Zus Terms of Service
Last Updated November 6, 2026
These Zus Terms of Service, the Zus Policies, the Zus BAA, and any other policies, terms or conditions which apply to the Zus Services and the Zus Platform (the “Zus Terms” or “Terms”) govern your access to and use of the Zus Services and Zus Platform. “You,” “your,” and “Customer” mean you and your Affiliated Legal Entity. Please read these Zus Terms carefully because they are a binding agreement between you and Zus Health, Inc. (“Zus,” “our,” “us,” or “we”). Zus and Customer are each a “Party” and together the “Parties.”
YOUR USE OF THE ZUS SERVICES OR THE ZUS PLATFORM CONSTITUTES ACCEPTANCE OF THE ZUS TERMS. IF YOU DO NOT AGREE TO THE ZUS TERMS, DO NOT USE THE ZUS SERVICES OR THE ZUS PLATFORM.
Capitalized terms not otherwise defined have the meaning provided in Section D below.
A. GENERAL TERMS
1. Zus Platform and Order Form
The Zus Platform enables you to access and use one or more Zus Services, such as access to the Zus Network, as specified in an Order Form. The Zus Network may include access to and use of Zus’ Common Patient Record, data sharing with third parties under a Third-Party Framework, and access to and use of other third-party products. We may also provide other data processing, usability, or analytic services.
2. Services and Obligations
a. Right to Use the Services. Subject to the Zus Terms, Zus grants Customer a non-exclusive, non-transferable (except as permitted in accordance with Section 15(h)), non-sublicensable, royalty-free, revocable, limited right during the Term to access and use in the United States the Zus Services set forth in an executed Order Form for the Permitted Purposes applicable to Customer. We may further restrict this right based on the nature of the Zus Service, Applicable Law, or the requirements of a Third-Party Service Provider or Third-Party Framework.
b. Data Hosting and Monitoring. We host the Common Patient Record and other software to provide the Zus Services as may be further described in an Order Form. We do not: review Health Data for accuracy or completeness before or after making the data available through the Zus Services. You are solely responsible for the confidentiality, integrity, accessibility, and security of all data and information you maintain on your own or in other licensed systems.
c. Service Levels. Except as otherwise provided in these Zus Terms, we will provide the Zus Platform in accordance with the uptime commitment set forth in the Zus Services SLA. We may modify the SLA in our sole discretion, and any modification will be effective upon posting to https://zushealth.com/zus-service-level-agreement/; provided, however, that no modification will materially reduce the overall level of service availability or performance made available to Customer during the then-current Term. Any Service Credits set forth in the SLA are your sole and exclusive remedy for our failure to achieve the uptime commitment. You acknowledge and agree that: (i) we may suspend access to the Zus Services, or temporarily degrade performance, for planned or unplanned maintenance, upgrades, improvements, or other reasons; (ii) we may suspend or discontinue use of any Application that negatively impacts the Zus Services, including suspending the Application’s access for the time needed to resolve the negative impacts; (iii) the Zus Services may be temporarily unavailable or interrupted for other reasons, including if Zus reasonably believes that doing so will substantially reduce a risk of harm to a person or is necessary to mitigate a security risk; and (iv) during any suspension, unavailability, or interruption, you are responsible for conducting normal operations without access to, or full use of, the Zus Services.
d. Changes to the Zus Terms and Zus Services.
i. We may make changes to the Zus Terms from time to time. Unless we note otherwise, changes to the Zus Terms become effective 30 days after they are posted. Notwithstanding the foregoing, we may make changes to the Zus Terms effective immediately to comply with Applicable Law or as necessary to support new functionality. Notwithstanding the foregoing, in the case of changes to the Zus BAA, we may only make changes if permitted by HIPAA or Applicable Law, which will take effect 90 days after they are posted. If you do not accept the changes to the Zus Terms, you must stop using the Zus Services and the Zus Platform.
ii. We may change the features and functionality of the Zus Services from time to time, including the Documentation; however, we will not materially decrease the overall functionality of the Zus Services. You are responsible for ensuring that you are using, and that your Application(s) are compatible with, the then-current version of the Zus Services and Documentation. We will try to avoid changes that are not backwards-compatible; however, if such changes are necessary, we will use commercially reasonable efforts to notify you at least sixty (60) calendar days before implementation.
e. Subcontractors. We may contract with Subcontractors to maintain, operate, or provide the Zus Services. We will be responsible for the performance of our Subcontractors when performing any Zus Services under these Zus Terms, as if Zus had directly performed such Zus Services.
f. Third-Party Service Providers. You acknowledge that we may provide you with the opportunity to access or use services or products provided by Third-Party Service Providers that are not Zus Subcontractors in connection with the Zus Services. You understand that you and your Users may be required to accept the terms and conditions governing the use of such Third-Party Service Providers’ products and services (“Third-Party Product Terms”). Zus is not responsible or liable for any products or services of Third-Party Service Providers or for their acts or omissions.
3. Zus Policies
a. Zus Policies. Zus has established Zus Policies that govern the activities of Zus and Participants with respect to the Zus Services, including the Permitted Purposes. The Zus Policies are accessible at https://docs.zushealth.com/docs/intro-to-zus.
b. Changes to the Zus Policies. We may change the Zus Policies from time to time. Unless we note otherwise, changes become effective thirty (30) calendar days after posting. Notwithstanding the foregoing, we may make changes effective immediately to comply with Applicable Law or support new functionality. If you do not accept changes to the Zus Policies, you must stop using the Zus Services.
4. Customer Obligations; Representations; Conditions of Use
a. Account Terms.
i. Customer Account Creation. You must create an Account to use the Zus Services. Account registration requires participation in Zus’ Vetting Process described in Section 4(a)(ii) below and compliance with all relevant Zus Policies and processes for onboarding and verification of identity, authority, and qualification for the Permitted Purposes.
ii. Vetting Process. Before or during your use of the Zus Services (in whole or in part), we may require you to participate in our Vetting Process. This process may include requests for information about you, your Users, and, if applicable, the services you provide to Users. You authorize our Third-Party Service Providers and other third parties to disclose, and us to retrieve, information about you and your Users. For more details regarding the personal information we may collect, use, disclose, process, and store about you and your Users, please read our Zus User Privacy Policy. Our requests may include your name, address, and other data about you, your representatives, and your Users.
iii. Keeping Your Account Current. You agree to keep your Customer Account information current. You must promptly update your Customer Account for any changes to your Affiliated Legal Entity or your provision of services.
b. Customer Representations.
You represent and warrant to Zus that:
i. you have the authority to bind your Affiliated Legal Entity to the Zus Terms.
ii. the Participant Type, Permitted Purpose, and other information you provide to us during the Vetting Process are true, complete, correct, and accurate in all material respects.
iii. you and your Users will access and use the Zus Services, Health Data made available through the Zus Services, and third party products only for the Permitted Purposes applicable to your Participant Type and only as permitted by Applicable Law.
iv. you will only access the minimum amount of Health Data through the Zus Services as necessary to fulfill the applicable Permitted Purpose.
v. your Application(s), your Customer Documentation, and your and your Users’ use of the Zus Services comply with the Zus Terms and Applicable Law in all material respects.
vi. you have provided to us, and will continue to provide to us, any Zus Opt Outs you receive from Individuals; and
vii. you have obtained, and will continue to obtain, any Consents that may be required by Applicable Law for use or disclosure of any Customer Data and any other Customer Content with or through the Zus Services.
c. Conditions of Use.
i. Other Access Requirements for Health Data. You may access Health Data through the Zus Services only if all of the following requirements have been met: (A) you have successfully completed the Vetting Process; (B) you have an Established Relationship with the Individual for whom you are requesting access to Health Data; (C) you access the Health Data only for Permitted Purposes applicable to Customer’s Participant Type; and (D) you meet all of your obligations under these Zus Terms.
ii. Compliance. You agree to be bound by the Zus Policies and Documentation applicable to you, including any technical specifications, Permitted Purpose requirements, and Applicable Law.
iii. Third-Party Frameworks. If you access or use the Zus Services to connect with or otherwise use a Third-Party Framework, you agree to comply with the Third-Party Product Terms set forth in .
iv. Customer Data Requirements. You must comply with the minimum requirements for participating in, contributing, supplying, sending, and sharing Health Data to receive and benefit from the Zus Network, including making Customer Data available to Zus in accordance with the scope, format, and specifications set forth in the Documentation, Zus Policies, and these Zus Terms. You will: (A) provide sufficient individual identifiers, as defined by Zus, to permit Zus to match Customer Data with other Health Data; (B) use reasonable and appropriate efforts to ensure all Customer Data is accurate, complete, true, and current, promptly correct discovered inaccuracies or errors in the Customer Data, and provide accurate directory and record locator information, including accurate API endpoints and facility and provider information; and (C) be solely responsible for determining which Health Data is integrated into your systems, medical records, and designated record set(s).
d. Usage Limitations. You will use the Zus Services in accordance with any usage limits in the Order Form. You may not allow or enable your Users to use the Zus Services to access any Health Data for Individuals for whom you or they do not have an Established Relationship for one or more Permitted Purposes applicable to your or their Participant Type. If you cease to maintain such a relationship with an Individual, you must immediately remove that Individual from your Member File and send us an updated Member File.
e. Your Application. You are solely responsible for delivering your Application to your Users. We have no liability or responsibility to you or your Users with respect to the delivery, performance, or availability of your Application (subject to our responsibilities under Section 2(c) above), or the Application’s compliance with Applicable Law.
f. Prohibited Content and Activities.
i. Prohibited Content. You may not use the Zus Services (and will not permit any third party or Users) to upload, transmit, host, execute, or store content or communications that are: (A) false, inaccurate, or intentionally deceptive, including content likely to adversely affect the public interest (such as public health or safety); (B) infringing, including content that infringes a third party’s proprietary or intellectual property rights (e.g., patent, copyright, trademark, trade secret, or right of publicity) under Applicable Law; (C) libelous, defamatory, fraudulent, or inappropriate, including content that is sexually obscene, discriminatory, or abusive to any individual or group or that promotes or glorifies violence; or (D) unlawful or illegal, including content involving computer hacking, malware, phishing, illegal export of controlled substances or illegal software, or that contains any material, products, or services that violate or encourage conduct that would violate any criminal laws, other Applicable Laws, or third-party rights.
ii. Prohibited Activities. You may not use the Zus Services (and will not permit any third party or User) to: (A) falsify your identity or the origin of any data or communications; (B) interfere with or negatively impact the Zus Services, Zus, or any third-party networks accessible through the Zus Services; (C) reverse engineer, copy, disassemble, decompile, or reframe any portion of the Zus Services or Documentation in a manner inconsistent with the Documentation; (D) bypass, probe, scan, or test any security mechanism, filtering capability, or system limit of the Zus Services or related systems or networks; (E) transmit any virus, malware, or other harmful code, or use bots or other automated means to access the Zus Services; (F) attempt to gain unauthorized access to the Zus Services or any connected system or application; (G) disrupt, disable, or overload the Zus Services, including by any denial of service (DoS) attack; (H) remove any proprietary rights or warning notices from any part of the Zus Services, Documentation, or related materials; (I) use any API except those identified for Participant use in the Documentation; (J) modify, translate, copy, or create derivative works based on the Zus Services; or (K) license, sublicense, sell, resell, rent, lease, transfer, assign, distribute, time share, or otherwise commercially exploit or make the Zus Services available to any third party, other than to your Users as expressly permitted under Section 2(a).
iii. Investigation, Enforcement and Reporting. We may investigate any suspected violation of these Zus Terms and remove or disable access to any content or resource that violates them. You agree to cooperate with us to remedy any violation. Without affecting any other remedies available to us, we may permanently or temporarily terminate or suspend your account or access to the Zus Services without notice or liability if Zus, in its sole discretion, determines that you have violated Section 4(d) of these Zus Terms. To report any violation of these Zus Terms, please email legal@zushealth.com.
g. Your Users.
i. Designation. You are responsible for identifying, registering, approving, and designating each of your Users, and notifying Zus as required by the Documentation or Zus Policies. You must not allow any third party (other than your Users) to access or use the Zus Services without Zus’ prior written agreement.
ii. Identity, Authority, and Access Controls. You will verify the identity and authority of your Users and ensure that only individuals who meet your requirements and the applicable requirements of these Zus Terms may access your Application and any Health Data accessible through the Zus Services.
iii. Your Users. You are responsible for ensuring that your Users comply with all relevant provisions of these Zus Terms, Documentation, Zus Policies, and Applicable Law when using the Zus Services.
iv. Attribution; Responsibility for Conduct. You are responsible for all acts and omissions of your Users and all others who access or use the Zus Services either through you or by use, lawfully or unlawfully, of any credential, login, password, or other security token of any of your Users. You further agree that the unique credentials associated with each User will be kept secure and are sufficient to verify that a particular User took the action associated with the use of those credentials.
v. Training. You must conduct, and provide confirmation of, training for your Users, as appropriate, to ensure that access to and use of the Zus Services and any data by those Authorized Users complies with these Zus Terms and Applicable Law.
h. Expansion of Services. If, at any time, you: (i) have a change in control or assignment (subject to Section 15(h)); (ii) add, acquire, divest, or otherwise obtain a majority interest in additional facilities, locations, or entities; (iii) modify Users beyond the number permitted for a Zus Service as specified in one or more Order Forms; (iv) experience a significant increase or decrease in the number of your patients; or (v) make or experience changes that impact the assumptions used to calculate Fees in an Order Form (collectively, a “Change Event”), then you must immediately notify us of the Change Event. You acknowledge and agree that if there is a Change Event, we may either adjust the Fees to account for it or refuse to provide the Zus Services beyond the scope of the original Order Form(s).
5. Evaluation Tools
a. Use of the Developer Sandbox. You may use our Sandbox Environment for testing, demonstration, or evaluation purposes. The Sandbox Environment is governed by separate Developer Sandbox Terms of Service (“Sandbox Terms”). The Sandbox Terms are incorporated into these Zus Terms and will remain in effect for the Term of the Zus Services; provided, however, that the Sandbox Terms may be modified or updated unilaterally by Zus in accordance with any amendment provisions in the Sandbox Terms, and no written amendment to these Zus Terms signed by both Parties will be required to give effect to any such modification or update. Your use of the Sandbox Environment is limited to Test Data (as defined in the Sandbox Terms), even when you are using Zus Services in production.
b. Beta Features. From time to time we may provide you with access to features, functionality, products, or services that are not yet generally available, including those designated as “beta,” “early-release,” “preview,” “limited availability,” “experimental,” “proof of concept (POC)," or similar (“Beta Releases”). We may modify, suspend, discontinue, or terminate your access to any Beta Release at any time without notice or liability. By accessing or using any beta release, you acknowledge and agree that: (i) Beta Releases are provided “AS IS,” “AS AVAILABLE,” and “WITH ALL FAULTS,” with no warranty of any kind, and Zus disclaims all express and implied warranties, including merchantability, fitness for a particular purpose, and non-infringement; (ii) Beta Releases may be unstable, incomplete, or contain errors, and may change in ways that are not backwards-compatible or that cause loss of data or functionality; (iii) the SLA, uptime commitments, support obligations, and other service level commitments in these Zus Terms, Documentation, or Zus Policies do not apply to Beta Releases; (iv) we have no liability, and no obligation to indemnify, defend, or hold harmless any party, in connection with any Beta Release or your use thereof; and (v) we have no obligation to make any Beta Release generally available.
6. Data Rights, Privacy and Security
a. Customer Data.
i. Rights in Customer Data. You retain all right, title, and interest (including any intellectual property rights) in and to the Customer Data. You represent, warrant, and covenant that you have all necessary consents, authorizations, acknowledgments, or other permissions (collectively, “Consents”) required by agreement and Applicable Law for you to grant the Data Use Rights (defined below). You are solely responsible for maintaining such Consents for at least six (6) years after their last use or expiration date, whichever occurs later. You must immediately notify us if Applicable Law prohibits, limits, or otherwise restricts the Data Use Rights given below.
ii. Use. Subject to Applicable Law and these Zus Terms, including the Zus BAA (found at https://zushealth.com/zus-business-associate-addendum/), you grant Zus during the Term a royalty-free, fully paid-up, non-exclusive, non-transferable (except as permitted by Section 15(h)) right to request, access, receive, use, copy, store, process, send, transmit, aggregate, display, disclose, create derivative works from, and engage in substantially similar activities with Customer Data: (A) for the proper management, operation, and administration of the Zus Services; (B) to provide Zus Services to Participants; (C) to evaluate, audit, improve, and develop the Services, including compiling Usage Data in the ordinary course of providing the Zus Services; and (D) as otherwise permitted by you in writing (collectively, the “Data Use Rights”). To the extent we retain any Customer Data after termination of these Terms, these use permissions will be perpetual and irrevocable. We will continue to follow the provisions of these Zus Terms, including the Zus BAA, with respect to such Customer Data.
iii. Artificial Intelligence. You acknowledge and agree that these Data Use Rights include permission for us to: (A) process Customer Data through AI as part of providing the Zus Services, including for fine-tuning such AI; and (B) use De-Identified Customer Data to train and develop AI. We will De-Identify Customer Data before any use for AI training purposes.
b. Common Patient Record. You acknowledge and agree that, with regard to any Health Data you upload to or share through the Zus Services that is included in the Common Patient Record (“Common Health Data”), as between you and any other Participants (“Common Participant”) with which you share a given Individual (a “Common Patient”), you and that Common Participant both have equal right, title, and interest in the Health Data for the Common Patient included in the Common Patient Record. Accordingly, you further acknowledge and agree that we cannot return or destroy Common Health Data.
c. Zus Data. We own all right, title, and interest (including any intellectual property rights) in and to the Zus Data, and we may use or disclose the Zus Data for any purpose permitted by Applicable Law.
d. Data Privacy, Security and Interoperability.
i. Our Responsibilities. We will comply with the privacy and security requirements set forth in the Zus BAA with respect to Health Data and the Zus User Privacy Policy with respect to User Data. We may implement or require information security safeguards we deem appropriate, including safeguards that impose requirements or conditions on your use of the Customer Services and access to the Zus Platform and Zus Network (“Additional Safeguards”). These Additional Safeguards will not be less stringent than Applicable Law (including HIPAA) but may impose obligations on you beyond the minimum requirements of Applicable Law where we believe necessary to protect the Zus Services and create a safe environment for all Participants in the Zus Network. Upon written request, we will provide you with a summary of our annual third-party security audit and/or third-party security certification(s), which you agree to maintain as Zus’ Confidential Information and use internally solely for the purpose of confirming our compliance with this paragraph.
ii. Your Responsibilities. You are responsible for your own compliance with Applicable Law, including ensuring that your uses and disclosures of Health Data comply with federal and state privacy, security, breach, and interoperability laws. You are also solely responsible for determining and/or ensuring that any requirement for notice, Consent, or other procedural conditions has been met. You will create and maintain privacy policies and documentation that comply with Applicable Law in all material respects and adequately and accurately disclose how you collect, use, store, and disclose Health Data, User Data, or other regulated data (collectively, “Customer Privacy Documentation”), and you will consistently apply and follow that Customer Privacy Documentation. You will make your Customer Privacy Documentation easily accessible to Individuals and Users, as applicable. Without limiting the foregoing, you agree that you will use and disclose Health Data, User Data, and other regulated data only for the purposes or activities disclosed in the Customer Privacy Documentation.
iii. Security Obligations. We each agree to implement and maintain administrative, physical, and technical safeguards to protect the security, confidentiality, and integrity of Health Data as set forth in greater detail in the applicable Zus Policies. You will not, and will not allow or enable any of your Users or other third parties to, bypass or breach any security feature, device, or protection used by the Zus Services. You and your Users may not access the Zus Services other than through your or their own then-valid access credentials. If you reasonably determine that we have materially failed to comply with our security obligations, and that such failure creates a material vulnerability affecting your information systems, you will promptly notify us, and you may suspend or limit access or connectivity between the Zus Services and your information systems. Any such failure by us will be a curable breach under Section 10. Upon receipt of any notice by you under this Section, we will use our best efforts to come into compliance with our obligations under this Section within the applicable cure period.
iv. Breach Reporting. We will report to you any Security Incident (not including Access Attempts) or Breach affecting your Health Data within the time period(s) set forth in the Zus BAA. You will require your Users, employees, and subcontractors to report to you any Security Incident (not including Access Attempts) and Unauthorized Uses or Disclosures of Health Data of which they become aware. You will report to us any Security Incident (not including Access Attempts) or Breach involving the Zus Services or Health Data from the Zus Services within five (5) business days after becoming aware of the event. We each further agree to follow the reporting and notification requirements set forth in the applicable Zus Policies and/or Third-Party Product Terms, including more stringent reporting deadlines. No attorney-client, accountant-client, or other legal privilege will be deemed waived by either Party by virtue of this Section. Where you caused one of the preceding events to occur, you will pay: (A) the costs of notification to affected Individuals; and (B) the costs of one year of credit monitoring offered to those Individuals.
v. Specially Regulated Data. You acknowledge that certain Health Data may be subject to additional notice, specific Consent, or other procedural requirements under Applicable Law (collectively, “Specially Regulated Data”). Except as expressly permitted by the Zus Policies or with Zus’ prior written and signed consent, you must not submit Specially Regulated Data or any other data prohibited by the applicable Zus Policies to Zus or in connection with the Zus Services. You are solely responsible for determining whether any of your Customer Data or other information is Specially Regulated Data and for having appropriate mechanisms within your systems to identify, segregate, and suppress Specially Regulated Data from unauthorized use or disclosure through or in connection with the Services.
vi. Zus Network Notice and Opt-Out. You are solely responsible for: (A) determining whether to notify Individuals of your participation in the Zus Network; and (B) notifying Zus of an Individual’s decision to opt out of sharing Health Data through the Zus Network. You must use and return the Zus Opt-Out Form (available at https://zushealth.com/zus-request-to-opt-out-form/) to opt out Individuals from the Common Patient Record (“Zus Opt Outs”). The Parties shall each comply with the applicable Zus Policies and Documentation with respect to the opt-out process.
vii. Interoperability Acknowledgment. You acknowledge and agree that: (A) you are requesting access to, exchange of, and use of Health Data in the manner provided through the Zus Services; (B) we are at all relevant times providing you with the requested access, exchange, and use of Health Data in the requested manner; and (C) these Zus Terms supersede and revoke all prior requests for Health Data pending before your agreement to these Zus Terms.
7. Mutual Confidentiality
a. General. Each Party will use the other Party’s Confidential Information only to exercise the receiving party’s (the “Receiving Party’s”) rights and fulfill its responsibilities under these Zus Terms and will use reasonable care to protect it from disclosure. The Receiving Party may disclose Confidential Information only to its Affiliates, employees, agents, or professional advisors who have a need to know and are bound by confidentiality obligations at least as restrictive as those set forth herein. The Disclosing Party agrees that these obligations will not apply to any information that the Receiving Party can document: (i) is or becomes generally available or known to the public through no improper action or inaction by the Receiving Party or any Affiliate, agent, consultant, or employee; (ii) was rightfully in its possession or known by it before receipt from the Disclosing Party; (iii) was rightfully disclosed to it by a third party having no obligation of confidentiality; (iv) was independently developed without use of any Confidential Information of the Disclosing Party; or (v) is disclosed by the Disclosing Party to a third party without a requirement of confidentiality.
b. Compelled Disclosures. Notwithstanding any other provision of these Zus Terms, a Receiving Party or its Affiliate may disclose Confidential Information to the extent compelled by court order, subpoena, warrant, or other valid legal authority; provided that the Receiving Party uses commercially reasonable efforts to promptly notify the other Party before any such disclosure (to the extent legally permitted).
c. Publicity & Network Transparency. You may publicly state that you are a Zus Customer, are using the Zus Platform and Zus Services, and are a Participant in the Zus Network. Zus may identify you as a customer of Zus, a Participant in the Zus Network, and as a contributor to the Common Patient Record.
8. Intellectual Property
a. Zus Ownership.
i. Zus IP. We exclusively own and reserve all right, title, and interest in and to the Zus Services (including the Zus Platform), the Documentation, the Zus Policies, Zus Data, Feedback, and our Confidential Information (together, the “Zus IP”). Notwithstanding the foregoing, Zus does not claim ownership of your Health Data.
ii. Feedback. We own any Feedback you provide to Zus and may implement, use, and incorporate it into the Zus Services without restriction or limitation. The Feedback you provide does not contain or reflect the confidential information, trade secrets, or proprietary materials of any third party.
iii. Infringement Notification. You agree not to infringe or misappropriate the Zus IP. Upon discovering or being notified of any actual or suspected infringement or misappropriation of the Zus IP, you shall promptly inform us and cease the infringement to the extent within your control. You will cooperate with us in protecting and defending the Zus IP.
b. Your Ownership.
i. Customer IP. You exclusively own and reserve all right, title, and interest in and to your Application(s), Customer Data (including your Health Data and User Data), Customer Content, Customer Documentation, and your Confidential Information (together, “Customer IP”).
ii. Customer Content. You agree not to load or incorporate into the Zus Services any Customer Content from a third party, whether clinical or otherwise, without permission from the applicable third-party licensor, and you are responsible for obtaining any necessary permissions.
c. Trademarks. Except as expressly provided herein (including Section 7(c)), these Zus Terms do not give either you or Zus the right to use the other Party’s trademarks, logos, or service marks (“Marks”) without the other Party’s prior written consent.
9. Payment Terms
a. Fees. You agree to pay the fees for the Zus Services set forth in an executed Order Form or associated pricing list (“Fees”). Except as otherwise set forth herein, your payment obligations are non-cancelable and Fees paid are non-refundable. You agree that payment of the Fees is not contingent on the delivery of any future features or functionality. You further acknowledge and agree that: (i) all Fees due and payable under these Zus Terms are reasonable and are in exchange for Zus Services provided by Zus and are not compensation for the sale of Health Data; and (ii) to the extent any discount is given and that discount is contrary or inconsistent with the Information Blocking Rule (see 42 USC 300jj-52 and 45 CFR Part 171) exception for fees set forth at 45 CFR 171.302, you shall be responsible for payment of the discounted portion of the Fee(s).
b. Billing. At the end of each month, we will issue an invoice identifying the Fees payable based on your use of the Zus Services that month. Unless otherwise agreed in an Order Form, you will pay the Fees within thirty (30) calendar days after receipt of the invoice. Unless we authorize otherwise, you will pay by credit card, debit card, or other approved electronic payment method.
c. Taxes. You are responsible for all taxes, customs, duties, fees, and other charges imposed by any governmental authority, including any value added tax, goods and services tax, sales tax, use or consumption tax, and/or withholding tax on the Zus Services. You are not responsible for taxes based on our net income, net worth, asset value, property value, or employment. If you are tax-exempt, you will provide us with the appropriate certificate or other evidence of tax exemption.
d. Payment Disputes. You must notify us within thirty (30) calendar days after receipt of an invoice of any Fees you wish to dispute. You may withhold disputed Fees without suspension of the Zus Services or assessment of a late fee until the dispute is resolved, so long as you act reasonably and in good faith and cooperate diligently with Zus to resolve the dispute.
e. Late Payments. Except in the case of a good faith dispute described in Section 9(d), if you fail to pay the Fees when due, we may (i) assess, and you will pay, a late fee of the lesser of 1.5% per month or the maximum amount allowable by Applicable Law, and/or (ii) suspend the Zus Services for your Customer Account until the Fees are paid in full.
10. Term, Termination & Suspension
a. Term. The Order Form will set forth the initial term of your use of the Zus Services (“Initial Term”). The Order Form will automatically renew for additional one-year or two-year periods as set forth in the Order Form (collectively with the Initial Term, the “Term”) unless either Party gives written notice to the other Party of its intent to terminate at least ninety (90) calendar days before the end of the then-current Term or other notice period set forth in the Order Form. If no Initial Term is designated on the Order Form, either Party may terminate your use of the Zus Services at any time on thirty (30) calendar days’ prior written notice to the other Party. These Zus Terms are effective on the date they are accepted by you and will continue in effect until expiration or termination of all Order Forms executed by the Parties.
b. Termination for Inactivity. Zus reserves the right to terminate your access to the Zus Services on thirty (30) calendar days advance written notice if, for a period of sixty (60) calendar days, you have not accessed or had any activity in the Zus Services and no Term is designated on your Order Form.
c. Termination for Breach. To the extent permitted by Applicable Law, either you or Zus may terminate an Order Form and these Zus Terms immediately on written notice if (i) the other Party materially breaches these Zus Terms and fails to cure that breach within thirty (30) calendar days after receipt of written notice of the breach, or (ii) the other Party ceases business operations or becomes subject to insolvency proceedings and the proceedings are not dismissed within ninety (90) calendar days.
d. Effect of Termination.
i. Zus BAA. Termination of the Zus Terms for any reason under this Section will also result in immediate and automatic termination of the Zus BAA on the same date termination of the Zus Services takes effect. Zus will follow the disposition of Health Data requirements of the Zus BAA.
ii. Transition. Upon termination of these Zus Terms for any reason under this Section: (A) you will notify your Users that their access to the Zus Services has terminated and that we may withhold, remove, or discard any content, data, or other information that Users post or upload to the Zus Platform while using the Zus Services; and (B) Zus will use commercially reasonable efforts to enable you to export or transfer your Customer Data contained in the Zus Platform.
e. Suspension of Services. We may immediately suspend your use of the Zus Services (in whole or in part) if we determine in good faith: (i) that you have materially breached any provision of these Zus Terms; (ii) that the information you provided as part of the Vetting Process is materially incomplete, inaccurate, or misleading; (iii) there is an unusual and material increase in your use of the Zus Services and such increase negatively impacts the operating capability of the Zus Services; (iv) that our provision of Zus Services to you is prohibited by Applicable Law; or (v) there is any use by you or one of your Users that threatens the security, integrity or availability of the Zus Services. If we suspend the Zus Services pursuant to Section 9(e) or this Section we will have no liability for any damage, costs, losses (including any loss of data or profits), or any other consequences that you may incur in connection with such suspension. We will notify you as soon as possible if we are unable to notify you prior to suspension of your access to the Zus Services.
11. Zus Representations and Warranties
We represent, warrant, and covenant to you that the Zus Services will perform in accordance with the Documentation in all material respects. Our sole obligation, and your sole and exclusive remedy, for any non-conformity with the express warranty set forth in this Section will be for us to, at our option: (i) remediate the material non-conformity; or (ii) refund to you a pro rata amount of the Fees you actually paid for the time period during which the affected services did not comply with this Section.
12. Disclaimers
a. GENERAL. EXCEPT FOR THE WARRANTY EXPRESSLY SET FORTH IN SECTION 11, AND TO THE FULLEST EXTENT PERMITTED BY APPLICABLE LAW, ZUS PROVIDES THE ZUS SERVICES, DOCUMENTATION, ZUS POLICIES, AND ZUS DATA ON AN “AS IS” AND “AS AVAILABLE” BASIS AND “WITH ALL FAULTS,” AND ZUS DISCLAIMS ALL PROMISES, REPRESENTATIONS, AND WARRANTIES, WHETHER EXPRESS OR IMPLIED, INCLUDING ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT, TITLE, AND NONINFRINGEMENT, AND ANY WARRANTIES ARISING OUT OF ANY COURSE OF DEALING, TRADE USAGE, OR TRADE PRACTICE. ZUS DOES NOT WARRANT THAT THE SERVICES OR DATA WILL MEET CUSTOMER’S REQUIREMENTS OR BE UNINTERRUPTED, TIMELY, ACCURATE, COMPLETE, FREE FROM FALSE MATCHES, SECURE, FREE FROM HARMFUL CODE, RELIABLE, INTEROPERABLE, COMPATIBLE WITH ANY PARTICULAR HARDWARE, SOFTWARE, OR DATA, OR ERROR FREE, OR THAT ALL ERRORS WILL BE CORRECTED. FOR THE AVOIDANCE OF DOUBT, CUSTOMER ACKNOWLEDGES AND AGREES THAT INDIVIDUAL IDENTITY RESOLUTION ACROSS DISPARATE RECORD SOURCES IS INHERENTLY PRONE TO MISMATCHING, AND ZUS DOES NOT WARRANT THE ACCURACY OF RESULTS OBTAINED FROM USE OF THE SERVICES; THUS, CUSTOMER AGREES THAT CUSTOMER IS RESPONSIBLE FOR VERIFYING THAT ANY DATA PROVIDED TO CUSTOMER MATCHES THE PARTICULAR INDIVIDUAL AND DOES NOT CONTAIN ERRORS. NO ORAL OR WRITTEN INFORMATION GIVEN BY ZUS, OR ITS EMPLOYEES, SUBCONTRACTORS, OR THIRD-PARTY SERVICE PROVIDERS, WILL CREATE A WARRANTY. CUSTOMER DOES NOT HAVE THE RIGHT TO MAKE OR PASS ON ANY REPRESENTATION OR WARRANTY ON BEHALF OF ZUS TO ANY THIRD PARTY.
b. CONTENT. WE ASSUME NO RESPONSIBILITY FOR THE ACCURACY, CURRENTNESS, OR COMPLETENESS OF ANY CONTENT CREATED BY, AVAILABLE IN, OR SHARED THROUGH THE ZUS SERVICES, INCLUDING HEALTH DATA, OR FOR ITS COMPLIANCE WITH ANY LEGAL REQUIREMENTS OR STANDARDS.
c. CLINICAL RESPONSIBILITY. YOU ACKNOWLEDGE AND AGREE THAT THE ZUS SERVICES AND ANY AVAILABLE HEALTH DATA OR CLINICAL CONTENT PROVIDED THROUGH THEM ARE NOT MEDICAL ADVICE OR INSTRUCTIONS FOR MEDICAL DIAGNOSIS, TREATMENT, OR CARE BY CUSTOMERS OR YOUR APPLICATION USERS. THE ZUS SERVICES ARE NOT A SUBSTITUTE FOR YOUR OR YOUR USERS’ PROFESSIONAL MEDICAL ADVICE AND SHOULD NOT BE USED WITHOUT THE SUPERVISION AND INDEPENDENT MEDICAL JUDGMENT OF A QUALIFIED HEALTHCARE PROFESSIONAL CONSISTENT WITH APPLICABLE STANDARDS OF GOOD MEDICAL PRACTICE.
d. INTERNET SECURITY. YOU ACKNOWLEDGE THAT THE INTERNET AND TELECOMMUNICATIONS PROVIDER NETWORKS ARE INHERENTLY INSECURE, AND YOU AGREE THAT WE ARE NOT LIABLE FOR ANY CHANGES TO, INTERCEPTION OF, OR LOSS OF HEALTH DATA WHILE IN TRANSIT VIA THE INTERNET OR A TELECOMMUNICATION PROVIDER’S NETWORK.
e. Other Participants and Third-Party Frameworks. By using the Zus Services, Customer acknowledges that other Participants have access to the Zus Services under similar terms and conditions. Zus relies on Customer and its Users to provide accurate information about their identity and purposes for access to and use of the Zus Services, including connection to third-party products through the Zus Services. Except for use of commercially reasonable measures, Customer acknowledges that Zus cannot directly control any third party’s (including other Participants, Third-Party Service Providers, and others who participate in Third-Party Frameworks) access to or use of the Zus Services or Health Data disclosed to them through the Zus Services. EXCEPT AS EXPRESSLY STATED IN THESE ZUS TERMS, PARTICIPANT WAIVES ANY CLAIM OR CAUSE OF ACTION AGAINST ZUS ARISING FROM OR RELATING TO ACTIONS OR INACTIONS OF THOSE THIRD PARTIES, INCLUDING ANY UNAUTHORIZED ACCESS, EXCHANGE, OR USE RESULTING FROM OTHER PARTICIPANTS’ AND DATA RECIPIENTS’ MISREPRESENTATIONS, BREACH, OR VIOLATION OF (I) ZUS POLICIES OR DOCUMENTATION, (II) THE REQUIREMENTS OF THIRD-PARTY FRAMEWORKS, OR (III) APPLICABLE LAW. ADDITIONALLY, CUSTOMER ACKNOWLEDGES THAT HEALTH DATA MAY BE SHARED WITH PARTICIPANTS IN THIRD-PARTY FRAMEWORKS. ZUS SHALL HAVE NO LIABILITY FOR THE ACTS OR OMISSIONS OF ANY USERS ACCESSING OR USING THOSE THIRD-PARTY FRAMEWORKS.
13. Mutual Indemnification
a. Indemnification by Zus.
i. Scope of Indemnification. Subject to the limitations in this Section, we will indemnify, defend, and hold harmless you and your directors, officers, and employees from and against all third-party Costs arising from or related to any actual or alleged claim (A) that our provision of the Zus Services infringes or misappropriates that third party’s intellectual property rights, or (B) arising from a breach of our obligations under the Zus BAA (“Customer Claim”). We will pay all Costs and any settlement amounts agreed to be paid by us or damages awarded against you in connection with any such Customer Claim.
ii. Infringement Alternatives. If the Zus Services are, or we believe are likely to become, the subject of a Customer Claim, we may, at our option and expense: (A) procure the right to continue providing the Zus Services as set forth in these Zus Terms, (B) modify the Zus Services as permitted in these Zus Terms, or (C) if we determine that the foregoing options are not reasonably practicable, terminate these Zus Terms or, if applicable, terminate the specific Zus Services that are the subject of any actual or potential Customer Claim, and refund you any unused pre-paid Fees.
iii. Limitations. We will have no liability or obligation under this subsection with respect to any Customer Claim arising (A) from your use of the Zus Services in breach of these Zus Terms, (B) from the combination, operation, or use of the Zus Services with other applications, portions of applications, products, or services where the Zus Services would not by themselves be infringing, or (C) from your use of the Zus Services where there is no charge.
b. Indemnification by You. You will indemnify, defend, and hold harmless Zus, its directors, officers, and employees from and against all Costs arising from or related to any actual or alleged: (i) breach by you or your Users of these Zus Terms; (ii) negligent act or omission or willful misconduct by you or your Users; (iii) your use of the Zus Services and access to the Zus Platform and Zus Network, including any intellectual property or privacy claims relating to the Application, Customer Data, or Health Data; and (iv) claim arising out of patient care or outcomes relating to your Users’ use of the Zus Services, regardless of the cause (together, the “Zus Claims”). You will pay all Costs and any settlement amounts agreed to be paid by you or damages awarded against Zus in connection with such Zus Claims.
c. Conditions for Indemnification. As a condition of the indemnification obligations in this Section: (i) the indemnified party (“Indemnified Party”) must promptly notify the indemnifying party (“Indemnifying Party”) of a respective Customer Claim or Zus Claim (individually and collectively, a “Claim”); provided, however, that any failure to give prompt notice will not relieve the Indemnifying Party of its obligations under this Section except to the extent the Indemnifying Party was actually and materially prejudiced by the failure; (ii) the Indemnifying Party will have the sole and exclusive authority to defend or settle the Claim; and (iii) the Indemnified Party will reasonably cooperate with the Indemnifying Party in connection with its obligations under this Section, at the Indemnifying Party’s expense. The Indemnified Party reserves the right, at its own expense, to participate in the defense of any Claim. Notwithstanding anything to the contrary in this Section, the Indemnifying Party will not settle any Claim that admits liability or fault on behalf of the Indemnified Party or creates any obligation on behalf of the Indemnified Party without the Indemnified Party’s prior written consent, which shall not be unreasonably withheld, conditioned, or delayed.
d. Exclusive Remedy. This Section 13 describes the Indemnifying Party’s only liability to, and the Indemnified Party’s exclusive remedy against, the other Party for third-party claims.
14. Mutual Limitation of Liability
a. Limitation on Indirect Liability. To the extent permitted by Applicable Law, neither Party will be responsible or liable for: (i) any indirect, punitive, incidental, special, consequential, or exemplary damages; (ii) personal injury or property damage; or (iii) lost revenues, profits, savings, or goodwill, even if those damages are foreseeable and whether or not the Party had been advised of the possibility of those damages.
b. Additional Zus Limitations. Zus will not be responsible for any liability or damages to you or others materially caused or contributed to by: (i) your use of the Zus Services or access to the Zus Platform or Zus Network in a manner inconsistent with the Documentation or Zus Policies; (ii) any unauthorized access to or use of the Zus Services, the Zus Platform, your information systems, Customer Content, or your Application arising from your failure to use or implement appropriate security controls; (iii) any errors, inaccuracies, omissions, or losses in or to any Customer Data provided to us; (iv) third-party content provided by you; or (v) the defamatory, offensive, or illegal conduct of others.
c. Liability Cap. Except for any indemnification obligations set forth in Section 13(a)(i)(A), under no circumstances will Zus’ liability under these Zus Terms exceed the total amount of Fees paid by you to Zus during the twelve (12) month period immediately preceding the event giving rise to the claim for damages. Notwithstanding the foregoing, in the event of a breach of the Zus BAA by Zus for which the sole responsibility rests with Zus, Zus’ liability for that breach will not exceed five (5) times the total amount of Fees paid by you to Zus during the twelve (12) month period immediately preceding the event giving rise to the claim for damages.
15. Miscellaneous
a. Notices. Both parties agree that email may be used to satisfy notice, approval, or consent requirements under these Zus Terms. We will send any notices to you under these Zus Terms to the email address you designate in your Customer Account. Notices to us under these Zus Terms must be sent to legal@zushealth.com.
b. Interpretation & Order of Precedence. Any ambiguities in these Zus Terms shall be interpreted to permit compliance with HIPAA and other Applicable Law. In the event of conflicting terms or provisions, the order of precedence is: (i) Zus BAA; (ii) Order Form; (iii) Terms of Service; (iv) Zus Policies; and (v) Documentation.
c. Linked Documents. These Zus Terms may contain hyperlinks or references to third-party or Zus-hosted documents, policies, or websites. Those linked documents are provided for reference only and do not form part of these Zus Terms unless expressly stated to be incorporated herein. Zus may update the URL location of any linked document at any time without notice, and a change in URL location will not affect these Zus Terms.
d. Entire Agreement. Except as provided in these Zus Terms (including any policies, addenda, or additional terms incorporated by reference) or any applicable Order Form, these Zus Terms supersede all prior and contemporaneous agreements, proposals, statements, sales materials, presentations, or agreements, whether oral or written.
e. Waiver & Severability. Neither Party will be treated as having waived any rights by not exercising, or delaying the exercise of, any rights under these Zus Terms. If any part of these Zus Terms is deemed invalid, illegal, or unenforceable, the rest of the Zus Terms will remain in effect.
f. Governing Law & Venue. These Zus Terms are governed by and construed in accordance with the laws of the Commonwealth of Massachusetts, without regard to its conflict of law rules. Any legal action, suit, or proceeding arising from these Zus Terms will be brought in state or federal court in Suffolk County, Massachusetts.
g. Assignability. Neither Party will assign, delegate, or otherwise transfer an Order Form(s) (and therefore these Zus Terms), in whole or in part, without the other Party’s prior written consent, except that either Party may assign an Order Form in the event of a merger or sale of all or substantially all of the Party’s assets.
h. Relationship & Third-Party Beneficiaries. These Zus Terms do not create any agency, partnership, or joint venture between the parties, nor do they confer any rights, benefits, obligations, or liabilities on any third party unless they expressly state otherwise. Neither Party has authority to commit the other Party in any way and will not attempt to do so or imply that it has that right.
i. Force Majeure. No failure, delay, or default in performance of any obligation of a Party will constitute an event of default or breach of these Zus Terms to the extent that the failure, delay, or default arises from a cause, existing or future, beyond the control and without negligence of that Party, including action or inaction of government, civil or military authority, fire, strike, lockout, or other labor dispute, flood, terrorist act, war, riot, theft, earthquake, or other natural disaster. The affected Party will take all reasonable actions to minimize the consequences of that cause.
j. Record Retention & Access. Zus will retain any business records or data that we collect, maintain, or create under these Zus Terms for the periods required by Applicable Law. If required for purposes of 42 CFR 420.300, or any other Applicable Law, upon written request we will make any necessary books, records, and documents available to the U.S. Department of Health and Human Services Comptroller General or other governmental authority for purposes of verifying the nature and extent of any costs incurred by you for services we provide to you under these Zus Terms for which payment may be or have been made under Medicare, Medicaid, or other applicable federal or state reimbursement programs. Our responsibility to provide access to you under this Section will continue for a period of seven (7) years from the date of termination of these Zus Terms.
k. U.S. Government Terms. The Zus Services and Documentation may qualify as “commercial items,” as that term is defined at Federal Acquisition Regulation (“FAR”) (48 C.F.R.) 2.101, consisting of “commercial computer software” and “commercial computer software documentation” as those terms are used in FAR 12.212. Consistent with FAR 12.212 and DoD FAR Supp. 227.7202-1 through 227.7202-4, and notwithstanding any other FAR or other contractual clause to the contrary in any agreement into which these Zus Terms may be incorporated, if you are a governmental entity, you will acquire the Zus Services and their Documentation with only those rights set forth in these Zus Terms. Use of the Zus Services or the Documentation constitutes agreement by you that the software is “commercial computer software” and the Documentation is “commercial computer software documentation,” and constitutes acceptance of the rights and restrictions herein.
l. Survival. Any provision of these Zus Terms that, by its nature or express terms, should reasonably survive expiration or termination of thee Zus Terms shall so provide, including without limitation the following Sections: Section 6 (Data Rights, Privacy and Security); Section 7 (Mutual Confidentiality); Section 8 (Intellectual Property), Section 9 (Payment Terms), Section 10(e) (Effect of Termination), Section 12 (Disclaimers), Section 13 (Mutual Indemnification), Section 14 (Mutual Limitation of Liability), Section 15 (Miscellaneous), the relevant provisions of (Third-Party Product Terms) and (Additional Terms) of these Zus Terms, and (Definitions) of these Zus Terms.
B. THIRD-PARTY PRODUCT TERMS
The Zus Services incorporate one or more third-party products, some of which have additional terms and conditions you must follow, as set forth in Exhibit A and which are incorporated by reference and apply to your access to and use of those third-party products. If there is a conflict between the Zus Terms and specific Third-Party Product Terms, the Third-Party Product Terms will apply. These Third-Party Product Terms are required by the relevant Third-Party Service Providers, and those Third-Party Service Providers are solely responsible for their content. To the extent these Third-Party Product Terms require an amendment to the Zus BAA (or any other BAA between you and us) to grant the data use permissions herein, you agree that the Zus BAA or other BAA is amended to give those permissions. We may also change the Third-Party Product Terms from time to time. Unless we note otherwise, changes become effective thirty (30) calendar days after posting. Notwithstanding the foregoing, we may make changes effective immediately to comply with Applicable Law, comply with the Third-Party Service Provider’s requirements, or support new functionality. If you do not accept the changes to the Third-Party Product Terms, you must stop using those third-party products through the Zus Services.
C. ADDITIONAL TERMS
1. Zus BAA
The Zus BAA, currently made available at https://zushealth.com/zus-business-associate-addendum/, is incorporated into and made part of these Zus Terms by this reference. In the event of any conflict between the terms of the Zus BAA and these Zus Terms, the terms of the Zus BAA shall control with respect to the subject matter governed thereby.
2. Zus Services SLAs
The Zus SLA, currently made available at https://zushealth.com/zus-service-level-agreement/, is incorporated into and made part of these Zus Terms by this reference. The Zus Services SLA may be changed from time to time as provided in Section 2(c) of the Zus General Terms.
D. DEFINITIONS
“Access Attempts” means unauthorized probes, scans, “pings”, and other activities which may or may not indicate threats, whose sources may be difficult or impossible to identify and whose motives are generally unknown, and which do not result in access to the Zus Services, your Application(s) or information systems, or to any Unsecured Health Data.
“Account” means the account that we assign to you following the Vetting Process and that controls use of and access to the Zus Services for your Users.
“Affiliate” means any entity that directly or indirectly controls, is controlled by, or is under common control with the specified Party. For purposes of this definition, “control” means direct or indirect ownership of more than fifty percent (50%) of the voting interests of the entity.
“Affiliated Legal Entity” means (a) the legal entity on whose behalf an individual accepts these Zus Terms, whether that individual is an employee, officer, director, or independent contractor of that entity, including any corporation, limited liability company, partnership, joint venture, trust, association, or other legally recognized entity that the accepting individual represents; or (b) any other legal entity that (i) directly or indirectly controls, is controlled by, or is under common control with the entity described in clause (a), where “control” means direct or indirect ownership or control of more than fifty percent (50%) of the voting interests of the subject entity, or (ii) has entered into a written contractual agreement or arrangement with the entity described in clause (a) under which the entity described in clause (a) has agreed to make the Zus Services available to that entity. For the avoidance of doubt, an entity may qualify as an Affiliated Legal Entity under clause (b)(ii) regardless of whether it is owned, in whole or in part, by the entity described in clause (a).
“Applicable Law” means any applicable state or federal law then in effect.
“Application” means your hardware, software, integrated technologies, or related licenses, technical information, privileges, rights, intellectual property, or services that use, integrate with, or incorporate elements of the Zus Services.
“Artificial Intelligence” or “AI” means any artificial intelligence or machine learning engine or system, neural network, large language model, or similar automated analytical or generative system or engine used by Zus in connection with the Zus Services.
“Breach” means a Breach of Unsecured Health Data as defined in 45 CFR 164.402 as well as any Unauthorized Use or Disclosure of Health Data or related information to the extent that Applicable Law requires such Unauthorized Use or Disclosure to be reported to a state agency or disclosed to the individuals who are the subject of such information.
“Business Associate” means an organization that meets the definition at 45 CFR 160.103 and which is either a Business Associate of a Covered Entity, or a Sub-Business Associate to a Business Associate serving a Covered Entity under HIPAA.
“Common Patient Record” means the aggregated Health Data maintained by Zus. The Common Patient Record may include Customer Data.
“Confidential Information” means information that one Party discloses to the other Party under these Zus Terms that is marked confidential or would reasonably be understood to be confidential given the nature of the information and the circumstances surrounding the disclosure. It does not include information expressly excluded from confidentiality protection in Section 7(a) of these Zus Terms.
“Costs” means claims, liabilities, costs, damages, and expenses, including reasonable attorneys’ fees.
“Covered Entity” is an organization which meets the definition of Covered Entity under the HIPAA Privacy Rule.
“Customer Content” means material that you create, or that is pre-existing (whether created by you or by a third party and appropriately licensed by you), and that you incorporate into your Application using the Zus Services, including unique questionnaires and forms, proprietary algorithms, workflows, processes, and clinical protocols or guidelines that you have developed.
“Customer Data” means the data, information, or other materials provided to Zus by Customer in connection with the Zus Services. Customer Data may include Health Data and User Data. Customer Data does not include Usage Data.
“Customer Documentation” means any documentation or materials you create or share with Zus relating to your Application(s), including any Customer Privacy Documentation.
“De-Identified” or “De-Identified Data” means data or information that meets the HIPAA de-identification standards at 45 CFR 164.514.
“Documentation” means the information, content, and materials available on the Zus documentation portal.
“Established Relationship” has the meaning set forth in the applicable Zus Policies, including:
- For Participants who are Health Care Providers (or their designated Business Associates): a documented Treatment relationship with Participant’s Health Care Provider(s);
- For Participants who are Health Plans (or their designated Business Associates): a documented Payment or Limited Health Care Operations relationship; and
- As otherwise provided for in Zus’s Permitted Purpose Policy.
“Feedback” means any feedback, suggestions, recommendations, or feature or functionality requests you provide to Zus related to the Zus Services.
“Health Data” means Individually Identifiable Health Information.
“HIPAA Privacy Rule” means the regulations at 45 CFR 160 and Subparts A and E of 45 CFR 164, as amended.
“HIPAA Security Rule” means the regulations at 45 CFR 160 and Subparts A and C of 45 CFR 164, as amended.
“HIPAA” means the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations, including without limitation the HIPAA Privacy Rule and HIPAA Security Rule, as amended.
“Individual” means a natural person who is a patient, enrollee, member, or consumer who receives health care. For purposes of these Zus Terms, an Individual does not include a natural person acting in a business or employment capacity.
“Individually Identifiable Health Information” has the meaning given to it under HIPAA at 45 CFR 160.103, regardless of whether the information is HIPAA-regulated.
“Limited Data Set” has the meaning in 45 CFR 164.514(e).
“Limited Health Care Operations” means the activities listed in paragraphs (1) and (2) of the definition of Health Care Operations in HIPAA at 45 CFR 164.501, and health care fraud and abuse detection and compliance activities as described at 45 CFR 164.506(c)(4).
“Member File” means a list of Individuals with whom you have an Established Relationship.
“Order Form” means the document signed between Zus and Customer that specifies the Services to be provided by Zus to Customer and other terms that are relevant to the Services and payment for the services.
“Participant Type” means the specific types of entity that may access the Zus Network, as defined in the Zus Policies.
“Participant” means a legal entity that: (a) qualifies for participation in the Zus Network in accordance with applicable Zus Policies; (b) has agreed to be contractually bound to the Zus Terms of Service or its substantive equivalent; and (c) has been approved by Zus to participate in the Zus Network (in whole or in part).
“Payment” has the meaning given in HIPAA at 45 CFR 164.501, and as may be further specified in Zus Policies.
“Permitted Purposes” refers to the specific reasons set forth in the Zus Policies for accessing and using the Zus Services, including accessing, transmitting, using, and disclosing Health Data. The Permitted Purposes for accessing the Common Patient Record may differ from the Permitted Purposes for accessing Health Data under a Third-Party Framework. Different Permitted Purposes apply depending on your Participant Type. You may not qualify for every Permitted Purpose supported by us.
“Security Incident” has the definition set forth in 45 CFR 164.304 with respect to the Zus Services and your information systems, but for purposes of these Zus Terms does not include an Access Attempt.
“Specially Regulated Data” is Health Data which is subject to certain additional or specific notice, consent or authorization requirements, or other limitations on disclosure as defined in Section 6(b)(v).
“Subcontractor” has the meaning given to it under HIPAA at 45 CFR 160.103, regardless of whether the person is HIPAA-regulated.
“Third-Party Framework” refers to a local, state, regional, or national data sharing agreement, arrangement, and/or set of rules or principles that permits the access, exchange, and use of electronic health information for certain purposes.
“Third-Party Service Provider” means a third party (and its vendors) that provides services (including software or products) that may be available to Participants through the Zus Services but is not a Subcontractor.
“Treatment” has the meaning given to it under HIPAA at 45 CFR 164.501, and as may be further specified in Zus Policies.
“Unauthorized Use or Disclosure” means any access, use or disclosure of Health Data that is not permitted by the Zus Terms, the Zus BAA, the Zus Policies or Applicable Law.
“Unsecured Health Data” means Health Data that is not rendered unusable, unreadable, or indecipherable to unauthorized persons through the use of a technology or methodology specified by the Secretary of the U.S. Department of Health and Human Services (HHS) in the guidance issued under section 13402(h)(2) of Public Law 111-5.
“Usage Data” means the statistical, technical, analytical, or administrative data compiled in the ordinary course of providing the Zus Services. Usage Data may be generated, created, or derived from Customer Data. To the extent any Usage Data contains Health Data, we shall: (a) De-Identify the Health Data and User Data; and (b) if applicable, anonymize it so that it does not identify Customer.
“User Data” means personal information identifying and pertaining to a User that is not Health Data.
“User” means any individual or legal entity that Customer has identified and authorized to access or use the Zus Services subject to these Zus Terms.
“Vetting Process” means our due diligence process to verify you as an approved Participant to use the Zus Services (in whole or in part).
“Your User Agreement” means your agreement or terms and conditions with your Users for the provision of your Application(s).
“Zus BAA” means the Zus Business Associate Addendum incorporated into these Zus Terms by reference.
“Zus Data means (a) all Usage Data, and (b) all data, information, or other materials provided or collected by Zus from sources other than Customer, including such data, information, or other materials from other Participants (e.g., the Common Patient Record).
“Zus Network” means the collection of Participants who use the Zus Platform to interact and share data for Permitted Purposes. The Zus Network consists of the Common Patient Record and, if a Participant is eligible, access to certain third-party networks and data exchange under certain Third-Party Frameworks.
“Zus Platform” means the infrastructure, technical services, tools, and systems created, maintained, and used by Zus to make available the Zus Services and support the Zus Network.
“Zus Policies” refers to any written policy and/or procedure created or adopted by Zus to provide detailed information or requirements related to the Zus Services. They include the Zus Data Network Permitted Purpose Policy and Zus Data Network Data Submission Policy, among others.
“Zus Services” means the set of application programming interfaces (APIs), software development kits (SDKs), tools, plugins, code, technology, content, data integrations and connections, infrastructure, AI solutions, and technical and data processing, usability, and analytics services that Zus uses and/or makes available to Customers, including developing functionality, performing functions, and processing data through the Zus Platform and retrieving data from, or sharing data through, the Zus Network as described in the Zus Terms and the Documentation. All references to Zus Services in these Terms include the Zus Platform and Zus Network. Not all Customers may qualify for access to, or use of, all Zus Services (in whole or in part).
Exhibit A
Third Party Product Terms
1. Medical History Service Terms
If you access or otherwise obtain data or services through the Medical History Service, then the terms and conditions applicable to the Medical History Service, and currently made available at https://zushealth.com/medical-history-service-terms/, shall apply to your access to and use of the Medical History Service and any data made available through it.
2. Medication Service Terms
If you access or otherwise obtain data or services through the Medication Service, then the terms and conditions applicable to the Medication Service, and currently made available at https://zushealth.com/medications-service-terms/, shall apply to your access to and use of the Medication Service and any data made available through it.
3. Quest Diagnostics Clinical Laboratories, Inc. (“Quest”). If you are receiving Health Data from Quest (“Quest Data”), then the following will apply:
a. If you are receiving Quest Data on an Individual from Connecticut, Florida, Kentucky, New York, New Mexico, Ohio, Pennsylvania or any state that requires a notice similar to the below, then the Quest Data is delivered with the following accompanying notice (and no further notice from Quest or Zus is required): “This information has been disclosed to you from confidential records which are protected by state law. State law prohibits you from making any further disclosure of this information without the specific written consent of the person to whom it pertains, or as otherwise permitted by law. Any unauthorized further disclosure in violation of state law may result in a fine or jail sentence or both. A general authorization for the release of medical or other information is NOT sufficient authorization for further disclosure.”
b. You must store Quest Data in a partitioned, private data store.
c. You must not transform any Quest Data or link any Quest Data to any other data unless the data is owned by Quest, Zus and/or you.
d. You must not license, lease, loan, sell, transfer or otherwise disclose Quest Data to a third party.
e. You must reasonably cooperate with us in providing a Letter of Direction required by Quest.
f. You may only use Quest Data for Treatment, Payment, and Limited Health Care Operations. You must not use Quest Data for any other purpose, unless required by Applicable Law. For clarity, (i) you must not commercialize Quest Data, whether de-identified or not, including without limitation by sale, offer to sell, export, distribute, or transfer; and (ii) you must not provide any Quest Data to a laboratory offering clinical or anatomical pathology services or any healthcare information technology or electronic medical record vendor, such as Siemens, McKesson, Cerner, and Allscripts.
4. LOINC (Logical Observation Identifiers Names and Codes) Copyright Notice and License
“This material contains content from LOINC (http://loinc.org). LOINC is copyright ©, Regenstrief Institute, Inc. and the Logical Observation Identifiers Names and Codes (LOINC) Committee and is available at no cost under the license at http://loinc.org/license. LOINC® is a registered United States trademark of Regenstrief Institute, Inc.”
5. American Medical Association End User Terms
The American Medical Association (AMA) holds the copyright for proprietary coding and medical datasets like Current Procedural Terminology (CPT®). The terms and conditions applicable to the AMA, and currently made available at https://zushealth.com/american-medical-association-end-user-agreement-terms/, shall apply to your access to and use of that AMA content.
6. Bamboo Health, Inc. (“Bamboo”)
If you are receiving Health Data from, or if Health Data is provided to, Bamboo, then the following will apply:
a. You may only use Health Data from Bamboo (“Bamboo Data”) for Treatment, Payment, or Limited Health Care Operations. You may not use Bamboo Data for underwriting or pricing. Further, you may not share Bamboo Data with other third parties without Bamboo’s express written consent.
b. You may only request and use the minimum amount of Bamboo Data required to accomplish the purpose.
c. You authorize Bamboo to: (i) use Customer Data for Data Aggregation services (as defined by HIPAA); (ii) create, use, and disclose De-Identified Customer Data for any purpose permitted by Applicable Law; and (iii) disclose externally any summary or aggregated data that does not relate to or identify any Individual attributed to Customer. You further authorize Bamboo to use Customer Data for the activities of a Health Oversight Agency or a Public Health Authority (each as defined by HIPAA). To the extent permitted by Applicable Law, Bamboo may share any reports and/or findings generated from those activities with Zus and/or other Participants who have a Treatment, Payment, or Health Care Operations (each as defined by HIPAA) purpose to receive the information. To the extent Bamboo retains any Customer Data or De-Identified Customer Data after termination of these Third-Party Product Terms, these use permissions will be perpetual and irrevocable.
7. Collective Medical Technologies, Inc. (“Collective”)
If the services of Collective are being used, then the following will apply:
a. Collective may access Customer Data, including without limitation Health Data, in Canada.
b. Collective may use and disclose Customer Data for development and improvement of Collective’s services, subject to Applicable Law.
c. Collective may use and disclose Customer Data to create and share Limited Data Sets in accordance with 45 CFR 164.514.
d. Collective may use Customer Data for Data Aggregation services (as defined by HIPAA) and may also use and disclose data derived from Customer Data for any lawful purpose, provided that such derived data does not contain Health Data or User Data.
8. Sigma Computing, Inc. (“Sigma”)
If you access visualizations viewed in workspaces called “Workbooks” powered by Sigma, then the terms and conditions applicable to the Workbook Services, and currently made available at https://zushealth.com/sigma-service-terms/, shall apply to your access to and use of the Workbooks and any data made available through them.