Terms and Conditions

These Terms and Conditions (these “Terms and Conditions”) are entered into on the Effective Date of the Order Form (the “Order Form”) between LilyLink Inc. with a place of business at 2261 Market Street STE 22278 San Francisco, CA 94114 (“Company”), and the Customer listed on the Order Form (“Customer”). These Terms and Conditions include and incorporate the Order Form and Business Associate Agreement Addendum (BAA) found at this link (collectively, the “Agreement”). If there is any inconsistency between the parts of the Agreement, the terms of the Order Form shall control over these Terms and Conditions, to the extent of any such conflict. The parties hereby agree as follows:

1. Service

1.1 Access and Use. During the Subscription Period and subject to the Use Limitations, Customer may (a) access and use the Service and Platform; and (b) copy and use the included Documentation only as needed to access and use the Service and support Users’ use of the Platform, in each case, for its internal business purposes and only if Customer complies with the terms of this Agreement.

1.2 Support. During the Subscription Period, Company will provide Technical Support to Customer and its Users as described in the Order Form, if any, with Updates rolled out as and when necessary as determined by Company in its sole discretion.

1.3 User Accounts. Customer shall designate a single representative to act as the account administrator (the “Administrator”). Administrator may authorize Clinic Users and Patient Users to access and use the Platform according to the Use Limitations as are set forth in the Order Form. Only Administrator and authorized Clinic Users shall have access to identifying personal information or Protected Health Information of Patient Users, in each case, subject to compliance with HIPAA (as defined below) and any restrictions on access set forth in any Business Associate Addendum entered into between the parties. Customer is responsible for all actions on Users’ accounts and for Users’ compliance with this Agreement. Customer and Users must protect the confidentiality of their passwords and login credentials. Customer will promptly notify Company if it suspects or knows of any fraudulent activity with its or its Users’ accounts, passwords, or credentials, or if they become compromised. Customer shall make no representations or warranties regarding the Platform or any other matter, to Users or any other third party, from or on behalf of Company. Other than as set forth in Section 1.2, Company will have no obligation to provide support or other services or remedies to Users.

1.4 Feedback and Usage Data. Customer may, but is not required to, give Company Feedback. Any such Feedback provided by Customer and/or a User is provided “AS IS”. Company may use all Feedback freely without any restriction or obligation. In addition, Company may collect and analyze Usage Data and deidentified information or data stored or processed through the Platform by Customer or its Users, provided that there is no reasonable basis to believe that the information can be used, alone or in combination with other reasonably available information, to identify any individual and any information or data constituting Protected Health Information is deidentified in accordance with the HIPPA deidentification procedures set forth in 45 CFR § 164.514(b) (“Deidentified Data”). Company may freely use Usage Data and Deidentified Data to maintain, improve, and enhance Company’s products and services without restriction or obligation. However, Company may only share Usage Data with others if the Usage Data is aggregated and does not identify Customer or Users.

1.5 Customer Content. Company may copy, display, modify, and use Customer Content only as needed to provide and maintain the Platform and related offerings. Customer is responsible for the accuracy and content of Customer Content.

2. Restrictions & Obligations

2.1 Restrictions on Customer.

1. Except as expressly permitted by this Agreement, Customer will not (and will not allow its Users or any anyone else to): (i) reverse engineer, decompile, or attempt to discover any source code or underlying ideas or algorithms of the Platform (except to the extent Applicable Laws prohibit this restriction); (ii) provide, sell, transfer, sublicense, lend, distribute, rent, or otherwise allow others to access or use the Product; (iii) remove any proprietary notices or labels; (iv) copy, modify, or create derivative works of the Product; (v) conduct security or vulnerability tests on, interfere with the operation of, cause performance degradation of, or circumvent access restrictions of the Platform; (vi) access accounts, information, data, or portions of the Product to which Customer does not have explicit authorization; (vii) use the Product to develop a competing service or product; (viii) use the Product for any High Risk Activities or with activity prohibited by Applicable Laws; (ix) use the Platform to obtain unauthorized access to anyone else’s networks or equipment; or (x) upload, submit, or otherwise make available to the Platform any Customer Content to which Customer and Users do not have the proper rights. Company may suspend or terminate a Customer’s or User’s access to the Platform at any time, without advance notice, if Company reasonably concludes such Customer or User has conducted itself in a way that is not consistent with this Section 2.1 or the other requirements of this Agreement or in a way that subjects Company to potential liability.
2. Customer’s use of the Platform must comply with all Documentation.

2.2 Suspension. If Customer (a) has an outstanding, undisputed balance on its account for more than 30 days after the Payment Period; (b) breaches Section 2.1 (Restrictions on Customer); or (c) uses the Platform in violation of the Agreement or in a way that materially and negatively impacts the Platform or others, then Company may suspend Customer’s access to the Platform with or without notice.

3. Additional Services

Company will perform the Additional Services as detailed in the Order Form, if any, which shall be subject to the terms of the Agreement, and Customer will reasonably cooperate with Company to allow the performance of Additional Services, including providing Customer Content as needed. Company is not responsible for any inability to perform the Additional Services if Customer does not cooperate as reasonably requested.

4. Privacy & Security

4.1 Protected Health Information. Notwithstanding anything herein to the contrary and except as set forth in Section 1.4, Company (directly and through its subcontractors) and its affiliates will not be permitted to access, create, maintain, use and/or disclose any Protected Health Information other than as required by law or as strictly required in accordance with the rights and obligations set forth in this Agreement and any Business Associate Addendum entered into between the parties, which is incorporated herein by reference, solely to the extent necessary for the following purposes: (a) to provide the Service, the Platform and any Additional Services to Customer as set forth in this Agreement; and (b) to perform its obligations and exercise its rights under this Agreement.

4.2 Prohibited Data. Customer will not (and will not allow anyone else to) submit Prohibited Data to the Platform unless authorized by the Agreement.

4.3 Security. Company will use commercially reasonable efforts to secure the Service from unauthorized access, alteration, or use and other unlawful tampering.

5. Payment & Taxes

5.1 Fees and Invoices. All fees are in U.S. Dollars and are exclusive of taxes. Except for the prorated refund of prepaid fees allowed with specific termination rights, fees are non-refundable. Company will send invoices for fees applicable to the Service in accordance with the schedule set forth in the Order Form. Invoices for Additional Services may be sent monthly during performance of the Additional Services unless the Order Form includes a different cadence. Minimum fees increase by the Consumer Price Index (CPI) % per renewal.

5.2 Payment. Customer will pay Company the fees and taxes in each invoice in U.S. Dollars within the Payment Period. The payment method will be specified in the invoice or the Order Form. The invoiced amount shall be equal to the revenue share percentage specified in the Order Form times the Expected RPM revenue.

5.3 Taxes. Customer is responsible for all duties, taxes, and levies that apply to fees, including sales, use, VAT, GST, or withholding, that Company itemizes and includes in an invoice. However, Customer is not responsible for Company’s income taxes.

5.4 Payment Dispute. If Customer has a good-faith disagreement about the amounts charged on an invoice, Customer must notify Company about the dispute during the Payment Period for the invoice and must pay all undisputed amounts on time. The parties will work together to resolve the dispute within 15 days of the end of the Payment Period. If no resolution is agreed, each party may pursue any remedies available under the Agreement or Applicable Laws.

6. Term & Termination

6.1 Subscription Period. Each Order Form will start on the Subscription Start Date, continue for the Subscription Period, and automatically renew for additional Subscription Periods unless one party gives written notice of non-renewal to the other party before the Non-Renewal Notice Date.

6.2 Agreement Term. This Agreement will start on the Effective Date and continue for the longer of (a) one year; or (b) until all Subscription Periods have ended.

6.3 Termination. In addition to any termination rights set forth in the Order Form, either party may terminate this Agreement if the other party (a) fails to cure a material breach of the Agreement within 30 days after receiving written notice of the breach; (b) materially breaches the Agreement in a manner that cannot be cured (including non-payment); (c) dissolves or stops conducting business without a successor; (d) makes an assignment for the benefit of creditors; or (e) becomes the debtor in insolvency, receivership, or bankruptcy proceedings that continue for more than 60 days. A party must notify the other in writing of its reason for termination, and such reason must be in compliance with the terms of this Agreement.

6.4 Effect of Termination. Termination of the Agreement will automatically terminate all Order Forms. Upon expiration or termination:

1. Customer will no longer have any right to use the Product, Technical Support or Additional Services.
2. Upon Customer’s request, Company will delete Customer Content (other than any Usage Data or Deidentified Data) within 60 days.
3. Each Recipient will return or destroy Discloser’s Confidential Information in its possession or control.
4. Company will submit a final invoice for all outstanding fees accrued before termination and Customer will pay the invoice according to Section 5 (Payment & Taxes); provided that in the event the Agreement is terminated due to Customer’s failure to pay, such termination by Company shall not relieve Customer of the obligation to pay all fees set forth in the then active Order Forms.
5. Only in the case of a termination upon the occurrence of the events set forth in Section 6.3(c), Company shall provide to Customer an exported copy of Customer’s billing and claim data as of the date of termination.

6.5 Survival.

1. The following sections will survive expiration or termination of the Agreement: Section 1.4 (Feedback and Usage Data), Section 2.1 (Restrictions on Customer), Section 5 (Payment & Taxes) for fees accrued or payable before expiration or termination, Section 6.4 (Effect of Termination), Section 6.5 (Survival), Section 7.4 (HIPAA Obligations), Section 8 (Disclaimer of Warranties), Section 9 (Limitation of Liability), Section 10 (Indemnification), Section 11 (Confidentiality), Section 12 (Reservation of Rights), Section 13 (General Terms), Section 14 (Definitions), and the portions of the Order Form referenced by these sections.
2. Each Recipient may retain Discloser’s Confidential Information in accordance with its standard backup or record retention policies maintained in the ordinary course of business or as required by Applicable Laws or a Business Associate Addendum entered into by the parties, in which case Section 4 (Privacy & Security) and Section 11 (Confidentiality) will continue to apply to retained Confidential Information.

7. Representations & Warranties

7.1 Mutual. Each party represents and warrants to the other that: (a) it has the legal power and authority to enter into this Agreement and perform its obligations hereunder and to grant the rights and licenses granted hereunder; (b) it is duly organized, validly existing, and in good standing under the Applicable Laws of the jurisdiction of its origin; (c) it will comply with all Applicable Laws in performing its obligations or exercising its rights in this Agreement; (d) the execution of this Agreement is by each party’s respective authorized representative; and (e) any additional warranties which the parties may include in the Order Form.

7.2 From Customer. Customer represents and warrants (a) that it, all Users, and anyone submitting Customer Content each have and will continue to have all rights necessary to submit or make available Customer Content to the Platform and to allow the use of Customer Content as described in the Agreement; and (b) that it will provide Company with good faith cooperation and access to such information as may be reasonably required by Company in order to provide the Services.

7.3 From Company. Company represents and warrants to Customer that it will (a) use reasonable efforts consistent with prevailing industry standards to provide and maintain the Service during the Subscription Period; and (b) perform Additional Services in a competent and professional manner.

7.4 HIPAA Obligations. The parties acknowledge and agree that each shall comply with, as applicable, all federal privacy and security regulations, including (but not limited to) the Health Insurance Portability and Accountability Act (“HIPAA”), in addition to Subtitle D (Privacy) of Title XIII of Division A and Section 4104(B) of Title IV of Division B of the American Recovery and Reinvestment Act of 2009 (HITECH), which regulations are codified at 45 C.F.R. parts 160 and 164 (Privacy Rule) and 45 C.F.R. parts 160, 162 and 164 (Security Rule). The provisions of this section shall survive expiration or termination of this Agreement for any reason.

8. Disclaimer of Warranties

Company does not guarantee that the Platform will function without errors, disruptions, delays, or imperfections, nor does it make any warranty as to the results that may be obtained from use of the Platform or any third-party devices or software used in connection with the Platform. Company and Customer each disclaim all other warranties, whether express or implied, including the implied warranties of merchantability, fitness for a particular purpose, title, and non-infringement. These disclaimers apply to the maximum extent permitted by Applicable Laws.

9. Limitation of Liability

9.1 Liability Caps. EACH PARTY’S TOTAL CUMULATIVE LIABILITY FOR ALL CLAIMS ARISING OUT OF OR RELATING TO THIS AGREEMENT WILL NOT EXCEED ONE TIMES THE FEES PAID OR PAYABLE BY CUSTOMER TO COMPANY IN THE 6 MONTH PERIOD IMMEDIATELY BEFORE THE PRECEDING THE ACT, OMISSION OR OCCURRENCE GIVING RISE TO SUCH LIABILITY.

9.2 Damages Waiver. Each party’s liability for any claim or liability arising out of or relating to this Agreement will be limited to the fullest extent permitted by Applicable Laws. Under no circumstances will either party be liable to the other for lost profits or revenues, lost data, or for consequential, special, indirect, exemplary, punitive, or incidental damages relating to this Agreement, even if the party is informed of the possibility of this type of damage in advance.

9.3 Exceptions. The liability caps in Section 9.1 and the damages waiver in Section 9.2 do not apply to (i) breach of Section 4 (Privacy & Security) resulting from gross negligence or willful misconduct; or (ii) breach of Section 11 (Confidentiality) resulting from gross negligence or willful misconduct.

10. Indemnification

10.1 Protection by Company. Company will indemnify, defend, and hold harmless Customer from and against all Company Covered Claims made by someone other than Customer, Customer’s Affiliates, or Users, and all out-of-pocket damages, awards, settlements, costs, and expenses, including reasonable attorneys’ fees and other legal expenses, that arise from the Company Covered Claim.

10.2 Protection by Customer. Customer will indemnify, defend, and hold harmless Company from and against all Customer Covered Claims made by someone other than Company or its Affiliates, and all out-of-pocket damages, awards, settlements, costs, and expenses, including reasonable attorneys’ fees and other legal expenses, that arise from the Customer Covered Claim.

10.3 Procedure. The Indemnifying Party’s obligations in this section are contingent upon the Protected Party: (a) promptly notifying the Indemnifying Party of each Covered Claim for which it seeks protection; (b) providing reasonable assistance to the Indemnifying Party at the Indemnifying Party’s expense; and (c) giving the Indemnifying Party sole control over the defense and settlement of each Covered Claim. A Protected Party may participate in a Covered Claim for which it seeks protection with its own attorneys only at its own expense. The Indemnifying Party may not agree to any settlement of a Covered Claim that contains an admission of fault or otherwise materially and adversely impacts the Protected Party without the prior written consent of the Protected Party.

10.4 Changes to Platform. If required by settlement or court order, or if deemed reasonably necessary in response to a Company Covered Claim, Company may: (a) obtain the right for Customer to continue using the Platform; (b) replace or modify the affected component of the Platform without materially reducing the general functionality of the Platform; or (c) if neither (a) nor (b) are reasonable, terminate the affected Order Form and issue a pro-rated refund of prepaid fees for the remainder of the Subscription Period.

10.5 Exclusions.

1. Company’s obligations as an Indemnifying Party will not apply to Company Covered Claims that result from (i) modifications to the Platform that were not authorized by Company or that were made in compliance with Customer’s instructions; (ii) unauthorized use of the Platform, including use in violation of this Agreement and including, without limitation, its failure to cease use of the Platform after Company’s direction pursuant to the Agreement and revisions to the Platform made without Company’s consent; (iii) use of the Platform in combination with items not provided by Company; (iv) use of an old version of the Platform where a newer release made by Company would avoid the Company Covered Claim; and (v) Company’s creation or modification of the Platform in compliance with specifications furnished by Customer.
2. Customer’s obligations as an Indemnifying Party will not apply to Customer Covered Claims that result from (i) the unauthorized use of the Customer Content, including use in violation of this Agreement; or (ii) revisions to Customer Content made by Company or its agents or employees without Customer’s consent, other than revisions necessary to display or use Customer Content.

10.6 Exclusive Remedy. This Section 10 (Indemnification), together with any termination rights, describes each Protected Party’s exclusive remedy and each Indemnifying Party’s entire liability for a Covered Claim.

11. Confidentiality

11.1 Non-Use and Non-Disclosure. Unless otherwise authorized in the Agreement, Recipient will (a) only use Discloser’s Confidential Information to fulfill its obligations or exercise its rights under this Agreement; and (b) not disclose Discloser’s Confidential Information to anyone else. In addition, Recipient will protect Discloser’s Confidential Information using at least the same protections Recipient uses for its own similar information but no less than a reasonable standard of care; provided that Protected Health Information shall be subject to the additional confidentiality obligations set forth in any Business Associate Addendum entered into between the parties.

11.2 Exclusions. Confidential Information does not include information that (a) Recipient knew without any obligation of confidentiality before disclosure by Discloser; (b) is or becomes publicly known and generally available through no fault of Recipient; (c) Recipient receives under no obligation of confidentiality from someone else who is authorized to make the disclosure; or (d) Recipient independently developed, without use of or reference to Discloser’s Confidential Information, and has provided written evidence supporting such independent development to Discloser.

11.3 Required Disclosures. Recipient may disclose Discloser’s Confidential Information to the extent required by Applicable Laws if, unless prohibited by Applicable Laws, Recipient provides the Discloser reasonable advance notice of the required disclosure and reasonably cooperates, at the Discloser’s expense, with the Discloser’s efforts to obtain confidential treatment for the Confidential Information.

11.4 Permitted Disclosures. Recipient may disclose Discloser’s Confidential Information to Users, employees, advisors, contractors, and representatives who each have a need to know the Confidential Information, but only if the person or entity is bound by confidentiality obligations at least as protective as those in this Section 11 and Recipient remains responsible for everyone’s compliance with the terms of this Section 11.

12. Reservation of Rights

Except for the limited right to access and use the Services and license to copy and use Documentation in Section 1.1 (Access and Use), Company retains all right, title, and interest in and to the Product, whether developed before or after the Effective Date. Except for the limited rights in Section 1.5 (Customer Content), Customer retains all right, title, and interest in and to the Customer Content.

13. General Terms

13.1 Entire Agreement; Order of Precedence. This Agreement is the only agreement between the parties about its subject and this Agreement supersedes all prior or contemporaneous statements (whether in writing or not) about its subject. Company expressly rejects any terms included in Customer’s purchase order or similar document, which may only be used for accounting or administrative purposes. Notwithstanding the foregoing, if any terms and conditions contained in the Order Form conflict with any terms and conditions contained in these Terms and Conditions, the order of precedence is: (a) the Order Form; and (b) these Terms and Conditions.

13.2 Modifications, Severability, and Waiver. Any waiver, modification, or change to the Agreement must be in writing and signed or electronically accepted by each party. However, Company may update Technical Support by giving Customer 30 days prior notice. During the 30-day notice period, Customer may terminate the Agreement or affected Order Form upon notice if the update is a material reduction from the prior version and Company cannot reasonably restore the prior version or a comparable alternative. If any term of this Agreement is determined to be invalid or unenforceable by a relevant court or governing body, the remaining terms of this Agreement will remain in full force and effect. The failure of a party to enforce a term or to exercise an option or right in this Agreement will not constitute a waiver by that party of the term, option, or right.

13.3 Governing Law and Chosen Courts. The law of the state of Delaware will govern all interpretations and disputes about this Agreement, without regard to its conflict of laws provisions. The parties will bring any legal suit, action, or proceeding about this Agreement in the state and federal courts located in Delaware and each party irrevocably submits to the exclusive jurisdiction of Delaware.

13.4 Injunctive Relief. Despite Section 13.3 (Governing Law and Chosen Courts), a breach of Section 11 (Confidentiality) or the violation of a party’s intellectual property rights may cause irreparable harm for which monetary damages cannot adequately compensate. As a result, upon the actual or threatened breach of Section 11 (Confidentiality) or violation of a party’s intellectual property rights, the non-breaching or non-violating party may seek appropriate equitable relief, including an injunction, in any court of competent jurisdiction without the need to post a bond and without limiting its other rights or remedies.

13.5 Non-Exhaustive Remedies. Except where the Agreement provides for an exclusive remedy, seeking or exercising a remedy does not limit the other rights or remedies available to a party.

13.6 Assignment. Neither party may assign any rights or obligations under this Agreement without the prior written consent of the other party. However, either party may assign this Agreement upon notice if the assigning party undergoes a merger, change of control, reorganization, or sale of all or substantially all its equity, business, or assets to which this Agreement relates. Any attempted but non-permitted assignment is void. This Agreement will be binding upon and inure to the benefit of the parties and their permitted successors and assigns.

13.7 Publicity. Company may identify Customer and use Customer’s logo and trademarks on Company’s website and in marketing materials to identify Customer as a user of the Product. Customer hereby grants Company a non-exclusive, royalty-free license to do so in connection with any marketing, promotion, or advertising of Company or the Product during the length of the Agreement.

13.8 Notices. Any notice, request, or approval about the Agreement must be in writing and sent to the Notice Address. Notices will be deemed given (a) upon confirmed delivery if by email, registered or certified mail, or personal delivery; or (b) two days after mailing if by overnight commercial delivery.

13.9 Independent Contractors. The parties are independent contractors, not agents, partners, or joint venturers. Neither party is authorized to bind the other to any liability or obligation.

13.10 No Third-Party Beneficiary. There are no third-party beneficiaries of this Agreement.

13.11 Attorney’s Fees. In any action or proceeding to enforce rights under this Agreement, the prevailing party will be entitled to recover costs and attorneys’ fees.

13.12 Force Majeure. Neither party will be liable for a delay or failure to perform its obligations of this Agreement if caused by a Force Majeure Event. However, this section does not excuse Customer’s obligations to pay fees.

13.13 Export Controls. Customer may not remove or export from the United States or allow the export or re-export of the Product or any related technology or materials in violation of any restrictions, laws, or regulations of the United States Department of Commerce, the United States Department of Treasury Office of Foreign Assets Control, or any other United States or foreign agency or authority.

13.14 Government Rights. The Service is deemed “commercial items” or “commercial computer software” according to FAR section 12.212 and DFAR section 227.7202, and the Documentation is “commercial computer software documentation” according to DFAR section 252.227-7014(a)(1) and (5). Any use, modification, reproduction, release, performance, display, or disclosure of the Product by the U.S. Government will be governed solely by the terms of this Agreement and all other use is prohibited.

13.15 Anti-Bribery. Neither party will take any action that would be a violation of any Applicable Laws that prohibit the offering, giving, promising to offer or give, or receiving, directly or indirectly, money or anything of value to any third party to assist Company or Customer in retaining or obtaining business. Examples of these kinds of laws include the U.S. Foreign Corrupt Practices Act and the UK Bribery Act 2010.

13.16 Titles and Interpretation. Section titles are for convenience and reference only. All uses of “including” and similar phrases are non-exhaustive and without limitation. The United Nations Convention for the International Sale of Goods and the Uniform Computer Information Transaction Act do not apply to this Agreement.

13.17 Signature. This Agreement may be signed in counterparts, including by electronic copies or acceptance mechanism. Each copy will be deemed an original and all copies, when taken together, will be the same agreement.

14. Definitions

1. “Affiliate” means an entity that, directly or indirectly, controls, is under the control of, or is under common control with a party, where control means having more than fifty percent (50%) of the voting stock or other ownership interest.
2. “Agreement” means these Terms and Conditions, between Company and Customer and the policies and documents referenced in or incorporated into these Terms and Conditions, including any applicable Order Form.
3. “Applicable Data Protection Laws” means the Applicable Laws that govern how the Service may process or use an individual’s personal information, personal data, personally identifiable information, or other similar term.
4. “Applicable Laws” means the laws, rules, regulations, court orders, and other binding requirements of a relevant government authority that apply to or govern Company or Customer.
5. “Clinic User” means a User that is provided access to the Platform by Administrator as a healthcare provider employed or engaged by Customer.
6. “Company Covered Claims” means any third party claim, suit, or proceeding arising out of, related to, or alleging infringement or misappropriation of a third party’s patent, copyright, trade secret, or other intellectual property right as a result of Customer’s authorized use of the Product. However, Company Covered Claims do not include, and Company’s obligations in the preceding sentence do not apply to the exclusions set forth in Section 10.5(a).
7. “Confidential Information” means information in any form disclosed by or on behalf of a Discloser, including before the Effective Date, to a Recipient in connection with this Agreement that (a) the Discloser identifies as “confidential”, “proprietary”, or the like; or (b) should be reasonably understood as confidential or proprietary due to its nature and the circumstances of its disclosure. Confidential Information includes the existence of this Agreement and the information on each Order Form. Customer’s Confidential Information includes non-public Customer Content, including Protected Health Information, and Company’s Confidential Information includes non-public information about the Product.
8. “Covered Claim” means either a Company Covered Claim or Customer Covered Claim.
9. “Customer Content” means any written material, photos, other images, logos, or other data, information, or materials submitted by or on behalf of Customer or Users to the Platform but excludes Feedback.
10. “Customer Covered Claims” means any third party claim, suit, or proceeding (i) arising out of, related to or alleging infringement or misappropriation of a copyright, trademark, or trade secret resulting from Company’s authorized use of Customer Content or otherwise arising out of, related to, or resulting from Company’s authorized use of Customer Content; (ii) arising out of, related to, or resulting from Customer's alleged or actual use of, misuse of, or failure to use the Platform; or (iii) arising out of, related to, or resulting from a violation of Applicable Laws by Customer or User. However, Customer’s obligations in the proceeding sentence do not apply to the exclusions set forth in Section 10.5(b).
11. “Discloser” means a party to this Agreement when the party is providing or disclosing Confidential Information to the other party.
12. “Documentation” means the usage manuals and instructional materials for the Service that are made available by Company.
13. “Expected RPM revenue” shall be equal to the sum of all CPT codes generated through use of the platform or Services (including but not limited to: 98960, 99453, 99454, 99457, 99458, 95249, 95250, 95251, 97802, 97803, 97804 0591T, 0592T, 0593T) sent to Customer medical biller for claim submissions times the Medicare national average reimbursement rate.
14. “Feedback” means suggestions, feedback, or comments about the Product or related offerings.
15. “Force Majeure Event” means an unforeseen event outside a party’s reasonable control where the affected party took reasonable measures to avoid or mitigate the impacts of the event. Examples of these kinds of events include unpredicted natural disaster like a major earthquake, war, pandemic, riot, act of terrorism, or public utility or internet failure.
16. “GDPR” means European Union Regulation 2016/679 as implemented by local law in the relevant European Union member nation, and by section 3 of the United Kingdom’s European Union (Withdrawal) Act of 2018 in the United Kingdom.
17. “High Risk Activity” means any situation where the use or failure of the Product could be reasonably expected to lead to death, bodily injury, or environmental damage. Examples include full or partial autonomous vehicle technology, medical life-support technology, emergency response services, nuclear facilities operation, and air traffic control.
18. “Indemnifying Party” means a party to this Agreement when the party is providing protection for a particular Covered Claim.
19. “Order Form” means Company’s order form, and any subsequent order form, which includes the key business details and definitions for this Agreement that are not defined in the Terms and Conditions. An Order Form may include details about the level of access and use granted to the Service or other details about the Product.
20. “Patient User” means a User that is provided access to the Platform by Administrator as a patient of Customer.
21. “Product” means the Service and Documentation.
22. “Prohibited Data” means (a) credit, debit, bank account, or other financial account numbers; (b) social security numbers, driver’s license numbers, or other unique and private government ID numbers; (c) special categories of data as defined in the GDPR; (d) other similar categories of sensitive information as set forth in the Applicable Data Protection Laws; (e) illegal content; (f) content that constitutes of lewd, pornographic or obscene material, or any product of an adult nature, including images, videos, or texts portraying nudity, sexual acts or products of an adult nature like drugs, adult toys or contraceptives; (g) hate speech; (h) defamatory or libelous content or constitutes trade disparagement or libel.
23. “Protected Health Information” means patient, medical, or other protected health information subject to the Health Insurance Portability and Accountability Act (as amended).
24. “Protected Party” means a party to this Agreement when the party is receiving the benefit of protection for a particular Covered Claim.
25. “Recipient” means a party to this Agreement when the party receives Confidential Information from the other party.
26. “Service” means the product and services described in the Order Form.
27. “Updates” means any and all patches, enhancements, updates, upgrades and new versions of the Platform that Company makes commercially available.
28. “Usage Data” means data and information about the provision, use, and performance of the Platform and related offerings based on Customer’s or User’s use of the Platform.
29. “User” means any individual, or end user, who uses the Platform on Customer’s behalf through his or her own account or through Customer’s account, including Clinic Users and Patient Users.

This Business Associate Addendum (this “Addendum”) supplements and is incorporated into the Terms and Conditions to which it is attached, and establishes specific legal obligations pursuant to HIPAA, regarding Protected Health Information that is received, maintained, or transmitted by LilyLink from or on behalf of the Client (“PHI”). Capitalized terms used in this Addendum without definition shall have the meanings ascribed to such terms under HIPAA or the Terms and Conditions, as applicable.

I. Obligations of LilyLink

Section 1.1. Use and Disclosure of PHI

LilyLink may use and disclose PHI as permitted or required under the Terms and Conditions (including this Addendum) or as Required by Law, but shall not otherwise use or disclose PHI. LilyLink shall not use or disclose PHI received from Client in any manner that would constitute a violation of HIPAA if so used or disclosed by Client (except as set forth in Sections 1.1(a), (b) and (c) below). To the extent LilyLink carries out any of the Client’s obligations under the HIPAA Privacy Rule, LilyLink shall comply with the requirements of the HIPAA Privacy Rule that apply to Client in the performance of such obligations. Without limiting the generality of the foregoing, LilyLink is permitted to use or disclose PHI as set forth below:

(a) LilyLink may use PHI internally for LilyLink’s proper management and administrative services or to carry out its legal responsibilities, including without limitation to develop and improve its suite of products and services;

(b) LilyLink may disclose PHI to a third party for LilyLink’s proper management and administration, including without limitation to develop and improve its suite of products and services, provided that the disclosure is Required by Law or LilyLink obtains reasonable assurances from the third party to whom the PHI is to be disclosed that the third party will (1) protect the confidentially of the PHI, (2) only use or further disclose the PHI as Required by Law or for the purpose for which the PHI was disclosed to the third party and (3) notify LilyLink of any instances of which the third-party is aware in which the confidentiality of PHI has been breached;

(c) LilyLink may use PHI to provide Data Aggregation services as defined by HIPAA;

(d) LilyLink may use PHI to create de-identified health information in accordance with the HIPAA de-identification requirements and Section 12.2 of the Terms and Conditions. LilyLink’s right to use such de-identified health information under this Section will survive the termination of this Addendum; and

(e) LilyLink may use and disclose PHI for purposes of obtaining an authorization to use and disclose PHI or any other permission from an Individual.

Section 1.2. Safeguards

LilyLink shall use commercially reasonable administrative, technical, and physical safeguards designed to prevent the use or disclosure of PHI other than as permitted or required under this Addendum, including requirements of the HIPAA Security Rule with respect to electronic PHI.

Section 1.3. Minimum Necessary Standard

To the extent required by the “minimum necessary” requirements of HIPAA, LilyLink shall only request, use and disclose the minimum amount of PHI necessary to accomplish the purpose of the request, use or disclosure.

Section 1.4. Mitigation

LilyLink shall take reasonable steps to mitigate, to the extent practicable, any harmful effect (that is known to LilyLink) of a use or disclosure of PHI by LilyLink in violation of this Addendum.

Section 1.5. Subcontractors

For each Subcontractor that creates, receives, maintains or transmits Client’s PHI on behalf of LilyLink, LilyLink shall enter into a written agreement meeting the requirements of 45 C.F.R. §§ 164.504(e) and 164.314(a)(2) that obligates the Subcontractor to comply with restrictions and conditions that are at least as restrictive as the restrictions and conditions that apply to LilyLink hereunder, as applicable to such Subcontractor’s services.

Section 1.6. Reporting Requirements

(a) If LilyLink becomes aware of a use or disclosure of PHI in violation of this Addendum by LilyLink or by a third party to which LilyLink disclosed PHI, including a Breach of Unsecured PHI, LilyLink shall report any such use or disclosure to the Client in accordance with 45 C.F.R. § 164.410 without unreasonable delay, and in no case later than forty-five (45) days after discovery of the Breach.

(b) LilyLink shall report any Security Incident involving EPHI that is not an Unsuccessful Security Incident (as defined below) of which LilyLink becomes aware without unreasonable delay, and in no case later than forty-five (45) days after discovery of the Security Incident. LilyLink hereby notifies Client of pings and other broadcast attacks on a firewall, denial of service attacks, port scans, unsuccessful login attempts, interception of encrypted information where the encryption key is not compromised, and other Unsuccessful Security Incidents. LilyLink will provide additional information about Unsuccessful Security Incidents on a reasonable basis, orally or in writing, if requested by Client. If the HIPAA security regulations are amended to remove the requirement to report Unsuccessful Security Incidents, the requirement hereunder to report Unsuccessful Security Incidents will no longer apply as of the effective date of the amendment. “Unsuccessful Security Incident” means a Security Incident that does not involve unauthorized access, use, disclosure, modification or destruction of EPHI or interference with an Information System in a manner that poses a material threat to the Confidentiality, Integrity, or Availability of the EPHI.

Section 1.7. Access to Information

Upon Client’s written request, LilyLink shall make available PHI to Client in accordance with this Addendum for so long as LilyLink maintains the PHI in a Designated Record Set, in accordance with 45 C.F.R. § 164.524. If LilyLink receives a request for access to PHI directly from an Individual, LilyLink shall forward such request to Client within ten (10) business days; and Client shall have the sole responsibility for approving such request and providing such access to the Individual.

Section 1.8. Availability of PHI for Amendment

Upon Client’s written request LilyLink shall provide PHI to Client for amendment, and incorporate any such amendments in the PHI for so long as LilyLink maintains such information in the Designated Record Set, in accordance with 45 C.F.R. § 164.526. If LilyLink receives a request for amendment to PHI directly from an Individual, LilyLink shall forward such request to Client within ten (10) business days. Client shall have the sole responsibility for approving such request and making such amendment.

Section 1.9. Accounting of Disclosures

Within thirty (30) business days of written notice by Client to LilyLink that it has received a request for an accounting of disclosures of PHI (other than disclosures to which an exception to the accounting requirement applies), LilyLink shall make available to Client such information as is in LilyLink’s possession and is required for Client to make the accounting required by 45 C.F.R. § 164.528. If LilyLink receives a request for an accounting directly from an Individual, LilyLink shall forward such request to Client within ten (10) business days; and Client shall have the sole responsibility for providing an accounting to the Individual.

Section 1.10. Availability of Books and Records

Following reasonable advance written notice, LilyLink shall make its internal practices, books and records relating to the use and disclosure of PHI received from, or created or received by LilyLink on behalf of, Client, available to the Secretary for purposes of determining Client’s compliance with HIPAA.

II. Obligations of the Client

Section 2.1. Permissible Requests

Client shall not request LilyLink to use or disclose PHI in any manner that would not be permissible under HIPAA if done by Client.

Section 2.2. Minimum Necessary Information

When Client discloses PHI to LilyLink, Client shall provide the minimum amount of PHI necessary for the accomplishment of Client’s purpose.

Section 2.3. Appropriate Disclosure of PHI to LilyLink

Client and its employees, representatives, consultants, contractors and agents shall not submit any Protected Health Information to LilyLink (A) outside of the Hosted Software or the Device Software, including but not limited to submissions to any online forum made available by LilyLink to its customers, email transmissions, and submissions through any support website, portal, or online help desk or similar service made available by LilyLink outside of the Hosted Software and the Device Software; or (B) directly to any third party involved in the provision of an online forum, email, support website, online help desk or other service described in subpart (A) above.

Section 2.4. Permissions; Restrictions

Client warrants that it has obtained and will obtain any consent, authorization and/or other legal permission required under HIPAA and other applicable law for the disclosure of PHI to LilyLink. Client shall notify LilyLink of any changes in, or revocation of, the permission by an Individual to use or disclose his or her PHI, to the extent that such changes may affect LilyLink’s use or disclosure of PHI. Client shall not agree to any restriction on the use or disclosure of PHI under 45 CFR § 164.522 that restricts LilyLink’s use or disclosure of PHI under this Addendum unless such restriction is Required By Law or LilyLink grants its written consent.

Section 2.5. Notice of Privacy Practices

Except as Required By Law, with LilyLink’s consent or as set forth in this Addendum, Client shall not include any limitation in Client’s notice of privacy practices that limits LilyLink’s use or disclosure of PHI under this Addendum.

III. Termination of this Agreement

Section 3.1. Termination Upon Breach of this Addendum

This Addendum may be terminated by either Party (the “Non-Breaching Party”) upon ninety (90) days written notice to the other Party (the “Breaching Party”) in the event that the Breaching Party materially breaches this Addendum in any material respect and such breach is not cured within such ninety (90) day period. Any determination of whether a material breach has been cured shall be made by LilyLink in its reasonable discretion.

Section 3.2. Return or Destruction of PHI upon Termination

Upon termination of this Addendum, LilyLink shall return or destroy all PHI received from Client or created or received by LilyLink on behalf of Client and which LilyLink still maintains as PHI. Notwithstanding the foregoing, to the extent that LilyLink determines, in its sole discretion, that it is not feasible to return or destroy such PHI, this Addendum shall survive termination hereof, and such PHI shall be used or disclosed solely for such purpose or purposes which prevented the return or destruction of such PHI.

IV. Miscellaneous

Section 4.1. Amendments to Comply with Law

If (a) any amendments to HIPAA are enacted after the Contract Date; or (b) any amendments to other data security and Privacy Laws are enacted after the Contract Date, to the extent such amendments require modifications to the then-current compliance obligations of either Party under this Addendum, the Parties agree to promptly meet and negotiate in good faith to mutually agree on such modifications. Any material modifications to LilyLink’s obligations under this BAA may include changes in financial terms as reasonably required to support such cost of compliance.

Section 4.2. Regulatory References

A reference in this Addendum to a section of HIPAA means the section in effect as of the Effective Date.