unless expressly permitted by Section 2.3.

2.3 Supabase may use and disclose PHI in its possession for the proper management and administration of Supabase's business and to carry out its legal responsibilities, provided that any such disclosure may only occur if (i) it is required by law; or (ii) Supabase obtains, in writing, prior to making any disclosure to a third party (1) reasonable assurances from this third party that the PHI will be held confidential as provided under this BAA and used or further disclosed only as required by law or for the purpose for which it was disclosed to this third party and (2) an agreement from this third party to notify Supabase of any breaches of the confidentiality of the PHI.

3. Safeguards.#

As, but only to the extent, provided in our Shared Responsibility Model, Supabase will use reasonable and appropriate safeguards to prevent the use or disclosure of PHI other than as provided by the Agreement or this BAA and agrees to implement administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity and availability of the electronic PHI that it creates, receives, maintains or transmits on behalf of Customer. Supabase's obligations under this Section 3 are limited to infrastructure and platform-level controls as defined in the Shared Responsibility Model. Customer is solely responsible for application-level access controls, including Row Level Security policies, API key management, user authentication configurations, and all other Customer-controlled configurations identified in the Shared Responsibility Model.

4. Reporting.#

Supabase shall report to Customer: (1) any use and/or disclosure of PHI that is not permitted or required by this BAA of which Supabase becomes aware; (2) any Security Incident affecting PHI of which it becomes aware, provided that notice is hereby deemed given for Unsuccessful Security Incidents and no further notice of such Unsuccessful Security Incidents shall be given; and/or (3) any breach of Customer's unsecured PHI that Supabase may discover. Notification of a breach will be made without unreasonable delay and in no case later than 60 calendar days. Notification(s) under this section, if any, will be delivered to Customer at the contact details associated with Customer's Supabase account or as otherwise stated in the Agreement.

5. Agreements with Subcontractors.#

Supabase shall require its subcontractors who create, receive, maintain, or transmit PHI on behalf of Supabase to agree in writing to (a) the same or no less restrictive restrictions and conditions that apply to Supabase with respect to such PHI; (b) appropriately safeguard the PHI; and (c) comply with the applicable requirements of 45 CFR Part 164 Subpart C of the Security Rule.

6. Disclosure to the Secretary.#

Supabase shall make available its internal practices, records, and books relating to the use and/or disclosure of PHI received from Customer to the Secretary of the Department of Health and Human Services for purposes of determining Customer's compliance with HIPAA, subject to attorney-client and other applicable legal privileges.

7. Access to and Amendment of PHI.#

To the extent that Business Associate maintains PHI in a Designated Record Set, Business Associate shall: provide access to such PHI to Customer in a time and manner that meets the requirements of 45 C.F.R. § 164.524, and make such PHI available for amendment, and incorporate any such amendments, in accordance with 45 C.F.R § 164.526.

8. Accounting of Disclosure.#

To the extent necessary for Customer to provide an accounting of disclosures in accordance with 45 C.F.R. § 164.528, Business Associate agrees to maintain and make available the information in its possession to assist Customer in responding to such a request.

9. Performance of Customer's Obligations.#

To the extent Supabase is to carry out a Covered Entity obligation under the Privacy Rule, Supabase shall comply with the requirements of the Privacy Rule that apply to Customer in the performance of such obligation.

10. Responsibilities of Customer.#

With regard to the use and/or disclosure of PHI by Supabase, Customer agrees:

10.1 Customer shall not request Supabase to use or disclose PHI in any manner that would not be permissible under HIPAA if done by Customer (except to the extent permitted by HIPAA for a business associate) or cause Supabase to be in violation of any applicable law or regulation;

10.2 Customer shall protect its PHI in compliance with HIPAA;

10.3 Customer represents and warrants that it is compliant with all applicable state and federal privacy and security laws and regulations, including the HIPAA Rules, and that it has implemented appropriate privacy and security safeguards to protect its PHI in compliance with HIPAA;

10.4 Customer shall notify Supabase in writing of any restriction to the use or disclosure of PHI that Customer has agreed to or is required to abide by, to the extent that such restriction may affect Supabase's use or disclosure of PHI;

10.5 Customer shall obtain any patient authorizations or consents that may be required under state or federal law or regulation in order to transmit PHI to Supabase and to enable Supabase and its subcontractors to use and disclose PHI as contemplated by this BAA and the Agreement, and represents and warrants that all required authorization or consents are valid and will remain in effect throughout the term of this BAA;

10.6 Customer shall notify Supabase in writing of any changes in, or revocation of, permission by an individual to use or disclose PHI, and take reasonable steps to ensure that such PHI is no longer processed by Supabase, if such changes or revocation may affect Supabase's use or disclosure of PHI;

10.7 Customer shall notify Supabase in writing of any limitations in Customer's privacy practices or its customers' privacy practices under 45 CFR 164.520 to the extent such limitation may affect Supabase's use or disclosure of PHI;

10.8 Customer shall maintain appropriate insurance coverage, including cyber liability and errors and omissions insurance, sufficient to cover its obligations and liabilities related to the handling, use, or disclosure of PHI under this BAA and the Agreement and shall provide proof of such insurance coverage upon request; and

10.9 Customer shall disclose to Supabase only the minimum amount of PHI reasonably necessary for Supabase to accomplish the intended purpose of such disclosure.

10.10 Shared Responsibility.

Security and compliance is a shared responsibility between Customer and Supabase. Customer is responsible for the proper management of access controls, configurations of its projects, and safeguarding PHI during transmission to and from the Supabase Services, as well as other obligations outlined in the Shared Responsibility Model. Customer's failure to comply with the Shared Responsibility Model constitutes a material breach of this BAA and may limit Supabase's obligations under Section 3.

10.11 No Obligation to Verify Compliance.

Customer acknowledges and agrees that Supabase is not responsible for verifying Customer's HIPAA compliance status, the adequacy of Customer's privacy and security programs, or the validity of patient authorizations or consents. Supabase relies entirely on Customer's representations and warranties in this Section 10. Supabase has no duty to audit, monitor, or investigate Customer's compliance with HIPAA or any other applicable law, except as expressly required by this BAA.

11. Term and Termination.#

This BAA shall remain in effect for so long as (1) Customer maintains an active subscription to the Supabase HIPAA Add-On, and (2) the Agreement between the parties remains in effect. Upon expiration, cancellation, or deactivation of the HIPAA Add-On, this BAA shall automatically terminate, and Supabase shall no longer be considered a Business Associate under HIPAA. Customer is solely responsible for ensuring PHI is not transmitted to or stored on Supabase services following deactivation of the HIPAA Add-On.

11.1 Termination for Breach.

Either Party may terminate this BAA upon written notice if the other Party materially breaches any obligation under this BAA and fails to cure such breach within thirty (30) calendar days of receiving written notice describing the breach in reasonable detail. Any termination for breach must specify the breached provision(s) and provide evidence of the alleged breach.

11.2 Effect of Termination.

Upon termination or expiration of this BAA,

(i) Supabase shall, within sixty (60) calendar days, either return to Customer or destroy all PHI in Supabase's possession or control, except as provided in subsection (ii) below. Customer may specify its preference for return or destruction in writing; otherwise, Supabase will destroy the PHI.

(ii) If it is not feasible to return or destroy the PHI (whether due to technical, legal, or contractual limitations), Supabase shall:

(a) limit further use or disclosure of such PHI solely to the purposes that make return or destruction infeasible; and

(b) extend the protections of this BAA to such retained PHI for so long as the PHI is maintained by Business Associate.

11.3 Survival.

Sections 10.11 (No Obligation to Verify Compliance), 11 (Term and Termination), and 12 (No Third-Party Beneficiaries) shall survive termination or expiration of this BAA.

12. No Third-Party Beneficiaries.#

This BAA is between the Parties hereto. Nothing express or implied in this BAA is intended to confer, nor shall anything herein confer, any rights, remedies, obligations, or liabilities whatsoever upon any person other than Supabase and Customer and any respective successors and assigns. For clarity, no patient, individual, or other third party is an intended third-party beneficiary of this BAA.

13. Interpretation.#

Except as expressly modified by this BAA, the terms of the Agreement shall remain in full force and effect and shall apply to this BAA. If there is any conflict between a provision in this BAA and a provision in the Agreement (including any data processing addendum incorporated into the Agreement or otherwise entered into by the Parties), this BAA will control.

14. Acceptance; No Signature Required.#

This BAA does not require a signature. Customer's acceptance of the Agreement (whether by electronic acceptance, signature of an Order, or otherwise) and subscription to the Supabase HIPAA Add-On constitutes Customer's acceptance of, and agreement to be bound by, this BAA and has the same effect as if the Parties had signed it. Supabase's acceptance is evidenced by its making this BAA available and providing the Supabase HIPAA Add-On to Customer.

15. Updates.#

Supabase may update this BAA from time to time as permitted by the Agreement, and the date at the top of this BAA associated with the current version of this BAA, will be updated accordingly. Notwithstanding the foregoing, Supabase may update this BAA at any time, effective upon notice to Customer, to the extent reasonably necessary to comply with changes to the HIPAA Rules or other applicable law, and no update will cause this BAA to fail to satisfy the requirements applicable to business associate agreements under the HIPAA Rules.