About this document. This document contains the Zeteo Edge Subscription Terms and Exhibits A through D. It forms part of the Zeteo Edge Subscription Agreement between Zeteo Health, Inc. and each Customer that signs a Zeteo Edge Order Form referencing this version, and it is incorporated by reference into that Order Form. It is not an agreement on its own and binds a Customer only through a signed Order Form. The version identified above governs each Order Form that references it as of its Effective Date; Zeteo may publish updated versions, which apply to an existing Agreement only as provided in Section 13.15 of the Terms. Capitalized terms are defined in Section 1 of the Terms or in the Order Form.
Contents
- Zeteo Edge Subscription Terms (Sections 1–13)
- Exhibit A — Service Description and Support
- Exhibit B — Customer Responsibilities and Site Requirements
- Exhibit C — Business Associate Agreement
- Exhibit D — Behavioral Health Rider (applies only under a signed Behavioral Health Addendum)
Zeteo Edge Subscription Terms
1. Definitions
Capitalized terms have the meanings given in this Section 1, in the Order Form, or where first used in quotation marks. "Zeteo," "Customer," "Party," "Parties," and "Effective Date" have the meanings given in the Order Form.
"Affiliated Practice" means each covered entity practice identified in the Order Form as a practice on whose behalf Customer enters into this Agreement. Customer represents that it is authorized to bind each Affiliated Practice to this Agreement and the BAA. References in this Agreement to Customer's Users, Clinicians, Staff Users, patients, Practice Locations, EHR, and Customer Data include those of each Affiliated Practice; each Affiliated Practice and its personnel receive the rights granted to Customer and its Users under Section 2.1; and Customer is responsible for each Affiliated Practice's compliance with this Agreement as if it were Customer's own.
"Agreement" means the Zeteo Edge Subscription Agreement formed by the Order Form, these Terms, the Exhibits (including the BAA) that apply under the Order Form, and the Documentation, as described in the Order Form.
"Clinician" means a physician, nurse practitioner, physician assistant, or other licensed healthcare professional employed or engaged by Customer or an Affiliated Practice who authors or approves Output under that professional's own credentials for patients under that professional's care. A nurse or other licensed professional who uses the Edge System only in support of a Clinician and does not author or approve Output under his or her own credentials is a Staff User, not a Clinician.
"Clinical Logic" means Zeteo's proprietary library of clinical use cases, decision rules, classifiers, templates, response patterns, knowledge base, and related content, as updated by Zeteo from time to time.
"Customer Data" means all data, content, and information that Customer, its Users, or Customer's EHR or other systems make available to the Edge System, including Protected Health Information, encounter audio and transcripts, clinical notes, templates, protocols, approved references, and messages. Customer Data does not include Operational Telemetry (including Diagnostic Data) or information de-identified on the Edge Units and transmitted under Section 4.10. Practice Tuning is addressed in Section 4.3.
"Diagnostic Data" means structured error and crash reports generated by the Edge System in a fixed schema published in the Documentation, consisting of event and error codes, software component and version identifiers, timestamps, and resource metrics, and containing no free text, memory contents, or Customer Data. Diagnostic Data is Operational Telemetry.
"Documentation" means the user guides, specifications, and service descriptions for the Edge System that Zeteo makes available to Customer, including Exhibit A. Zeteo may update the Documentation from time to time, provided that an update does not materially reduce the core functionality of the Released Workflows (Section 2.6).
"Edge Network" means Zeteo's program, described in Section 4.10, under which participating Edge Units contribute de-identified information to the development of Models and Clinical Logic.
"Edge System" or "System" means Zeteo's on-premises clinical AI system, comprising the Edge Units, the Software, the Models, and the Clinical Logic, together with the Documentation and any updates, upgrades, and replacements that Zeteo provides under this Agreement.
"Edge Unit" means each physical computing device, including any Satellite Unit, together with its enclosure, cabling, peripherals (including any recording devices and any recovery controller used to unlock the Edge Unit after an unplanned restart), and pre-installed Software, that Zeteo installs, or supplies for installation, at a Practice Location under this Agreement.
"EHR" means Customer's electronic health record system and related practice-management and patient-communication systems.
"Go-Live Date" means the date determined under Section 2.4.
"Initial Term" means the initial subscription period stated in the Order Form, measured from the Go-Live Date.
"Models" means the machine-learning models, model weights, adapters, embeddings, and related artifacts deployed on the Edge Units, including the Practice Tuning.
"Monthly Subscription Fee" means the monthly fee for the Subscription Tier selected in the Order Form, as adjusted under Sections 5.3 and 5.5.
"Operational Telemetry" means structured system-health and usage fields transmitted from the Edge Units in a fixed schema published in the Documentation (such as system health, software versions, feature usage counts, latency, and Output acceptance and edit rates), which contains no free text and no Customer Data, and includes Diagnostic Data.
"Order Form" means the Zeteo Edge Order Form, signed by both Parties, that references and incorporates these Terms and the Exhibits.
"Output" means any draft note, summary, message, care plan, authorization request, draft recommendation, transcript, response, or other content generated by the Edge System for review by a User.
"Practice Location" means each physical office of Customer identified in the Order Form at which Edge Units are installed.
"Practice Tuning" means configurations, preferences, model adapters, fine-tuned weights, and similar artifacts that the Edge System derives from Customer Data in order to adapt the System to Customer's workflows and to individual Clinicians.
"Protected Health Information" or "PHI" has the meaning given in the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations, as amended ("HIPAA").
"Renewal Term" has the meaning given in Section 11.1.
"Satellite Unit" means an additional Edge Unit that Zeteo installs to add capacity at a Practice Location, as described in Section A.2 of Exhibit A.
"Software" means Zeteo's proprietary software installed on or used with the Edge Units, including the clinician workspace, integration layer, local clinical engine, and management and update tooling, in object code form, and any third-party or open-source components included with it.
"Staff User" means a medical assistant, nurse, front-office, billing, or administrative employee or contractor of Customer or an Affiliated Practice who is authorized to use the Edge System in support of Clinicians.
"Subscription Term" means the Initial Term together with any Renewal Terms.
"Subscription Tier" means the tier selected in the Order Form, as adjusted under Section 5.3.
"User" means a Clinician or Staff User.
2. The Edge System
2.1 Subscription.
Subject to this Agreement, Zeteo grants Customer a non-exclusive, non-transferable, non-sublicensable right during the Subscription Term to permit its Users to access and use the Edge System from the Practice Locations and, through Customer's secured remote-access methods, from other locations in the United States, solely for Customer's internal clinical and administrative operations in the care of the patients of Customer and the Affiliated Practices, and solely for the number of Clinicians covered by the Subscription Tier.
2.2 Edge Units; title and bailment.
(a) Zeteo will furnish, install, configure, maintain, and support the Edge Units at the Practice Locations as described in Exhibit A. Zeteo retains sole title to the Edge Units at all times. Customer holds the Edge Units as bailee for Zeteo, with a right of possession and use only, and the Edge Units are not sold, leased, or financed to Customer.
(b) Customer will (i) keep the Edge Units at the Practice Locations and will not relocate, open, modify, or connect them to other hardware or software without Zeteo's prior written consent, except that portable recording devices may be moved within a Practice Location; (ii) provide the physical space, power, network connectivity, and physical security described in Exhibit B; (iii) keep the Edge Units free of liens and encumbrances and, on request, use commercially reasonable efforts to obtain a waiver or acknowledgment from any landlord or lender confirming that the Edge Units are Zeteo's property; and (iv) notify Zeteo within twenty-four (24) hours of any loss, theft, or unauthorized physical access to an Edge Unit, and promptly of any damage or malfunction. Upon receiving notice of a loss or theft, Zeteo will promptly revoke the credential required to unlock the affected Edge Unit.
(c) Zeteo may remotely monitor the operational health of the Edge Units, and may, in its discretion, replace, upgrade, or add Edge Units (including Satellite Units) from time to time, or optimize the Software or Models, to maintain the service levels in Exhibit A. Upon expiration or termination of this Agreement, or during any suspension under Section 5.2, Zeteo may remotely disable the Software on the Edge Units, provided that Zeteo will not erase Customer Data before the export period in Section 11.4 has run.
(d) The Parties intend this Agreement as an agreement for services and a license of software, under which the Edge Units are furnished solely as the means of delivering the Edge System at the Practice Locations, are not separately selected, priced, or paid for by Customer, and are not leased or sold to Customer; the Monthly Subscription Fee is set by the number of Clinicians and by any additional service capacity Customer elects in the Order Form, not by the Edge Units supplied, which Zeteo selects and may change under Section A.2 of Exhibit A. To the extent Article 2A of the Uniform Commercial Code is nonetheless held to apply to the Edge Units, Customer waives, to the fullest extent permitted by law, the rights and remedies conferred on a lessee by UCC Sections 2A-508 through 2A-522, including any right to reject or revoke acceptance of, or to deduct from fees on account of, the Edge Units, except as expressly provided in this Agreement. Customer authorizes Zeteo to file precautionary UCC financing statements identifying the Edge Units as Zeteo's property.
2.3 Risk of loss.
Risk of loss, theft, or damage to the Edge Units passes to Customer upon installation and remains with Customer until the Edge Units are returned to Zeteo or collected by Zeteo under Section 11.4 or Section A.5 of Exhibit A. If an Edge Unit is lost, stolen, or damaged beyond normal wear and tear, other than as a result of Zeteo's negligence or willful misconduct or a defect in the unit, Customer will pay Zeteo the replacement cost stated in Exhibit A for that unit and, if Zeteo installs the replacement on site, the Replacement Service Fee stated in Section A.2 of Exhibit A, and Zeteo will supply a replacement. Customer may insure the Edge Units for their replacement cost under its property insurance.
2.4 Installation and Go-Live.
(a) Zeteo will perform on-site installation and initial configuration as described in Exhibit A, and Customer will perform its responsibilities in Exhibit B. The Parties will cooperate in good faith to schedule installation within the target installation window in the Order Form. If no target installation window is stated, it ends sixty (60) days after the Effective Date. Zeteo personnel on site will comply with Customer's reasonable written site, safety, and privacy policies provided to Zeteo in advance.
(b) When installation and initial configuration at the first Practice Location are complete and the Edge System is available for use by Clinicians with the Initial Workflows (as defined in Section A.1(a) of Exhibit A) in accordance with Exhibit A, Zeteo will notify Customer in writing (email sufficient). The Edge System is deemed accepted, and the "Go-Live Date" is the date of that notice, unless within five (5) business days after the notice Customer notifies Zeteo of a material non-conformity of an Initial Workflow with Exhibit A, in which case Zeteo will correct the non-conformity and re-issue the notice, and the Go-Live Date is the date of the re-issued notice. Where the Order Form lists additional Practice Locations with a rollout schedule, the same acceptance process applies to each later location, and Zeteo will use commercially reasonable efforts to meet each target go-live date.
(c) If the Go-Live Date has not occurred within the later of ninety (90) days after the Effective Date and thirty (30) days after the end of the target installation window, for reasons not attributable to Customer or to Customer's EHR vendor or another third party Customer selects (any such third-party delay extending the period day for day), Customer may terminate this Agreement on written notice, Zeteo will refund any amounts paid, and neither Party will have further liability, as Customer's sole remedy. If the Go-Live Date is delayed for reasons attributable to Customer (including failure to satisfy Exhibit B), and Zeteo has given Customer written notice of the unmet item at least fifteen (15) days earlier, Zeteo may begin invoicing the Monthly Subscription Fee, and the Initial Term will be measured, as if the Go-Live Date had occurred on the day following the end of the target installation window.
2.5 EHR connectivity.
The Edge System connects to Customer's EHR through interfaces made available by Customer's EHR vendor, which vary by vendor and by Customer's license. Zeteo will use commercially reasonable efforts to configure the connection method described in Exhibit A. Where the EHR does not permit Output to be written directly into the patient record, Zeteo will configure an alternative workflow (such as clinician-initiated transfer) and will confirm the workflow with Customer before the Go-Live Date. Customer is responsible for obtaining and maintaining all EHR vendor authorizations, credentials, API access, and licenses needed for the connection, and for any fees charged by the EHR vendor. Zeteo will not knowingly configure a connection method that is prohibited by the published terms of Customer's EHR vendor that Customer has provided to Zeteo. Zeteo is not responsible for changes, limitations, outages, or restrictions imposed by Customer's EHR vendor or by any other third-party product or service that Customer selects and uses with the Edge System (other than components Zeteo includes in the Software), makes no warranty regarding any such third-party product or service, and is not responsible for the availability or operation of the Edge System to the extent caused by such a third-party product or service.
External connections. The Edge Units exchange Customer Data with Customer’s EHR and, where a workflow requires it, with payers, clearinghouses, and other external systems that Customer designates, through the connection method confirmed under this Section 2.5. Where an EHR, payer, or clearinghouse requires an intermediary connection service operated by Zeteo or its subcontractor to complete an exchange, Zeteo may use one if Customer has consented in the Order Form, subject to the following: (a) inference and the generation of Output occur only on the Edge Units; (b) Zeteo lists each intermediary connection service it uses, with its operator, hosting region, the data exchanged, and whether a subcontractor BAA is in place, in the Documentation, and adds a service to that list at least thirty (30) days before it is first used for any Customer’s data; (c) Customer Data is encrypted in transit, is not stored in the service beyond what is needed to complete the exchange, and is not used for any other purpose, including training or tuning Models, without limiting Zeteo’s rights under Sections 4.3 and 4.10 once the data is received on the Edge Units; (d) any third-party operator is bound by a written agreement meeting Section II.5 of the BAA; (e) each exchange is logged without logging Customer Data, and the log is available to Customer on request; and (f) Customer may withdraw its consent for any service on thirty (30) days’ written notice, after which Zeteo will configure the alternative workflow described in this Section 2.5 if one is available, and withdrawal does not entitle Customer to a fee reduction or to terminate, and any reduction in functionality or availability that results from a withdrawal is not a non-conformity under Section 9.2 or an availability shortfall under Section A.6 of Exhibit A. Customer Data transmitted through an intermediary connection service remains Customer Data and, to the extent it contains PHI, PHI. A service hosted by or for Customer’s EHR vendor, payer, or clearinghouse as part of its own product is not an intermediary connection service.
2.6 Early Access program; changes.
Customer acknowledges that Zeteo is making the Edge System available under an early access program. Zeteo may add, modify, or remove features of the Edge System during the Subscription Term, provided that Zeteo will not materially reduce the core functionality of the Released Workflows described in Section A.1 of Exhibit A without Customer's consent, except where Zeteo reasonably determines that a change is required by law, regulatory guidance, or to address a security or patient-safety risk, in which case Zeteo will notify Customer and, if the change materially reduces that core functionality, Customer may terminate this Agreement on thirty (30) days' written notice without any fee under Section 11.3. Roadmap items and features not described in Exhibit A are not promised and are not a basis for this Agreement, and Zeteo's release of a workflow, feature, or product to other customers does not entitle Customer to it except as provided in Section A.1 of Exhibit A. Customer agrees to provide reasonable feedback on the Edge System when requested.
2.7 Users.
Customer is responsible for its Users' compliance with this Agreement and for all activity under Customer's accounts. Customer will ensure that only Clinicians approve Output for entry into a patient record, transmission to a patient or payer, or use in a clinical decision, and will promptly deactivate the credentials of any User whose employment or engagement ends.
3. Restrictions
Customer will not, and will not permit any third party to: (a) copy, modify, translate, or create derivative works of the Edge System; (b) reverse engineer, decompile, disassemble, extract, or otherwise attempt to derive the source code, Models, model weights, Clinical Logic, prompts, or other non-public elements of the Edge System, or access the storage of an Edge Unit other than through the Software, except to the extent applicable law expressly prohibits this restriction; (c) sell, resell, rent, lease, lend, sublicense, distribute, or otherwise make the Edge System available to any third party, or use it to provide services to any person other than Customer's own patients; (d) use the Edge System to build or train a competing product or service, or publish benchmarks or performance comparisons of the Edge System without Zeteo's written consent, which Zeteo will not unreasonably withhold for peer-reviewed research that does not disclose Zeteo's Confidential Information; (e) remove or alter any proprietary notices or Zeteo branding on the Edge Units or Software; (f) interfere with or circumvent any security, update, licensing, or monitoring mechanism of the Edge System; (g) install any software on, or connect any device to, an Edge Unit other than as directed by Zeteo; (h) use the Edge System in violation of applicable law, including HIPAA and laws governing the recording of conversations; or (i) use the Edge System for any patient or purpose other than those permitted by Section 2.1. Exceeding the Subscription Tier is governed exclusively by Section 5.3 and is not a breach of this Section 3.
4. Customer Data, Practice Tuning, and Privacy
4.1 Ownership of Customer Data.
As between the Parties, Customer owns all right, title, and interest in and to the Customer Data and the Output. Customer grants Zeteo a non-exclusive license during the term of this Agreement to process Customer Data on the Edge Units, and to the limited extent described in Sections 2.5, 4.4, and 4.5, solely to provide, maintain, secure, and improve the Edge System for Customer and to perform Zeteo's obligations under this Agreement.
4.2 Local processing; no off-unit backups.
The Edge System is designed so that Customer Data, including PHI, is processed and stored on the Edge Units within Customer's network at the Practice Locations. Zeteo will not transmit Customer Data from the Edge Units to Zeteo or to any third-party cloud or hosted AI service, except (a) as Customer directs or as necessary to deliver Output to Customer's EHR or messaging systems, including through an intermediary connection service under Section 2.5; (b) during supervised support sessions that Customer authorizes under Section 4.4; or (c) as required by law. Software and model updates delivered by Zeteo to the Edge Units do not carry Customer Data back to Zeteo, and, other than Customer Data in transit through an intermediary connection service under Section 2.5 of the Terms, and PHI handled under Section A.5 of Exhibit A or incidentally received in support communications, Zeteo does not hold Customer Data outside the Edge Units. Zeteo does not maintain off-unit backups of Customer Data or Practice Tuning; Customer should transfer approved Output to its EHR promptly, and Zeteo is not responsible for Customer Data or Output that has not been transferred to the EHR if an Edge Unit fails. During the Subscription Term, Zeteo will provide reasonable assistance, through the Edge System or on request, for Customer to export Customer Data and Output stored on the Edge Units for patient-access, amendment, legal-process, or records-retention purposes.
4.3 Practice Tuning.
The Edge System adapts to Customer by generating Practice Tuning from Customer Data, including from Clinicians' prior notes and messages and from Users' edits to Output. Practice Tuning is created and stored only on the Edge Units. Zeteo will not use Customer Data or Practice Tuning to train or tune Models deployed for any other customer, except information de-identified on the Edge Units and transmitted under Section 4.10. As between the Parties, Zeteo owns the intellectual property rights in Practice Tuning as a derivative of the Models and Clinical Logic; Practice Tuning is nonetheless treated as Customer Data and, to the extent it contains PHI, as PHI, for purposes of Sections 4.2, 4.7, and 8 and the BAA, is stored only on the Edge Units, and will be destroyed on termination under Section 11.4. Customer acknowledges that Practice Tuning reflects the style and content of Clinicians' prior documentation, and that Clinicians should review Output for carried-over content.
4.4 Support access.
Zeteo may access the Edge Units remotely for maintenance, monitoring, updates, and support. Zeteo's routine remote access is limited to system health, configuration, and Operational Telemetry (including Diagnostic Data) under Section 4.5. Where a support request cannot be resolved without viewing Customer Data, Zeteo will request Customer's authorization for a supervised support session conducted over an encrypted connection and logged, and any PHI accessed in that session is governed by the BAA. Zeteo personnel and subcontractors who perform on-site installation or support are bound by written confidentiality obligations consistent with the BAA.
4.5 Operational Telemetry and Diagnostic Data.
Zeteo may collect Operational Telemetry from the Edge Units and may use and disclose it for the purposes of operating, supporting, securing, and improving Zeteo's products and services and for aggregate reporting. Diagnostic Data is generated on the Edge Units in the fixed schema published in the Documentation and, by construction, contains no free text, memory contents, or Customer Data. Crash logs, stack traces, and other unstructured diagnostic output remain on the Edge Units and are accessible to Zeteo only in a supervised support session under Section 4.4. Zeteo will receive information de-identified from Customer Data only under Section 4.10. Zeteo will not identify Customer, any User, or any patient in connection with any Operational Telemetry or de-identified information, will not attempt to re-identify de-identified information, and will not sell de-identified information in any form that includes individual patient-level records. Aggregate statistics, benchmarks, and Models derived under Section 4.10 are not patient-level records.
4.6 HIPAA and the BAA.
To the extent Zeteo creates, receives, maintains, or transmits PHI on behalf of Customer, the Parties will comply with the BAA. Nothing in this Agreement requires either Party to act in violation of HIPAA, and in the event of a conflict between this Agreement and the BAA with respect to PHI, the BAA controls.
4.7 Security.
Zeteo will maintain administrative, physical, and technical safeguards appropriate to the Edge System, including encryption of Customer Data at rest on the Edge Units, role-based access controls, authenticated and integrity-checked software updates, logging of administrative access, and the security program described in Exhibit A. The Software, Models, and Clinical Logic are stored on the Edge Units in encrypted form, and Customer acknowledges that they are Zeteo's trade secrets. Customer will maintain the physical, network, and account security described in Exhibit B. Each Party will notify the other without undue delay, and in any event within the period required by the BAA, upon discovering a security incident affecting Customer Data.
4.8 Patient consent and recording laws.
Recording and transcription of patient encounters are initiated by Users, not automatically by the Edge System. Where the Edge System is used to record or transcribe encounters, Customer is solely responsible for determining whether, and in what form, notice or consent is required under federal and state law (including state laws requiring the consent of all parties to a recorded conversation, including patients, companions, interpreters, and Customer personnel, and, for telehealth encounters, the law of the state where the patient is located) and for obtaining and documenting that consent. Zeteo will provide configurable consent prompts and sample language as described in Exhibit A, but does not provide legal advice and makes no representation that any sample language is sufficient in any jurisdiction.
4.9 Business contact data.
Zeteo processes the business contact information of Customer's personnel that Zeteo holds in its own systems (such as names, titles, roles, work email addresses, and support and billing correspondence) as an independent controller for the purposes of managing the customer relationship, billing, support, security, and legal compliance, in accordance with Zeteo's privacy policy. Such information, as held in Zeteo's own systems, is not Customer Data; User account and activity records on the Edge Units remain Customer Data.
4.10 Edge Network.
(a) Participation level. Customer participates in the Edge Network at Level 1 unless Customer elects Level 0 in the Order Form or in the Edge System settings. Customer may change its participation level at any time in the Edge System settings, effective for Edge Network jobs that begin after the change. Neither Zeteo nor any system that coordinates the Edge Network will override a participation level that Customer has set.
(b) Participation levels. Level 0: Operational Telemetry only. Level 1: Operational Telemetry, aggregate statistics derived from Customer Data, and model updates derived from Customer Data and Practice Tuning. Level 2: Level 1 plus federated training of model adapters across participating Edge Units. Level 3: Level 2 plus additional network programs, such as clinical trial matching and evidence generation. Levels 2 and 3 are not available as of the Effective Date. Zeteo will notify Customer when a level becomes available, and Customer participates in it only by election: for Level 2, in the Edge System settings on the terms then stated in the Documentation; for Level 3, under a separate addendum signed by both Parties.
(c) De-identification. Before any information derived from Customer Data or Practice Tuning leaves an Edge Unit under this Section 4.10, the Edge System is designed to de-identify it on the Edge Unit in accordance with 45 C.F.R. § 164.514(b). Zeteo will maintain a documented de-identification method meeting that standard, which Zeteo selects and which may be performed by automated means on the Edge Unit, and will describe the method in effect in the Documentation. Zeteo does not intend to receive identifiable Customer Data under this Section 4.10; if Zeteo discovers that identifiable Customer Data has been received under it, Zeteo will not use it, will delete it, and will notify Customer as the BAA requires. The restrictions on identification, re-identification, and sale in Section 4.5 apply to all information received under it.
(d) Use. Zeteo may use information received under this Section 4.10 to develop, train, evaluate, and improve Models and Clinical Logic, which may be deployed for Customer and for other customers.
(e) Transparency. The Edge System will maintain a log, viewable by Customer, of each Edge Network job run on the Edge Units, the participation level in effect, and the category of information transmitted.
(f) Withdrawal. When Customer lowers or ends its participation, Zeteo will not receive further information at the withdrawn level. Contributions already incorporated into Models before the change are not removed.
(g) Network benefits. While Customer participates at Level 1 or higher, Zeteo will make available to Customer, as part of the Monthly Subscription Fee and as they are released, the benchmarks, payer and workflow intelligence, and improvements to Models and Clinical Logic that Zeteo derives from the Edge Network for Customer's specialty and workflows, as Zeteo generally releases them to Level 1 participants, and excluding workflows, features, and products governed by Section A.1(d) of Exhibit A.
5. Fees and Payment
5.1 Fees.
Customer will pay the Monthly Subscription Fee for each month of the Subscription Term beginning on the Go-Live Date (or earlier as provided in Section 2.4(c)). The first two Monthly Subscription Fees are payable on signature of the Order Form, are applied to the first two months after the Go-Live Date, and are refundable only as provided in Section 2.4(c) and Section 11.4(f). Fees for any partial month at the beginning or end of the Subscription Term are prorated. The Monthly Subscription Fee (including any fee for additional capacity stated in the Order Form), together with any installation fee for an additional Practice Location stated in the Order Form, is the only charge for the Edge System as described in Exhibit A; fees for additional products or professional services will be set out in a separate written order.
5.2 Invoicing and payment.
Unless the Order Form specifies a prepay option, Zeteo will invoice the Monthly Subscription Fee monthly in advance beginning with the third month after the Go-Live Date, and Customer will pay each invoice within thirty (30) days of the invoice date. Card payments are subject to the processing surcharge stated in the Order Form where permitted by law. Annual prepayments are invoiced on the Go-Live Date (less the two months paid on signature) and on each anniversary of it; a full Initial Term prepayment is invoiced on the Go-Live Date, less the two months paid on signature. Prepaid fees are non-refundable except as expressly provided in this Agreement, and Customer may not set off or withhold any amount except as provided in Section 5.6 and Section A.6 of Exhibit A and as credited under Section 11.3. Amounts not paid when due accrue interest at one and one-half percent (1.5%) per month or the maximum rate permitted by law, whichever is less, and Customer will reimburse Zeteo's reasonable costs of collection. If any undisputed amount is more than thirty (30) days past due, Zeteo may, on ten (10) days' written notice, suspend Customer's access to the Edge System until payment is received; suspension does not relieve Customer of its payment obligations, and Zeteo is not liable for any consequence of a suspension made in accordance with this Section. During any suspension, Zeteo will preserve Customer Data on the Edge Units and will, on request, provide Customer an export of Customer Data and Output for patient-care, patient-access, and legal-process purposes.
5.3 Tier true-up.
A Clinician is counted for a calendar month if that Clinician authors or approves Output in that month and in the preceding month. Clinicians at a Practice Location that has not yet gone live under Section 2.4(b) are not counted. If the number of Clinicians so counted exceeds the number covered by Customer's Subscription Tier, Customer's Subscription Tier and Monthly Subscription Fee will move to the lowest tier that covers the actual number of Clinicians, at the fee stated in the Order Form or, if none is stated for that tier, at Zeteo's then-current list fee for that tier or, where the count exceeds twenty (20) Clinicians and no Custom fee is stated in the Order Form, the Tier 5 fee plus five hundred dollars ($500) per month for each Clinician above twenty (20), effective the first day of the following month. Zeteo may determine the number of Clinicians from Edge System records, will notify Customer in writing of any tier change, with the Clinician count supporting it, at least fifteen (15) days before it takes effect (and Customer may dispute the count under Section 5.6), and will provide any additional capacity that Zeteo determines is needed for the new tier, in the manner described in Section A.2 of Exhibit A, without charge beyond the fee for the new tier. Tiers do not step down during the Initial Term but may step down at the start of any Renewal Term on sixty (60) days' written notice.
5.4 Taxes.
Fees are exclusive of all sales, use, excise, value-added, property, and similar taxes, duties, and charges, all of which Customer will pay, other than taxes on Zeteo's net income. If Customer is tax-exempt, it will provide a valid exemption certificate.
5.5 Renewal pricing.
Zeteo may increase the Monthly Subscription Fee for any Renewal Term by giving Customer written notice at least seventy-five (75) days before the start of that Renewal Term, provided that any increase for a Renewal Term will not exceed, over the fee in effect for the same Subscription Tier during the preceding term, the greater of (a) ten percent (10%) and (b) the percentage increase in the Consumer Price Index for All Urban Consumers (CPI-U, U.S. city average, all items) published by the U.S. Bureau of Labor Statistics for the most recent twelve (12) month period available on the date of the notice. This limit applies only to the fee for the same Subscription Tier and does not limit a change in the Monthly Subscription Fee resulting from a tier change under Section 5.3, fees for additional on-site capacity under Section A.2 of Exhibit A, or fees for add-on workflows, products, or services.
5.6 Disputed amounts.
Customer may withhold payment of any amount it disputes in good faith, provided it notifies Zeteo of the dispute and its basis before the due date and pays all undisputed amounts. The Parties will work in good faith to resolve the dispute within thirty (30) days.
6. Intellectual Property
6.1 Zeteo property.
As between the Parties, Zeteo and its licensors own all right, title, and interest, including all intellectual property rights, in and to the Edge System (including the Edge Units, Software, Models, Clinical Logic, Practice Tuning, and Documentation), all improvements, modifications, and derivative works of any of them by whomever made, and the Operational Telemetry and the de-identified information described in Section 4.10 (collectively, "Zeteo IP"). Zeteo IP does not include Customer Data or Output. No rights are granted to Customer other than as expressly set out in this Agreement. To the extent Customer or any User acquires any right, title, or interest in Zeteo IP, Customer hereby assigns, and will cause its Users to assign, all such right, title, and interest to Zeteo.
6.2 Output.
Customer owns the Output generated for Customer and may use it for any lawful purpose consistent with this Agreement. Customer acknowledges that Output is generated by automated means from Customer Data and the Clinical Logic, that similar or identical Output may be generated for other customers from similar inputs, and that nothing in this Section 6.2 conveys any ownership of the Clinical Logic, templates, or Models from which Output is produced.
6.3 Feedback.
If Customer or any User provides suggestions, comments, or other feedback about the Edge System ("Feedback"), Zeteo may use and exploit the Feedback without restriction or payment, and Customer hereby assigns to Zeteo all rights in the Feedback. Feedback does not include Customer Data. Nothing in this Agreement limits Zeteo's right to develop, acquire, license, or market products or services that perform the same or similar functions as any product or service of Customer.
6.4 Open-source components.
The Software includes third-party open-source components and open-weight models, each used under its published license terms, which Zeteo will identify in the Documentation on request and may change from time to time as Zeteo updates the Models under Section A.4 of Exhibit A. Those terms apply to the open-source components and open-weight models themselves, and nothing in this Agreement restricts Customer's rights under them; to the extent any such terms impose conditions on Customer's use of a Model, Zeteo will state those conditions in the Documentation; they do not apply to, and grant no rights in, Zeteo's adapters, Practice Tuning, Clinical Logic, prompts, or the Software.
6.5 Learnings.
Zeteo may use the know-how, techniques, workflow configurations, rule and template structures, and generalized learnings that it acquires in providing the Edge System, including from Users' edits to Output and from Customer's requests and feedback, to develop and improve the Edge System and Zeteo's other products and services, provided that Zeteo does not use Customer's Confidential Information, PHI, or any information that identifies Customer, a User, or a patient except as permitted by Sections 4 and 8 and the BAA. This Section 6.5 does not grant Zeteo any right in Customer Data or Output.
7. Clinical Use and Responsibility
7.1 Clinician review.
The Edge System produces drafts and decision-support content for review by qualified Clinicians. Customer acknowledges and agrees that (a) all Output must be reviewed, edited as appropriate, and approved by a Clinician before it is entered into a patient record, sent to a patient or payer, or used in a clinical decision; (b) the Edge System does not practice medicine, does not establish a patient relationship, and does not make clinical decisions, and the Clinical Logic, although authored with physician input, does not establish or constitute a standard of care; (c) Customer and its Clinicians retain sole responsibility for all diagnoses, treatments, communications, orders, prior authorization and appeal submissions, and other professional judgments, regardless of whether Output was used; (d) the Edge System is not intended for use in medical emergencies; and (e) Customer is solely responsible for the accuracy, medical necessity, and supporting documentation of any code, claim, or representation submitted to a payer or government program, whether or not Output was used in preparing it, and the Edge System is not a coding or billing compliance tool.
7.2 Accuracy.
Output may be incomplete or inaccurate, may omit information that is not present in structured form in Customer Data, and may not reflect the most current clinical guidance. The Edge System is designed to display the sources it relied upon and to flag gaps in available data, but Customer will not rely on those indications as a substitute for Clinician review. Output may reflect Customer's own protocols and approved references as supplied by Customer, and Zeteo is not responsible for their content.
7.3 Regulatory status.
Zeteo intends the Edge System to be clinical documentation, communication, and workflow software and, with respect to any decision-support content, software that (a) displays, analyzes, or prints medical information about a patient or other medical information; (b) is intended to support or provide recommendations to a healthcare professional about prevention, diagnosis, or treatment of a disease or condition; and (c) is intended to enable the healthcare professional to independently review the basis for those recommendations so that it is not the intent that the professional rely primarily on them to make a clinical decision regarding an individual patient, within the meaning of Section 520(o)(1)(E) of the Federal Food, Drug, and Cosmetic Act. Except for any Released Workflow that the Documentation expressly describes as performing such a function and states the regulatory status of, the Edge System is not intended to acquire, process, or analyze a medical image or a signal from an in vitro diagnostic device or a pattern or signal from a signal acquisition system, is not intended for time-critical decision-making, and has not been cleared or approved by the U.S. Food and Drug Administration. Customer will not use the Edge System in a manner inconsistent with this intended use.
7.4 Compliance with law.
Each Party will comply with all laws applicable to its performance under this Agreement, including HIPAA, the HITECH Act, state privacy and recording-consent laws, laws governing the corporate practice of medicine, and federal and state anti-kickback and self-referral laws. No part of the fees under this Agreement is conditioned on, or takes into account, the volume or value of any referrals or business otherwise generated between the Parties or with any third party.
7.5 AI disclosure laws.
Customer is responsible for determining whether any federal or state law requires notice to patients that artificial intelligence was used in generating communications or in connection with their care, and for providing that notice. Zeteo will (a) make available documentation describing the Edge System's intended uses, limitations, and the categories of data used to develop the Models, sufficient to support Customer's compliance obligations as a deployer of the Edge System, and (b) provide a means to indicate in Output that it was generated with AI assistance.
7.6 Intended use.
The Edge System is intended to draft clinical documentation, patient communications, summaries, care-plan content, and authorization requests from Customer Data, and to surface evidence-aligned information with its sources, for review, editing, and approval by a Clinician before any clinical or patient-facing use. Except as the Documentation expressly provides for a particular Released Workflow, the Edge System is not intended to diagnose, to recommend or initiate treatment without Clinician review, to triage or prioritize patients for urgent care, to communicate with patients without Clinician approval, to analyze medical images or physiological signals, or to be used where the time available for Clinician review is insufficient to consider the basis for the Output. Zeteo will describe the intended use, intended users, and limitations of each Released Workflow in the Documentation, will state the regulatory status of any Released Workflow that performs a function listed in the preceding sentence, and will notify Customer before enabling any such workflow; Customer will use each Released Workflow consistently with its description.
8. Confidentiality
8.1 Definition.
"Confidential Information" means non-public information disclosed by a Party ("Discloser") to the other ("Recipient") in connection with this Agreement that is marked or identified as confidential or that a reasonable person would understand to be confidential, including, in Zeteo's case, the Edge System, the Clinical Logic, pricing, roadmap, and security information, and, in Customer's case, Customer Data and Customer's business and operational information. Confidential Information does not include information that the Recipient can show (a) was publicly available other than through the Recipient's breach; (b) was rightfully known to the Recipient without restriction before disclosure; (c) was rightfully received from a third party without restriction; or (d) was independently developed without use of the Discloser's Confidential Information. PHI is governed by the BAA and Section 4 in addition to this Section 8.
8.2 Obligations.
The Recipient will (a) use the Discloser's Confidential Information only to perform or exercise rights under this Agreement; (b) protect it using at least the care it uses for its own confidential information, and no less than reasonable care; and (c) disclose it only to its employees, contractors, and professional advisors who need to know it and are bound by written confidentiality obligations at least as protective as this Section 8. The Recipient may disclose Confidential Information to the extent required by law or court order, provided it gives the Discloser prompt notice (where legally permitted) and reasonable assistance in seeking protective treatment. Upon termination, and on the Discloser's request, the Recipient will return or destroy the Discloser's Confidential Information, except that (i) the Recipient may retain copies in routine backups and as required by law, subject to this Section 8, (ii) Customer Data on the Edge Units is handled under Section 11.4, and (iii) PHI is returned or destroyed as the BAA requires, without regard to clause (i). These obligations continue for five (5) years after termination, except that they continue for so long as the information remains a trade secret under applicable law and, for PHI, for as long as the BAA requires.
8.3 Equitable relief.
Each Party acknowledges that a breach of this Section 8 or of Section 3 may cause irreparable harm for which monetary damages would be inadequate, and that the non-breaching Party may seek injunctive or other equitable relief without posting a bond, in addition to any other remedies.
9. Warranties and Disclaimers
9.1 Mutual.
Each Party represents and warrants that it has full power and authority to enter into and perform this Agreement, that doing so does not conflict with any other agreement by which it is bound, and that neither it nor, to its knowledge, any of its personnel performing under this Agreement is excluded, debarred, or suspended from participation in any federal health care program, and each Party will notify the other promptly if that changes.
9.2 Zeteo.
Zeteo warrants that (a) during the Subscription Term, the Released Workflows will perform materially in accordance with their descriptions in Section A.1 of Exhibit A (support, hardware replacement, and availability being governed exclusively by Sections A.5 and A.6 of Exhibit A); (b) installation and support services will be performed in a professional and workmanlike manner by qualified personnel; (c) Zeteo will not knowingly introduce into the Edge Units any virus, malware, or other malicious code; and (d) Zeteo will maintain the security program described in Section 4.7. Customer's sole remedy, and Zeteo's sole obligation, for breach of the warranty in clause (a) is for Zeteo to use commercially reasonable efforts to correct the non-conformity, and if Zeteo cannot do so within thirty (30) days after Customer's written notice, Customer may terminate this Agreement on written notice to Zeteo, with the consequences stated in Section 11.4(f). Availability shortfalls are governed exclusively by Section A.6 of Exhibit A.
9.3 Customer.
Customer represents and warrants that (a) it has all rights, consents, and authorizations necessary to provide Customer Data to the Edge System and to permit the processing described in this Agreement; (b) its use of the Edge System and Output will comply with applicable law and, with respect to connection methods Customer has directed or approved in writing, with the terms of its EHR vendor; (c) it will obtain any consent required under Section 4.8 and will not use the Edge System to record any encounter for which required consent has not been obtained; (d) its Users are appropriately licensed and trained for the functions they perform with the Edge System; (e) it is not a federal, state, or local government entity or agency; and (f) it will not make available to the Edge System records subject to 42 C.F.R. Part 2 or psychotherapy notes unless it has obtained any consent required for the processing described in this Agreement.
9.4 Disclaimer.
EXCEPT AS EXPRESSLY SET OUT IN THIS SECTION 9, THE EDGE SYSTEM, OUTPUT, AND ALL SERVICES ARE PROVIDED "AS IS," AND ZETEO AND ITS LICENSORS DISCLAIM ALL OTHER WARRANTIES, EXPRESS, IMPLIED, OR STATUTORY, INCLUDING ANY WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, NON-INFRINGEMENT, ACCURACY, AND UNINTERRUPTED OR ERROR-FREE OPERATION. WITHOUT LIMITING THE FOREGOING, ZETEO DOES NOT WARRANT THAT OUTPUT WILL BE ACCURATE, COMPLETE, OR SUITABLE FOR ANY PARTICULAR PATIENT OR PURPOSE, THAT THE EDGE SYSTEM WILL INTEROPERATE WITH ANY PARTICULAR EHR OR THIRD-PARTY SYSTEM, OR THAT USE OF THE EDGE SYSTEM WILL ACHIEVE ANY PARTICULAR CLINICAL, OPERATIONAL, OR FINANCIAL RESULT.
10. Indemnification
10.1 By Zeteo.
Zeteo will defend the Customer Indemnitees against any third-party claim alleging that the Edge System, as provided by Zeteo and used in accordance with this Agreement, infringes or misappropriates that third party's patent, copyright, trademark, or trade secret, and will pay damages, costs, and attorneys' fees finally awarded against the Customer Indemnitees or agreed in a settlement approved by Zeteo. Zeteo has no obligation for claims arising from (a) Customer Data or Output; (b) modification of the Edge System by anyone other than Zeteo; (c) combination of the Edge System with products, data, or processes not supplied by Zeteo, where the claim would not have arisen but for the combination; (d) use of the Edge System after Zeteo has notified Customer to cease use because of a claim or has provided a non-infringing modification; or (e) use in breach of this Agreement; or (f) open-source components or open-weight models identified in the Documentation, in the form published by their licensors. If the Edge System is, or Zeteo believes it is likely to be, the subject of such a claim, Zeteo may at its option and expense procure the right for Customer to continue using it, modify or replace it so that it is non-infringing without material loss of functionality, or, if neither is commercially reasonable, terminate this Agreement on thirty (30) days' written notice, with the consequences stated in Section 11.4(f). This Section 10.1 states Zeteo's entire liability, and Customer's exclusive remedy, for infringement claims.
10.2 By Customer.
Customer will defend the Zeteo Indemnitees against any third-party claim (including by a patient, payer, regulator, or EHR vendor) arising from (a) any diagnosis, treatment, communication, order, submission, or other professional act or omission by Customer or its Users, including any that used or relied on Output; (b) Customer Data, including any claim that Zeteo's processing of Customer Data as permitted by this Agreement violates a third party's rights; (c) Customer's failure to obtain any consent required under Section 4.8 or to comply with recording-consent, AI-disclosure, or other laws applicable to Customer; (d) Customer's breach of its EHR vendor's terms; or (e) use of the Edge System in breach of this Agreement; and will pay damages, costs, and attorneys' fees finally awarded against the Zeteo Indemnitees or agreed in a settlement approved by Customer; in each case except to the extent the claim arises from Zeteo's breach of this Agreement or the BAA, or Zeteo's gross negligence or willful misconduct, and, with respect to clauses (b) and (d), except to the extent the claim arises from a connection method that Zeteo selected and configured without Customer's written direction or approval.
10.3 Procedure.
"Customer Indemnitees" means Customer and its officers, directors, employees, and Users; "Zeteo Indemnitees" means Zeteo and its officers, directors, employees, and contractors; and the Party seeking defense on behalf of its indemnitees is the "Indemnified Party." The Indemnified Party will give the indemnifying Party prompt written notice of the claim (provided that delay relieves the indemnifying Party only to the extent it is prejudiced), sole control of the defense and settlement, and reasonable cooperation at the indemnifying Party's expense. The indemnifying Party will not settle a claim in a manner that admits fault on behalf of, or imposes any obligation on, the Indemnified Party or its indemnitees without the Indemnified Party's written consent, not to be unreasonably withheld. The Indemnified Party may participate with its own counsel at its own expense.
11. Term and Termination
11.1 Term.
This Agreement begins on the Effective Date and continues until the end of the Initial Term. Thereafter it renews automatically for successive twelve (12) month periods (each a "Renewal Term") unless either Party gives written notice of non-renewal at least sixty (60) days before the end of the then-current term. Zeteo will send Customer a written reminder of the non-renewal deadline at least fifteen (15) days before that deadline; if Zeteo fails to do so, Customer may give notice of non-renewal at any time before the end of the then-current term, effective at the end of that term.
11.2 Termination for cause.
Either Party may terminate this Agreement on written notice if the other Party (a) materially breaches this Agreement and fails to cure within thirty (30) days after written notice describing the breach, or (b) becomes insolvent, makes a general assignment for the benefit of creditors, or becomes subject to bankruptcy or similar proceedings that are not dismissed within sixty (60) days. Zeteo may also terminate this Agreement on fifteen (15) days' written notice if Customer fails to pay undisputed amounts within thirty (30) days after Zeteo's written notice of non-payment.
11.3 Early termination.
(a) Termination for convenience after the third month. Customer may terminate this Agreement for convenience, effective at the end of any month after the third full month following the Go-Live Date, by giving at least thirty (30) days' written notice and paying, on or before the termination date, the applicable percentage of the Installation Cost Recovery Fee for Customer's Subscription Tier (Tiers 1 and 2: $7,500; Tier 3: $12,500; Tiers 4 and 5: $17,500; Custom: as stated in the Order Form or, if none is stated, $17,500). The applicable percentage is determined by the number of full months remaining in the Initial Term after the termination date: more than nine (9) months, 100%; seven (7) to nine (9) months, 75%; four (4) to six (6) months, 50%; one (1) to three (3) months, 25%. The earliest effective termination date under this clause (a) is the last day of the fourth full month after the Go-Live Date, and termination under this clause (a) is effective only if Customer has paid all amounts then due and the applicable fee on or before the termination date. By way of example, for a 12-month Initial Term and a $7,500 fee, termination effective at the end of month four is $5,625 (75%), month six is $3,750 (50%), and month nine is $1,875 (25%); for a 24-month Initial Term, termination effective at the end of month six is $7,500 (100%). The fee is determined by the Subscription Tier in effect on the Effective Date and does not change with a tier change under Section 5.3. The Installation Cost Recovery Fee reflects Zeteo's unrecovered cost of on-site installation, configuration, and Practice Tuning. (b) Termination for breach or non-payment. If Zeteo terminates this Agreement during the Initial Term under Section 11.2 for Customer's breach or non-payment, Customer will pay an early termination fee equal to the lesser of (i) the Monthly Subscription Fees that would have been payable from the termination date through the end of the Initial Term and (ii) the greater of (A) fifty percent (50%) of those fees and (B) six (6) times the Monthly Subscription Fee, calculated as of the effective date of termination. (c) Any prepaid fees attributable to the period after the termination date will be credited against any fee due under this Section 11.3, and any excess will be refunded. The Parties agree that each fee under this Section 11.3 is a reasonable estimate of Zeteo's unrecovered costs and, in the case of clause (b), lost benefit of the bargain, and is not a penalty. During any Renewal Term, Customer may terminate for convenience on sixty (60) days' written notice without any fee under this Section 11.3.
11.4 Effect of termination.
Upon expiration or termination for any reason: (a) Customer's rights under Section 2.1 end and Users will stop using the Edge System; (b) Customer will pay all fees accrued through the termination date and any fee due under Section 11.3; (c) within thirty (30) days after the later of the termination date and delivery of any export requested under clause (d), Customer will make the Edge Units available for collection by Zeteo during business hours (or will return them using prepaid shipping materials that Zeteo supplies) in the condition received, normal wear excepted; (d) within thirty (30) days after termination, Customer may request an export of Customer Data and Output stored on the Edge Units that has not already been delivered to Customer's EHR, in a commonly used electronic format, and Zeteo will deliver the export within ten (10) business days after the request and will not collect, or erase Customer Data from, any Edge Unit until the later of the end of that thirty-day period and delivery of any requested export; (e) following collection, Zeteo will securely erase all Customer Data and Practice Tuning from the Edge Units in accordance with NIST SP 800-88 or an equivalent standard and will certify erasure in writing on request; and (f) if Customer terminates under Section 2.4(c), 2.6, 9.2, 11.2(a), or 11.2(b), or Section A.6 of Exhibit A, or Zeteo terminates under Section 10.1, Zeteo will refund any prepaid fees attributable to the period after the termination date within thirty (30) days, and no fee under Section 11.3 is payable. If Customer fails to make an Edge Unit available for collection or return within thirty (30) days after the later of the termination date and Zeteo's delivery of any export requested under clause (d), Customer will pay Zeteo the replacement cost stated in Exhibit A for that unit as liquidated damages, which the Parties agree is a reasonable estimate of Zeteo's loss and not a penalty. That payment does not transfer title to the Edge Unit or any right in the Software, Models, or Clinical Logic. After that thirty-day period, Zeteo may remotely disable the Software on, and remotely erase Customer Data and Practice Tuning from, that unit, and Customer is thereafter solely responsible for any Customer Data remaining on it. If the unit is subsequently returned in the condition required by clause (c), Zeteo will refund the payment less its reasonable costs of recovery and refurbishment.
11.5 Survival.
Sections 1, 2.2(c), 2.2(d), 2.3, 3, 4 (for so long as Zeteo retains any Customer Data, except that Sections 4.10(d) and 4.10(f), and the restrictions on identification, re-identification, and sale in Section 4.5 as applied to information received under Section 4.10, survive without that limitation), 5 (as to amounts accrued), 6, 7, 8, 9.4, 10, 11.3, 11.4, 11.5, 12, and 13, and the provisions of the Exhibits referenced in those Sections, survive termination.
12. Limitation of Liability
12.1 Excluded Claims.
"Excluded Claims" means (a) a Party's indemnification obligations under Section 10; (b) Customer's breach of Section 3(a) through (d) or infringement or misappropriation of Zeteo IP; (c) Customer's payment obligations, including the fee under Section 11.3 and replacement costs; and (d) a Party's gross negligence, willful misconduct, or fraud.
12.2 Exclusion of certain damages.
EXCEPT FOR EXCLUDED CLAIMS, IN NO EVENT WILL EITHER PARTY BE LIABLE TO THE OTHER UNDER OR IN CONNECTION WITH THIS AGREEMENT, UNDER ANY THEORY OF LIABILITY, FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, OR PUNITIVE DAMAGES, OR FOR LOSS OF PROFITS, REVENUE, GOODWILL, OR DATA, OR COST OF SUBSTITUTE GOODS OR SERVICES, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. For clarity, reasonable costs of breach notification, credit monitoring, and regulatory response that a Party incurs as a result of the other Party's breach of Section 4 or the BAA are direct damages subject to the cap in Section 12.3.
12.3 Cap.
EXCEPT FOR EXCLUDED CLAIMS, EACH PARTY'S TOTAL CUMULATIVE LIABILITY UNDER OR IN CONNECTION WITH THIS AGREEMENT WILL NOT EXCEED THE GREATER OF (i) FIFTY THOUSAND DOLLARS ($50,000) AND (ii) THE FEES PAID AND PAYABLE BY CUSTOMER TO ZETEO UNDER THIS AGREEMENT IN THE TWELVE (12) MONTHS IMMEDIATELY PRECEDING THE EVENT GIVING RISE TO THE CLAIM. FOR CLAIMS ARISING FROM A PARTY'S BREACH OF SECTION 4, SECTION 8, OR THE BAA, THE FOREGOING CAP IS INCREASED TO TWO (2) TIMES THAT AMOUNT.
12.4 Basis of bargain.
The Parties agree that the limitations in this Section 12 are an essential basis of the bargain, that the fees reflect them, and that they apply even if any limited remedy fails of its essential purpose.
13. General
13.1 Insurance.
Customer will maintain professional liability insurance for its Clinicians consistent with applicable requirements.
13.2 Publicity.
Customer grants Zeteo a non-exclusive, royalty-free license during the Subscription Term to use Customer's name and logo, in the form Customer provides, to identify Customer as a customer in Zeteo's customer lists and marketing materials, including on Zeteo's website, in accordance with any reasonable brand guidelines Customer provides. Customer may withdraw this consent on written notice, and Zeteo will cease new uses within thirty (30) days. Any press release, case study, or statement attributed to Customer or a named employee of Customer requires Customer's prior written approval.
13.3 Governing law; dispute resolution.
This Agreement is governed by the laws of the State of Delaware, without regard to its conflict-of-laws rules. Before filing any action other than for injunctive relief or collection of undisputed fees, a Party will give the other written notice of the dispute, and executives of each Party with settlement authority will meet (in person or by video) within fifteen (15) business days after the notice to attempt in good faith to resolve it. Any action against Zeteo must be brought in the state or federal courts located in New Castle County, Delaware, or New York County, New York, and any action against Customer must be brought in the state or federal courts located in the state of Customer's principal practice address stated in the Order Form, except that a Party may assert counterclaims in any action properly brought against it under this Section; each Party consents to that jurisdiction and venue, and the designated courts have exclusive jurisdiction over the actions assigned to them, except that either Party may seek injunctive relief in any court of competent jurisdiction. EACH PARTY WAIVES TRIAL BY JURY IN ANY ACTION ARISING OUT OF OR RELATING TO THIS AGREEMENT. In any action to collect unpaid fees or to enforce Section 3 or Section 8, the prevailing Party is entitled to recover its reasonable attorneys' fees and costs.
13.4 Assignment.
Neither Party may assign this Agreement without the other Party's prior written consent, not to be unreasonably withheld, except that either Party may assign it without consent to a successor in connection with a merger, acquisition, or sale of all or substantially all of its assets or of the business to which this Agreement relates, provided that an assignee of Customer must be a healthcare provider and must assume Customer's obligations in writing. Any other attempted assignment is void. This Agreement binds and benefits the Parties and their permitted successors and assigns.
13.5 Subcontractors.
Zeteo may use subcontractors to perform its obligations, remains responsible for their performance, and will ensure that any subcontractor with access to PHI is bound by a written agreement consistent with the BAA.
13.6 Force majeure.
Neither Party is liable for failure or delay in performance (other than payment obligations) caused by events beyond its reasonable control, including natural disasters, epidemics, war, terrorism, labor disputes, utility or internet failures, acts of government, or EHR vendor outages, provided the affected Party uses reasonable efforts to mitigate and resume performance.
13.7 Notices.
Notices under this Agreement must be in writing and delivered by email (effective on the next business day after transmission, unless the sender receives a delivery-failure notice), nationally recognized overnight courier, or certified mail, to the addresses in the Order Form (for Customer) and to Zeteo Health, Inc., 136 Madison Avenue, 5th and 6th Floors, PMB #4206, New York, NY 10016, Attn: Legal, with a copy by email to legal@zeteo.health (for Zeteo), or to such other address as a Party designates by notice. Routine operational communications may be sent by email to the designated contacts.
13.8 Independent contractors.
The Parties are independent contractors. Nothing in this Agreement creates a partnership, joint venture, agency, franchise, or employment relationship, and neither Party has authority to bind the other.
13.9 Entire agreement; amendment; waiver.
This Agreement, including the Order Form, Terms, Exhibits, BAA, and Documentation, is the entire agreement between the Parties regarding its subject matter and supersedes all prior or contemporaneous proposals, agreements, and communications, written or oral, including any terms in a Customer purchase order or vendor portal, except that any confidentiality agreement between the Parties executed before the Effective Date continues to govern information disclosed under it. Customer has not relied on any representation not set out in this Agreement, including any time-savings or performance figures in Zeteo's marketing materials. Except as provided in Section 13.15, this Agreement may be amended only by a written instrument signed by both Parties. No waiver is effective unless in writing, and no waiver of any breach is a waiver of any other breach.
13.10 Severability.
If any provision of this Agreement is held unenforceable, it will be enforced to the maximum extent permissible and the remaining provisions will remain in full force.
13.11 Export.
Customer will not export, re-export, or relocate the Edge Units or Software outside the United States.
13.12 Counterparts and electronic signature.
This Agreement may be executed in counterparts and by electronic signature (including through DocuSign or a similar service), each of which is deemed an original and all of which together are one instrument. Electronic signatures and electronically delivered copies have the same effect as originals.
13.13 No third-party beneficiaries.
There are no third-party beneficiaries to this Agreement. Nothing in this Agreement confers any right on any patient or other person.
13.14 Interpretation.
Headings are for convenience only. "Including" means "including without limitation." No rule of strict construction applies against the drafter.
13.15 Updates to the Terms Document.
Zeteo may update the Terms Document by publishing a new version at the address stated in the Order Form (or a successor address of which Zeteo gives notice) and sending written notice of the update, with a summary of the changes, to Customer’s contact for notices. An update takes effect for this Agreement thirty (30) days after that notice. If an update materially reduces Customer’s rights or materially increases Customer’s obligations, Customer may terminate this Agreement by written notice given before the update takes effect, without any fee under Section 11.3 and with a refund of any prepaid fees attributable to the period after termination; otherwise, Customer’s continued use of the Edge System after the update takes effect is acceptance of it. No update may, without a written amendment signed by both Parties, change the fees, Initial Term, or other commercial terms stated in the Order Form, the BAA, Section 4, or Section 12. Section 13.9 continues to govern all other amendments.
Exhibit A — Service Description and Support
A.1 Workflows.
(a) Initial Workflows. Customer selects in the Order Form two (2) or three (3) workflows from Section A.1(c), from among those Zeteo confirms in writing (email sufficient) before installation as available at installation, to be running when the Edge System goes live (the "Initial Workflows"). Unless Customer selects otherwise, the Initial Workflows are pre-charting and chart summaries, care plan drafts and recommendations, and patient messaging. Zeteo will install and configure the Edge System with the Initial Workflows running on the Edge Units by the Go-Live Date.
(b) Additional workflows. The Edge System is offered under an early access program (Section 2.6 of the Terms), and Zeteo releases the workflows in Section A.1(c) that are not Initial Workflows to Edge customers on a rolling basis. Zeteo may enable any such workflow for Customer, at no additional charge, at any time after Zeteo makes it generally available to Edge customers, on notice to Customer (email sufficient), and in any event will enable it within thirty (30) days after the later of Customer's request and the date it becomes generally available; Zeteo will inform Customer of expected release timing on request. Zeteo does not commit to a release date for any workflow that is not yet generally available, and the timing of a release is not a non-conformity under Section 9.2 of the Terms. Customer may also request workflows not listed in Section A.1(c), which Zeteo may agree to develop on terms (including any fees) set out in a written order.
(c) Included workflows. The Edge System includes the following workflows. Zeteo will state in the confirmation under Section A.1(a) which of them are available at installation; the others are released under Section A.1(b):
Ambient scribe: visit-note drafts in each Clinician's template, structure, and phrasing, from encounter audio captured by the Edge Units or associated recording devices.
Patient messaging: draft replies to patient messages based on the patient's record, with references to the record.
Pre-charting and chart summaries: a pre-visit snapshot including history, medications, recent results, and open items.
Pre-visit medication reconciliation.
Care plan drafts and evidence-aligned draft content matched to Customer's protocols and approved references.
Prior authorization drafts.
Clinician question-and-answer: evidence-grounded responses, with sources displayed, to clinical questions in the context of a specific patient.
(d) Released Workflows. The Initial Workflows, each additional workflow once released to Customer, and any other workflow that Zeteo makes available to Customer under this Section A.1 during the Subscription Term (each, a "Released Workflow") produce Output for Clinician review with the sources relied upon displayed and run on the Edge Units. The workflows listed in Section A.1(c) are included in the Monthly Subscription Fee and will not be designated as separately priced add-ons. Workflows, features, and products that Zeteo releases after the Effective Date and that are not listed in Section A.1(c) are not part of the Edge System under this Agreement unless Zeteo makes them available to Customer, at Zeteo's election either as part of the Monthly Subscription Fee or as a separately priced add-on under a written order; they become Released Workflows only when so made available. Only Released Workflows are part of the Edge System for purposes of Sections 2.6 and 9.2(a) of the Terms and Section A.6.
A.2 Edge Units.
Zeteo will determine, in its discretion, the number, type, and configuration of Edge Units for Customer's Subscription Tier and Practice Locations (Zeteo's "standard allocation") and may change that allocation during the Subscription Term. Zeteo determines whether capacity for a Subscription Tier, a tier change under Section 5.3 of the Terms, or an additional Practice Location is delivered through Software or Model optimization, replacement or upgrade of existing Edge Units, additional Edge Units, or a combination, and nothing in this Agreement obligates Zeteo to supply any particular number or type of Edge Units, or any Edge Unit beyond those Zeteo determines are required. Additional on-site capacity beyond the standard allocation is provided only where stated in the Order Form, for the monthly fee stated there, which is a fee for the additional service capacity and not for any Edge Unit; Zeteo determines the Edge Units, if any, used to deliver it. Edge Units remain Zeteo's property. Edge Units are of three types: a Primary Unit (workstation-class unit, 96 GB memory), a Satellite Unit (compact unit, 64 GB memory), and a Compact Unit (compact unit, 16 GB memory). Replacement cost for purposes of Sections 2.3 and 11.4 of the Terms: Primary Unit $6,000; Satellite Unit $3,000; Compact Unit $1,000; recording device, the manufacturer's then-current retail price; recovery controller, $400. Zeteo may update these figures, not to exceed Zeteo's then-current acquisition cost (including applicable sales tax and shipping) for a unit of the same type, for Edge Units installed after it gives Customer written notice of the updated figures.
Replacement Service Fee. When Zeteo installs a replacement Edge Unit on site under Section 2.3 of the Terms, Customer will pay a Replacement Service Fee consisting of (i) on-site labor at $275 per hour, with a minimum of eight (8) hours per visit; (ii) travel time at $137.50 per hour; and (iii) Zeteo's reasonable travel expenses, without markup. Zeteo will give Customer a written estimate before dispatch. The Replacement Service Fee does not apply to hardware replacements under Section A.5 or to Edge Units not returned under Section 11.4 of the Terms.
A.3 Installation.
Zeteo personnel will perform installation and initial configuration on-site at each Practice Location over approximately two (2) consecutive business days, including: physical installation of the Edge Units; network configuration in coordination with Customer's IT contact; EHR connection using the method available for Customer's EHR (an application programming interface or FHIR connection where the EHR vendor makes one available to Customer; otherwise a Zeteo-supplied browser extension or desktop application operating within Customer's network); configuration of Customer's templates, protocols, and approved references; creation of each Clinician's initial Practice Tuning for the Initial Workflows from the Clinician's historical notes and messages; User account setup; and initial training for Clinicians and Staff Users. Travel and expenses for the initial installation at the first Practice Location are included in the Monthly Subscription Fee; each additional Practice Location is subject to the one-time installation fee stated in the Order Form, which covers travel and expenses for its installation. Additional on-site visits requested by Customer that are not required to correct a non-conformity are billable at the labor and travel rates, and on the expense terms, of the Replacement Service Fee in Section A.2, with Customer's prior approval.
A.4 Ongoing tuning and updates.
After the Go-Live Date, the Edge System continues to refine Practice Tuning from Customer Data and User edits, on the Edge Units. Zeteo delivers Software and Model updates to the Edge Units remotely, during maintenance windows that Zeteo will schedule outside Customer's normal clinic hours where practicable and with at least twenty-four (24) hours' notice for updates expected to interrupt service for more than fifteen (15) minutes. Updates are authenticated and integrity-checked before installation and do not transmit Customer Data to Zeteo.
A.5 Support and hardware replacement.
Zeteo provides support by email and by a support line during the hours of 8:00 a.m. to 6:00 p.m. Eastern Time, Monday through Friday, excluding U.S. federal holidays ("Support Hours"). Issues reported outside Support Hours are treated as received at the start of the next Support Hours period. Target response times, measured within Support Hours: Severity 1 (Edge System unavailable or unusable for all Clinicians at a Practice Location): Zeteo will respond within two (2) hours and work continuously during Support Hours until service is restored; Severity 2 (the Edge System or a Released Workflow unavailable or materially impaired for one or more, but not all, Clinicians at a Practice Location, with or without a workaround, or any issue that would otherwise be Severity 1 but for which a workaround is in use): response within eight (8) business hours; Severity 3 (all other issues, including issues that do not materially impair a Released Workflow, and questions): response within two (2) business days. Hardware failures are remedied by remote repair where possible and otherwise, at Zeteo's election and expense, by shipment of a replacement unit within five (5) business days after Zeteo determines that remote repair is not possible (with Customer installing the replacement under Zeteo's remote guidance) or by on-site replacement. Before removing a replaced or failed Edge Unit from a Practice Location, Zeteo will erase Customer Data from it in accordance with NIST SP 800-88 where the unit is operable; otherwise Zeteo will transport the unit with its storage encrypted, destroy or erase the storage media within ten (10) business days, and certify destruction on request. Where recoverable, Zeteo will migrate Practice Tuning to the replacement unit.
A.6 Availability.
Zeteo will use commercially reasonable efforts to make the Edge System available for use at each Practice Location at least 99% of the time in each calendar month, excluding scheduled maintenance, Customer-caused outages (including power, network, physical interference, or EHR vendor unavailability), suspension under Section 5.2 of the Terms, and force majeure events. If availability in a calendar month falls below 99% for reasons within Zeteo's control, Customer may request, within thirty (30) days after the end of that month, a service credit of two and one-half percent (2.5%) of that month's Monthly Subscription Fee for each percentage point, prorated for any fraction of a percentage point, by which availability at the affected Practice Location falls below 99%, up to a maximum credit of fifteen percent (15%) of the month's fee across all Practice Locations. If availability at any Practice Location falls below 90% in any three (3) consecutive months for reasons within Zeteo's control, Customer may terminate the Agreement on thirty (30) days' written notice without any fee under Section 11.3 and with a refund of prepaid fees for the period after termination. Zeteo will measure availability from Edge Unit telemetry and, on request, will provide Customer a monthly availability report for each Practice Location; an Edge Unit is available when Users at that Practice Location can access the Software and generate Output in the Released Workflows. Service credits and that termination right are Customer's sole remedies for availability shortfalls; credits are applied against future invoices.
A.7 Security program.
Zeteo maintains a written information security program, covering the Edge Units, Zeteo's systems that receive Operational Telemetry or hold Edge Unit unlock credentials, and any intermediary connection service under Section 2.5 of the Terms, that includes: full-volume encryption of each Edge Unit using industry-standard encryption, such that a powered-off Edge Unit cannot be decrypted without a credential that is not stored on the Edge Unit or on any other device at the Practice Location; unlock credentials held in Zeteo's systems and released only to authenticated recovery controllers, with revocation on loss or theft, with emergency unlock available through Zeteo support during Support Hours, and with any unavailability of the credential service that prevents an Edge Unit from restarting counted against availability under Section A.6; role-based access control with unique User credentials and multi-factor authentication for administrative access; logging of administrative and support access to the Edge Units; signed and integrity-checked software updates; secure configuration baselines for the Edge Units; background checks for personnel with access to Customer environments; annual security awareness training; vulnerability management with prioritized remediation of critical vulnerabilities; incident response procedures aligned with the BAA; and an annual independent SOC 2 examination of Zeteo's corporate controls, which Zeteo will extend to the Edge System in its next examination period. Zeteo will provide its most recent SOC 2 report and security questionnaire responses on request and subject to Section 8 of the Terms.
A.8 Consent tooling.
When an ambient scribe workflow is a Released Workflow, the Edge System provides a configurable consent prompt that Users can present before recording, the ability to record a patient's verbal consent at the start of an encounter, and sample notice language that Customer may adapt. Customer is responsible for selecting and approving the language and practice used at its Practice Locations as provided in Section 4.8 of the Terms.
A.9 Encounter audio retention.
Encounter audio is retained on the Edge Units only until the associated note draft is approved by a Clinician or for seven (7) days, whichever is earlier, after which it is deleted, unless Customer configures a longer retention period, in which case Customer is responsible for determining whether retained audio is part of the medical record and for any retention or production obligations relating to it.
A.10 AI-assistance indicator.
The Edge System provides a configurable means to indicate in Output that it was generated with AI assistance, and Documentation describing the Edge System's intended uses, limitations, and the categories of data used to develop the Models, as described in Section 7.5 of the Terms.
Exhibit B — Customer Responsibilities and Site Requirements
Customer will provide the following at each Practice Location, before and during the Subscription Term. Zeteo's obligations that depend on these items are excused to the extent Customer does not provide them.
B.1 Points of contact.
A designated Customer IT contact (or Customer's managed IT service provider) with authority to make network and EHR configuration decisions, and a designated clinical lead Clinician for workflow and template decisions. Both will be available during the installation window.
B.2 Physical environment.
A secure, access-controlled location for each Edge Unit (such as a locked IT closet, server room, or administrative office not accessible to patients), with a stable surface, adequate ventilation and ambient temperature appropriate for computing equipment, and protection from liquids and physical interference. Edge Units (other than portable recording devices moved within the Practice Location) will not be moved from the installed location without Zeteo's written consent.
B.3 Power and network.
A dedicated grounded power outlet for each Edge Unit (uninterruptible power supply recommended); a wired Ethernet connection to Customer's local network for each Edge Unit; a power outlet and wired Ethernet connection for any recovery controller; outbound internet access from the Edge Units to Zeteo's update and support endpoints (which Zeteo will specify); and any firewall, VLAN, or DNS configuration needed for Users' workstations and devices to reach the Edge Units within the local network. Customer will not expose the Edge Units to the public internet.
B.4 EHR access.
Timely provision of EHR API or FHIR credentials, user accounts, vendor authorizations, and any EHR vendor approvals required for the connection method in Exhibit A, including requesting from its EHR vendor the application programming interface access the vendor is required to make available under 45 C.F.R. § 170.404 and Part 171, and payment of any EHR vendor fees for that access. Customer will notify Zeteo at least thirty (30) days before any planned EHR change, migration, or major upgrade.
B.5 Historical materials for Practice Tuning.
Access, within the Edge System and in accordance with the BAA, to each participating Clinician's historical notes and patient messages for an agreed look-back period, together with Customer's templates, protocols, approved clinical references, and standing orders, so that initial Practice Tuning can be created before the Go-Live Date. Customer acknowledges, and will inform its Users during onboarding, that Zeteo keeps no off-unit backup of Customer Data or Practice Tuning (Section 4.2 of the Terms), that unapproved drafts and Practice Tuning on a failed Edge Unit may be lost, and that approved Output should be transferred to the EHR promptly.
B.6 Users and training.
An accurate list of Clinicians and Staff Users, availability of Users for initial training during the installation window, and prompt notice of User additions and removals.
B.7 Patient consent and policies.
Approved patient notice and consent language and practice for recorded encounters (see Section 4.8 of the Terms and Section A.8 of Exhibit A), any AI-use notices Customer determines are required under Section 7.5 of the Terms, and any updates to Customer's Notice of Privacy Practices that Customer determines are appropriate.
B.8 Devices.
Workstations, tablets, or phones used by Users to access the Edge System that meet the minimum requirements in the Documentation, are maintained with current operating system security updates, and are protected by Customer's own access controls.
Exhibit C — Business Associate Agreement
This Business Associate Agreement (this "BAA") is entered into between Zeteo Health, Inc. ("Company") and the Customer identified in the Order Form ("Covered Entity") and is effective as of the Effective Date of the Zeteo Edge Subscription Agreement of which it forms part (the "Agreement"). This BAA is incorporated by reference into the Order Form, is executed by the Parties' execution of the Order Form, and does not require separate signature. Capitalized terms used in this BAA without definition have the meanings given in the Agreement or in the Administrative Simplification provisions of the Health Insurance Portability and Accountability Act of 1996, the Health Information Technology for Economic and Clinical Health Act, and their implementing regulations, as amended from time to time (collectively, "HIPAA").
I. General Provisions
1. Effect. This BAA controls with respect to Protected Health Information that Company creates, receives, maintains, or transmits from or on behalf of Covered Entity ("PHI"), and its terms supersede any conflicting or inconsistent terms of the Agreement to the extent of the conflict or inconsistency. This BAA does not otherwise modify the Agreement.
2. Nature of the Services; On-Premises Processing. Covered Entity acknowledges that under the Agreement (a) PHI is processed and stored on Edge Units owned by Company and located at Covered Entity's Practice Locations within Covered Entity's network; (b) Company's routine remote access to the Edge Units is limited to system health, configuration, and Operational Telemetry; (c) Company may access PHI only during supervised support sessions authorized by Covered Entity under Section 4.4 of the Terms, during on-site installation and support, when transmitting Customer Data through an intermediary connection service under Section 2.5 of the Terms, and when handling replaced or failed Edge Units under Section A.5 of Exhibit A; and (d) Company does not, in the ordinary course of providing the Edge System, maintain copies of PHI outside the Edge Units, other than PHI in transit through an intermediary connection service under Section 2.5 of the Terms; PHI that Company incidentally receives in support communications or supervised support sessions, or that resides on an Edge Unit removed from a Practice Location under Section A.5 of Exhibit A, is subject to this BAA and will be used only for the purpose for which it was received and destroyed when no longer needed for that purpose. The Parties agree that Company is a business associate of Covered Entity with respect to PHI that Company creates, receives, maintains, or transmits on the Edge Units or otherwise in performing the Agreement. This BAA applies to all such PHI wherever located and however accessed, whether on the Edge Units, during support or installation, on replaced or failed Edge Units, or otherwise, and its application does not depend on the on-premises characterization in this Section I.2.
3. No Third-Party Beneficiaries. The Parties have not created and do not intend to create by this BAA any third-party rights, including rights for Covered Entity's patients.
4. HIPAA Amendments. Any future amendment to HIPAA affecting business associate agreements is incorporated by reference into this BAA, effective on the later of the Effective Date and the compliance date specified by HIPAA.
5. Regulatory References. A reference in this BAA to a section of HIPAA means the section as it may be amended from time to time.
6. Independent Contractor. Company is at all times an independent contractor of Covered Entity and not an agent or employee of Covered Entity.
II. Obligations of Company
1. Use and Disclosure of PHI. Company may use and disclose PHI as permitted or required under the Agreement and this BAA and as Required by Law, and will not otherwise use or disclose PHI. Company will not use or disclose PHI in any manner that would violate HIPAA if done by Covered Entity, except as permitted in clauses (a) through (d) below. To the extent Company carries out any of Covered Entity's obligations under the HIPAA Privacy Rule, Company will comply with the requirements of the Privacy Rule that apply to Covered Entity in the performance of those obligations. Without limiting the foregoing, Company may: (a) use PHI for Company's proper management and administration or to carry out its legal responsibilities; (b) disclose PHI to a third party for Company's proper management and administration, provided that the disclosure is Required by Law or Company obtains reasonable assurances from the third party that it will protect the confidentiality of the PHI, use or further disclose it only as Required by Law or for the purpose for which it was disclosed, and notify Company of any instance of which it is aware in which the confidentiality of the PHI has been breached; (c) use PHI to provide Data Aggregation services relating to the health care operations of Covered Entity; and (d) use PHI to create de-identified information in accordance with 45 C.F.R. § 164.514, provided that de-identification is performed on the Edge Units before any transmission to Company as described in Section 4.10 of the Terms, and Company may use and disclose de-identified information for any purpose permitted by law, subject to Sections 4.5 and 4.10 of the Terms.
2. Safeguards. Company will use appropriate safeguards to prevent the use or disclosure of PHI other than as permitted by this BAA, and will implement administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of electronic PHI that it creates, receives, maintains, or transmits on behalf of Covered Entity, including the safeguards described in Section 4.7 of the Terms and Section A.7 of Exhibit A, provided that physical safeguards for the Edge Units at the Practice Locations are provided by Covered Entity under Section III.5 of this BAA and Exhibit B of the Agreement. Company will comply with the HIPAA Security Rule with respect to electronic PHI.
3. Minimum Necessary. Company will request, use, and disclose only the minimum amount of PHI necessary to accomplish the purpose of the request, use, or disclosure, to the extent required by HIPAA.
4. Mitigation. Company will take reasonable steps to mitigate, to the extent practicable, any harmful effect known to Company of a use or disclosure of PHI by Company in violation of this BAA.
5. Subcontractors. Company will enter into a written agreement meeting the requirements of 45 C.F.R. §§ 164.504(e) and 164.314(a)(2) with each subcontractor that creates, receives, maintains, or transmits PHI on behalf of Company, obligating the subcontractor to comply with restrictions and conditions at least as restrictive as those that apply to Company under this BAA.
6. Reporting. (a) Company will report to Covered Entity, without unreasonable delay, any use or disclosure of PHI in violation of this BAA by Company or by a third party to which Company disclosed PHI. (b) Company will report any successful Security Incident involving electronic PHI to Covered Entity in writing without unreasonable delay, and will report attempted but unsuccessful Security Incidents of which it becomes aware on a reasonable basis as requested by Covered Entity; this BAA constitutes notice of routine unsuccessful attempts (such as port scans, pings, and blocked log-in attempts) that do not result in unauthorized access, use, or disclosure. (c) Following discovery of a Breach of Unsecured PHI, Company will notify Covered Entity in accordance with 45 C.F.R. § 164.410 without unreasonable delay and in no case later than thirty (30) calendar days after discovery, and will provide the information reasonably available to Company that Covered Entity needs to make any notifications required by 45 C.F.R. §§ 164.404 through 164.408.
7. Access to PHI. Within fifteen (15) business days of a written request by Covered Entity for access to PHI about an Individual contained in a Designated Record Set maintained by Company, if any, Company will make that PHI available to Covered Entity for so long as Company maintains it in the Designated Record Set, including through the export assistance described in Section 4.2 of the Terms. If Company receives a request for access directly from an Individual, Company will forward it to Covered Entity within ten (10) business days. Covered Entity has sole responsibility for determining whether to approve a request for access.
8. Amendment. Within fifteen (15) business days of a written request from Covered Entity for amendment of an Individual's PHI contained in a Designated Record Set maintained by Company, if any, Company will make that PHI available to Covered Entity for amendment and will incorporate any amendment as required by 45 C.F.R. § 164.526. If Company receives a request for amendment directly from an Individual, Company will forward it to Covered Entity within ten (10) business days. Covered Entity has sole responsibility for determining whether to approve a request for amendment.
9. Accounting of Disclosures. Within thirty (30) business days of written notice from Covered Entity that it has received a request for an accounting of disclosures of PHI, Company will make available to Covered Entity the information in Company's possession that Covered Entity requires to make the accounting required by 45 C.F.R. § 164.528. If Company receives a request for an accounting directly from an Individual, Company will forward it to Covered Entity within ten (10) business days. Covered Entity has sole responsibility for providing the accounting.
10. Books and Records. Following reasonable advance written notice, Company will make its internal practices, books, and records relating to the use and disclosure of PHI available to the Secretary of Health and Human Services for purposes of determining Covered Entity's compliance with HIPAA.
11. Replaced and Failed Edge Units. Company will handle PHI on any Edge Unit removed from a Practice Location in accordance with Section A.5 of Exhibit A, including erasure in accordance with NIST SP 800-88 where the unit is operable and, otherwise, encrypted transport and destruction or erasure of the storage media within ten (10) business days, with certification on request.
III. Obligations of Covered Entity
1. Permissible Requests. Covered Entity will not request Company to use or disclose PHI in any manner that would not be permissible under HIPAA if done by Covered Entity, except as provided in Sections II.1(a) through (d).
2. Minimum Necessary. When Covered Entity makes PHI available to Company, Covered Entity will provide the minimum amount of PHI necessary for the accomplishment of Company's purpose.
3. Permissions; Restrictions. Covered Entity represents and warrants that it has obtained and will obtain any consents, authorizations, and other legal permissions required under HIPAA and other applicable law for the disclosure of PHI to Company and the processing described in the Agreement, including any consent required for the recording of patient encounters. Covered Entity will notify Company of any change in, or revocation of, an Individual's permission to use or disclose PHI, to the extent the change may affect Company's use or disclosure of PHI. Covered Entity will not agree to any restriction on the use or disclosure of PHI under 45 C.F.R. § 164.522 that restricts Company's use or disclosure of PHI under the Agreement unless the restriction is Required by Law or Company consents in writing, which consent will not be unreasonably withheld.
4. Notice of Privacy Practices. Except as Required by Law, with Company's consent, or as set out in the Agreement or this BAA, Covered Entity will not include in its notice of privacy practices any limitation that limits Company's use or disclosure of PHI under the Agreement.
5. Physical and Network Safeguards. Covered Entity will maintain the physical, network, and account safeguards for the Edge Units described in Exhibit B of the Agreement, which the Parties acknowledge are necessary to the security of PHI maintained on the Edge Units. Covered Entity will notify Company within twenty-four (24) hours after discovering any loss, theft, or unauthorized physical access to an Edge Unit, and will cooperate with Company in determining whether the event is a Breach of Unsecured PHI and in any resulting remote disablement or erasure of the unit. As between the Parties, Covered Entity is responsible for any use or disclosure of PHI resulting from a failure of the physical, network, or account safeguards in Exhibit B.
6. Covered Entity Status. Covered Entity represents that it is a covered entity under HIPAA or, if it is a management services organization or other entity acting for covered entities, that it is authorized to bind each covered entity practice at the Practice Locations to this BAA, has identified those practices in the Order Form, and agrees that this BAA satisfies 45 C.F.R. § 164.504(e) as between Company and each such practice.
IV. Term and Termination
1. Term. This BAA is effective as of the Effective Date and continues until all PHI maintained by Company on behalf of Covered Entity has been returned or destroyed in accordance with Section IV.3.
2. Termination for Breach. Notwithstanding any other provision of the Agreement, either Party (the "Non-Breaching Party") may terminate the Agreement and this BAA on thirty (30) days' advance written notice to the other Party (the "Breaching Party") if the Breaching Party materially breaches this BAA and does not cure the breach within that thirty-day period. A termination under this Section IV.2 is treated, for purposes of Sections 11.3 and 11.4 of the Terms, as a termination under Section 11.2(a) of the Terms by the Non-Breaching Party.
3. Return or Destruction of PHI. Upon expiration or termination of the Agreement, Company will destroy all PHI maintained on the Edge Units in accordance with Section 11.4 of the Terms, after providing any export requested by Covered Entity under that Section, and will destroy or return any other PHI that Company maintains in any form and will retain no copies. Company's obligation to destroy PHI on an Edge Unit is conditioned on Covered Entity making the unit available to Company under Section 11.4 of the Terms; where Covered Entity does not, Company will remotely erase the unit where feasible, and PHI remaining on a unit retained by Covered Entity is Covered Entity's responsibility. To the extent Company reasonably determines that return or destruction of any PHI is not feasible, the terms of this BAA survive with respect to that PHI, and Company will use or disclose it solely for the purpose that prevents its return or destruction.
V. Limitation of Liability
The limitations and exclusions of liability in Section 12 of the Terms, including the increased cap for breaches of Section 4 of the Terms or this BAA, apply to this BAA and to all claims arising out of or relating to it. This Article V survives expiration or termination of this BAA.
VI. Miscellaneous
This BAA is part of the Agreement and is governed by its provisions on governing law, dispute resolution, notices, amendment, and counterparts. The Parties will amend this BAA as necessary to comply with changes in HIPAA.
Exhibit D — Behavioral Health Rider
This Exhibit D applies only where the Parties have signed a Behavioral Health Addendum that incorporates it. Customer will notify Zeteo in writing before the Edge System is used for psychiatric, psychological, counseling, behavioral health, or substance use disorder services at any Practice Location, and will not use the Edge System for those services until a Behavioral Health Addendum has been signed. Where this Exhibit D applies, it controls over the Terms and Exhibits A and B to the extent of any conflict; the BAA continues to control with respect to PHI, and this Exhibit D adds to, and does not reduce, the protections of the BAA. Capitalized terms have the meanings given in the Agreement.
D.1 Edge Network level.
Notwithstanding Section 4.10(a) of the Terms, Customer participates in the Edge Network at Level 0 unless Customer elects a higher level in writing. Level 0 includes Operational Telemetry (including Diagnostic Data), so support, security, software updates, and availability measurement under Exhibit A are unaffected by this Section D.1; Model and Clinical Logic updates are delivered on Zeteo's general release schedule and are not tuned or tested against Customer's own data.
D.2 Psychotherapy notes.
Where a Clinician designates an encounter as a psychotherapy session, or designates Output as psychotherapy notes within the meaning of 45 C.F.R. § 164.501, the Edge System will (a) store that Output separately from other Customer Data, in a location within the Edge Units that Customer designates, and will not transfer it to the general patient record in the EHR except as the Clinician directs; (b) exclude that Output, the associated encounter audio and transcript, and any information derived from them from every Edge Network level and from Operational Telemetry, so that they leave the Edge Units only when the Clinician directs a transfer to the EHR, when Customer requests an export under Section 4.2 or 11.4 of the Terms, or in a supervised support session that Customer authorizes under Section 4.4 of the Terms; and (c) use Practice Tuning derived from them only for the designating Clinician. Customer is responsible for configuring and applying the designation. Zeteo will not use or disclose psychotherapy notes for any purpose other than providing the Edge System to Customer, and Section II.1(c) and (d) of the BAA do not apply to psychotherapy notes.
D.3 Encounter audio and consent.
Encounter audio is retained on the Edge Units only until the associated note draft is approved or seven (7) days after the encounter, whichever is earlier, and that period is not configurable to a longer period. The consent prompt described in Section A.8 of Exhibit A is enabled by default for every recorded encounter. Customer will obtain any written patient consent that applicable state law requires before artificial intelligence is used to record or transcribe a therapy session, and will not use the ambient scribe workflow in a therapy session until that consent has been obtained.
D.4 Therapeutic communication.
The Edge System drafts documentation and communications for Clinician review as described in Section 7.1 of the Terms; it is not designed to provide, and Customer will not use it to provide, psychotherapy, counseling, or therapeutic communication to a patient without a licensed Clinician's review and approval of each communication. Customer is responsible for compliance with state laws that regulate the use of artificial intelligence in mental health services, and Zeteo will make available, under Section 7.5 of the Terms, documentation describing the Edge System's intended uses and limitations sufficient to support that compliance.
D.5 42 C.F.R. Part 2.
If Customer, or any Practice Location, is a program within the meaning of 42 C.F.R. Part 2, then with respect to records subject to Part 2 ("Part 2 Records"): (a) Zeteo is a qualified service organization of Customer, acknowledges that in receiving, storing, processing, or otherwise dealing with Part 2 Records it is fully bound by 42 C.F.R. Part 2, and, if necessary, will resist in judicial proceedings any effort to obtain access to Part 2 Records except as permitted by Part 2; (b) Zeteo will not redisclose Part 2 Records except as permitted by Part 2 and the Agreement; (c) Part 2 Records, and any information derived from them, are excluded from every Edge Network level and from de-identification under Section 4.10 of the Terms; and (d) Customer will identify to Zeteo the Clinicians, Practice Locations, or record categories to which Part 2 applies so that the Edge System can be configured accordingly.
D.6 State confidentiality laws.
Customer is responsible for obtaining any patient consent that state mental health confidentiality laws require for the processing described in the Agreement, including by a business associate. On Customer's request, Zeteo will configure Level 0 participation under Section D.1 and the segregation described in Section D.2 for specified Clinicians, Practice Locations, or record categories.