Practice Service Terms

1. Parties and agreement

These terms are between Expy LLC, located at business address to be added ("MedTap"), and the legal practice identified in the accepted order ("Practice"). They become effective when Practice's authorized representative affirmatively accepts these terms and the accompanying Business Associate Agreement through MedTap's registration process, or when both parties sign them.

The agreement consists of these terms, the version of the BAA identified in the acceptance record, and the accepted order describing features, term, price, and service start date. The BAA controls any conflict concerning protected health information. An order changes these terms only where it expressly identifies a change accepted by both parties. MedTap's privacy notice explains data handling and does not expand the PHI uses allowed by the BAA.

The representative confirms authority to bind the identified Practice. Each separately contracting legal entity must be identified in an agreement; an employee's personal account or an unidentified affiliated clinic is not automatically covered.

2. Service and pilot limits

MedTap provides electronic patient intake collection, authorized practice access, and intake export for the features specified in the order. The initial pilot is limited to adult patients acting for themselves and the approved practice workflow. Any demonstration workspace uses fictional information only. Real patient information may be entered only after MedTap confirms live activation for Practice.

MedTap provides software, not medical care, emergency monitoring, diagnosis, medical advice, or guaranteed insurance coverage. Practice remains responsible for clinical decisions, reviewing intake before relying on it, correcting errors, and incorporating records into its clinical record system. An intake submission does not by itself confirm an appointment, treatment, payment, or filing in an EHR.

The service includes the patient's own MedTap record, which a patient may reuse to complete intake at another participating practice at the patient's direction. Practice's access is to the intake it receives. Features such as eligibility, OCR, family access, and messaging are included only if specifically enabled under an updated order and appropriate safeguards. An experimental feature must be identified before Practice uses it.

3. Accounts and Practice responsibilities

Practice will provide accurate organization and billing details, appoint an authorized administrator and privacy contact, and restrict staff access to legitimate duties. Each staff member uses an individual account and completes the required security setup. Practice will promptly remove access when duties or employment change, protect devices and exports, and notify MedTap of suspected compromised access.

Practice is responsible for the legal basis for collecting and disclosing its patient information, for its own Notice of Privacy Practices, and for the clinical forms and instructions it supplies. Practice will not request a use or disclosure contrary to applicable law or the BAA. MedTap remains responsible for its own obligations; Practice's responsibilities do not excuse MedTap's failures.

Practice will use the approved pilot workflow and maintain an assisted or existing intake alternative if a patient cannot or chooses not to use the app. Practice must not upload data from excluded workflows without arranging appropriate support first.

4. Patient information and confidentiality

Practice retains its rights in information submitted by or for Practice, subject to patients' rights under applicable law. Practice grants MedTap only the limited right to process that information to perform the agreed service and as permitted by the BAA. No ownership transfer or general resale, advertising, or model-training license is granted.

Each party will protect the other's nonpublic business information using reasonable care, use it only for this relationship or as required by law, and disclose it only to persons with a need to know and confidentiality duties. This obligation does not cover information independently developed, lawfully received without restriction, already lawfully known, or publicly available through no breach. PHI remains governed by the BAA regardless of these business-information exceptions.

The patient's own MedTap record is held under Expy LLC's separate agreement with the patient. Practice's rights under this section do not extend to it, and a patient's continued use of MedTap after Practice's agreement ends is not a use of Practice's information.

MedTap may use service providers to deliver the service. It remains responsible for applicable subcontractor arrangements and for its own obligations. The current provider list is available at our service provider list. PHI processing is limited by the BAA, including when a provider changes.

5. Security, support and service changes

MedTap will apply the safeguards and assistance required by the BAA and maintain reasonable administrative, technical, and physical protections appropriate to the service. Practice will follow the account and device security requirements presented during setup. Neither party guarantees that every incident can be prevented.

Support is available at support@expymed.com during the hours disclosed in the order. Urgent security reports go to security@expymed.com. No uptime percentage, resolution time, or 24-hour ordinary support commitment applies unless expressly stated in the order. The BAA's reporting obligations apply independently of ordinary support hours.

MedTap may maintain and improve the service. It will give reasonable advance notice of a change that materially reduces an agreed paid feature, except when immediate action is needed for security or law. If the resulting service materially fails to match the order and MedTap cannot reasonably restore it, Practice may end the affected service and receive the unused prepaid fees for it.

6. Pilot, fees and cancellation

The order must identify whether this is a free pilot or paid service. A free pilot ends on the date stated in the order and does not automatically become a paid subscription. Practice must affirmatively accept a paid order before charges begin.

For paid service, the checkout/order states the total price, applicable taxes, billing interval, initial charge date, renewal arrangement, and cancellation method. The offer is a single flat fee per location for everything enabled under the order: there is no per-use charge, no usage allowance and no overage. A feature that carries a per-use cost is not part of the base fee and must be priced in an updated order before it is enabled. MedTap will not add an undisclosed charge or convert a pilot by treating silence as acceptance.

Under the proposed monthly offer, Practice may cancel future renewal through Legal & Billing or by contacting support@expymed.com. Cancellation takes effect at the end of the current paid period unless the parties agree otherwise. Already used service fees are not refunded solely because of cancellation; unused prepaid fees are returned when MedTap ends paid service without Practice's material breach, or as otherwise required by this agreement or law. There is no early termination fee under this proposed offer.

MedTap will give at least 30 days' notice of a price increase before the first renewal to which it applies and let Practice cancel before that renewal. Any different commercial offer must be clearly stated in the accepted order. This proposed billing language must be checked against the actual launch jurisdiction and implemented payment flow.

7. Suspension and ending the service

MedTap may restrict access as reasonably necessary to address a security threat, unlawful use, or material breach. It will give notice and a reasonable opportunity to resolve the issue when doing so is safe and lawful. Restrictions should be proportionate; safe record access and transition assistance must be considered separately from new intake or staff permissions.

Either party may end the agreement for a material breach not cured within 30 days after written notice, or immediately if the breach cannot be cured or continued service presents an urgent legal or security risk. Practice's rights to terminate for a material BAA violation are not limited by this cure period. MedTap may end a free pilot on reasonable notice and will coordinate the return of any live pilot records.

Practice may request export during service and on termination. The order will specify a practical export/transition window of 60 days and supported export formats. Records will be returned or destroyed as the BAA requires. Cancellation does not immediately erase medical records or extinguish patient rights. MedTap will explain any lawful retention exception and protect retained information; it will not hold PHI hostage to a payment dispute.

8. Responsibility and disputes

Each party remains responsible for its own acts, omissions, and applicable legal obligations. No provision waives rights or remedies that applicable law prohibits waiving, and this section does not limit either party's own obligations under applicable law.

Neither party is liable to the other for indirect, incidental, special, consequential, or punitive damages, or for lost profits or lost revenue, arising out of this agreement.

Except for the matters listed below, each party's total liability arising out of this agreement is limited in the aggregate to the greater of the fees paid or payable by Practice under the accepted order in the twelve months before the event giving rise to the claim, or $5,000. The floor matters during a free pilot, when the fee figure would otherwise be zero.

A higher limit applies to a party's breach of its confidentiality obligations, and to MedTap's breach of the BAA or of its safeguards for protected health information: for those matters each party's total liability is limited in the aggregate to the greatest of three times that twelve-month figure, $50,000, or the proceeds actually available to the liable party under any applicable insurance then in force. Tying the upper limit to insurance actually held means the commitment rises with the cover rather than promising a figure that cannot be funded.

No limit in this section applies to a party's fraud or willful misconduct, to amounts owed under the accepted order, or to a liability that applicable law does not permit to be limited. These terms create no duty for Practice to indemnify MedTap, and no dispute under them is subject to mandatory arbitration.

The parties will first try to resolve an ordinary contract dispute through their designated contacts. That process does not delay urgent protective relief, mandatory reporting, patient rights, or termination authorized by the BAA. Governing law and court venue are Idaho law, and the state and federal courts located in Idaho, subject to mandatory applicable law. These fields must be resolved before acceptance.

9. Notices and revisions

Practice's legal and incident contacts are those shown in its organization settings and acceptance record. MedTap's legal contact is legal@expymed.com. Each party must keep its contacts current. Sensitive incident details will use an appropriate secure channel.

MedTap will preserve the accepted versions and make copies available to Practice. Posting a new version alone does not rewrite a previously accepted BAA. Material contract changes require notice and affirmative acceptance by an authorized Practice representative before they apply, unless applicable law requires a change independently. The parties will cooperate on amendments needed for legal compliance.

If a provision is unenforceable, the remaining terms continue to the extent permitted by law. Neither party may assign this agreement in a way that avoids its confidentiality or PHI duties; any permitted successor must assume the applicable obligations. These terms do not create clinical authority or a partnership between the parties.

Acceptance record supplied by the service

Practice legal name and address; representative's name, title and verified account; confirmation of authority; order ID and offer; exact terms and BAA version IDs; document hashes; timestamp; affirmative electronic action; downloadable accepted copies. MedTap's standing offer is made in its legal entity name and the record identifies both parties.

A dashed placeholder marks a detail that is not settled yet. Questions: support@expymed.com