Terms and Conditions

These Terms and Conditions (“Terms”) govern access to and use of the EHR360 website, electronic health record platform, software, applications, AI-enabled capabilities, and related services collectively referred to as the “Services.”

These Terms constitute an agreement between EHR360 (“EHR360,” “we,” “us,” or “our”) and the individual or organization accessing or using the Services (“you” or “your”).

By accessing or using the Services, creating an account, or accepting an applicable Order Form or service agreement, you agree to these Terms.

If you are using EHR360 on behalf of a healthcare practice or other organization, you represent that you are authorized to accept these Terms on behalf of that organization.

If you do not agree to these Terms, you should not use the Services.

Healthcare organizations may enter into additional agreements with EHR360, including:

• Order Forms;
• Master Service Agreements (“MSAs”);
• Business Associate Agreements (“BAAs”);
• Statements of Work;
• Implementation agreements; or
• Other written agreements.

If there is a conflict between these Terms and a separately executed agreement, the separately executed agreement will control with respect to the subject matter of that conflict.

A BAA will control with respect to the use, disclosure, protection, return, or destruction of Protected Health Information (“PHI”).

“Authorized User” means an individual authorized to access the Services through a healthcare organization or other EHR360 customer.

“Covered Entity” has the meaning provided under the Health Insurance Portability and Accountability Act (“HIPAA”).

“Business Associate” has the meaning provided under HIPAA and includes EHR360 when it performs applicable services involving PHI on behalf of a Covered Entity.

“Customer Data” means information submitted to or processed through the Services on behalf of a customer.

“PHI” means Protected Health Information as defined under HIPAA.

“Patient” means an individual receiving services from a healthcare organization that uses EHR360.

Authorized Users

Healthcare professionals, employees, contractors, administrators, and other organizational users must be legally permitted and appropriately authorized to use the Services.

Users are responsible for:

• Providing accurate account information;
• Maintaining the confidentiality of login credentials;
• Using appropriate authentication and security measures;
• Preventing unauthorized access to their accounts; and
• Promptly notifying EHR360 or their organization if they suspect unauthorized account activity.

Accounts are intended for individual authorized users and should not be shared unless expressly permitted through functionality provided by EHR360.

Patient Access

Patients may access patient-facing functionality when it is made available by their healthcare provider.

Access for minors, parents, guardians, personal representatives, or authorized proxies may depend on applicable law and the healthcare provider's policies and configuration.

EHR360 provides an electronic health record and practice management platform that may include capabilities such as:

• Electronic health records;
• Clinical documentation;
• Appointment scheduling;
• Patient intake;
• Patient portal functionality;
• Secure communications;
• E-prescribing;
• Laboratory and diagnostic workflows;
• Billing and revenue-cycle workflows;
• Practice analytics;
• Interoperability and healthcare data exchange;
• Administrative and operational workflows; and
• AI-enabled workflow assistance.

Specific features available to a customer depend on the customer's subscription, configuration, integrations, and applicable agreements.

We may improve, modify, add, or discontinue features as the Services evolve. Where a change materially affects contracted functionality, any applicable Order Form, MSA, or other written agreement will govern.

EHR360 includes AI-enabled capabilities designed to assist healthcare organizations with clinical, administrative, operational, patient-access, and revenue-cycle workflows.

These capabilities may include assistance with:

• Patient communication;
• Scheduling;
• Patient intake;
• Clinical documentation;
• Chart summarization and information retrieval;
• Clinical workflow support;
• Document and fax processing;
• Coding and billing workflows; and
• Practice analytics.

AI-generated content, summaries, suggestions, documentation, or other outputs are intended to assist authorized users and healthcare professionals.

They are not a substitute for independent professional judgment.

Healthcare professionals remain responsible for appropriately reviewing AI-generated information and making their own clinical decisions regarding diagnosis, treatment, prescriptions, patient care, and other professional matters.

EHR360 does not practice medicine or independently establish a healthcare provider-patient relationship through the provision of its software.

Healthcare organizations and Authorized Users are responsible for:

• Using the Services in accordance with applicable laws and professional requirements;
• Maintaining appropriate professional licenses and credentials;
• Managing user access and permissions;
• Ensuring only authorized individuals access patient information;
• Maintaining appropriate security practices within their own organization;
• Reviewing clinical documentation and other information as appropriate;
• Maintaining accurate information submitted through the Services;
• Obtaining patient authorizations or consents when required;
• Configuring workflows appropriately for their organization; and
• Exercising independent professional judgment regarding patient care.

Healthcare organizations remain responsible for the clinical and professional services they provide to their patients.

You may not use the Services to:

• Violate applicable law or regulation;
• Access information without authorization;
• Attempt to bypass access controls or security measures;
• Introduce malware, malicious code, or harmful technology;
• Interfere with the availability, integrity, or operation of the Services;
• Impersonate another person or organization;
• Use another person's account without authorization;
• Scrape or automatically extract information except through authorized functionality or APIs;
• Reverse engineer or attempt to discover non-public source code except where such restriction is prohibited by law;
• Copy, resell, sublicense, or commercially exploit the Services except as expressly authorized;
• Violate intellectual property, privacy, or other rights of another party; or
• Use the Services for fraudulent, abusive, or unlawful purposes.

EHR360 may investigate suspected misuse and take reasonable action to protect the Services, customers, patients, and other users.

Customers retain their rights in Customer Data submitted to or maintained through EHR360.

EHR360 does not acquire ownership of a healthcare organization's patient records merely because those records are processed through the Services.

You grant EHR360 the limited rights necessary to host, store, process, transmit, back up, and otherwise handle Customer Data as required to provide, secure, maintain, and support the Services.

Where Customer Data contains PHI, EHR360's handling of that information is additionally governed by applicable HIPAA requirements and the applicable BAA.

When EHR360 creates, receives, maintains, or transmits PHI on behalf of a Covered Entity in circumstances subject to HIPAA, EHR360 acts as a Business Associate.

EHR360 and applicable healthcare customers will enter into a BAA as required.

When acting as a Business Associate, EHR360 will handle PHI in accordance with:

• Applicable HIPAA requirements;
• The applicable BAA; and
• Other applicable legal obligations.

Depending on the applicable BAA, EHR360's responsibilities may include:

• Using and disclosing PHI only as permitted or required;
• Maintaining appropriate safeguards for PHI;
• Reporting applicable unauthorized uses, disclosures, or breaches;
• Supporting Covered Entities with applicable patient privacy obligations;
• Requiring applicable subcontractors handling PHI to maintain appropriate protections; and
• Addressing PHI at termination in accordance with the BAA and applicable law.

Healthcare organizations remain responsible for their own HIPAA obligations, including appropriate access management, patient communications, Notices of Privacy Practices, and clinical use of PHI.

EHR360 maintains administrative, technical, and physical safeguards designed to protect the confidentiality, integrity, and availability of information processed through the Services.

Depending on the applicable Services and environment, safeguards may include:

• Encryption in transit and at rest;
• Authentication mechanisms;
• Multi-factor authentication;
• Role-based access controls;
• Logging and monitoring;
• Security assessments;
• Backup and recovery procedures;
• Workforce privacy and security training; and
• Incident-response procedures.

Customers are responsible for security within their own environments, including protecting credentials, endpoints, users, networks, and access permissions.

No electronic system can guarantee absolute security.

Fees for EHR360 are determined by the applicable Order Form, subscription plan, MSA, or other written agreement.

Depending on the Services selected, fees may include:

• Subscription fees;
• Implementation or onboarding fees;
• Integration fees;
• Transaction or payment-processing fees; and
• Other agreed service charges.

You agree to pay applicable fees according to the payment terms stated in your agreement with EHR360.

Unless otherwise stated in an applicable agreement, customers are responsible for applicable taxes associated with their purchase of the Services, excluding taxes based on EHR360's net income.

EHR360 may suspend certain Services for material non-payment where permitted by the applicable agreement and law. Any action affecting access to PHI will remain subject to applicable HIPAA obligations and the applicable BAA.

EHR360 may integrate with third-party products and services, including laboratories, pharmacies, payment processors, clearinghouses, imaging systems, communication services, and other healthcare technologies.

Third-party products and services may be governed by separate terms, privacy policies, fees, and availability requirements.

EHR360 does not control independent third-party services and is not responsible for their acts, omissions, availability, or performance except to the extent expressly provided in an applicable written agreement.

Changes made by third-party providers may affect the availability or functionality of integrations.

EHR360 and its licensors retain all rights, title, and interest in the Services, including applicable:

• Software;
• Source and object code;
• User interfaces;
• Designs;
• Documentation;
• Branding;
• Trademarks;
• Logos;
• Technology;
• Processes; and
• Other intellectual property.

Subject to these Terms and applicable agreements, EHR360 grants authorized customers and users a limited, non-exclusive, non-transferable right to access and use the Services for their intended business or healthcare purposes during the applicable subscription term.

No ownership rights in EHR360 technology are transferred to users or customers.

Feedback

If you voluntarily provide suggestions or feedback concerning the Services, EHR360 may use that feedback to evaluate and improve its products and services without an obligation to compensate you.

This does not transfer ownership of Customer Data or PHI to EHR360.

EHR360 works to maintain reliable access to the Services, but uninterrupted or error-free availability cannot be guaranteed.

Service interruptions may result from:

• Planned maintenance;
• Emergency maintenance;
• Third-party service failures;
• Internet or telecommunications failures;
• Security events;
• Infrastructure issues; or
• Circumstances outside EHR360's reasonable control.

Where a customer has a separately agreed service-level commitment, that agreement will control.

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW AND EXCEPT AS EXPRESSLY PROVIDED IN A SEPARATE WRITTEN AGREEMENT, THE SERVICES ARE PROVIDED “AS IS” AND “AS AVAILABLE.”

EHR360 DISCLAIMS IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, AND NON-INFRINGEMENT TO THE EXTENT PERMITTED BY LAW.

EHR360 DOES NOT GUARANTEE THAT:

• THE SERVICES WILL ALWAYS BE UNINTERRUPTED OR ERROR-FREE;
• EVERY DEFECT WILL BE CORRECTED IMMEDIATELY;
• THIRD-PARTY INTEGRATIONS WILL ALWAYS REMAIN AVAILABLE; OR
• AI-GENERATED OUTPUT WILL ALWAYS BE COMPLETE, ACCURATE, OR APPROPRIATE FOR A PARTICULAR CLINICAL SITUATION.

Healthcare professionals remain solely responsible for the clinical services they provide, including reviewing relevant information and exercising independent professional judgment.

Nothing in these Terms limits any warranty expressly provided in an applicable executed agreement.

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, NEITHER PARTY WILL BE LIABLE FOR INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, PUNITIVE, OR CONSEQUENTIAL DAMAGES ARISING FROM OR RELATED TO THE SERVICES, INCLUDING LOSS OF PROFITS, REVENUE, BUSINESS OPPORTUNITIES, OR GOODWILL.

EXCEPT FOR OBLIGATIONS OR LIABILITIES THAT CANNOT LAWFULLY BE LIMITED, EHR360'S AGGREGATE LIABILITY ARISING FROM OR RELATED TO THE SERVICES WILL NOT EXCEED THE AMOUNT PAID OR PAYABLE TO EHR360 FOR THE APPLICABLE SERVICES DURING THE TWELVE MONTHS PRECEDING THE EVENT GIVING RISE TO THE CLAIM.

Any different liability allocation contained in an applicable MSA, Order Form, BAA, or other executed agreement will control.

Nothing in this section is intended to limit liability where such limitation is prohibited by applicable law.

To the extent permitted by applicable law and subject to any separately executed agreement, you agree to defend, indemnify, and hold harmless EHR360 and its affiliates, officers, directors, employees, and agents from third-party claims arising from:

• Your unlawful or unauthorized use of the Services;
• Your material violation of these Terms;
• Your violation of third-party rights;
• Your professional services or independent clinical decisions; or
• Customer Data submitted in violation of applicable law or third-party rights.

Any separate indemnification obligations agreed between EHR360 and an organizational customer in an MSA, Order Form, BAA, or other executed agreement will control over this section.

Customer Termination

Customers may terminate Services according to the cancellation or termination provisions contained in their applicable Order Form, MSA, or subscription agreement.

Suspension or Termination by EHR360

EHR360 may suspend or terminate access where permitted by the applicable agreement, including circumstances involving:

• Material violation of these Terms;
• Material non-payment;
• Unlawful use;
• A significant security threat;
• Fraudulent activity; or
• A legal or regulatory requirement.

Where reasonably practicable, EHR360 will provide notice and an opportunity to address the issue before termination.

PHI and Customer Data After Termination

Termination of Services does not eliminate obligations relating to PHI.

The return, transfer, retention, destruction, or continued protection of PHI following termination will be handled in accordance with the applicable BAA, customer agreement, and applicable law.

EHR360 will not intentionally use access to PHI as leverage in a payment or commercial dispute where doing so would violate applicable legal or contractual obligations.

Procedures, formats, timing, and any applicable fees for exporting other Customer Data may be specified in the applicable agreement.

Use of the Services is also subject to the EHR360 Privacy Policy.

The Privacy Policy explains how EHR360 collects, uses, protects, and otherwise processes personal information.

Where EHR360 handles PHI on behalf of a Covered Entity, the applicable BAA and HIPAA requirements additionally govern that information.

Before initiating formal legal proceedings relating to these Terms, you agree to contact EHR360 and make a reasonable good-faith effort to resolve the matter informally.

Contact:

support@ehr360.ai

The parties should allow a reasonable period to attempt informal resolution unless immediate action is required to protect legal rights, confidentiality, security, intellectual property, or patient information.

For organizational customers, dispute-resolution, governing-law, arbitration, and venue provisions contained in an applicable MSA, Order Form, or other executed agreement will control.

If no separate written agreement specifies governing law or venue, applicable law and the rules of the court or tribunal having proper jurisdiction will determine those matters.

EHR360 may update these Terms to reflect changes in the Services, business operations, legal requirements, or policies.

When these Terms are updated, the “Last Updated” date at the top of this page will be revised.

Where appropriate or legally required, EHR360 may provide additional notice of material changes through:

• Email;
• The Services;
• An account notification; or
• The EHR360 website.

Changes will apply prospectively from their effective date.

Material contractual rights established in separately executed customer agreements will not be modified solely through an update to these website Terms unless the applicable agreement permits such modification.

Entire Agreement

These Terms, together with the Privacy Policy and any applicable executed agreements, constitute the agreement governing your use of the Services.

Severability

If a provision of these Terms is determined to be invalid or unenforceable, the remaining provisions will continue in effect to the fullest extent permitted by law.

Waiver

Failure to enforce a provision of these Terms does not waive the right to enforce that provision in the future.

Assignment

Users may not assign their rights or obligations under these Terms without EHR360's prior written consent.

EHR360 may assign its rights and obligations as part of a merger, acquisition, reorganization, sale of assets, or similar transaction, subject to applicable law and contractual requirements.

Force Majeure

Neither party will be responsible for delays or failures caused by events beyond its reasonable control, except for obligations that applicable law does not permit the parties to excuse.

Relationship of the Parties

Nothing in these Terms creates a partnership, joint venture, employment, fiduciary, or agency relationship between EHR360 and its customers or users.

Questions about these Terms, account matters, or legal notices concerning the Services may be directed to:

By creating an account, accepting an applicable agreement, or using the Services after these Terms become effective, you acknowledge that you have read and agree to be bound by these Terms and any additional agreements applicable to your use of EHR360.