Terms of Service

Definitions

Throughout these Terms, the following definitions apply:

• "Hipafy," "we," "us," or "our" refers to the operator of the Hipafy platform, currently operating as a registered sole trader (egyéni vállalkozó) under Hungarian law, with registered address in Hungary.
• "Customer," "you," or "your" refers to the individual or entity that has registered for, accessed, or used the Services.
• "Services" means the Hipafy web platform, compliance documentation generation tool, HIPAA training module, compliance assessment quiz, document storage features, BAA tracking functionality, and any related software, content, or support services made available by Hipafy.
• "Documentation" refers to any documents, policies, procedures, training certificates, or other materials generated by or through the Services based on Customer-provided information.
• "User" means any individual who accesses or uses the Services under a Customer account, including staff members who complete training modules.
• "Subscription" means a paid plan granting access to the Services for a defined period.
• "Customer Data" means information, data, and other content that Customer or its Users input into the Services.
• "HIPAA" refers to the Health Insurance Portability and Accountability Act of 1996, as amended, and regulations promulgated thereunder, including 45 CFR Parts 160 and 164.
• "PHI" means Protected Health Information as defined under HIPAA.
• "Agreement" means these Terms of Service, together with any applicable Order Form, Privacy Policy, and other policies incorporated by reference.

The Services

2.1 Nature of the Services

Hipafy provides software tools designed to assist healthcare practices in organising and generating compliance-related documentation. The Services include an onboarding assessment, automated document generation, a staff training module, a training completion certificate, and a dashboard for tracking Business Associate Agreements and annual review dates.

The Services are compliance documentation tools only. They are not a substitute for qualified legal counsel, professional compliance consulting, or a formal compliance program managed by a trained professional.

2.2 No Guarantee of Compliance

HIPAA compliance is a continuous operational obligation that requires ongoing management, staff training, risk management, vendor oversight, and policy enforcement. The documentation generated by Hipafy represents a starting point and reference tool — not a certification, not a determination of compliance, and not a guarantee of any regulatory outcome.

2.3 HHS and OCR Disclaimer

Hipafy is not affiliated with, endorsed by, approved by, or certified by the U.S. Department of Health and Human Services (HHS), the Office for Civil Rights (OCR), or any other governmental body. No governmental authority has reviewed, validated, or endorsed the Services or the Documentation generated thereby. Any claim to the contrary would be false.

2.4 Changes to the Services

Hipafy reserves the right to modify, update, suspend, or discontinue any aspect of the Services at any time, with or without notice. We will make reasonable efforts to notify Customers of material changes to core features. Continued use of the Services following any modification constitutes acceptance of the updated Services.

2.5 Regulatory Updates

Hipafy endeavors to update its document templates and training content when significant regulatory changes occur. However, Hipafy makes no warranty that its content reflects the most current version of any regulation at any given time. Customers are solely responsible for monitoring regulatory changes applicable to their practice and for ensuring their compliance documentation remains current. The existence of an active Hipafy subscription does not relieve the Customer of this obligation.

Accounts and Access

3.1 Account Registration

To access the Services, you must create an account by providing accurate, complete, and current information. You agree to update your account information promptly if it changes. Hipafy reserves the right to refuse registration or terminate accounts at its discretion.

3.2 Account Security

You are responsible for maintaining the confidentiality of your account credentials and for all activities that occur under your account. You must notify Hipafy immediately of any unauthorized use of your account or any other security breach. Hipafy will not be liable for any loss or damage arising from your failure to maintain account security.

3.3 Authorized Users

A Subscription grants access to a defined number of Users as specified in your plan. You are responsible for ensuring that all Users comply with these Terms. Actions or omissions by any User are deemed your actions or omissions. You must not share login credentials between multiple individuals.

3.4 Eligibility

The Services are intended for use by healthcare practices and their staff located in the United States that are subject to HIPAA. By using the Services, you represent that you are a covered entity or a business associate as defined under HIPAA, or are authorized to act on behalf of one. You represent that you are at least 18 years of age and have the legal capacity to enter into this Agreement.

Fees and Payment

4.1 Subscription Fees

Access to paid features of the Services requires a Subscription. Fees are as stated on the Hipafy pricing page at the time of purchase. Hipafy reserves the right to change its pricing with reasonable notice. Price changes will not affect your current billing period but will take effect at renewal.

4.2 Billing

Annual Subscriptions are billed in full at the start of each subscription period. Monthly Subscriptions are billed at the start of each calendar month. All fees are stated and charged in US Dollars (USD). You authorize Hipafy and its payment processor to charge your payment method on the applicable billing dates.

4.3 Taxes

Subscription fees do not include applicable taxes. You are responsible for all taxes, duties, levies, or similar governmental assessments applicable to your purchase, excluding taxes based on Hipafy's net income. If Hipafy is required to collect taxes, they will be added to your invoice.

4.4 Money-Back Guarantee

Hipafy offers a 30-day money-back guarantee on your first Subscription payment. If you are not satisfied with the Services, you may request a full refund within 30 days of your initial payment by contacting support@hipafy.com. This guarantee applies to your first payment only and is not available on renewal payments. Refunds are processed within 10 business days.

4.5 No Refunds on Renewal

Except as provided in Section 4.4 or where required by applicable law, all fees are non-refundable. If you cancel your Subscription, you will retain access to the Services until the end of your current billing period, after which access will terminate. No pro-rata refunds are provided for unused portions of a billing period.

4.6 Failure to Pay

If payment is not received by the due date, Hipafy may suspend your access to the Services. Hipafy is not liable for any loss or damage resulting from such suspension. Reactivation may require payment of all outstanding amounts.

4.7 Payment Processing

Payments are processed by a third-party payment processor (currently Stripe). Hipafy does not store your payment card information. Your use of payment processing services is subject to the terms and privacy policy of the applicable processor. Hipafy is not liable for errors or omissions by any payment processor.

Acceptable Use

5.1 Permitted Use

Subject to these Terms and payment of applicable fees, Hipafy grants you a limited, non-exclusive, non-transferable, revocable license to access and use the Services for your internal business purposes during the term of your Subscription.

5.2 Prohibited Uses

You agree not to, and not to permit any User to:

• Use the Services for any unlawful purpose or in violation of any applicable law or regulation;
• Provide false or misleading information to generate documentation, including misrepresenting the nature, size, or operations of your practice;
• Resell, sublicense, or otherwise make the Services available to third parties without Hipafy's written consent;
• Reverse engineer, decompile, disassemble, or attempt to derive the source code of the Services;
• Use automated means (bots, scrapers, crawlers) to access the Services;
• Introduce malicious code, viruses, or other harmful components into the Services;
• Attempt to gain unauthorized access to any part of the Services or related systems;
• Remove, obscure, or alter any proprietary notices, labels, or marks on the Services;
• Use the Services to store, transmit, or process actual patient PHI beyond what is minimally necessary for the assessment questionnaire;
• Use the Services in a manner that could damage, disable, overburden, or impair Hipafy's infrastructure;
• Represent to any third party, including regulators, auditors, or patients, that the Documentation generated by Hipafy has been reviewed or approved by any government authority or legal professional, unless you have independently obtained such review;
• Use the Services to facilitate fraud or to create documentation you know to be inaccurate.

5.3 Customer Responsibility for Inputs

The Documentation generated by Hipafy is only as accurate as the information you provide. You are solely responsible for the accuracy, completeness, and truthfulness of all information you input into the Services. Hipafy is not responsible for any Documentation that is inaccurate, incomplete, or unsuitable as a result of your inputs.

5.4 Professional Review Recommended

Hipafy strongly recommends that all Documentation generated by the Services be reviewed by a qualified healthcare compliance attorney or professional before being filed, presented to auditors, or relied upon for regulatory purposes. The existence of an active Subscription does not substitute for professional review.

Intellectual Property

6.1 Hipafy's Intellectual Property

The Services, including all software, content, templates, training materials, assessments, user interfaces, logos, and marks, are owned by Hipafy or its licensors and are protected by applicable intellectual property laws. Nothing in these Terms grants you any rights to Hipafy's intellectual property except as expressly set forth herein.

6.2 Your Documentation

Documentation generated by the Services based on your inputs belongs to you. Hipafy does not claim ownership of your Documentation. However, by using the Services, you grant Hipafy a limited, royalty-free license to process and store your Customer Data for the sole purpose of providing the Services.

6.3 Feedback

If you provide suggestions, feedback, or ideas regarding the Services ("Feedback"), you grant Hipafy a perpetual, irrevocable, royalty-free license to use that Feedback for any purpose, including improving the Services, without any obligation to compensate you.

6.4 HHS Source Materials

The Services reference and link to materials published by HHS and OCR that are in the public domain. Such materials belong to the U.S. government and are used for informational purposes only. Hipafy's use of public domain government materials does not imply endorsement by any government authority.

Confidentiality

7.1 Mutual Confidentiality

Each party agrees to keep the other party's confidential information ("Confidential Information") confidential and to use it only for purposes of performing its obligations under this Agreement. Confidential Information means any information designated as confidential or that reasonably should be understood to be confidential given the nature of the information and circumstances of disclosure.

7.2 Exclusions

Confidentiality obligations do not apply to information that: (a) is or becomes publicly known through no fault of the receiving party; (b) was known to the receiving party before disclosure; (c) is received from a third party without restriction; or (d) is required to be disclosed by law, provided the disclosing party is notified promptly.

7.3 Customer Data Confidentiality

Hipafy treats all Customer Data as confidential. Hipafy will not sell Customer Data to third parties, will not use Customer Data for advertising purposes, and will not disclose Customer Data except as required to provide the Services, as required by law, or with your explicit consent.

Data and Privacy

8.1 Privacy Policy

Hipafy's collection and use of personal data is governed by its Privacy Policy, which is incorporated into these Terms by reference. By using the Services, you consent to the data practices described in the Privacy Policy.

8.2 Customer Data

You retain ownership of your Customer Data. Hipafy processes Customer Data only as necessary to provide the Services and in accordance with your instructions and the Privacy Policy. You are responsible for ensuring that your Customer Data does not violate any applicable law or third-party rights.

8.3 No PHI Storage

Hipafy's Services are designed to collect practice-level operational information (such as your EHR vendor, staff count, and communication practices) and do not require the input of actual patient PHI. You must not input actual patient records, clinical notes, diagnosis information, or other patient-specific PHI into the Services beyond what is strictly necessary to complete the assessment questionnaire. Hipafy is not designed or intended to serve as a repository for patient PHI.

8.4 GDPR and International Data

Hipafy operates from Hungary and may process data subject to the EU General Data Protection Regulation (GDPR). Where applicable, Hipafy processes personal data in accordance with GDPR requirements. For details of the legal bases for processing and your rights as a data subject, please refer to the Privacy Policy.

8.5 Security

Hipafy implements reasonable technical and organizational measures to protect Customer Data. However, no security system is impenetrable, and Hipafy cannot guarantee absolute security. You are responsible for maintaining the security of your account credentials and for ensuring that your own systems used to access the Services are secure.

8.6 Data Retention and Deletion

Upon termination of your Subscription, Hipafy will retain your Customer Data for a period of 30 days, after which it may be deleted. You are responsible for exporting and retaining copies of your Documentation and other data before your Subscription terminates. Hipafy is not liable for any data loss following the retention period.

No Legal Advice — Software Tool Only

9.1 Not a Law Firm

Hipafy is a software company, not a law firm. Hipafy does not provide legal services, legal advice, or legal representation. No attorney-client relationship is created between you and Hipafy by virtue of your use of the Services or by any communication with Hipafy staff. Nothing in the Services, the Documentation, the training content, the assessment results, or any other output of the Services constitutes legal advice.

9.2 Not a Compliance Certification

Completion of the Hipafy assessment, receipt of a compliance score, generation of Documentation, completion of the training module, or receipt of a training certificate does not constitute a certification, audit, determination, or finding of compliance with HIPAA or any other law. Hipafy does not audit your practice, verify your representations, or determine whether you are actually compliant with applicable law.

9.3 Customer Responsibility

You remain solely and entirely responsible for your own HIPAA compliance. This includes, without limitation: conducting your own risk assessments, implementing appropriate administrative, physical, and technical safeguards, training your workforce, managing your business associate relationships, responding to breaches, and meeting all other obligations imposed on covered entities and business associates under HIPAA. The Services assist you in creating documentation related to these obligations; they do not fulfill those obligations on your behalf.

9.4 Consult a Professional

Hipafy strongly recommends that you consult a qualified healthcare compliance attorney or a licensed healthcare compliance professional before relying on the Services or the Documentation for regulatory purposes, before responding to any regulatory inquiry or audit, before entering into or amending Business Associate Agreements, and whenever you have questions about your specific legal obligations.

9.5 Document Accuracy Dependent on Your Inputs

The Documentation generated by Hipafy reflects the information you provided during the assessment process. If that information is inaccurate, incomplete, or out of date, the resulting Documentation will be similarly deficient. You are responsible for reviewing all generated Documentation for accuracy before use.

9.6 Regulatory Changes

HIPAA regulations and HHS guidance evolve over time. Hipafy makes reasonable efforts to update its content in response to significant regulatory changes, but cannot guarantee that all content reflects the most current regulatory requirements at all times. You are responsible for monitoring regulatory developments and ensuring your compliance program accounts for current requirements.

Warranties and Disclaimers

10.1 Customer Warranties

You represent and warrant that: (a) you have the legal authority to enter into this Agreement; (b) your use of the Services will comply with these Terms and all applicable laws; (c) all information you provide to the Services is accurate and complete to the best of your knowledge; and (d) you will not use the Services to facilitate any violation of applicable law.

10.2 Hipafy's Disclaimer of Warranties

10.3 Third-Party Services

The Services may reference or integrate with third-party services, including EHR vendors, payment processors, and email providers. Hipafy makes no warranties regarding any third-party services and is not responsible for their performance, availability, or compliance.

Limitation of Liability

Some jurisdictions do not allow the exclusion or limitation of certain damages. In such jurisdictions, Hipafy's liability will be limited to the fullest extent permitted by applicable law.

Indemnification

12.1 Customer Indemnification of Hipafy

You agree to indemnify, defend, and hold harmless Hipafy and its officers, directors, employees, agents, and successors from and against any and all claims, damages, liabilities, costs, and expenses (including reasonable legal fees) arising out of or relating to: (a) your use of the Services in violation of these Terms; (b) the inaccuracy of any information you provided to the Services; (c) your actual HIPAA compliance or non-compliance; (d) any regulatory investigation, audit, or enforcement action involving your practice; (e) any claim by a patient, employee, or third party arising from your practice's operations; or (f) your violation of any applicable law.

12.2 Indemnification Procedure

Hipafy will notify you promptly of any claim subject to indemnification. You will have the right to assume control of the defense of such claim, provided that Hipafy may participate at its own expense and that you may not settle any claim that imposes liability or obligations on Hipafy without Hipafy's prior written consent.

Term and Termination

13.1 Term

This Agreement begins when you first access the Services and continues until your Subscription expires or is terminated in accordance with these Terms.

13.2 Termination by You

You may cancel your Subscription at any time through your account settings or by contacting support@hipafy.com. Cancellation takes effect at the end of the current billing period. You will retain access to the Services until the end of the period for which you have paid.

13.3 Termination by Hipafy

Hipafy may suspend or terminate your access to the Services immediately, with or without notice, if: (a) you breach any material provision of these Terms and fail to cure such breach within 14 days of written notice; (b) you engage in prohibited uses as described in Section 5.2; (c) continued provision of the Services would violate applicable law; or (d) your Subscription payment fails and is not remedied within 10 days.

13.4 Effect of Termination

Upon termination: (a) all licenses granted to you will immediately terminate; (b) you must cease all use of the Services; (c) Hipafy will retain your data for 30 days as described in Section 8.6. The following Sections survive termination: Sections 1, 4.5, 6.1, 6.3, 7, 9, 10, 11, 12, 13.4, 15, and 16.

Modifications to These Terms

Hipafy reserves the right to modify these Terms at any time. We will provide notice of material changes by: (a) posting the updated Terms on the Hipafy website with a new effective date; and (b) where reasonably practicable, notifying you by email at the address associated with your account at least 14 days before the changes take effect.

Your continued use of the Services after the effective date of any modification constitutes acceptance of the updated Terms. If you do not agree to the updated Terms, you must stop using the Services and cancel your Subscription before the effective date.

For material changes that adversely affect your rights, you may terminate your Subscription within 30 days of notice and receive a pro-rata refund of any prepaid, unused fees.

Governing Law and Disputes

15.1 Governing Law

These Terms are governed by the laws of Hungary, without regard to its conflict of law principles, except where mandatory consumer protection laws of another jurisdiction apply to you.

Notwithstanding the foregoing, where a dispute arises from the use of the Services by a Customer located in the United States, the parties agree that US federal law applicable to internet-based services may also apply, and both parties submit to the non-exclusive jurisdiction of courts in Hungary and the state in which the Customer is located.

15.2 Informal Resolution

Before initiating any formal legal proceeding, you agree to contact Hipafy at legal@hipafy.com and attempt to resolve the dispute informally for a period of 30 days. Hipafy will similarly attempt to resolve disputes informally before pursuing formal action.

15.3 Formal Disputes

If informal resolution fails, disputes arising out of or relating to these Terms or the Services may be submitted to the courts of competent jurisdiction in Hungary. Where Customer is a US-based entity, disputes may alternatively be resolved in the state courts of the Customer's state of principal business, subject to mutual agreement.

15.4 Limitation Period

Any claim or cause of action arising from or relating to the Services must be filed within one (1) year after the cause of action arose, or it will be permanently barred.

General Provisions

16.1 Entire Agreement

These Terms, together with the Privacy Policy and any applicable Order Form, constitute the entire agreement between you and Hipafy with respect to the Services and supersede all prior agreements, understandings, representations, and negotiations, whether written or oral.

16.2 Severability

If any provision of these Terms is found to be invalid, illegal, or unenforceable, that provision will be modified to the minimum extent necessary to make it enforceable, and the remaining provisions will continue in full force and effect.

16.3 Waiver

Hipafy's failure to enforce any right or provision of these Terms does not constitute a waiver of that right or provision. Any waiver must be in writing and signed by an authorized representative of Hipafy.

16.4 Assignment

You may not assign or transfer these Terms or any rights hereunder without Hipafy's prior written consent. Hipafy may assign these Terms or any rights hereunder without your consent in connection with a merger, acquisition, or sale of all or substantially all of its assets. Any attempted assignment in violation of this section is void.

16.5 Force Majeure

Neither party will be liable for any failure or delay in performance caused by circumstances beyond its reasonable control, including acts of God, natural disasters, government actions, internet outages, or pandemic-related disruptions.

16.6 No Third-Party Beneficiaries

These Terms do not create any third-party beneficiary rights. No patient, employee, regulator, or other third party has any rights under these Terms.

16.7 Language

These Terms are written in English. In the event of any conflict between an English version and any translated version, the English version shall prevail.

16.8 Export Controls

You represent that you are not located in a country subject to a U.S. government embargo and are not listed on any U.S. or EU government list of prohibited parties. You agree to comply with all applicable export control laws in your use of the Services.

16.9 Electronic Communications

By using the Services, you consent to receive communications from Hipafy electronically, including by email and in-app notifications. You agree that electronic communications satisfy any legal requirement that communications be in writing.

16.10 Headings

Section headings are for convenience only and do not affect the interpretation of these Terms. The word "including" means "including without limitation."

Contact Information

For questions about these Terms, to exercise your data rights, or to report a concern, contact Hipafy at:

• Email: legal@hipafy.com
• Support: support@hipafy.com
• Website: hipafy.com

Hipafy operates as a registered sole trader (egyéni vállalkozó) under the laws of Hungary. Legal notices should be sent by email to legal@hipafy.com with the subject line "Legal Notice — Terms of Service."