Terms of Use

Summary

By accessing the Health Universe Platform, you agree to be bound by these Terms of Use, including the Data Use and De-Identified Data section and the Standard Business Associate Terms below. Please read these terms carefully. You must affirmatively accept these Terms of Use to access the Health Universe Platform. If you do not agree to these terms, you may not use the Health Universe Platform. If you have any questions about these terms, please contact us at support@healthuniverse.com.

Important notice about your data. Health Universe may de-identify information that you submit to or generate through the Health Universe Platform, including Protected Health Information, and may use, license, commercialize, and sell the resulting de-identified and aggregated data, including to develop and train artificial intelligence models. This applies to information submitted before and after your acceptance of these Terms of Use. Health Universe does not sell personal information or Protected Health Information in identifiable form, and never uses information retrieved through the TEFCA network for these purposes. If you do not want information used as described in these Terms of Use, do not submit it to the Health Universe Platform.

Relationship to Executed Agreements — Order of Precedence

If you access the Health Universe Platform on behalf of an organization that has entered into a Master Services Agreement, Order Form, or Addendum with Health Universe, Inc. (collectively, “Executed Agreements”), including any negotiated Business Associate Agreement (“BAA”) or ToP, those Executed Agreements govern your organization’s commercial relationship with Health Universe and, in the event of any conflict with these Terms of Use, control in accordance with the order of precedence stated therein. These Terms of Use govern each individual user’s access to and conduct on the Health Universe Platform and apply to all users, including users of organizations with Executed Agreements, to the extent not inconsistent with those Executed Agreements. Nothing in these Terms of Use expands any rights granted, or limits any obligations assumed, under an Executed Agreement.

If you submit Protected Health Information (“PHI”) to the Health Universe Platform and no negotiated BAA is in effect between Health Universe and you or the organization on whose behalf you act, the Standard Business Associate Terms set forth below apply to that PHI. A negotiated BAA or Master Services Agreement, once executed, supersedes the Standard Business Associate Terms and the Data Use and De-Identified Data section of these Terms of Use with respect to the subject matter it expressly addresses, as of its effective date. De-Identified Data created before that effective date is not affected. Other than the Standard Business Associate Terms, your use of the Health Universe Platform does not create a Business Associate Agreement by implication, course of conduct, or otherwise.

Eligibility, Accounts & Acceptable Use

Eligibility

The Health Universe Platform, and the information provided through it, is intended for trained healthcare professionals and other authorized users acting within the scope of their professional roles. Certain features, including nationwide record retrieval, are available only to licensed clinicians and other authorized personnel who have completed Health Universe’s identity verification and credentialing requirements, which may include providing a National Provider Identifier (NPI), state license number, and other verification information. If you are an individually licensed clinician (for example, a sole practitioner identified by your own National Provider Identifier) accessing the Health Universe Platform on your own behalf rather than on behalf of an organization with an Executed Agreement, you are treated as the “Customer” for purposes of these Terms of Use with respect to your own access, and the Standard Business Associate Terms apply to you individually unless you execute a negotiated BAA with Health Universe. If you are an individual user who is not a healthcare provider (for example, a patient or member of the public), see “Data Handling” for how your information is handled.

Accounts

Account credentials are issued to individuals and may not be shared. You are responsible for maintaining the confidentiality of your credentials and for all activity occurring under your account. You will promptly notify Health Universe of any suspected unauthorized access to or use of your account.

Acceptable Use

You will not, and will not permit any third party to: (a) reverse engineer, decompile, disassemble, or otherwise attempt to discover source code or the underlying structure of the Health Universe Platform; (b) copy, modify, create derivative works of, resell, sublicense, lease, distribute, or otherwise exploit the Health Universe Platform except as expressly permitted under these Terms of Use or an Executed Agreement; (c) remove or obscure proprietary notices; (d) use the Health Universe Platform to build or support a competitive product or service; (e) attempt unauthorized access, scraping, automated extraction, or circumvention of access controls except as expressly approved in writing; (f) attempt to re-identify any de-identified information; (g) use the Health Universe Platform in violation of these Terms of Use, any Executed Agreement, or applicable law; or (h) use the Health Universe Platform in a manner that poses a material security risk, material patient-safety risk, or material threat to platform stability. Health Universe may suspend access if it reasonably believes such circumstances exist, and will provide prompt notice where legally and practically permitted and work in good faith to resolve the issue.

Use of Platform Information — Clinical Responsibility

The information provided by Health Universe applications and software is intended for trained healthcare professionals. The information should be used as a reference to enhance understanding of a healthcare provider’s diagnosis and treatment advice, but it should not be used as a substitute for professional medical advice. It is important to consult a healthcare provider for individual assessment and to consider all factors that may affect treatment decisions. The information provided by Health Universe, or the apps it aggregates, may not be accurate, complete, or up-to-date, so it is important to cross-reference any information, assertions or conclusions with data from other systems. Nothing in the Health Universe materials should be taken as an endorsement of any product or service. It is important to seek professional advice when making decisions about patient care.

You and your organization are solely responsible for all clinical decision-making, patient care, coding, billing, medical record content, regulatory submissions, and other clinical and operational decisions. The Health Universe Platform, including any AI-generated output, summarization, or recommendation, is a tool to support authorized workflows and does not constitute clinical, medical, legal, or regulatory advice. Outputs may contain errors or omissions, and the treating clinician retains sole responsibility for diagnosis and treatment decisions.

User Developments and Third-Party Products

The Health Universe Platform may be used to configure, deploy, or operate AI models, algorithms, integrations, workflows, prompts, applications, and similar materials developed by or for you or your organization (“Customer Developments”), and may interoperate with third-party models, software, integrations, or services (“Third-Party Products”). Health Universe makes no representation or warranty regarding, and does not endorse or validate, the fitness, accuracy, safety, regulatory compliance, or clinical appropriateness of any Customer Development or Third-Party Product, and disclaims responsibility and liability for them and their use. You are responsible for ensuring that Customer Developments comply with applicable law, including applicable FDA, ONC, and HIPAA requirements, and for complying with applicable third-party terms.

TEFCA Data Retrieval

Network Relationship and Conditions of Access

Health Universe, Inc. (“Health Universe”) participates in the Trusted Exchange Framework and Common Agreement (“TEFCA”) network as a Participant of Kno2, a Qualified Health Information Network (“QHIN”) designated under TEFCA. Customers access TEFCA Exchange through Health Universe’s Connectivity Services solely as Subparticipants, and only after executing, and for so long as they remain in compliance with, the Subparticipant Terms of Participation (“ToP”) required under the Common Agreement, together with any applicable Business Associate Agreement and Health Universe onboarding and vetting requirements. The ToP and any negotiated BAA are Addenda within the meaning of any applicable Executed Agreement and control with respect to the subject matter they expressly address. Capitalized terms used in this Section and not otherwise defined in these Terms of Use have the meanings assigned to them in the Common Agreement, the applicable Standard Operating Procedures (“SOPs”), and the ToP.

Health Universe’s connectivity to the TEFCA network, provided through its QHIN, Kno2, is made available to Customer solely for the Treatment Exchange Purpose as that term is defined under the Common Agreement and the applicable SOPs, including without limitation: (a) pre-visit or point-of-care summarization of a patient’s available medical record; and (b) retrieval of clinical information reasonably necessary to support medical necessity determinations, order validation, and clinical decision-making incident to the ordering, performance, or interpretation of a diagnostic test or other treatment activity. Health Universe does not retrieve, and Customer shall not request or use Health Universe’s TEFCA connectivity to retrieve, data from the network for Payment, Health Care Operations, research, Individual Access Services, or any other non-Treatment Exchange Purpose.

TEFCA Information Excluded from De-Identification and Commercialization

Information retrieved through TEFCA Exchange (“TEFCA-retrieved information”) is excluded from the Data Use and De-Identified Data section of these Terms of Use and from the de-identification permission in the Standard Business Associate Terms. Health Universe does not de-identify, aggregate, license, sell, or use TEFCA-retrieved information to train artificial intelligence models, and uses it only as described in this TEFCA Data Retrieval section.

Customer Representations

Customer represents and warrants that each Query submitted through Health Universe’s TEFCA connectivity is made in good faith for a bona fide Treatment activity involving the individual whose information is being requested, and Customer is solely responsible for the accuracy of that representation to the network. Customer further represents and warrants that all use of TEFCA-retrieved information within its organization is limited to authorized users acting within the scope of the Treatment Exchange Purpose and consistent with Customer’s obligations under the ToP, HIPAA, and Applicable Law.

Scope of Health Universe’s Obligations

Health Universe’s obligations with respect to TEFCA-retrieved information are limited to facilitating the underlying Treatment-purpose Query and delivering the responsive clinical data to Customer for that stated purpose, and Health Universe accesses, uses, and retains TEFCA-retrieved information solely as necessary to do so, consistent with the ToP and applicable SOPs. Once information has been retrieved and delivered to Customer in support of a Treatment activity, any subsequent access, use, retention, disclosure, or repurposing of that information by Customer is outside the scope of the Treatment Exchange Purpose for which the data was obtained, is not authorized, endorsed, or reviewed by Health Universe, and is Customer’s sole responsibility to evaluate under applicable law, including HIPAA, the TEFCA Common Agreement, and Customer’s own participation or subparticipant agreements, including the ToP. Health Universe makes no representation regarding, and disclaims all liability for, Customer’s downstream use or retention of TEFCA-retrieved information beyond the original Treatment Exchange Purpose for which it was obtained.

Vetting, Audit, and Suspension

Health Universe maintains purpose-of-use tagging, audit logging, and Subparticipant vetting consistent with its obligations as a TEFCA Participant. Health Universe may require Customer to attest to the Treatment purpose of any Query, may audit Customer’s use of the Connectivity Services, and may suspend or terminate Customer’s access to TEFCA Exchange, without liability, where Health Universe reasonably suspects that Customer has requested or used TEFCA-retrieved information for a non-Treatment purpose or otherwise in violation of the ToP, the Common Agreement, or Applicable Law.

No Liability for Non-Treatment Use

Health Universe is not liable for, and Customer assumes sole responsibility for, any access, use, retention, disclosure, or other processing of TEFCA-retrieved information outside the Treatment-vetted purposes approved under TEFCA and set forth in Customer’s executed ToP. Any such use is a material breach of these Terms of Use and of the ToP, and Customer shall be solely responsible for all consequences of such use, including any claims, penalties, corrective action plans, or network sanctions arising therefrom.

Data Handling

Health Universe’s collection, use, and disclosure of information through the Health Universe Platform is described in these Terms of Use and in the Health Universe Privacy Policy. PHI is also governed by the Standard Business Associate Terms or, where executed, a negotiated BAA, and TEFCA-retrieved information is governed by the ToP.

Your Responsibility for What You Submit. You decide whether to submit information to the Health Universe Platform. By submitting any information, including PHI, you represent and warrant that (a) you have the right to possess that information; (b) you are authorized, by law and by any organization on whose behalf you act, to submit it to Health Universe for the purposes described in these Terms of Use, including de-identification, aggregation, artificial intelligence training, and commercialization of De-Identified Data; and (c) you have provided all notices and obtained all consents and authorizations required for that submission. You are solely responsible for determining whether your submission is permitted under HIPAA, state law, your organization’s policies, and any other applicable law. Health Universe relies on these representations and has no obligation to verify them. If you are not authorized to submit information for these purposes, or do not want information used as described in these Terms of Use, do not submit it, or have your organization contact support@healthuniverse.com to execute a negotiated BAA. Any submission of information that you are not authorized to submit, or that is inconsistent with your representations in this section, is a material breach of these Terms of Use and may result in immediate suspension or termination of your access and deletion of the submitted information. Nothing in these Terms of Use waives, limits, or excuses your independent obligations under HIPAA or other applicable law.

Information That Is PHI. To the extent information you submit is PHI, including because you are a HIPAA covered entity or business associate or are acting on behalf of one, Health Universe processes it as your business associate under the Standard Business Associate Terms, unless a negotiated BAA is in effect.

Information That Is Not PHI. To the extent information you submit is not PHI, including health information you submit about yourself or about another individual with that individual’s express permission, it is handled under these Terms of Use and the Health Universe Privacy Policy. You are responsible for obtaining and honoring any permission required from the individual to whom the information relates.

Not a System of Record. The Health Universe Platform is not a system of record and is not a medical-records custodian or designated record set for any patient. Customers and users are responsible for documenting retrieved information into their own electronic health record or other system of record where required. Health Universe may purge TEFCA-retrieved information and other transient clinical data when no longer needed to provide the services, in accordance with its data retention practices, the applicable Addendum, and applicable law, and has no obligation to preserve or reproduce such information except as expressly stated in an Executed Agreement.

Data Use and De-Identified Data

(a) License to Submitted Information. You grant Health Universe a non-exclusive, worldwide, royalty-free, sublicensable license to host, copy, process, transmit, and use information you submit to or generate through the Health Universe Platform, including prompts, inputs, outputs, and uploaded files, to provide, support, secure, and improve the Health Universe Platform and to create De-Identified Data. For PHI, this license is exercised only as permitted by the Standard Business Associate Terms or an applicable negotiated BAA.

(b) De-Identification. Health Universe may de-identify information submitted to or generated through the Health Universe Platform, including PHI, in accordance with applicable law, including the de-identification standards of HIPAA where they apply. Information de-identified in accordance with HIPAA is not PHI.

(c) Aggregate and System Data. Health Universe may generate aggregated data, benchmark data, and operational, performance, availability, usage, integrity, and security data relating to use of the Health Universe Platform that does not identify you, your organization, or any individual. This data, together with de-identified information created under this section, is “De-Identified Data.”

(d) Ownership and Use of De-Identified Data. As between you and Health Universe, Health Universe owns all right, title, and interest in and to De-Identified Data. Health Universe may use, disclose, license, commercialize, and sell De-Identified Data for any lawful purpose, including to develop, train, test, validate, benchmark, and improve analytics, artificial intelligence, and machine learning models and related products and services offered to third parties, without payment or attribution to you.

(e) No Re-Identification. Health Universe will not re-identify or attempt to re-identify De-Identified Data. Health Universe will contractually require any third party that receives De-Identified Data to (i) not re-identify or attempt to re-identify any individual, and (ii) not further disclose De-Identified Data except to parties bound by equivalent restrictions.

(f) No Sale of Personal Information or PHI. Health Universe does not sell personal information or PHI in identifiable form.

(g) Exclusions. This section does not apply to (i) TEFCA-retrieved information; (ii) records subject to 42 C.F.R. Part 2, except as de-identified in accordance with that Part; or (iii) information governed by an Executed Agreement that expressly restricts de-identification or the use of De-Identified Data.

(h) Scope. This section applies to all information submitted to or generated through the Health Universe Platform under your account, whether submitted before or after your acceptance of these Terms of Use, and survives termination of your access.

Standard Business Associate Terms

These Standard Business Associate Terms apply to PHI that you submit to the Health Universe Platform when no negotiated BAA is in effect between Health Universe and you or the organization on whose behalf you act. For purposes of these terms, “Covered Entity” means you or that organization, as applicable, in its capacity as a HIPAA covered entity or business associate, and Health Universe acts as Covered Entity’s business associate or subcontractor business associate. Terms used but not defined in these Standard Business Associate Terms have the meanings given in HIPAA and its implementing regulations at 45 C.F.R. Parts 160 and 164.

1. Permitted Uses and Disclosures. Health Universe may use and disclose PHI only (a) to provide the Health Universe Platform and services requested by or on behalf of Covered Entity; (b) to de-identify PHI in accordance with 45 C.F.R. § 164.514, after which the resulting information is De-Identified Data that may be used as described in the Data Use and De-Identified Data section of these Terms of Use; (c) for the proper management and administration of Health Universe and to carry out its legal responsibilities, as permitted by 45 C.F.R. § 164.504(e)(4); (d) to provide data aggregation services relating to the health care operations of Covered Entity; and (e) as required by law. Health Universe will not use or disclose PHI in a manner that would violate Subpart E of 45 C.F.R. Part 164 if done by Covered Entity, except as permitted in clauses (b) through (d).

2. Safeguards. Health Universe will use appropriate safeguards, and will comply with Subpart C of 45 C.F.R. Part 164 with respect to electronic PHI, to prevent use or disclosure of PHI other than as permitted by these terms.

3. Reporting. Health Universe will report to Covered Entity any use or disclosure of PHI not permitted by these terms of which it becomes aware, including any Breach of Unsecured PHI as required by 45 C.F.R. § 164.410, without unreasonable delay and in no case later than sixty (60) calendar days after discovery. Health Universe will report Security Incidents of which it becomes aware, provided that this section constitutes notice of unsuccessful Security Incidents, such as pings, port scans, denial-of-service attempts, and blocked log-in attempts, for which no further notice is required.

4. Subcontractors. Health Universe will ensure, in accordance with 45 C.F.R. § 164.502(e)(1)(ii), that any subcontractor that creates, receives, maintains, or transmits PHI on its behalf agrees in writing to restrictions and conditions at least as protective as those that apply to Health Universe under these terms.

5. Individual Rights. To the extent Health Universe maintains PHI in a designated record set, which it does not ordinarily do, Health Universe will make that PHI available for access and amendment as required by 45 C.F.R. §§ 164.524 and 164.526, and will make available the information required for Covered Entity to provide an accounting of disclosures under 45 C.F.R. § 164.528. Health Universe will forward to Covered Entity any such request it receives directly from an individual.

6. Covered Entity Obligations. To the extent Health Universe carries out any of Covered Entity’s obligations under Subpart E of 45 C.F.R. Part 164, Health Universe will comply with the requirements of that Subpart that apply to Covered Entity in the performance of that obligation.

7. Books and Records. Health Universe will make its internal practices, books, and records relating to the use and disclosure of PHI available to the Secretary of Health and Human Services for purposes of determining compliance with HIPAA.

8. Covered Entity Responsibilities. Covered Entity will (a) not request that Health Universe use or disclose PHI in any manner not permitted under HIPAA if done by Covered Entity, except as permitted in Section 1; (b) notify Health Universe of any restriction on the use or disclosure of PHI that Covered Entity has agreed to that may affect Health Universe’s permitted uses; and (c) ensure that its notice of privacy practices and other disclosures permit the uses and disclosures described in these terms.

9. Term and Termination. These terms remain in effect for so long as Health Universe maintains PHI submitted by or on behalf of Covered Entity, and end with respect to future PHI upon execution of a negotiated BAA. If Covered Entity determines that Health Universe has materially breached these terms and Health Universe fails to cure the breach within thirty (30) days after written notice, Covered Entity may terminate its use of the Health Universe Platform.

10. Return or Destruction. Upon termination, Health Universe will return or destroy PHI where feasible. Where return or destruction is not feasible, Health Universe will extend the protections of these terms to that PHI and limit further uses and disclosures to the purposes that make return or destruction infeasible. De-Identified Data is not PHI and is not subject to return or destruction.

11. Authority. By submitting PHI, you represent and warrant that you are the Covered Entity or are authorized to accept these terms on its behalf. If you are not so authorized, you are personally responsible for the submission and for the representations in the Data Handling section.

Intellectual Property — Feedback

Health Universe and its licensors retain all right, title, and interest in and to the Health Universe Platform, related software, documentation, configurations, prompts, agents, templates, workflows, tools, reports, know-how, De-Identified Data, and all improvements and derivative works of the foregoing (“Health Universe IP”). Subject to these Terms of Use and any applicable Executed Agreement, you are granted a limited, non-exclusive, non-transferable right to access and use the Health Universe Platform only to the extent and for the purposes expressly stated. No rights are granted by implication, estoppel, or otherwise. If you provide suggestions, ideas, comments, or feedback regarding the Health Universe Platform, you grant Health Universe a perpetual, irrevocable, worldwide, non-exclusive, royalty-free license to use, reproduce, modify, and incorporate that feedback into its products and services, without payment obligation.

Indemnification

To the extent not governed by an Executed Agreement, you and, where applicable, the organization on whose behalf you use the Health Universe Platform will defend Health Universe against any third-party claim, demand, suit, proceeding, or governmental investigation or enforcement action arising from or alleging: (a) data or other materials provided by or on behalf of you or your organization; (b) breach of these Terms of Use or applicable law; (c) any inaccuracy in your representations regarding your right, authority, or consent to submit information to the Health Universe Platform, including under the Data Handling section and the Standard Business Associate Terms; (d) unlawful, unauthorized, or unpermitted collection, use, disclosure, transmission, or other handling of information, PHI, or other regulated personal data by you or your organization, including any use of TEFCA-retrieved information outside the Treatment Exchange Purpose; or (e) any Customer Development; and will pay damages finally awarded, civil fines or penalties finally imposed to the extent legally permissible, and amounts agreed in settlement, in each case arising from such claim. For organizations with an Executed Agreement, the indemnification provisions of that agreement govern.

No Warranty — Limitation of Liability

For organizations with an Executed Agreement, the limitation-of-liability provisions of that agreement, including its aggregate liability cap and exclusions, govern claims arising under or relating to that agreement in accordance with its order of precedence.

Suspension; Termination

Health Universe may suspend or terminate your access to the Health Universe Platform, in whole or in part, for breach of these Terms of Use, for the reasons stated in the Acceptable Use and TEFCA sections above, or where required by applicable law or network policy. For organizations with an Executed Agreement, suspension and termination of the underlying subscription are governed by that agreement.

If You Do Not Accept. Acceptance of these Terms of Use, and of any material update to them, is a condition of access. If you are an existing user and do not accept, your access to the Health Universe Platform will end. For thirty (30) days after that date, you may request an export of information you previously submitted by contacting support@healthuniverse.com, after which Health Universe may delete that information in accordance with its data retention practices and applicable law. Information you submitted before declining will not be used under the Data Use and De-Identified Data section of these Terms of Use.

Provisions that by their nature should survive termination, including intellectual property, the Data Use and De-Identified Data section, the Standard Business Associate Terms with respect to PHI Health Universe continues to maintain, confidentiality obligations, disclaimers, indemnification, and limitations of liability, survive.

Governing Law

These Terms of Use, and any dispute arising out of or relating to them, are governed by the laws of the State of Delaware, without regard to conflict-of-laws rules, and the state and federal courts located in Delaware will have exclusive jurisdiction. The United Nations Convention on Contracts for the International Sale of Goods does not apply.

Changes to These Terms

Health Universe may update these Terms of Use from time to time by posting a revised version with an updated “Last updated” date. For material changes, including changes to how Health Universe uses data, Health Universe will request your affirmative acceptance through the Health Universe Platform, and the revised terms apply once you accept them. Non-material changes take effect upon posting. If any provision of these Terms of Use is held unenforceable, it will be enforced to the maximum extent permitted and the remaining provisions will remain in effect. Failure to enforce a right is not a waiver. You may not assign these Terms of Use without Health Universe’s prior written consent. These Terms of Use, including the Standard Business Associate Terms, together with the Privacy Policy and any applicable Executed Agreements, constitute the entire agreement regarding your use of the Health Universe Platform. If you have questions about these terms, please contact us at support@healthuniverse.com.