Master Service Agreement
Last Modified: 04/26/2024
Updox LLC (“Updox”) requires users of its services, including any entity executing a service order (“Customer”) that references these terms to accept and adhere to these terms and conditions (the, “Agreement”). This Agreement governs the purchase and use of Updox’s services and is accepted by executing a service order that references this Agreement or by using or accessing Updox’s services. Updox may update this Agreement from time to time and Customer will have 30 days to reject the updated terms by providing written notice to Updox. If Customer continues to use or receive the services following such period, the updated Agreement will be deemed accepted.
1. Service Order.
Services will be ordered by Customer pursuant to either executing or acknowledging service orders, orders form or sales orders (each, a “Service Order”). Each Service Order will include the specific services being ordered (the, “Service”) and the associated fees and any additional terms as applicable. Each additional Service Order will be numbered sequentially (e.g. Service Order 1, 2, 3, etc.) and upon either execution of acknowledgement by both parties will be deemed an addendum hereto and will be subject to all of the terms and conditions herein. Any one of Customer’s subsidiaries or affiliates may also order services under this Agreement by entering into a Service Order signed by such subsidiary or affiliate and Updox and agreeing to be bound by the terms of this Agreement and such Service Order.
2. Software/Service.
2.1. Updox hereby grants to Customer during the term of this Agreement a non-exclusive, non-transferrable (except as provided herein) right to access and use the Service pursuant to the terms herein.
2.2. Accounts; Security.Access to or use of certain portions and features of the Service may require you to create an account (“Account”). Customer states that all information provided by it is current, accurate, complete, and not misleading. Customer further states that it will maintain and update all information provided by it to ensure accuracy on a prompt, timely basis. Customer is entirely responsible for maintaining the confidentiality and security of its account(s), including the password. Accounts are not transferrable. Customer agrees to promptly notify Updox if Customer becomes aware or suspects any unauthorized use of its accounts, including any unauthorized access or attempted access. Customer is responsible for all activities that occur under its account(s). Further, Customer is the primary account holder and is responsible for all charges made by additional users added to the accounts. A user license is required for each person utilizing Customer’s master account, or other data generated through the use of the Service. Any sharing of such data to reduce the number of licenses required or sharing account information in any way is strictly prohibited.
2.3. Restrictions on Use.In accessing or using the Service, Customer will not: (a) resell, lease, encumber, sublicense, distribute, publish, transmit, transfer, assign or provide such access or use to any third party in any medium whatsoever; (b) devise specifications from, reverse engineer, reverse compile, disassemble, or create derivative works based on the Service; (c) apply systems to extract or modify information in the Service using technology or method such as those commonly referred to as “web scraping,” “data scraping,” or “screen scraping”; (d) knowingly input or post through or to the Service any content that is illegal, threatening, harmful, lewd, offensive, or defamatory or that infringes the intellectual property rights, privacy rights or rights of publicity of others, (e) store data in the Service that is regulated by the PCI Data Standards (f) input or transmit through or to the Service any virus, worm, Trojan Horse, or other mechanism that could damage or impair the operation of the Service or grant unauthorized access thereto; (g) use or access the Service for purposes of monitoring the availability, performance or functionality of the Service or for any other benchmarking or competitive purposes; or (h) cause, assist, allow or permit any third party (including an end-user) to do any of the foregoing; (i) use the Service to compete with Updox in any way; or (j) permit any third party to use or access the Service other than Customer’s direct employees or contractors who are acting on Customer’s behalf and Customer’s authorized users.
2.4. Text Message Compliance. Mobile carriers supporting Company’s text message services may impose fines for incidents of misuse, such as sending messages with inappropriate content. Customer will be solely responsible for text messages sent from its account, including the payment of any fines imposed due to such text messages. Mobile carriers have established that content violations include text messages that: (a) involve manipulating individuals into disclosing privacy information, such as credit card or social security numbers, including any phishing, smishing, and social engineering; (b) messages that contain illegal content, including mentions of substances like cannabis, marijuana, CBD, illegal prescriptions, and solicitation; and (c) messages that contain content related to sex, hate, alcohol, firearms, and tobacco (SHAFT). This list is non-exhaustive and determinations of content violations are subject to the mobile carrier’s discretion. This policy applies to SMS or MMS, Short Code, Toll-Free, and 10DLC transmissions. Company reserves the right to suspend or revoke access to the Services or terminate this Agreement for repeated content violations.
2.5. Maintenance.Customer agrees that Updox may install software updates, error corrections, and software upgrades to the Service as Updox deems necessary from time to time. All such updates, error corrections and upgrades will be considered part of the Service for purposes of this Agreement. Updox will have no liability for modifications to, or suspension or discontinuance of the Service, or any part thereof, whether with or without notice to Customer.
2.6. Fax Services. As part of the Services, Company may provide Customer use of certain faxing services (“Faxing Services”) from third-party service provider. Such Faxing Services are made available to Customer subject to the Faxing Services Addendum attached as Exhibit B hereto. Customer understands that these terms and conditions are subject to change from time to time.
2.7. Applicable Laws. Customer’s access to and use of the Service is subject to all applicable international, federal, state and local laws and regulations. Customer may not use the Service or any information data or Customer Content in violation of or to violate any law, rule or regulation. Ensuring Customer’s use of the Service is compliant with applicable laws is the responsibility of Customer, including but not limited to obtaining prior express written consent for any automatic calls or text messages as required by the Telephone Consumer Protection Act (TCPA) and obtaining all required authorizations (including establishing all required terms and conditions) for payments processed via the Service.
2.8. Suspension of Service.Updox has the right to immediately suspend the Service (a) in order to prevent damage to or degradation of the Service or unauthorized or non-compliant use or (b) for operational reasons such as repair, maintenance, or improvement or because of any emergency, or (c) if, following notice from Updox, Customer has failed to pay any amounts due and owing. In the case of (a) or (b) Updox will give Customer prior notice if reasonable and will ensure that the Service is restored as soon as possible after the event given rise to suspension has been resolved to Updox’s reasonable satisfaction.
3. Data Licenses.
3.1. Customer Content. As between Updox and Customer, all title and intellectual property rights in and to all electronic data or information submitted to and stored in the Service that is owned by Customer (“Customer Content”) is owned by Customer. Customer acknowledges and agrees that in connection with the provision of the Services, Updox may store and maintain Customer Content for a period of time consistent with Updox’s standard business processes for the Service. Following expiration or termination of the Agreement or a Customer account, if applicable, Updox may deactivate the applicable Customer account(s) and delete any data therein. Customer grants Updox the right to host, use, process, display and transmit Customer Content to provide the Services pursuant to and in accordance with this Agreement, the Business Associate Agreement attached as Exhibit A hereto and the applicable Service Order. Customer has sole responsibility for the accuracy, quality, integrity, legality, reliability, and appropriateness of Customer Content, and for obtaining all rights related to Customer Content required by Updox to perform the Services. The Service does not replace the need for Customer to maintain regular backups or redundant data archives. The Updox has no obligation or liability for any loss, alteration, destruction, damage, corruption, or recovery of Customer Content.
3.2. Aggregated Data. Customer agrees that, subject to Updox’s confidentiality obligations in this Agreement and the restrictions in the Business Associate Agreement, Updox may (a) capture data regarding the use of the Service by Customer and its end users, (b) collect metrics and data related to the Updox Content, and (c) aggregate and analyze any metrics and data collected pursuant to subsections (a) and/or (b) of this sentence (collectively, the “Aggregated Data”). Customer agrees that Updox may use, reproduce, distribute and prepare derivative works, solely as incorporated into Aggregated Data, provided that under no circumstances will Updox use the Aggregated Data in a way that identifies Customer or its users as the source of the data or in violation of applicable law.
4. Third-Party Services.
Except as expressly permitted in this Agreement or as otherwise agreed by Updox in writing, Customer is prohibited from linking to the Service, framing of all or any portion of the Service, and the extraction of data from the Service. Updox reserves the right to disable any unauthorized links or frames. Updox will not be responsible and expressly disclaims any liability for any third party services that Customer may use or connect to through the Service, including any responsibility for the availability of such third party services. If Customer activates any APIs, links or integrations to enable data sharing through the Service, Customer thereby authorizes Updox to send and receive Customer Content with any such activated third party service and represents and warrants to Updox that Customer has all appropriate right and title to grant such authorization. Customer will be solely responsible for any third party fees related to the third party services and compliance with any applicable third party service terms.5. Intellectual Property.
5.1. Proprietary Rights. Updox’s intellectual property, including without limitation the Service, its trademarks and copyrights and excluding any Updox Content contained therein, and any modification thereof, are and will remain the exclusive property of Updox and its licensors. No licenses or rights are granted to Customer except for the limited rights expressly granted in this Agreement.
5.2. Feedback. Customer agrees that advice, feedback, criticism, or comments provided to Updox related to the Service are given to Updox and may be used by Updox freely and without restriction and will not enable Customer to claim any interest, ownership or royalty in Updox’s intellectual property.
6. Payment and Taxes.
6.1. Payment. Fees are set forth in the applicable Service Form (“Fees”). Upon execution of any Service Form that includes professional services, Updox will invoice Customer for any such professional service Fees as of the Service Form’s Effective Date, and Updox will not perform any professional services until Fees related to those professional services are paid in full. Any usage Fees, as set forth in an applicable Service Order, will be billed monthly and in arrears. Fees owed by Customer to Updox will be automatically debited from the bank account or other electronic payment method for which Customer has provided applicable account information and Customer hereby authorizes Updox to perform all such debits. Updox will send invoices to the contact(s) provided in a Service Order. Unless otherwise set forth in the applicable Service Order, Fees are due and payable by Customer within 30 days of receipt of the invoice for such Fees. An administrative late charge of $35.00 per invoice per month will be charged for any electronic transaction that is declined, any returned check or any invoice more than 60 days past due. Additionally, undisputed amounts that are past due will be subject to a monthly charge of 1.5% per month or the maximum rate permitted by law, whichever is less. Customer waives the right to contest billing discrepancies that are not reported within two billing cycles. Customer agrees to pay all reasonable costs of collection in the event any amount is not paid when due. Updox, upon notice to Customer, which notice may be in the form of an invoice, will have the right to change Fees effective any time, which right will include without limitation the right to charge a Fee for new features or functions of the Service or for features or functions that have previously been offered at no charge. Unless otherwise noted in the Service Order, all Fees are payable in United States Dollars, and non-refundable.
6.2. Automatic Payment Terms. Unless otherwise outlined in the applicable Service Order, Customer authorizes Updox to charge the credit card information provided, or debit the bank account information provided, as applicable, beginning as of the Effective Date and monthly thereafter, for all applicable fees due as defined in the Agreement. Customer understands that this authorization will remain in effect until it is canceled in writing and agrees to notify Updox in writing of any changes in Customer’s account information or termination of this authorization at least 15 days prior to the next billing date. If the payment date falls on a weekend or holiday, Customer understands that payments may be executed on the next business day. For ACH debits to a checking/savings account, Customer understands that because these are electronic transactions, these funds may be withdrawn from Customer’s account as of the payment date, and that it will have limited time to report and dispute errors. In the case the ACH transaction is returned for Non Sufficient Funds (“NSF”) Customer understands that Updox may at its discretion attempt to process the charge again within 30 days, and agrees to an additional charge for each attempt returned NSF, which will be initiated as a separate transaction from the authorized payment. Customer has certified that the business bank account information provided is enabled for ACH transactions, and agrees to reimburse Updox for all penalties and fees incurred as a result of Customer’s bank rejecting ACH debits or credits as a result of the account not being properly configured for ACH transactions. Both parties agree to be bound by NACHA Operating Rules as they pertain to these transactions. Customer acknowledges that the origination of ACH transactions to its account must comply with the provisions of U.S. law. Customer agrees not to dispute these scheduled transactions with its bank or credit card company provided the transactions correspond to the terms indicated in this Agreement.
6.3. Upgrades and Downgrades. An upgrade or downgrade (if applicable) of Customer’s Services will not result in a pro-rated refund due to client. Upgrades are effective immediately, Updox will charge Customer any associated Fee increases as of the date the upgraded features are made available to Customer. Downgrades are effective as of the next billing cycle.
6.4. Taxes. Updox Fees do not include any local, state, federal or foreign taxes, levies or duties of any nature. Including value-added, sales, use or withholding taxes (“Taxes”). Customer is responsible for paying all Taxes for which Customer is responsible under this Section. Updox may invoice taxes to Customer and Customer will pay such taxes, unless Customer provides Updox with a valid tax exemption certificate authorized by the appropriate taxing authority.
7. Term and Termination.
7.1. Term. This Agreement will be effective as of the stated date in an initial Service Order (“Effective Date”) and remain in effect until (a) all executed Service Orders have expired or been terminated or (b) terminated by either party as permitted by this Agreement
7.1.1 Month to Month. The initial term for month to month subscriptions will be one month, thereafter the Service Order will automatically renew for successive periods equal to the initial term unless canceled by either party by providing 30 days’ prior written notice, in which case termination will be effective as of the end of the second month period following the notice, or as otherwise provided in this Agreement.
7.1.2 Annual. The initial term for annual subscriptions will be one year, thereafter, the Service Order will automatically renew for successive periods equal to the initial term, unless cancelled by either party by providing 60 days’ written notice prior to the end of the then current term, or as otherwise provided in this Agreement.
7.2. Termination. Either party may terminate this Agreement immediately for a breach by the other party of any of its material terms, if the breaching party has failed to cure such breach (if curable) within 30 days of receipt of written notice from the non-breaching party describing the breach. Either party may terminate this Agreement without notice if the other party becomes insolvent, makes or has made an assignment for the benefit of creditors, is the subject of proceedings in voluntary or involuntary bankruptcy instituted on behalf of or against such party (except for involuntary bankruptcies which are dismissed within 60 days), or has a receiver or trustee appointed for substantially all of its property.
7.3. Effects of Termination. Upon the expiration or termination of this Agreement for any reason, (a) Customer will immediately cease using the Service, (b) Customer Content will be retained for 30 days and then destroyed, destroyed data cannot be recovered and Updox will have no liability to Customer for such destruction; (c) upon request, each party will return or destroy all Confidential Information of the other party, provided, that each party may retain one copy of the Confidential information of the other party as necessary to comply with applicable law or its records retention or archival policies or practices (and such retained Confidential Information will remain subject the non-disclosure obligations in this Agreement) and (d) any unpaid, undisputed amounts due through termination will become immediately due and payable.
7.4. Survival. Any provisions of this Agreement that expressly, or by implication, are intended to survive its termination or expiration will survive and continue to bind the parties, including without limitation provisions relating to confidentiality, representations and warranties, indemnification, limitations on liability, intellectual property, and Customer’s payment obligations under this Agreement.
8. Confidential Information.
8.1. Confidential Information. “Confidential Information” means any information disclosed by one party to the other whether orally or in writing that is designated as confidential or that reasonably should be understood by the receiving party to be confidential, notwithstanding the failure of the disclosing party to designate it as such. Confidential Information may include information that is proprietary to a third party and is disclosed by one party to another pursuant to this Agreement. The [Service], all features and functions thereof and related pricing and product plans will be the Confidential Information of Updox.
8.2. Non-Disclosure. EEach party agrees to maintain the confidentiality of the other party’s Confidential Information with the same security and measures it uses to protect its own Confidential Information of a similar nature (but in no event less than reasonable security and measures) and not to use such Confidential Information except as necessary to perform its obligations or exercise its rights under this Agreement. The receiving party may disclose Confidential Information of the disclosing party to those employees, officers, directors, agents, affiliates, consultants, users, and suppliers who need to know such Confidential Information for the purpose of carrying out the activities contemplated by this Agreement and who have agreed to confidentiality provisions that are no less restrictive than the requirements herein. Such party will be responsible for any improper use or disclosure of the disclosing party’s Confidential Information by any such parties. Except as expressly permitted by this Section, the receiving party will not disclose or facilitate the disclosure of Confidential Information of the disclosing party to any third party. The restrictions in this Section shall continue until such time as the information is covered by an exclusion set forth below.
8.3. Exclusions. The receiving party will have no obligation under this Section with respect to information provided by the disclosing party that: (a) is or becomes generally available to the public other than as a result of a breach of this Agreement by the receiving party, (b) is or becomes available to the receiving party from a source other than the disclosing party, provided that such source is not known to the receiving party to be bound by an obligation of confidentiality to the disclosing party with respect to such information, (c) was in the receiving party’s possession prior to disclosure by the disclosing party, or (d) is independently developed by the receiving party without reference to the Confidential Information. Further either party may disclose Confidential Information (i) as required by any court or other governmental body or as otherwise required by law, or (ii) as necessary for the enforcement of this Agreement or its rights hereunder.
9. Disclaimers.
UPDOX DOES NOT WARRANT THAT THE SERVICE WILL BE PERFORMED ERROR-FREE OR UNINTERRUPTED, THAT UPDOX WILL CORRECT ALL ERRORS OR THAT THE SERVICE WILL MEET CUSTOMER’S REQUIREMENTS OR EXPECTATIONS. UPDOX IS NOT RESPONSIBLE FOR ANY ISSUES RELATED TO THE PERFORMANCE, OPERATIONS OR SECURITY OF THE SERVICE THAT ARISE FROM CUSTOMER CONTENT OR THIRD PARTY APPLICATIONS OR SERVICES PROVIDED BY THIRD PARTIES. UPDOX EXPRESSLY DISCLAIMS (TO THE GREATEST EXTENT PERMISSIBLE UNDER APPLICABLE LAW) ALL OTHER WARRANTIES EXPRESS, IMPLIED, STATUTORY OR OTHERWISE, RELATING TO THE SUBJECT MATTER OF THIS AGREEMENT, INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, TITLE, OR FITNESS FOR A PARTICULAR PURPOSE.
10. Limitation of Liability.
IN NO EVENT WILL UPDOX OR ITS AFFILIATES BE LIABLE FOR ANY INDIRECT, CONSEQUENTIAL, INCIDENTAL, SPECIAL, PUNITIVE, OR EXEMPLARY DAMAGES, OF ANY KIND OR NATURE ARISING OUT OF THIS AGREEMENT OR THE SERVICE, INCLUDING WITHOUT LIMITATION, ANY COST TO COVER PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES (WHICH THE PARTIES AGREE WILL NOT BE CONSIDERED DIRECT DAMAGES), OR ANY LOSS OF REVENUE, PROFITS, SALES, DATA, DATA USE, GOOD WILL, OR REPUTATION. UPDOX’S MAXIMUM LIABILITY ARISING OUT OF OR RELATED TO THE SERVICE OR THIS AGREEMENT WILL BE LIMITED TO THE AMOUNT OF FEES CUSTOMER HAS PAID TO UPDOX IN THE 3 MONTH(S) PRIOR TO THE EVENT(S) GIVING RISE TO SUCH LIABILITY. THE LIMITATIONS SET FORTH IN THIS SECTION APPLY REGARDLESS OF THE LEGAL THEORY ON WHICH A CLAIM IS BROUGHT, EVEN IF UPDOX HAS BEEN NOTIFIED OF THE POSSIBILITY OF DAMAGE OR IF SUCH DAMAGE COULD HAVE BEEN REASONABLY FORESEEN AND NOTWITHSTANDING ANY FAILURE OF ESSENTIAL PURPOSE OF ANY EXCLUSIVE REMEDY PROVIDED IN THIS AGREEMENT.
11. Indemnification.
Customer agrees to defend and indemnify Updox and its affiliates from and against any legal action, demand, suit, or proceeding brought against Updox or its affiliates by a third party arising out of or related to the Customer Content or Customer’s use of the Service.
12. Publicity.
Customer hereby consents to Updox identifying Customer as a customer by name and logo in Updox’s promotional materials, subject to Customer’s right to revoke such consent in writing at any time. Upon such revocation, Updox will have 30 days to process Customer’s request.
13. Assignment.
Customer may not assign or transfer this Agreement or any of its rights or obligations hereunder in whole or in part without the prior written consent of Updox. Updox may assign this Agreement to an affiliate, or to a successor in interest by merger, consolidation of sales of assets. Subject to the foregoing, this Agreement will inure to the benefit of, be binding upon, and be enforceable against, each of the parties hereto and their respective successors and assigns.
14. Notices.
Any notice required under this Agreement will be provided to the other party in writing. If Customer wishes to provide notice to Updox, Customer will send notice via email to: [email protected]. Updox will send notices to one or more contact(s) on file for Customer. Notices from Updox, other than for a breach of this Agreement may be provided within the Service.
15. Attorney’s Fees.
In the event any proceeding or lawsuit is brought in connection with this Agreement, the prevailing party in such proceeding will be entitled to receive its reasonable costs, expert witness and attorneys’ fees.
16. Relationship of the Parties.
This Agreement does not create any joint venture, partnership, agency, or employment relationship between the parties.
17. No Third Party Beneficiaries.
This Agreement is being entered into for the sole benefit of the parties hereto, and nothing herein, express or implied, is intended to or will confer upon any other person or entity any legal or equitable right, benefit or remedy of any nature whatsoever.
18. Equitable Remedies.
Each party acknowledges and agrees that (a) a breach or threatened breach by such party may give rise to irreparable harm to the other party for which monetary damages may not be an adequate remedy; and (b) if a breach or threatened breach by such party occurs, the other party will in addition to any and all other rights and remedies that may be available to such other party at law, at equity or otherwise in respect of such breach, be entitled to seek equitable relief that may be available from a court of competent jurisdiction, without any requirement to post a bond or other security.
19. Force Majeure.
Neither party will be liable under this Agreement for any failure or delay in the performance of its obligations (except for the payment of money) on account of strikes, shortages, riots, insurrections, fires, flood, storm, explosions, acts of God, war, governmental action, labor conditions, earthquakes, material shortages, or any other cause that is beyond the reasonable control of such party.
20. Limitation of Claims.
No legal proceedings, regardless of form, arising under or relating to this Agreement may be brought by Customer more than six months after it first have actual knowledge of the facts giving rise to the cause of action.
21. Export Compliance.
Customer must comply with United States, foreign and international laws and regulations, including without limitation, the United States Export Administration Regulations and the United States Office of Foreign Asset Control regulations, and other anti-boycott and import regulations. Such export laws govern use of the Service including technical data and any Service deliverables provided under this Agreement and Customer agrees to comply with all such laws and regulations (including “deemed export” and “deemed re-export” regulations). Customer is responsible for ensuring that no data, information, software programs and/or materials resulting from the Service (or direct product thereof) will be exported directly or indirectly in violation of these laws. Customer will indemnify Updox for any violation by Customer of any applicable export controls or economic sanctions laws and regulations.
22. Governing Law, Jurisdiction and Venue.
This Agreement will be governed by and construed in all respects in accordance with the laws of the State of Ohio, without regard to its conflicts of laws principles. Each party hereby consents to the exclusive venue and jurisdiction of the courts of Columbus, Ohio. THE PARTIES FURTHER AGREE, TO THE EXTENT PERMITTED BY APPLICABLE LAW, TO WAIVE ANY RIGHT TO TRIAL BY JURY WITH RESPECT TO ANY CLAIM, COUNTERCLAIM OR ACTION ARISING FROM THE TERMS OF THIS AGREEMENT.
23. Severability, Waiver and Amendment.
If any provision of this Agreement is held by a court of competent jurisdiction to be unenforceable or invalid, such provision will be changed and interpreted as to best accomplish the objectives of the original provision to the fullest extent permitted by law, and the remaining provisions will remain in full force and effect. No waiver of any term or right in this Agreement will be effective unless made in writing and signed by an authorized representative of the waiving party. Any waiver or failure to enforce any provision of this Agreement will not be deemed a waiver of future enforcement of that or any other provision. Except to the extent otherwise expressly provided in this Agreement, this Agreement may only be amended in writing signed by both parties hereto.
24. Counterparts, Entire Agreement and Order of Precedence.
This Agreement, together with any Service Order(s), the Business Associate Agreement, and the Privacy Policy states the entire agreement of the parties regarding the subject matter of this Agreement, and supersedes all prior proposals, agreements or other communications between the parties, oral or written, regarding such subject matter. If an ambiguity or conflict exists among the documents the order of precedence will be the terms and conditions of: (a) a Service Order; (b) the Business Associate Agreement; and (c) this Agreement. Any preprinted terms on any purchase order are hereby expressly rejected by Updox and will be of no force or effect.
Exhibit A
HIPAA BUSINESS ASSOCIATE AGREEMENT
This HIPAA Business Associate Agreement (“BAA”) amends and is made part of that certain Master Services Agreement (“Service Agreement”), by and between you (“Entity”) and Updox LLC (“Associate”). Entity and Associate agree that the parties incorporate this BAA into the Service Agreement in order to comply with the requirements of the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), the Health Information Technology for Economic and Clinical Health Act (“HITECH”) and their implementing regulations set forth at 45 C.F.R. Parts 160 and Part 164 (the “HIPAA Rules”). To the extent Associate is acting as a Business Associate of Entity pursuant to the Service Agreement, the provisions of this BAA shall apply, and Associate shall be subject to the penalty provisions of HIPAA as specified in 45 CFR Part 160.
1. Definitions.
Capitalized terms not otherwise defined in this BAA shall have the meaning set forth in the HIPAA Rules. References to “PHI” mean Protected Health Information maintained, created, received or transmitted by Associate from Entity or on Entity’s behalf.
2. Uses or Disclosures.
Associate will neither use nor disclose PHI except as permitted or required by this BAA or as Required By Law. To the extent Associate is to carry out an obligation of Entity under the HIPAA Rules, Associate shall comply with the requirements of the HIPAA Rules that apply to Entity in the performance of such obligation. Associate is permitted to use and disclose PHI: (a) to perform any and all obligations of Associate as described in the Service Agreement, provided that such use or disclosure would not violate the HIPAA Rules if done by Entity directly; (b) otherwise permitted by law, provided that such use or disclosure would not violate the HIPAA Rules, if done by Entity directly and provided that Entity gives its prior written consent; (c) to perform Data Aggregation services relating to the health care operations of Entity; (d) to report violations of the law to federal or state authorities consistent with 45 C.F.R. § 164.502(j)(1); (e) as necessary for Associate’s proper management and administration and to carry out Associate’s legal responsibilities (collectively “Associate’s Operations”), provided that Associate may only disclose PHI for Associate’s Operations if the disclosure is Required By Law or Associate obtains reasonable assurance, evidenced by a written contract, from the recipient that the recipient will: (1) hold such PHI in confidence and use or further disclose it only for the purpose for which Associate disclosed it to the recipient or as Required By Law; and (2) notify Associate of any instance of which the recipient becomes aware in which the confidentiality of such PHI was breached; (f) to de-identify PHI in accordance with 45 C.F.R. § 164.514(b), provided that such de-identified information may be used and disclosed only consistent with applicable law. In the event Entity notifies Associate of a restriction request that would restrict a use or disclosure otherwise permitted by this BAA, Associate shall comply with the terms of the restriction request.
3. Safeguards.
Associate will use appropriate administrative, technical and physical safeguards to prevent the use or disclosure of PHI other than as permitted by this BAA. Associate will also comply with the provisions of 45 CFR Part 164, Subpart C of the HIPAA Rules with respect to electronic PHI to prevent any use or disclosure of such information other than as provided by this BAA.
4. Subcontractors.
In accordance with 45 CFR §§ 164.308(b)(2) and 164.502(e)(1)(ii), Associate will ensure that all of its subcontractors that create, receive, maintain or transmit PHI on behalf of Associate agree by written contract to comply with the same restrictions and conditions that apply to Associate with respect to such PHI.
5. Minimum Necessary.
Associate represents that the PHI requested, used or disclosed by Associate shall be the minimum amount necessary to carry out the purposes of the Service Agreement. Associate will limit its uses and disclosures of, and requests for, PHI (i) when practical, to the information making up a Limited Data Set; and (ii) in all other cases subject to the requirements of 45 CFR § 164.502(b), to the minimum amount of PHI necessary to accomplish the intended purpose of the use, disclosure or request.
6. Obligations of Entity.
Entity shall notify Associate of (i) any limitations in its notice of privacy practices, (ii) any changes in, or revocation of, permission by an individual to use or disclose PHI, and (iii) any confidential communication request or restriction on the use or disclosure of PHI that Entity has agreed to or with which Entity is required to comply, to the extent any of the foregoing affect Associate’s use or disclosure of PHI.
7. Access and Amendment.
In accordance with 45 CFR § 164.524, Associate shall permit Entity or, at Entity’s request, an individual (or the individual’s designee) to inspect and obtain copies of any PHI about the individual that is in Associate’s custody or control and that is maintained in a Designated Record Set. If the requested PHI is maintained electronically, Associate must provide a copy of the PHI in the electronic form and format requested by the individual, if it is readily producible, or, if not, in a readable electronic form and format as agreed to by Entity and the individual. Associate will, upon receipt of notice from Entity, promptly amend or permit Entity access to amend PHI so that Entity may meet its amendment obligations under 45 CFR § 164.526. If a request for access or amendment is of PHI is received by Associate from any entity other than Entity, Associate will promptly inform Entity of such request.
8. Accounting.
Except for disclosures excluded from the accounting obligation by the HIPAA Rules and regulations issued pursuant to HITECH, Associate will record for each disclosure that Associate makes of PHI the information necessary for Entity to make an accounting of disclosures pursuant to the HIPAA Rules. In the event the U.S. Department of Health and Human Services (“HHS”) finalizes regulations requiring Covered Entities to provide access reports, Associate shall also record such information with respect to electronic PHI held by Associate as would be required under the regulations for Covered Entities beginning on the effective date of such regulations. Associate will make information required to be recorded pursuant to this Section available to Entity promptly upon Entity’s request for the period requested, but for no longer than required by the HIPAA Rules (except Associate need not have any information for disclosures occurring before the effective date of this BAA).
9. Inspection of Books and Records.
Associate will make its internal practices, books, and records, relating to its use and disclosure of PHI, available upon request HHS to determine compliance with the HIPAA Rules.
10. Reporting.
To the extent Associate becomes aware or discovers any use or disclosure of PHI not permitted by this BAA, any Security Incident involving electronic PHI or any Breach of Unsecured Protected Health Information involving PHI, Associate shall promptly report such use, disclosure, Security Incident or Breach to Entity. Associate shall mitigate, to the extent practicable, any harmful effect known to it of a Security Incident, Breach or use or disclosure of PHI by Associate not permitted by this BAA. Notwithstanding the foregoing, the parties acknowledge and agree that this section constitutes notice by Associate to Entity of the ongoing existence and occurrence of attempted but Unsuccessful Security Incidents (as defined below) for which no additional notice to Entity shall be required. “Unsuccessful Security Incidents” shall include, but not be limited to, pings and other broadcast attacks on Associate’s firewall, port scans, unsuccessful log-on attempts, denials of service and any combination of the above, so long as no such incident results in unauthorized access, use or disclosure of electronic PHI. All reports of Breaches shall be made in compliance with 45 CFR § 164.410.
11. Term and Termination.
This BAA shall be effective as of the effective date of the Service Agreement and shall remain in effect until termination of the Service Agreement. Either party may terminate this BAA and the Service Agreement effective immediately if it determines that the other party has breached a material provision of this BAA and failed to cure such breach within thirty (30) days of being notified by the other party of the breach. If the non-breaching party determines that cure is not possible, such party may terminate this BAA and the Service Agreement effective immediately upon written notice to other party.
Upon termination of this BAA for any reason, Associate will, if feasible, return to Entity or destroy all PHI maintained by Associate in any form or medium, including all copies of such PHI. Further, Associate shall recover any PHI in the possession of its agents and subcontractors and return to Entity or securely destroy all such PHI. In the event that Associate determines that returning or destroying any PHI is infeasible, Associate may maintain such PHI but shall continue to abide by the terms and conditions of this BAA with respect to such PHI and shall limit its further use or disclosure of such PHI to those purposes that make return or destruction of the PHI infeasible. Upon termination of this BAA for any reason, all of Associate’s obligations under this BAA shall survive termination and remain in effect (a) until Associate has completed the return or destruction of PHI as required by this Section and (b) to the extent Associate retains any PHI pursuant to this Section.
12. Third Parties.
Notwithstanding anything in this BAA or the Service Agreement to the contrary, Associate will not be liable for any in violation of HIPAA, this BAA, or the Service Agreement, or use or disclosure of PHI in violation thereof, that is caused by any entity or individual other than Associate, including but not limited to third party vendors selected by Entity to provide services to Entity related to the services provided under the Service Agreement.
13. General Provisions.
In the event that any final regulation or amendment to final regulations is promulgated by HHS or other government regulatory authority with respect to PHI, the parties shall negotiate in good faith to amend this BAA to remain in compliance with such regulations. Any ambiguity in this BAA shall be resolved to permit Entity and Associate to comply with the HIPAA Rules. Nothing in this BAA shall be construed to create any rights or remedies in any third parties or any agency relationship between the parties. A reference in this BAA to a section in the HIPAA Rules means the section as in effect or as amended. The terms and conditions of this BAA override and control any conflicting term or condition of the Service Agreement and replace and supersede any prior business associate agreements in place between the parties. All non-conflicting terms and conditions of the Service Agreement remain in full force and effect.
Exhibit B
FAX SERVICES ADDENDUM
If Customer orders Fax Services pursuant to any Order Form, the terms of this Fax Services Addendum will apply and is made a part of the Terms and Conditions (“Agreement”) by and between Updox, LLC (“Company”), provider of faxing service (“Service Provider”) and the Customer. Capitalized terms not otherwise defined in this Fax Services Addendum shall have the meaning set forth in the Agreement.
1. The Fax Service.
The fax service provides Customer with the capability to send and receive fax documents using electronic mail (“email“) pursuant to the terms set forth herein (the “Fax Service“). As part of the registration process, Customer shall be required to provide an email address. Customer is responsible for (1) maintaining the confidentiality of its password, fax service number and account information, (2) for all individual end users who access and/or use the Fax Service through Customer’s account, and (3) any activities that occur through Customer’s account. Customer’s right to use the Fax Service is personal to it and Customer agrees not to resell the use of the Fax Service.
2. Customer’s Conduct.
Customer is solely responsible for the contents of its transmissions through the Fax Service, and the Fax Service simply acts as a passive conduit for it to send and receive information of its own choosing. However, Service Provider reserves the right to take any action with respect to the Fax Service that Service Provider deems necessary or appropriate in Service Provider’s sole discretion if Service Provider believes Customer or its information may create liability for Service Provider, compromise or disrupt the Fax Service for Customer or other subscribers to the Fax Service, or may cause Service Provider to lose (in whole or in part) the services of the ISPs or other suppliers of Service Provider. Customer’s use of the Fax Service is subject to all applicable local, state, national and international laws and regulations (including without limitation those governing account collection, export control, consumer protection, unfair competition, anti-discrimination or false advertising). Customer agrees: (1) to comply with all applicable laws regarding the transmission of technical data exported from the United States through the Fax Service; (2) not to use the Fax Service for illegal purposes; (3) not to interfere or disrupt networks connected to the Fax Service; (4) to comply with all regulations, policies and procedures of networks connected to the Fax Service; (5) not to use the Fax Service to infringe any third party’s copyright, patent, trademark, trade secret or other proprietary rights or rights of publicity or privacy; (6) not to transmit through the Fax Service any unlawful, harassing, libelous, abusive, threatening, harmful, vulgar, obscene or otherwise objectionable material of any kind or nature; and (7) not to use the Fax Service to store any “protected health information” (as such term is used in the Health Insurance Portability and Accountability Act of 1996, Pub. L. No. 104-191). Customer further agrees not to transmit any material that encourages conduct that could constitute a criminal offense, give rise to civil liability or otherwise violate any applicable local, state, national or international law or regulation. The transmission of unsolicited commercial “junk faxes” is illegal under the Federal Telephone Consumer Protection Act of 1991 and a number of similar state laws. Customer will not use or reference the Fax Service for chain letters, junk fax or junk mail, spamming or any use of distribution lists to any person who has not given specific permission to be included in such a process. Customer is not permitted to “opt in” to receive spam faxes on its fax service number or to use its fax service number as a “drop-box” for responses to email spam offers.
3. Privacy Policy.
Customer understands and agrees that it is subject to Service Provers own privacy policy and Customer may be bound by such privacy policy by using the service provided by Service Provider, including j2 Cloud Services, LLC and EC Data Systems, Inc.
3.1 j2 Cloud Services Privacy Policy. The current j2 Privacy Policy, which is incorporated herein by this reference, is available at www.efaxcorporate.com. By accepting this agreement, you expressly consent to disclosures and use of your information as enumerated in such Privacy Policy. j2 may amend its Privacy Policy at any time upon thirty (30) days’ notice by (i) posting a revised version of the Privacy Policy on its website, and/or (ii) sending information regarding amendments to the Privacy Policy to the email address you provide Service Provider. Your continued use of the Fax Service after such thirty (30) day period shall be deemed acceptance by you of the amended Privacy Policy.
3.2 EC Data Systems Privacy Policy. The current EC Data Systems Privacy Policy, which is incorporated herein by this reference, is available at https://www.faxage.com/tos.php. By accepting this agreement, you expressly consent to disclosures and use of your information as enumerated in such Privacy Policy.
4. Disclaimer of Warranties.
CUSTOMER EXPRESSLY AGREES THAT USE OF THE FAX SERVICE IS AT ITS SOLE RISK. THE FAX SERVICE IS PROVIDED ON AN “AS IS” AND “AS AVAILABLE” BASIS. SERVICE PROVIDER EXPRESSLY DISCLAIMS ALL WARRANTIES OF ANY KIND, WHETHER EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. SERVICE PROVIDER MAKES NO WARRANTY THAT THE FAX SERVICE WILL MEET CUSTOMER’S REQUIREMENTS, OR THAT THE FAX SERVICE WILL BE UNINTERRUPTED, TIMELY, SECURE, OR ERROR FREE OR THAT ANY TRANSMISSION THROUGH THE FAX SERVICE WILL BE SENT OR RECEIVED; NOR DOES SERVICE PROVIDER MAKE ANY WARRANTY AS TO THE RESULTS THAT MAY BE OBTAINED FROM THE USE OF THE FAX SERVICE OR AS TO THE ACCURACY OR RELIABILITY OF ANY COMMUNICATIONS OR TRANSMISSIONS, OR THE ACCURACY OF ANY TRANSLATION OR ALTERATION OF CUSTOMER’S TRANSMISSIONS OR DATA, OR THE ACCURACY OF ANY INFORMATION OBTAINED THROUGH THE FAX SERVICE, OR THE ACCURACY OR RELIABILITY OF ANY FILTERING TECHNOLOGY USED IN CONNECTION WITH THE FAX SERVICE, OR THAT DEFECTS IN THE SOFTWARE WILL BE CORRECTED. CUSTOMER UNDERSTANDS AND AGREES THAT ANY MATERIAL AND/OR DATA DOWNLOADED OR OTHERWISE OBTAINED THROUGH THE USE OF THE FAX SERVICE IS DONE AT ITS OWN DISCRETION AND RISK AND THAT IT WILL BE SOLELY RESPONSIBLE FOR ANY DAMAGE TO ITS COMPUTER SYSTEM OR LOSS OF DATA THAT RESULTS FROM THE DOWNLOAD OF SUCH MATERIAL AND/OR DATA. CUSTOMER ASSUMES FULL RESPONSIBILITY AND RISK OF LOSS RESULTING FROM UNAUTHORIZED ACCESS TO OR ALTERATION OF ITS TRANSMISSIONS, DATA OR FILES UPLOADED, HOSTED OR TRANSMITTED VIA THE FAX SERVICE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES, WHETHER ARISING UNDER ANY THEORY OF CONTRACT, TORT (INCLUDING NEGLIGENCE), STRICT LIABILITY OR OTHERWISE. SERVICE PROVIDER MAKES NO WARRANTY REGARDING ANY GOODS OR SERVICES PURCHASED OR OBTAINED THROUGH THE FAX SERVICE OR ANY TRANSACTIONS ENTERED INTO THROUGH THE FAX SERVICE. SERVICE PROVIDER ASSUMES NO RESPONSIBILITY FOR THE DELETION OR FAILURE TO STORE FAX AND EMAIL MESSAGES. NO ADVICE OR INFORMATION, WHETHER ORAL OR WRITTEN, OBTAINED BY CUSTOMER FROM SERVICE PROVIDER OR THROUGH THE FAX SERVICE SHALL CREATE ANY WARRANTY NOT EXPRESSLY MADE HEREIN. SOME JURISDICTIONS DO NOT ALLOW THE EXCLUSION OF CERTAIN WARRANTIES, SO SOME OF THE ABOVE EXCLUSIONS MAY NOT APPLY TO CUSTOMER.
5. Limitation of Liability.
IN NO EVENT SHALL COMPANY OR SERVICE PROVIDER BE LIABLE FOR ANY INDIRECT, INCIDENTAL, PUNITIVE, SPECIAL OR CONSEQUENTIAL DAMAGES, RESULTING FROM THE USE OR THE INABILITY TO USE THE FAX SERVICE OR FOR COST OF PROCUREMENT OF SUBSTITUTE GOODS AND SERVICES OR RESULTING FROM ANY GOODS OR SERVICES PURCHASED OR OBTAINED OR MESSAGES RECEIVED OR TRANSACTIONS ENTERED INTO THROUGH THE FAX SERVICE OR RESULTING FROM UNAUTHORIZED ACCESS TO OR ALTERATION OF CUSTOMER’S TRANSMISSIONS OR DATA, INCLUDING BUT NOT LIMITED TO, DAMAGES FOR LOSS OF PROFITS, USE, DATA OR OTHER INTANGIBLE, EVEN IF COMPANY AND SERVICE PROVIDER HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. COMPANY AND SERVICE PROVIDER’S LIABILITY TO CUSTOMER OR ANY THIRD PARTIES IS LIMITED TO $50. SOME JURISDICTIONS DO NOT ALLOW THE LIMITATION OR EXCLUSION OF LIABILITY FOR INCIDENTAL OR CONSEQUENTIAL DAMAGES SO SOME OF THE ABOVE LIMITATIONS MAY NOT APPLY TO CUSTOMER.
6. Indemnification.
Customer agrees to indemnify and hold Company, Service Provider and their affiliates, officers and employees, harmless from any claim or demand, including reasonable attorneys’ fees, made by any third party due to or arising out of Customer’s use of the Fax Service, Customer’s violation of this Fax Services Addendum, or the infringement by Customer, or another user of the Fax Service on Customer’s behalf, of any third party intellectual property right.
7. Porting.
CUSTOMER UNDERSTANDS AND AGREES THAT IT WILL HAVE USE OF THE FAX SERVICE NUMBERS THAT ARE PROVIDED AS PART OF THE FAX SERVICE (EACH SUCH FAX SERVICE NUMBER IS REFERRED TO HEREINAFTER A “DID”) ONLY UNTIL THE END OF THE TERM OF CUSTOMER’S AGREEMENT, UNLESS CUSTOMER SATISFY THE REQUIREMENTS FOR A PORTED DID (AS DEFINED BELOW) AS SET FORTH BELOW. SERVICE PROVIDER IS GRANTING CUSTOMER REVOCABLE PERMISSION TO USE SUCH DID(S) IN ACCORDANCE WITH THIS AGREEMENT FOR THE LENGTH OF THE TERM OF THE AGREEMENT. CUSTOMER UNDERSTANDS AND AGREES THAT SERVICE PROVIDER IS THE CUSTOMER OF RECORD OF ALL DID(S) PROVIDED AS PART OF THE FAX SERVICE AND, THEREFORE, SERVICE PROVIDER HAS CERTAIN RIGHTS WITH RESPECT TO THE DID(S), INCLUDING WITHOUT LIMITATION CERTAIN RIGHTS RELATING TO THE PORTING OF DID(S). AS THE CUSTOMER OF RECORD FOR THE DID(S), SERVICE PROVIDER HAS A DIRECT RELATIONSHIP WITH THE TELEPHONE COMPANY THAT PROVIDES THE UNDERLYING TELECOMMUNICATIONS THAT SUPPORT THE FAX SERVICE CUSTOMER RECEIVE. CUSTOMER UNDERSTAND AND AGREE THAT SERVICE PROVIDER IS NOT, ITSELF, A TELEPHONE COMPANY AND THEREFORE IS NOT UNDER ANY LEGAL OBLIGATION TO PERMIT CUSTOMER TO PORT ANY DID(S) PROVIDED AS PART OF THE FAX SERVICE UNLESS THEY ARE PORTED DID(S) AND CUSTOMER SATISFIES THE REQUIREMENTS SET FORTH BELOW. CUSTOMER UNDERSTAND AND AGREE THAT IT IS EXPRESSLY PROHIBITED FROM CAUSING OR ATTEMPTING TO CAUSE SUCH DID(S) TO BE TRANSFERRED TO ANY OTHER SERVICE PROVIDER, TELEPHONE CARRIER OR ANY OTHER PERSON OR ENTITY UNLESS THEY ARE PORTED DID(S) AND CUSTOMER SATISFY THE REQUIREMENTS SET FORTH BELOW. CUSTOMER UNDERSTANDS AND AGREES THAT FOLLOWING THE TERMINATION OF THE FAX SERVICE FOR ANY REASON, THE DID(S) PROVIDED BY SERVICE PROVIDER AS PART OF THE FAX SERVICE AND ANY PORTED DID(S) WHICH CUSTOMER FAILS TO REQUEST TO PORT AS SET FORTH BELOW MAY BE RE-ASSIGNED IMMEDIATELY TO ANOTHER PARTY, AND CUSTOMER AGREE THAT SERVICE PROVIDER WILL NOT BE LIABLE FOR ANY DAMAGES WHATSOEVER (INCLUDING BUT NOT LIMITED TO DIRECT, INDIRECT, CONSEQUENTIAL OR SPECIAL DAMAGES) ARISING OUT OF ANY SUCH RE-ASSIGNMENT, AND CUSTOMER HEREBY WAIVES ANY CLAIMS WITH RESPECT TO ANY SUCH REASSIGNMENT, WHETHER BASED ON CONTRACTUAL, TORT OR OTHER GROUNDS, EVEN IF SERVICE PROVIDER HAS BEEN ADVISED OF THE POSSIBILITY OF DAMAGES.
A “Ported DID” is a telephone number Customer ported from its telecommunications carrier(s) to Service Provider’s telecommunications carrier(s) to be placed in Service Provider’s name. Service Provider’s charges for porting in and porting out Ported DIDs depends on the location and quantity of the Ported DIDs. Customer shall not delete Ported DIDs from its account during the term of the Agreement. In the event Customer fails to request to port out any Ported DIDs within sixty (60) days of the termination of this agreement, Customer shall no longer have a right to have any Ported DIDs ported out.