Universal Terms of Service

2.1  Type 1 (Pay-in-Arrears)

Services rendered to a Type 1 (Pay-in-Arrears) account are billed weekly in arrears. All services rendered Monday through Sunday are invoiced the following Monday. A valid Credit Card or ACH payment method must be on file at all times — no exceptions — outside of insurance carriers who are billed weekly via CMS-1500. Accounts without a valid payment method on file are subject to suspension per Section 9.

2.2  Type 2 (Pre-Funded)

A Type 2 (Pre-Funded) account requires the Customer to pre-fund an account balance. Services are drawn against that balance as rendered. No weekly invoice is generated while the Current Balance is sufficient. The account becomes active upon HealthcareLive's receipt of the Customer's first deposit (the Account Active Date). Pre-funded account terms are governed by Sections 7 and 8.

2.3  Weekly Billing

All accounts are billed on a weekly cycle, no exceptions. Customers who do not wish to receive a weekly invoice must elect a Type 2 (Pre-Funded) account.

2.4  Account Authorization Required

A Health Services Account Authorization is required for all accounts and all agreement types, including Fee-for-Service, Flat Fee Per Episode, Benefits Program, On-Site Services, and Insurance Carrier arrangements. The Account Authorization establishes the Customer's account, payment method, and acceptance of these Universal Terms of Service, regardless of the billing arrangement in effect under any separately executed agreement.

The Account Authorization may be executed via DocuSign or other written agreement acceptable to HealthcareLive. Once available, click-through execution within the HealthcareLive EHR Platform will also be supported. Either party may cancel this Agreement with 30 days' written notice.

3.1  Fee-for-Service (FFS)

Fee-for-Service is the standard billing method available to all accounts. Services are billed per service at the applicable rate set out in the Service Rate Schedule at the time of service. The current Service Rate Schedule is accessible within the Billing Section of the EHR Platform by the Customer's designated Account Administrator.

3.2  Flat Fee Per Episode (FFPE)

A flat fee per clinical episode arrangement is available to Type 2 (Pre-Funded) accounts only and requires an executed Flat Fee Per Episode (FFPE) Agreement. FFPE billing covers Tier 1, Tier 2, Care Navigation, and Data Entry products and services within a defined clinical episode. The following are excluded from FFPE billing and always billed at the FFS rate:

• Tier 3 products and services (billed as additional charges);
• Special products and services, including Report Only and laboratory services.

3.3  Benefits Programs

Per Employee Per Month (PEPM), Per Engaged Employee Per Month (PEEPM), and Per Member Per Month (PMPM) arrangements are available for Benefits program accounts. Each requires a separately executed Benefits Agreement. Contact your HealthcareLive sales representative for details.

3.4  On-Site Services

On-site service arrangements require a separately executed On-Site Services Agreement. Contact your HealthcareLive sales representative for details.

3.5  Special Products and Services

Certain products and services are excluded from all bundled billing arrangements and are always billed at the applicable FFS rate, including without limitation Report Only services, laboratory services, durable medical equipment, and drug testing services. The Service Rate Schedule identifies all such items.

4.1  Type 1 Accounts

Type 1 (Pay-in-Arrears) accounts must maintain a valid Credit Card or ACH payment method on file at all times. No other payment method is accepted. CMS-1500 carrier billing is available for insurance carrier customers — see Section 4.4.

4.2  Type 2 Accounts

Type 2 (Pre-Funded) accounts may use any of the following payment methods for deposits and replenishment:

• Credit Card or ACH (recommended — enables automatic replenishment);
• Check (allow 3–5 business days for processing);
• Wire transfer (allow 3–5 business days for processing).

Credit Card or ACH on file is strongly recommended to ensure uninterrupted service through automatic replenishment.

4.3  Stripe Payment Processing

Credit Card and ACH payment information is processed and stored exclusively by Stripe, Inc. via encrypted vault. HealthcareLive does not store or retain Customer card numbers or ACH credentials. The Customer's designated Account Administrator may securely store payment credentials within the Billing Section of the HealthcareLive platform.

4.4  CMS-1500 Carrier Billing

Insurance carrier and workers' compensation customers may elect CMS-1500 billing, available on Type 1 (Pay-in-Arrears) accounts only. CMS-1500 billing operates on a two-tier basis:

• Tier 1 services are billed to and paid by the Employer (Customer) at the applicable FFS rate;
• Tier 2 services are billed to and paid by the Carrier or third-party administrator via CMS-1500.

HealthcareLive will bill the applicable party directly for each tier. Customer guarantees payment of any Tier 1 amounts and any Tier 2 amounts not paid by the carrier within the applicable payment terms. A Credit Card or ACH payment method is required on file as backup.

4.5  Credit Card Processing Fee

HealthcareLive does not currently charge a processing fee for Credit Card payments. HealthcareLive expressly reserves the right to implement a Credit Card processing fee in the future. Any such fee will be communicated to Customer in writing no fewer than 30 days prior to taking effect. Customer may cancel this Agreement with 30 days' written notice at no penalty if Customer objects to the implementation of a processing fee. No processing fee applies to ACH, check, or wire transfer payments.

5.1  Standard Payment Terms

Payment is due within Net 30 days of the invoice date or service date, as applicable. Customers may negotiate alternative payment terms in writing. Any such alternative terms must be documented in writing to be enforceable.

5.2  Late Payment Interest

Invoices not paid in full by their due date accrue interest at 1.5% per month (18% per annum), from the due date until payment is received in full. Interest on services rendered to a Type 2 (Pre-Funded) account with a zero or negative balance accrues after standard Net 30 payment terms have been exceeded, and continues until paid in full.

5.3  No Standard Discounts

HealthcareLive does not offer standard discounts for pre-funding an account, maintaining a Credit Card or ACH payment method on file, or for high service volume. Any custom pricing arrangement must be negotiated separately and documented in writing.

5.4  Collections and Attorneys' Fees

If HealthcareLive is required to pursue collection of any unpaid amounts due under this Agreement, Customer shall be liable for all reasonable costs of collection, including reasonable attorneys' fees and court costs, in addition to the outstanding balance and any accrued interest. HealthcareLive may refer overdue accounts to a collections agency or initiate legal proceedings after providing Customer with written notice and a 10-business-day opportunity to cure.

6.1  Rate Schedule and Execution Date Effect

Each HealthcareLive agreement becomes effective and binding upon execution (the "Execution Date"). The Service Rate Schedule takes effect immediately upon the Execution Date and is accessible at all times within the Billing Section of the HealthcareLive EHR Platform. The Service Rate Schedule is not distributed externally.

All services rendered shall be billed at the then-current Service Rate Schedule, which may be updated from time to time in accordance with these Universal Terms of Service. Customers with active written contracted rate agreements within a specified term are not subject to rate changes until their contract renewal date.

6.2  Rate Update Notice

HealthcareLive may update the Service Rate Schedule at any time at its sole discretion. HealthcareLive will provide Customer with advance written notice of any rate change, published within the EHR Platform Billing Section and delivered to Customer's primary account email address. Updated rates apply to services rendered on or after the effective date of the update. Customer may cancel this Agreement with 30 days' written notice if Customer disagrees with a rate change.

6.3  Locked and Contracted Rates

Standard account authorizations do not lock service rates. Rate locks are available only through a separately executed agreement such as a Flat Fee Per Episode Agreement, or through pre-funding an account at the current rate schedule and utilizing those pre-funded funds until the balance is depleted. Pre-existing locked or contracted rate agreements are honored through their contracted term. Upon expiration, rates revert to the then-current Service Rate Schedule and prior rates may not be renewed.

6.4  Billing Audit Rights

Customer has the right, upon reasonable written notice and no more than once per calendar year, to request a review of billing records for services rendered under this Agreement during the preceding 12-month period. HealthcareLive will make relevant billing records available within 15 business days of a written request. Billing disputes must be raised in writing within 90 days of the invoice date; disputes raised after this period are waived.

7.1  Opening Deposit

A Type 2 (Pre-Funded) account requires a minimum opening deposit of $2,500. The account becomes active for service utilization upon HealthcareLive's receipt of the opening deposit (the Account Active Date). Services are billed at the rate in effect at the time funds are deposited; pre-funded balances serve as a de facto rate lock for the deposited amount until the balance is depleted, consistent with Section 6.3.

7.2  Replenishment Level and Trigger

Customer designates a Replenishment Level in the Account Authorization. Minimum Replenishment Level: $2,500 for FFS accounts; $10,000 for FFPE accounts. The Replenishment Trigger fires automatically when the Current Balance falls below 20% of the Replenishment Level — no exceptions. When the trigger fires:

• If a Credit Card or ACH is on file, replenishment occurs automatically with no action required from Customer;
• If paying by check or wire, Customer must remit payment promptly upon notification (allow 3–5 business days for processing).

7.3  Negative Balance

7.4  Balance Expiry

Unused pre-funded balances expire 365 days from the date of each individual deposit. HealthcareLive will make best commercial efforts to provide Customer with a written reminder at 30 days before a deposit is scheduled to expire. Upon expiry, unused funds are forfeited. Deposits are non-refundable once applied to the account, except upon termination for cause due to HealthcareLive's breach of its service delivery obligations under Section 8.

8.1  HealthcareLive's Obligation

So long as a Type 2 (Pre-Funded) account maintains a positive, unexpired Current Balance, HealthcareLive is obligated to make contracted services available to Customer and to process eligible service requests against that balance in accordance with the service standards set out in this Agreement. This obligation continues until the earlier of: the Current Balance is fully consumed through service delivery; the balance expires pursuant to Section 7.4; or this Agreement is terminated pursuant to Section 23.

8.2  Permitted Service Interruptions

HealthcareLive shall not suspend, reduce, or materially impair service delivery to a Type 2 (Pre-Funded) account while that account maintains a positive, unexpired Current Balance, except: due to a Force Majeure Event (Section 25); as required by applicable law or regulation; for documented misuse or material breach of this Agreement by Customer; or during a scheduled maintenance window communicated to Customer in advance with reasonable notice.

8.3  Customer Remedies for Service Failure

If HealthcareLive fails to deliver services against a valid, positive, unexpired Current Balance in material breach of Section 8.1, and such breach is not cured within 10 business days of written notice from Customer, Customer's remedies shall include a credit equal to the value of services not delivered, the right to terminate this Agreement with immediate effect and receive a refund of the unused pre-funded balance, and any other remedies available at law or equity subject to Section 24.

8.4  Balance Expiry During Breach

HealthcareLive shall not permit pre-funded balances to expire during any period in which HealthcareLive is in material breach of its service delivery obligations under Section 8.1.

9.1  Grounds for Suspension

HealthcareLive reserves the right to suspend a Customer account under any of the following circumstances:

• A Type 1 account does not have a valid Credit Card or ACH payment method on file;
• A Customer's account balance remains negative beyond the agreed payment terms;
• An invoice remains unpaid beyond the applicable due date and Customer has not made satisfactory arrangements for payment; or
• Customer is in material breach of any other provision of this Agreement.

9.2  Reinstatement

A suspended account will be reinstated upon payment in full of all outstanding balances, including accrued interest, and restoration of a valid payment method where required. HealthcareLive reserves the right to require a deposit or advance payment before reinstating services.

10.1  Access

Subject to Customer's compliance with this Agreement and timely payment of all amounts due, HealthcareLive grants Customer a non-exclusive, non-transferable right to access and use the EHR Platform for the purpose of managing its HealthcareLive health services account.

10.2  Account Administrator

Customer shall designate at least one Account Administrator responsible for managing billing, payment credentials, and platform access within the Billing Section of the EHR Platform. Customer is responsible for all actions taken by its Account Administrator within the platform.

10.3  Employer Communication Channels

To facilitate efficient delivery of program updates, utilization reports, educational materials, and other routine programmatic communications, Customer shall establish and maintain a dedicated group email distribution alias on its own corporate email domain, as follows, unless an alternative arrangement is mutually agreed in writing:

Customer is responsible for creating each alias and for maintaining accurate, current membership — including the prompt addition of new Account Administrators, safety personnel, or newly Eligible Employees, and the prompt removal of individuals who separate from employment or lose eligibility. HCL is not responsible for non-delivery or delayed delivery of communications resulting from Customer’s failure to maintain accurate alias membership or from Customer’s own email security, spam filtering, or internal distribution configuration. Where Customer already maintains a suitable all-staff or benefits-eligible distribution list, Customer may use that existing list in place of creating a new alias, provided HCL is notified in writing of the applicable address.

Communications sent to an alias established under this Section are limited to general programmatic content and will not include Protected Health Information or other information specific to any individual recipient. This Section does not affect, and is not a substitute for, any notice HCL is required to deliver to a specific individual under Section 14, Section 27, applicable law (including HIPAA or ERISA), or any other provision of this Agreement; such notices will be delivered through the channel required for that purpose.

10.4  Intellectual Property

The EHR Platform, all software, algorithms, content, trademarks, and HealthcareLive brand elements are the exclusive intellectual property of HealthcareLive. Customer receives no ownership interest in the platform or any associated intellectual property. Customer may not copy, reverse engineer, modify, or create derivative works of the EHR Platform or any HealthcareLive technology.

10.5  Platform Terms of Use

Use of the HealthcareLive EHR Platform is additionally governed by the Platform Terms of Use, available at www.HealthcareLive.com/terms-of-service. In the event of a conflict, these Universal Terms of Service prevail with respect to billing, payment, and account matters.

11.1  Three-Party Structure

HealthcareLive services are delivered through three entities, each with a distinct and defined role:

• HealthcareLive, Inc. (Manager) — provides platform operations, administration, scheduling, care coordination, credentialing administration, and all customer-facing management services. Manager does not practice medicine and has no clinical authority.
• HealthcareLive Medical Group (Provider) — the physician-led medical entity responsible for all clinical determinations, medical oversight, utilization management, and physician services. Provider is the entity through which clinical services are rendered.
• Clinically Integrated Network (Network) — a network of independently contracted licensed healthcare providers who deliver care to patients. Network providers make independent clinical judgments and are not employees of Manager or Provider.

11.2  Single Payment Obligation

Customer's payment obligation is satisfied by a single payment to the HealthcareLive Medical Group (Provider). No separate payment by Customer to Manager or any Network provider is required or expected. The allocation of payments among Manager, Provider, and Network is governed exclusively by separate inter-party agreements to which Customer is not a party.

11.3  No Manager Clinical Authority

HealthcareLive (Manager) has no authority to direct, override, or influence the clinical decisions of the Medical Group (Provider) or any Network provider. All clinical determinations are made exclusively by Provider and Network providers acting within their independent licensed capacity.

11.4  Credentialing and Network Composition

HealthcareLive strives to contract with the highest level of providers (e.g., board certified, fellowship-trained), but will only contract with independently qualified providers who meet applicable licensing and credentialing requirements. Network composition may vary by geography and service type.

12.1  Independent Contractors

All clinical services are delivered by independent contractors — CIN providers, Medical Group physicians, and other licensed professionals — and not by HealthcareLive employees. HealthcareLive coordinates, schedules, and facilitates care but is not the clinical provider of record.

12.2  Subcontractors

HealthcareLive may engage subcontractors to support platform operations, administrative functions, and technology services. HealthcareLive remains responsible for ensuring that any subcontractor handling Customer data does so in compliance with the confidentiality and data security provisions of this Agreement.

12.3  Network Changes

HealthcareLive reserves the right to modify the composition of its provider network and subcontractor relationships at any time. Material changes to the network that would significantly affect service delivery to Customer will be communicated with reasonable advance notice.

13.1  Service Rate Confidentiality

The Service Rate Schedule is proprietary and confidential to HealthcareLive. Customer agrees not to disclose rate information to any third party without HealthcareLive's prior written consent. Access is limited to Customer's designated Account Administrator through the Billing Section of the EHR Platform.

13.2  Mutual Confidentiality

Each party agrees to hold the other's Confidential Information in strict confidence and not to disclose it to any third party without prior written consent, except as required by applicable law or legal process. This obligation survives termination of this Agreement for a period of three (3) years.

13.3  Marketing and Case Study Consent

HealthcareLive may request Customer's consent to reference Customer's name, logo, or aggregate outcome data in marketing materials, case studies, or public communications. Such consent is voluntary, opt-in, and may be withdrawn by Customer at any time in writing. HealthcareLive will not identify Customer by name without prior written consent.

14.1  Security Standards

HealthcareLive maintains administrative, physical, and technical safeguards designed to protect Customer data and patient health information against unauthorized access, disclosure, alteration, or destruction, in accordance with applicable law including the HIPAA Security Rule and applicable state data security laws.

14.2  Breach Notification

In the event of a confirmed data breach involving Customer's data or patient health information, HealthcareLive will notify Customer in writing as soon as reasonably practicable, or within such timeframe as required by applicable law, including: a description of the nature of the breach; the categories and approximate number of individuals and records affected; the likely consequences of the breach; and the measures taken or proposed to address the breach.

14.3  Data Retention

As a standard practice, HealthcareLive retains patient and clinical records for a minimum of ten (10) years from the date of service or last treatment. Records relating to minor patients are retained until the minor reaches the age of majority in the applicable state plus the standard ten-year retention period. This Section 14.3 shall survive termination of this Agreement.

14.4  Customer Responsibilities

Customer is responsible for maintaining the security of its account credentials, Account Administrator access, and any data that Customer uploads to or transmits through the EHR Platform. Customer shall promptly notify HealthcareLive of any suspected unauthorized access to its account.

15.1  HIPAA Compliance

The collection, use, storage, and disclosure of patient health information in connection with services delivered under this Agreement is governed by HealthcareLive's Privacy Policy and applicable law, including HIPAA where applicable.

15.2  Business Associate Agreement

Where Customer qualifies as a Covered Entity under HIPAA and requests a Business Associate Agreement, HealthcareLive will execute a BAA with Customer upon written request. Under any such BAA: Customer acts as the Covered Entity; HealthcareLive acts as the Business Associate; and the BAA governs HealthcareLive's use and disclosure of Protected Health Information on Customer's behalf.

A BAA is executed only upon Customer's written request and is not automatically included in this Agreement.

16.1  Multi-State Operations

HealthcareLive delivers telehealth and health services across multiple states. Services are subject to applicable state and federal telehealth laws, which vary by jurisdiction and may change over time. HealthcareLive monitors regulatory requirements and updates its service delivery model accordingly.

16.2  Provider Licensure

Clinical services are delivered by providers who are independently licensed in the applicable state(s). HealthcareLive coordinates care delivery but does not guarantee that services are available in all jurisdictions at all times.

16.3  Customer Compliance Responsibility

Customer is responsible for ensuring that its use of HealthcareLive services complies with applicable law in its jurisdiction, including workers' compensation regulations, state telehealth requirements, and applicable fee schedule regulations.

16.4  Workers' Compensation

HealthcareLive services are designed to support workers' compensation injury triage and management. Customer is responsible for ensuring compliance with applicable workers' compensation laws in its state(s) of operation. HealthcareLive will cooperate reasonably with Customer's compliance obligations upon request.

17.1  Mutual Representations

Each party represents and warrants that: it has full legal authority to enter into this Agreement; this Agreement constitutes a valid and binding obligation; its execution does not violate any applicable law or other agreement; and it is in compliance with all applicable laws and regulations governing its operations.

17.2  HealthcareLive Warranties

HealthcareLive additionally represents and warrants that services will be delivered with reasonable professional skill and care; the EHR Platform will be maintained with reasonable uptime; HealthcareLive will maintain appropriate credentials and licenses; and HealthcareLive will maintain qualification and credentialing standards for Network providers.

17.3  Customer Warranties

Customer additionally represents and warrants that all information provided in the Account Authorization is accurate and complete; Customer will use HealthcareLive services only for lawful purposes; and Customer has obtained all necessary authorizations to share any employee or patient information with HealthcareLive.

17.4  Disclaimer

18.1  Indemnification by HealthcareLive

HealthcareLive agrees to defend, indemnify, and hold harmless Customer and its officers, directors, employees, and agents from and against any third-party claims arising out of or related to: HealthcareLive's material breach of this Agreement; HealthcareLive's gross negligence or willful misconduct; or HealthcareLive's infringement of any third-party intellectual property right in connection with the EHR Platform.

18.2  Indemnification by Customer

Customer agrees to defend, indemnify, and hold harmless HealthcareLive, the HealthcareLive Medical Group, CIN providers, and their respective officers, directors, employees, and agents from and against any third-party claims arising out of or related to: Customer's material breach of this Agreement; Customer's misuse of the EHR Platform or HealthcareLive services; Customer's violation of applicable law; or any claim by Customer's employees arising from Customer's failure to properly administer its workers' compensation program.

18.3  Indemnification Procedure

The indemnified party shall: (a) promptly notify the indemnifying party in writing of any claim; (b) grant the indemnifying party sole control of the defense and settlement; and (c) provide reasonable cooperation. The indemnifying party shall not settle any claim in a manner that imposes obligations on the indemnified party without prior written consent.

19.1  No Practice of Medicine

19.2  Clinical Responsibility

The HealthcareLive Medical Group (Provider) is responsible for clinical oversight and all clinical determinations made by its employed or contracted physicians. Network providers (CIN) are responsible for the independent clinical judgments made in the course of delivering care to patients. HealthcareLive (Manager) bears no clinical responsibility and is not liable for the clinical decisions, diagnoses, or treatment recommendations of the Medical Group or Network providers, except to the extent of HealthcareLive's own gross negligence or willful misconduct.

19.3  Emergency Services

20.1  HealthcareLive Insurance

HealthcareLive shall maintain, at its own expense, the following insurance coverages throughout the term of this Agreement:

• Commercial General Liability: minimum $1,000,000 per occurrence / $3,000,000 aggregate;
• Professional Liability / Errors & Omissions: minimum $1,000,000 per claim;
• Cyber Liability / Data Breach: minimum $1,000,000 per occurrence; and
• Workers' Compensation as required by applicable law.

20.2  Customer Insurance

Customer shall maintain appropriate insurance coverages for its operations, including workers' compensation coverage as required by applicable law. Upon request, each party shall provide the other with certificates of insurance evidencing the coverages required under this Agreement.

21.1  Non-Solicitation of Providers and Staff

During the term of this Agreement and for a period of twelve (12) months following termination or expiration, Customer agrees not to directly solicit, recruit, or hire any HealthcareLive employee, Account Manager, or CIN provider who was introduced to Customer through the HealthcareLive platform or relationship, without HealthcareLive's prior written consent.

21.2  Remedy

Customer acknowledges that a breach of this Section 21 would cause HealthcareLive irreparable harm for which monetary damages would be an inadequate remedy, and that HealthcareLive shall be entitled to seek equitable relief, including injunction, in addition to any other remedies available at law.

22.1  OFAC Compliance

Each party represents and warrants that it is not on the U.S. Treasury Department's OFAC Specially Designated Nationals list or any other applicable sanctions list; not located in or organized under the laws of a country subject to U.S. sanctions; and not owned or controlled by any person or entity on any such list. Each party agrees to notify the other promptly if it becomes aware of any change in these representations.

22.2  Healthcare Regulatory Compliance

Both parties agree to comply with all applicable federal and state healthcare laws and regulations, including but not limited to the Anti-Kickback Statute, the Stark Law (physician self-referral), and applicable state fee-splitting prohibitions, in connection with their respective activities under this Agreement.

23.1  Term and Auto-Renewal

This Agreement commences on the Execution Date and continues for an initial term of one (1) year. Unless either party provides written notice of non-renewal at least 30 days prior to the end of the then-current term, this Agreement will automatically renew for successive one-year terms. These Universal Terms of Service remain in effect for so long as any HealthcareLive agreement incorporating them is in force.

23.2  Termination for Convenience

Either party may terminate this Agreement at any time with 30 days' written notice. Services rendered prior to the effective termination date remain billable and payable in full. Termination for convenience does not entitle Customer to a refund of any pre-funded balance; Customer may continue to draw down the pre-funded balance for eligible services until depleted or expired per Section 7.4.

23.3  Termination for Cause

Either party may terminate this Agreement immediately upon written notice if the other party materially breaches this Agreement and fails to cure such breach within 10 business days of written notice identifying the breach.

23.4  Effect of Termination on Pre-Funded Balances

• Termination for Convenience: Customer may continue drawing down the pre-funded balance until depleted or expired. No refund is owed.
• Termination for Cause — Customer Breach: HealthcareLive may apply the pre-funded balance to any outstanding amounts owed. Any remaining balance is non-refundable.
• Termination for Cause — HealthcareLive Breach: Customer is entitled to a refund of the unused pre-funded balance after settlement of any amounts owed by Customer, payable within 30 days of the termination effective date.

23.5  Survival

Sections 5, 6, 13, 14.3, 14, 18, 21, 24, and any payment obligations accrued prior to termination survive the termination or expiration of this Agreement.

24.1  Mutual Limitation

24.2  Cap on Liability

HealthcareLive's total aggregate liability to Customer under this Agreement shall not exceed the total amount paid by Customer to HealthcareLive in the 12 months immediately preceding the event giving rise to the claim.

24.3  Exceptions

The limitations in Sections 24.1 and 24.2 do not apply to: (a) Customer's obligation to pay amounts owed for services rendered; (b) HealthcareLive's obligation to refund unused pre-funded balances pursuant to Section 23.4; (c) either party's indemnification obligations under Section 18; or (d) damages arising from a party's gross negligence or willful misconduct.

26.1  Governing Law

This Agreement is governed by the laws of the State of Ohio, without regard to its conflict of law principles.

26.2  Dispute Resolution and Arbitration

The parties agree to attempt to resolve any dispute arising under this Agreement through good-faith negotiation for a period of 30 days following written notice of the dispute. If the dispute is not resolved through negotiation, it shall be submitted to binding arbitration administered by the American Arbitration Association (AAA) under its Commercial Arbitration Rules, as the exclusive means of resolving such dispute. The arbitration shall be conducted by a single arbitrator in Cincinnati, Ohio, and the arbitrator's decision shall be final and binding on both parties.

Notwithstanding the foregoing, either party may seek emergency or injunctive relief from a court of competent jurisdiction to prevent irreparable harm pending arbitration. Each party bears its own costs of arbitration unless the arbitrator determines otherwise.

26.3  Entire Agreement and Order of Precedence

These Universal Terms of Service, together with the Account Authorization and all separately executed agreements, constitute the entire agreement between the parties and supersede all prior agreements, representations, and understandings relating to the same subject matter. In the event of a conflict:

26.4  Amendment

HealthcareLive may amend these Universal Terms of Service at any time by posting the updated version at www.HealthcareLive.com/terms-of-service and notifying Customer via the EHR Platform or primary account email. Customer's continued use of HealthcareLive services following notice of any amendment constitutes acceptance. Customer may terminate with 30 days' written notice if Customer does not agree to an amendment.

26.5  Severability

If any provision of this Agreement is found to be invalid or unenforceable, the remaining provisions continue in full force and effect.

26.6  Waiver

No failure or delay by either party in exercising any right under this Agreement operates as a waiver of that right. A waiver of any breach does not constitute a waiver of any subsequent breach.

26.7  Assignment

Customer may not assign or transfer any rights or obligations under this Agreement without HealthcareLive's prior written consent. HealthcareLive may assign this Agreement in connection with a merger, acquisition, or sale of substantially all of its assets.

26.8  Notices

All notices required under this Agreement must be in writing and delivered by email with confirmation of receipt, or by certified mail to the addresses set out in the Account Authorization. Notices to HealthcareLive should be directed to: legal@HealthcareLive.com  |  1311 Vine Street, Cincinnati OH 45202.

26.9  Electronic Execution

This Agreement may be executed electronically, including by click-through consent within the HealthcareLive platform or via DocuSign, with the same legal effect as a handwritten signature.

27.1  Purpose and Scope

This Section governs how HealthcareLive, Inc. and HealthcareLive Medical Group, Prof. Corp. (collectively, “HCL”) store, process, and transfer data — including Protected Health Information (“PHI”) and personal data — collected through HCL’s telehealth platform, electronic health record system, and related services (collectively, the “Platform”).

This Section applies to all users of the Platform, including patients and their authorized representatives, employer-clients and their designated personnel, referring providers including ship’s physicians, and any other party who accesses or uses the Platform. By accessing or using the Platform, you acknowledge that you have read, understood, and agree to the data practices described in this Section.

27.2  Data Storage and Processing — United States

All data collected, processed, or stored through the HCL Platform — including PHI, personal data, consultation records, diagnostic information, imaging results, clinical notes, and AI-assisted documentation — is stored and processed on servers located in the United States.

By using the Platform, you acknowledge that your data — regardless of your physical location, citizenship, or country of residence at the time of service — is transmitted to and stored in the United States and is governed by US law.

27.3  International Data Transfer

HCL’s Platform serves users in multiple jurisdictions, including patients receiving services while located outside the United States. When data is transmitted to HCL’s US systems from outside the United States, that transmission constitutes an international data transfer governed by the laws of both the originating jurisdiction and the United States.

27.3.1  Transfer Acknowledgment — All Users

By using the Platform from any location, you acknowledge and agree that: (a) your data will be transmitted to and stored in the United States, regardless of your physical location at the time of service; (b) US law, including HIPAA, governs the storage, processing, and protection of your data once received by HCL’s US systems; (c) HCL maintains HIPAA-compliant security infrastructure; (d) HCL does not sell your data or use it for marketing purposes; and (e) the laws of the United States may provide a different level of data protection than the laws of your country of residence, and by using the Platform you expressly consent to such transfer and processing under US law.

27.3.2  European Union / EEA Users

If you are physically located in the European Union (EU) or European Economic Area (EEA) at the time you use the Platform — including patients on vessels docked at EU/EEA ports or sailing in EU/EEA territorial waters — additional provisions apply under Regulation (EU) 2016/679 (the “General Data Protection Regulation” or “GDPR”).

27.3.3  Cross-Border Transfer Mechanism (EU/EEA to United States)

Transfers of personal data and health data from EU/EEA territory to HCL’s US systems are carried out under the following mechanisms:

27.3.4  Your GDPR Rights (EU/EEA Users)

If you are located in the EU/EEA and GDPR applies to your data, you have the rights described in the table below, subject to applicable exceptions and limitations. To exercise any right, contact HCL’s Privacy Officer at privacy@healthcarelive.com with subject line “GDPR Data Subject Request.” HCL will respond within 30 days (extendable by 60 days for complex requests, with notice).

27.3.5  United Kingdom Users

If you are physically located in the United Kingdom at the time you use the Platform, additional provisions apply under the UK General Data Protection Regulation (retained EU law as it forms part of UK law, the “UK GDPR”) and the Data Protection Act 2018. The United Kingdom is not part of the European Union or European Economic Area for purposes of this Section; Sections 27.3.2–27.3.4 above do not apply to UK users — this Section 27.3.5 through 27.3.7 applies instead. HCL processes health data under UK GDPR Article 9 on the same legal bases described in Section 27.3.2 (medical diagnosis and health care by a health professional; supplementary explicit consent via HCL’s patient consent agreement).

27.3.6  Cross-Border Transfer Mechanism (UK to United States)

Transfers of personal data from the United Kingdom to HCL’s US systems are carried out under the International Data Transfer Addendum to the European Commission’s Standard Contractual Clauses (the “UK Addendum”), issued by the UK Information Commissioner’s Office. The UK Addendum forms part of the same Standard Contractual Clauses arrangement with Amazon Web Services, Inc. described in Section 27.3.3 and applies automatically under AWS’s service terms whenever UK GDPR governs the processing of UK-origin data. HCL has conducted a Transfer Risk Assessment in accordance with UK Information Commissioner’s Office guidance, evaluating the same categories of safeguards and legal-framework considerations described for the EU/EEA Transfer Impact Assessment in Section 27.3.3, adapted to the UK’s assessment methodology. HCL reviews and updates this assessment at least annually or upon material changes in applicable law.

27.3.7  Your UK GDPR Rights (UK Users)

If you are located in the UK and UK GDPR applies to your data, you have the same categories of rights described in Section 27.3.4 for EU/EEA users — access, rectification, erasure (subject to the same HIPAA retention limitation), restriction, portability, and objection — exercised the same way, by contacting HCL’s Privacy Officer at privacy@healthcarelive.com with subject line “UK GDPR Data Subject Request.” You may also file a complaint with the UK Information Commissioner’s Office (ICO) at ico.org.uk or by telephone at 0303 123 1113.

27.3.8  Switzerland Users

If you are physically located in Switzerland at the time you use the Platform, additional provisions apply under the Swiss Federal Act on Data Protection (revised, in force since September 1, 2023, the “FADP”). Switzerland is not part of the European Union or European Economic Area for purposes of this Section. The FADP is broadly aligned with the GDPR but differs in some respects — a Data Protection Officer is recommended but not mandatory, and the FADP does not impose a fixed 72-hour breach notification deadline (breaches likely to result in high risk to the data subject’s personality or fundamental rights are reported to the Federal Data Protection and Information Commissioner as quickly as possible).

27.3.9  Cross-Border Transfer Mechanism (Switzerland to United States)

Transfers of personal data from Switzerland to HCL’s US systems are carried out under the Standard Contractual Clauses described in Section 27.3.3, as amended for Switzerland in accordance with requirements published by the Swiss Federal Data Protection and Information Commissioner (the “Swiss Addendum”). The Swiss Addendum forms part of the same agreement with Amazon Web Services, Inc. described in Section 27.3.3 and applies automatically under AWS’s service terms whenever the Swiss FADP governs the processing of Swiss-origin data.

27.3.10  Your Swiss FADP Rights (Switzerland Users)

If you are located in Switzerland and the FADP applies to your data, you have rights of access, rectification, and restriction comparable to those described in Section 27.3.4, subject to the same HIPAA medical-record retention limitation on erasure. To exercise any right, contact HCL’s Privacy Officer at privacy@healthcarelive.com with subject line “FADP Data Subject Request.” You may also file a complaint with the Federal Data Protection and Information Commissioner (FDPIC) at edoeb.admin.ch.

27.3.11  Canada Users (including Québec)

If you are physically located in Canada at the time you use the Platform, additional provisions apply under the federal Personal Information Protection and Electronic Documents Act (“PIPEDA”) and, for users located in Québec, the Act Respecting the Protection of Personal Information in the Private Sector, as amended by Law 25 (the “Québec Privacy Act”). PIPEDA is accountability-based: HCL remains accountable for personal information transferred to its US systems and applies the contractual and technical safeguards described in Sections 27.2 and 27.5. For Québec residents, HCL conducts a privacy impact assessment in accordance with Section 17 of the Québec Privacy Act before transferring personal information outside Québec, evaluating the sensitivity of the information, the purpose of the transfer, the contractual and technical safeguards described in this Section, and the legal framework applicable in the United States. Québec residents may file a complaint with the Commission d’accès à l’information (CAI) at cai.gouv.qc.ca; other Canadian residents may contact the Office of the Privacy Commissioner of Canada (OPC) at priv.gc.ca.

27.3.12  Other Jurisdictions

HCL’s Platform may, from time to time, be accessed by or on behalf of users located in jurisdictions not separately addressed in this Section 27.3. Unless and until a jurisdiction-specific subsection is added, the Transfer Acknowledgment in Section 27.3.1 governs such transfers. As HCL’s services expand into additional jurisdictions, HCL will evaluate and, where legally required, implement an appropriate jurisdiction-specific transfer mechanism, and will update this Section in accordance with Section 27.8.

27.4  Data Retention Schedule

27.5  Data Security

HCL implements and maintains comprehensive technical, administrative, and physical safeguards in accordance with the HIPAA Security Rule (45 C.F.R. § 164.300 et seq.), including: end-to-end encryption for all data in transit (TLS 1.2 or higher); encryption at rest for all PHI; role-based access controls; multi-factor authentication; annual HIPAA security risk analyses; documented security policies and workforce training; Business Associate Agreements with all vendors having access to PHI; and incident response procedures compliant with the HIPAA Breach Notification Rule and applicable state breach notification laws.

HCL reserves the right, without liability, to immediately suspend or terminate a user’s access to the Platform in the event that HCL reasonably determines that continued access poses a security risk to the Platform, to PHI or personal data of any user, or to HCL’s systems. HCL will provide notice of any such suspension as soon as practicable, and will restore access promptly upon resolution of the identified security concern.

Despite HCL’s security measures, no electronic system is completely secure. By using the Platform, you acknowledge the inherent limitations of electronic data security and agree that HCL is not liable for unauthorized access resulting from your own device or network vulnerabilities. In no event shall HCL be liable for any indirect, incidental, consequential, special, or punitive damages, including loss of revenue, loss of profits, or loss of business opportunity, arising from any data incident, regardless of whether HCL was advised of the possibility of such damages.

27.6  Breach Notification

In the event of a data breach affecting your PHI or personal data, HCL will notify affected individuals and applicable regulatory authorities in accordance with: (a) HIPAA Breach Notification Rule (45 C.F.R. § 164.400 et seq.) — notification within 60 days of discovery for breaches affecting 500 or more individuals; annual log for smaller breaches; (b) applicable state breach notification laws — HCL will comply with the most stringent applicable timeline; (c) GDPR Article 33 — for breaches affecting EU/EEA resident data, notification to the applicable supervisory authority within 72 hours of becoming aware where the breach is likely to result in risk to individuals’ rights; (d) GDPR Article 34 — notification to affected EU/EEA individuals without undue delay where the breach is likely to result in high risk.

HCL’s obligation to provide breach notification is limited to the notifications expressly required under the statutes and regulations identified in this Section 27.6. Nothing in this Section shall be construed as creating a private right of action, expanding HCL’s notification obligations beyond applicable legal requirements, or waiving any defense or limitation otherwise available to HCL under applicable law.

27.7  Privacy Officer and Data Protection Contacts

27.8  Changes to This Section

HCL reserves the right to update this Section at any time, with or without notice. Material changes will be communicated to registered users via email to the address on file, a prominent notice on the Platform, or both. Continued use of the Platform following the effective date of changes constitutes acceptance of the updated terms. If required by applicable law, HCL will obtain renewed explicit consent for material changes for purposes of processing health data. If you do not agree to any updated terms, your sole remedy is to discontinue use of the Platform and request deletion of non-PHI data in accordance with Section 27.4.

This Section, and any dispute arising out of or relating to HCL’s data practices described herein, shall be governed by and construed in accordance with the laws of the State of Ohio, without regard to its conflict-of-law principles. Any legal action or proceeding arising under this Section shall be brought exclusively in the federal or state courts located in Hamilton County, Ohio, and you irrevocably consent to the personal jurisdiction and venue of such courts. Notwithstanding the foregoing, this choice-of-law provision does not affect the application of GDPR to users located in the EU/EEA to the extent that GDPR applies.