TERMS OF SERVICE

These Terms of Service (“Terms”) constitute a legally binding agreement between you and Atelia Software Inc., doing business as Atelia Health (“Atelia Health,” “we,” “us,” or “our”). By creating an account, accessing, or using our website, mobile application, or services (collectively, the “Services”), you agree to be bound by these Terms, our Privacy Policy (available at ateliahealth.com/privacy), and the HIPAA Business Associate Agreement attached as Exhibit A to these Terms.

If you are accepting these Terms on behalf of a group practice, organization, or other legal entity, you represent and warrant that you have the authority to bind that entity to these Terms, and the terms “you” and “Provider” refer to that entity.

If you do not agree to these Terms, you may not access or use the Services.

Atelia Health provides an AI-powered operations platform for healthcare providers, including:

• Billing and charge capture (mobile and web-based)
• Patient census management
• Physician scheduling and shift management
• Clinical documentation and note generation
• Patient communication (text, call, video)
• Electronic fax (e-fax) receiving and processing
• Workflow automation and task management
• Care coordination across facilities
• RVU tracking and performance analytics
• Practice management and reporting

The Services are designed to layer on top of existing electronic health record (EHR) systems and operate as a complementary “sidecar” platform without replacing your core clinical systems.

3.1 Account Types

• Individual Provider Account: A healthcare provider (physician, NP, PA) registers individually and is the Covered Entity under HIPAA for purposes of the Business Associate Agreement (Exhibit A).
• Practice Account: A group practice or organization registers through an authorized representative. The practice entity is the Covered Entity. Individual providers are added as authorized users under the practice account.
• Staff Account: Authorized staff members (MAs, billers, schedulers, administrators) may be granted access under a Provider or Practice account with role-based permissions.

3.2 Account Responsibilities

• You are responsible for maintaining the confidentiality of your account credentials and for all activities that occur under your account.
• You agree to notify Atelia Health immediately of any unauthorized use of your account or any other breach of security.
• You are responsible for ensuring that all users under your account comply with these Terms and applicable law, including HIPAA.
• You must provide accurate, current, and complete information during registration and keep your account information updated.

4.1 Business Associate Agreement

If you are a healthcare provider or practice that transmits, stores, or processes Protected Health Information (“PHI”) through the Services, you agree to the HIPAA Business Associate Agreement attached as Exhibit A to these Terms. The BAA is automatically effective upon your acceptance of these Terms and governs our obligations regarding the use, disclosure, and protection of PHI.

4.2 Provider Responsibilities

As the Covered Entity under HIPAA, you are responsible for:

• Obtaining any required patient authorizations or consents before transmitting PHI to Atelia Health.
• Providing patients with a Notice of Privacy Practices that accurately describes your information practices.
• Ensuring that any PHI you provide to Atelia Health is permitted to be disclosed under HIPAA for purposes of Treatment, Payment, or Healthcare Operations.
• Notifying Atelia Health of any restrictions, limitations, or revocations of patient authorizations that may affect our use or disclosure of PHI.
• Complying with all applicable federal, state, and local laws and regulations governing the privacy and security of health information.

4.3 Minimum Necessary

You agree to provide Atelia Health only the minimum amount of PHI necessary for us to perform the Services. Atelia Health will use, disclose, and request PHI in accordance with the HIPAA Minimum Necessary standard.

You agree to use the Services only for lawful purposes and in accordance with these Terms. You agree not to:

• Use the Services for any purpose other than legitimate healthcare operations, treatment, or payment activities.
• Upload, transmit, or store any content that is unlawful, harmful, threatening, abusive, or otherwise objectionable.
• Attempt to gain unauthorized access to any portion of the Services, other users’ accounts, or any systems or networks connected to the Services.
• Use the Services to transmit any viruses, malware, or other harmful code.
• Reverse engineer, decompile, disassemble, or otherwise attempt to derive the source code of the Services.
• Use the Services in any manner that could interfere with, disrupt, or negatively affect other users or the integrity of the Services.
• Share your account credentials with unauthorized individuals or allow unauthorized access to your account.
• Use the Services in violation of HIPAA or any other applicable healthcare privacy or security law.

6.1 Our Property

The Services, including all software, algorithms, AI models, user interfaces, designs, text, graphics, and other content provided by Atelia Health, are the exclusive property of Atelia Software Inc. and are protected by copyright, trademark, patent, trade secret, and other intellectual property laws. These Terms do not grant you any right, title, or interest in the Services except for the limited right to use the Services in accordance with these Terms.

6.2 Your Data

You retain all ownership rights in the data and content you upload, transmit, or create through the Services, including PHI. By using the Services, you grant Atelia Health a limited, non-exclusive license to use, process, store, and transmit your data solely for the purpose of providing the Services and as permitted by the Business Associate Agreement (Exhibit A).

Certain features of the Services may require payment of fees. If applicable:

• Fees will be communicated to you before you are charged and will be set forth in a separate order form, subscription agreement, or as displayed within the Services.
• Payment is processed through Stripe, which is PCI-DSS Level 1 certified. Atelia Health does not store or process payment card information.
• Fees are non-refundable unless otherwise stated in a separate written agreement.
• Atelia Health reserves the right to modify fees upon thirty (30) days’ prior written notice.

THE SERVICES ARE PROVIDED “AS IS” AND “AS AVAILABLE” WITHOUT WARRANTIES OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT.

Atelia Health does not provide medical advice, diagnoses, or treatment recommendations. The Services are operational and administrative tools designed to support healthcare providers in their practice. All clinical decisions remain the sole responsibility of the healthcare provider.

Atelia Health does not guarantee that the Services will be uninterrupted, error-free, or completely secure, although we implement reasonable safeguards as described in our Privacy Policy and Security documentation.

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, ATELIA HEALTH SHALL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, INCLUDING BUT NOT LIMITED TO LOSS OF PROFITS, DATA, GOODWILL, OR OTHER INTANGIBLE LOSSES, ARISING OUT OF OR RELATED TO YOUR USE OF OR INABILITY TO USE THE SERVICES.

ATELIA HEALTH’S TOTAL AGGREGATE LIABILITY ARISING OUT OF OR RELATED TO THESE TERMS OR THE SERVICES SHALL NOT EXCEED THE GREATER OF (A) THE TOTAL FEES PAID BY YOU TO ATELIA HEALTH IN THE TWELVE (12) MONTHS PRECEDING THE CLAIM, OR (B) ONE HUNDRED DOLLARS ($100).

NOTHING IN THESE TERMS SHALL LIMIT OR EXCLUDE LIABILITY FOR FRAUD, GROSS NEGLIGENCE, WILLFUL MISCONDUCT, OR ANY LIABILITY THAT CANNOT BE EXCLUDED OR LIMITED UNDER APPLICABLE LAW.

You agree to indemnify, defend, and hold harmless Atelia Software Inc. and its officers, directors, employees, agents, and affiliates from and against any claims, liabilities, damages, losses, costs, and expenses (including reasonable attorneys’ fees) arising out of or related to:

• Your use of the Services in violation of these Terms.
• Your violation of any applicable law or regulation, including HIPAA.
• Any PHI or other data you provide through the Services that infringes or violates the rights of any third party.
• Your failure to obtain required patient authorizations or consents.

• You may terminate your account at any time by contacting us at legal@ateliahealth.com, through the account settings in the Services, or at ateliahealth.com/delete-my-account. Deletion of your data following termination is described in Section 7 of our Privacy Policy.
• Atelia Health may suspend or terminate your access to the Services if you violate these Terms, fail to pay applicable fees, or if required by law.
• Upon termination, your right to use the Services will immediately cease. PHI will be handled in accordance with the Business Associate Agreement (Exhibit A, Section 6.3).
• Sections 6 (Intellectual Property), 8 (Disclaimers), 9 (Limitation of Liability), 10 (Indemnification), and 13 (Governing Law) shall survive termination.

Atelia Health may modify these Terms at any time by posting the revised Terms on our website and updating the “Effective Date.” For material changes, we will provide notice to registered users via email or through the Services at least thirty (30) days before the changes take effect. Your continued use of the Services after the effective date of any modification constitutes your acceptance of the modified Terms.

• These Terms shall be governed by and construed in accordance with the laws of the State of California, without regard to conflict of laws principles.
• Any dispute arising out of or related to these Terms or the Services shall first be submitted to good-faith mediation. If mediation is unsuccessful, the dispute shall be resolved by binding arbitration administered by JAMS in San Jose, California.
• Nothing in this section shall prevent either party from seeking injunctive or other equitable relief in a court of competent jurisdiction to prevent irreparable harm.

• Entire Agreement: These Terms, together with the Privacy Policy and the Business Associate Agreement (Exhibit A), constitute the entire agreement between you and Atelia Health regarding the Services and supersede all prior agreements and understandings.
• Severability: If any provision of these Terms is found to be unenforceable, the remaining provisions shall remain in full force and effect.
• Waiver: The failure of Atelia Health to enforce any right or provision of these Terms shall not constitute a waiver of that right or provision.
• Assignment: You may not assign or transfer these Terms without Atelia Health’s prior written consent. Atelia Health may assign these Terms in connection with a merger, acquisition, or sale of all or substantially all of its assets.
• Notices: All notices to Atelia Health should be sent to legal@ateliahealth.com. Notices to you will be sent to the email address associated with your account.

Atelia Health operates a text messaging program on behalf of the healthcare providers who use the Services, covering appointment reminders, care and follow-up communications, and secure links. Accepting these Terms does not enroll you in that program and does not constitute consent to receive those messages.

• Consent: Consent is collected separately from these Terms, through a distinct opt-in that is unchecked by default and that you may decline. Consent to receive text messages is never a condition of accepting these Terms, of purchase, of creating an account, or of receiving care, and declining it does not restrict your access to any part of the Services. You may opt in or out at any time.
• Verification Codes: If you choose to verify a mobile number — for example, to book an appointment online — we text you a one-time code through our verification service. That code is sent because you requested it, is separate from the messaging program described above, and enrolls you in nothing.
• Message Frequency: Message frequency varies based on your interactions with your provider and the Services you use.
• Message and Data Rates: Message and data rates may apply, according to your mobile carrier plan.
• Opt-Out: Reply STOP to any message to unsubscribe; we will send a confirmation and stop further messages unless you opt back in.
• Help: Reply HELP for assistance, or email legal@ateliahealth.com.
• Privacy: Mobile phone numbers and text-messaging opt-in consent are not sold or shared with third parties or affiliates for their marketing purposes. See our Privacy Policy for details.

Atelia Software Inc. (dba Atelia Health)
Email: legal@ateliahealth.com
Phone: (415) 505-6124
Website: ateliahealth.com

This HIPAA Business Associate Agreement (the “BA Agreement”) is entered into as of the date that the Atelia Health User (referred to in this BA Agreement as “Provider”) electronically agrees to the Terms of Service governing the Atelia Health service. This BA Agreement is entered into between the Provider (“Covered Entity”) and Atelia Software Inc., doing business as Atelia Health (“Business Associate”).

This BA Agreement applies only if and solely to the extent that Atelia Health receives, creates, maintains, or transmits Protected Health Information relating to patients of Provider in connection with the services (“Covered Services”) that Atelia Health, as a Business Associate, performs for or on behalf of Provider, as a Covered Entity.

1. Definitions

The following terms used in this BA Agreement shall have the same meaning as those terms in the HIPAA Rules (45 CFR Parts 160 and 164): Breach, Data Aggregation, Designated Record Set, Disclosure, Health Care Operations, Individual, Minimum Necessary, Notice of Privacy Practices, Protected Health Information (PHI), Required By Law, Secretary, Security Incident, Subcontractor, Unsecured Protected Health Information, and Use.

“Covered Services” means the billing, census management, scheduling, clinical documentation, patient communication, care coordination, fax processing, workflow automation, and practice management services provided by Business Associate to Covered Entity through the Atelia Health platform.

2. Obligations of Business Associate

• 2.1 Business Associate agrees to not use or disclose PHI other than as permitted or required by this BA Agreement or as Required By Law.
• 2.2 Business Associate agrees to use appropriate safeguards, and comply with the HIPAA Security Rule with respect to electronic PHI, to prevent use or disclosure of PHI other than as provided for by this BA Agreement.
• 2.3 Business Associate agrees to report to Covered Entity any use or disclosure of PHI not provided for by this BA Agreement of which it becomes aware, including Breaches of Unsecured PHI as required by 45 CFR § 164.410.
• 2.4 Business Associate agrees to ensure that any subcontractors that create, receive, maintain, or transmit PHI on behalf of the Business Associate agree to the same restrictions, conditions, and requirements that apply to the Business Associate under this BA Agreement.
• 2.5 Business Associate agrees to make available PHI in a Designated Record Set to the Covered Entity as necessary to satisfy Covered Entity’s obligations under 45 CFR § 164.524 (Individual Access).
• 2.6 Business Associate agrees to make any amendment(s) to PHI in a Designated Record Set as directed or agreed to by the Covered Entity pursuant to 45 CFR § 164.526.
• 2.7 Business Associate agrees to maintain and make available the information required to provide an accounting of disclosures to the Covered Entity as necessary to satisfy Covered Entity’s obligations under 45 CFR § 164.528.
• 2.8 Business Associate agrees to make its internal practices, books, and records available to the Secretary of HHS for purposes of determining compliance with the HIPAA Rules.
• 2.9 Business Associate shall implement administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of the electronic PHI that it creates, receives, maintains, or transmits on behalf of the Covered Entity.

3. Permitted Uses and Disclosures by Business Associate

• 3.1 Business Associate may use or disclose PHI to perform the Covered Services for, or on behalf of, Covered Entity, provided that such use or disclosure would not violate the HIPAA Rules if done by the Covered Entity.
• 3.2 Business Associate may use or disclose PHI as Required By Law.
• 3.3 Business Associate may use PHI for the proper management and administration of Business Associate or to carry out the legal responsibilities of Business Associate, provided that: (a) the disclosures are Required By Law; or (b) Business Associate obtains reasonable assurances from the person to whom the information is disclosed that the information will remain confidential and will be used or further disclosed only as Required By Law or for the purposes for which it was disclosed.
• 3.4 Business Associate may de-identify PHI in accordance with 45 CFR § 164.514(a)–(c). De-identified information does not constitute PHI and is not subject to the terms of this BA Agreement.

4. Obligations of Covered Entity

• 4.1 Covered Entity shall notify Business Associate of any limitation(s) in the Covered Entity’s Notice of Privacy Practices that may affect Business Associate’s use or disclosure of PHI.
• 4.2 Covered Entity shall notify Business Associate of any changes in, or revocation of, the permission by an Individual to use or disclose his or her PHI, to the extent that such changes may affect Business Associate’s use or disclosure of PHI.
• 4.3 Covered Entity shall notify Business Associate of any restriction on the use or disclosure of PHI that Covered Entity has agreed to or is required to abide by under 45 CFR § 164.522, to the extent that such restriction may affect Business Associate’s use or disclosure of PHI.

5. Breach Notification

• 5.1 Business Associate shall, following the discovery of a Breach of Unsecured PHI, notify Covered Entity of such Breach within twenty-four (24) hours of discovery. Business Associate shall provide Covered Entity with sufficient information to enable Covered Entity to fulfill its breach notification obligations under HIPAA.
• 5.2 Such notification shall include, to the extent available: (a) the nature of the Breach; (b) the PHI involved; (c) the identity of any individuals whose information was involved; (d) the steps Business Associate has taken to investigate and mitigate the Breach; and (e) contact information for further inquiries.
• 5.3 Business Associate shall cooperate with Covered Entity in investigating and mitigating the Breach and fulfilling any notification obligations under HIPAA.

6. Term and Termination

• 6.1 This BA Agreement shall be effective as of the date Provider agrees to the Terms of Service and shall remain in effect for the duration of the Provider’s use of the Covered Services, unless terminated earlier as provided herein.
• 6.2 Either party may terminate this BA Agreement if it determines that the other party has violated a material term of this BA Agreement and the violation has not been cured within thirty (30) days of written notice.
• 6.3 Upon termination, Business Associate shall, if feasible, return or destroy all PHI received from or created or received on behalf of Covered Entity. If return or destruction is not feasible, Business Associate shall extend the protections of this BA Agreement to the retained PHI and limit further uses and disclosures to those purposes that make return or destruction not feasible, for as long as Business Associate retains such information.

7. General Provisions

• 7.1 A reference in this BA Agreement to a section in the HIPAA Rules means the section as in effect or as amended.
• 7.2 The parties agree to take such action as is necessary to amend this BA Agreement from time to time to comply with the requirements of HIPAA and any other applicable law.
• 7.3 Any ambiguity in this BA Agreement shall be interpreted to permit compliance with the HIPAA Rules.
• 7.4 The respective rights and obligations of the parties under Sections 5 and 6.3 shall survive the termination of this BA Agreement.
• 7.5 This BA Agreement shall be governed by the laws of the State of California, without regard to conflict of laws principles.