OpenCoreEMR Terms of Service

1. ACCEPTANCE OF THESE TERMS

THESE TERMS OF SERVICE (THESE “TERMS”) ARE A BINDING AGREEMENT BETWEEN OPENCOREEMR INC., A DELAWARE CORPORATION WITH OFFICES AT 455 MARKET ST., SUITE 1940, PMB 629461, SAN FRANCISCO, CA 94105 (“OPENCOREEMR,” “WE,” “US,” OR “OUR”), AND THE HEALTH CARE ORGANIZATION OR OTHER LEGAL ENTITY ON WHOSE BEHALF THE SERVICES ARE ACCESSED (“CUSTOMER” OR “YOU”).

BY CHECKING THE BOX INDICATING YOUR AGREEMENT, CLICKING “I AGREE,” OR OTHERWISE ACCESSING OR USING THE SERVICES, YOU REPRESENT AND WARRANT THAT: (A) YOU HAVE READ AND UNDERSTAND THESE TERMS; (B) YOU ARE AT LEAST EIGHTEEN (18) YEARS OLD AND OF LEGAL AGE TO FORM A BINDING CONTRACT; AND (C) YOU HAVE THE AUTHORITY TO BIND THE LEGAL ENTITY IDENTIFIED DURING REGISTRATION TO THESE TERMS. IF YOU DO NOT HAVE THAT AUTHORITY, OR IF THAT ENTITY DOES NOT AGREE TO THESE TERMS, DO NOT ACCESS OR USE THE SERVICES.

PLEASE READ SECTION 4 (DE-IDENTIFIED DATA; RETENTION; AUTHORIZED USES) CAREFULLY. IT DESCRIBES OPENCOREEMR’S RIGHTS TO CREATE, OWN, AND COMMERCIALIZE DE-IDENTIFIED DATA DERIVED FROM CUSTOMER DATA, INCLUDING FOR THE TRAINING OF ARTIFICIAL INTELLIGENCE MODELS BY OPENCOREEMR AND BY THIRD PARTIES; IT DESCRIBES OPENCOREEMR’S RETENTION RIGHTS; AND IT DESCRIBES USES MADE PURSUANT TO PATIENT AUTHORIZATIONS. IT STATES THAT THOSE RIGHTS ARE PRINCIPAL CONSIDERATION FOR OPENCOREEMR PROVIDING THE SERVICES AT NO CHARGE. SECTION 4.9 SETS OUT CUSTOMER’S RESPONSIBILITY FOR OBTAINING RECORDING CONSENTS. SECTION 11 CONTAINS DISCLAIMERS OF WARRANTIES AND LIMITATIONS OF LIABILITY. SECTION 15.1 CONTAINS A WAIVER OF THE RIGHT TO TRIAL BY JURY. SECTION 13 CONTAINS YOUR CONSENT TO RECEIVE COMMUNICATIONS FROM US, INCLUDING BY EMAIL, TEXT MESSAGE, CALL, AND PUSH NOTIFICATION.

1.1 Business Associate Agreement. Customer may not submit Protected Health Information to the Services until Customer has also accepted OpenCoreEMR’s Business Associate Agreement (the “BAA”), which is presented for separate acceptance during registration and is available at https://opencoreemr.com/business-associate-agreement/. The BAA is a separate agreement and requires separate acceptance.

1.2 Electronic Contracting. Customer consents to transact electronically and agrees that its electronic acceptance of these Terms and the BAA constitutes a signature satisfying any requirement that an agreement be in writing and signed, in accordance with the Electronic Signatures in Global and National Commerce Act, 15 U.S.C. § 7001 et seq., and applicable state law. All notices, disclosures, and other communications that OpenCoreEMR provides electronically satisfy any legal requirement that such communications be in writing.

1.3 Authorized Users. Where an individual accesses the Services pursuant to an invitation from an existing Customer, these Terms bind that individual as an Authorized User with respect to Sections 5 (Restrictions; Acceptable Use), 12 (Confidentiality; Security; HIPAA; Data Protection), and 1.2 (Electronic Contracting), and the Customer’s prior acceptance governs the service relationship. Acceptance by an Authorized User does not constitute a new grant under Section 4 (De-Identified Data), does not bind the Customer to any additional obligation, and does not amend any agreement between the Customer and OpenCoreEMR.

1.4 Existing Written Agreements. If Customer has entered into a separate written agreement with OpenCoreEMR governing the Services, see Section 15.2 (Order of Precedence; Negotiated Agreements), which explains how these Terms interact with that agreement.

1.5 Changes to These Terms. OpenCoreEMR may modify these Terms from time to time. OpenCoreEMR will post the updated Terms, revise the “Last Updated” date, and provide notice of material changes by email to the address associated with Customer’s account and by notice within the Services. Changes take effect for new customers immediately and for existing customers thirty (30) days after the Last Updated date, except that OpenCoreEMR may require affirmative acceptance of updated Terms before permitting further use of the Services, in which case the updated Terms take effect upon that acceptance. If Customer does not agree to updated Terms, Customer must stop using the Services and may terminate under Section 10. Notwithstanding the foregoing, any expansion of OpenCoreEMR’s rights in Customer Data or De-Identified Data beyond those set out in Section 4 as of the date of Customer’s acceptance will be made only by affirmative acceptance and will not take effect by continued use alone.

2. DEFINITIONS

“Affiliate” means an entity which is directly or indirectly controlling, controlled by, or under common control with a Party.

“AI Content” has the meaning given in Section 7.1.

“Authorized User” means an individual who is a member of Customer’s workforce and whom Customer has authorized to access the Services using credentials issued to or selected by that individual.

“Customer Data” means all data collected by the Services or uploaded by Customer or its Authorized Users to the Platform.

“Customer of Record” means the legal entity identified by Customer during account registration, on whose behalf these Terms are accepted.

“De-Identified Data” means data, datasets, outputs, insights, statistics, analytics, benchmarks, models, algorithms, improvements, derivative data, or other information created, derived, inferred, or generated by or on behalf of OpenCoreEMR from Customer Data, PHI, AI Content, Recordings, Transcriptions, or any other content or materials submitted to, stored in, or generated by the Services, or from use of the Services, but only to the extent such information has been de-identified in accordance with HIPAA, including 45 C.F.R. § 164.514, and does not identify and cannot reasonably be used to identify Customer, any patient, or any individual. For clarity, De-Identified Data may include aggregated and anonymized clinical, operational, utilization, outcomes, billing, workflow, and performance data, but excludes Customer Data and PHI.

“Documentation” means the user guides, technical documentation, specifications, and other materials describing the operation, functionality, or use of the Services that OpenCoreEMR makes available to Customer, as updated from time to time.

“DPA” means OpenCoreEMR’s Data Processing Addendum, as described in Section 12.5.

“Effective Date” means the date Customer first accepts these Terms or first accesses the Services, whichever is earlier.

“HIPAA” means the Health Insurance Portability and Accountability Act of 1996 and the regulations promulgated thereunder, as amended, including by the HITECH Act.

“IP” means, in the case of OpenCoreEMR, the OpenCoreEMR Marks, the OpenCoreEMR Content, and the Services; and, in the case of Customer, the Customer Marks and the Customer Data.

“Marks” means a Party’s trade names, trademarks, service marks, logos, or other commercial or product designations.

“OpenCoreEMR Content” means the (i) Services and related user interface; (ii) workflow tools provided or made available by OpenCoreEMR; and (iii) core technology making up the Platform.

“Order” means a written or electronic order form, subscription selection, or checkout confirmation through which Customer purchases paid Services.

“Party” means each of OpenCoreEMR and Customer, and “Parties” means both.

“PHI” means Protected Health Information as defined under HIPAA.

“Platform” means OpenCoreEMR’s AI-powered electronic health records and practice management platform built on OpenEMR. The Platform includes any Updates made during the Term.

“Patient Authorization” means a valid authorization from an individual meeting the requirements of 45 C.F.R. § 164.508, including, where applicable, the statement required by 45 C.F.R. § 164.508(a)(4) that the disclosure will result in remuneration to OpenCoreEMR.

“Recording” means any audio or video recording of a clinical encounter or other interaction captured through or uploaded to the Services.

“Transcription” means any text rendering of a Recording, whether generated by the Services, by a Model Provider, or by a human transcriptionist.

“Services” means the Platform, the Website, any OpenCoreEMR mobile application, and any professional or ancillary services OpenCoreEMR provides to Customer.

“Software” means any software and associated documentation made available via the Services.

“Updates” means modifications, updates, and changes made by OpenCoreEMR to the Platform which OpenCoreEMR makes generally available to its customers at no additional fee.

“Usage Data” means de-identified and aggregated data derived from the operation of the Services, including telemetry, performance metrics, feature usage statistics, and other operational analytics that do not identify Customer, Customer’s patients, or any individual. For clarity, Usage Data is not Customer Data and is owned by OpenCoreEMR, provided it remains de-identified and aggregated.

“Website” means opencoreemr.com and its subdomains.

3. ACCOUNTS; LICENSE; AUTHORITY

3.1 License to Customer. Subject to these Terms, OpenCoreEMR grants Customer a non-exclusive, non-transferable, non-sublicensable, revocable license to access and use the Services and the OpenCoreEMR Content during the Term, solely for Customer’s internal business and clinical operations. Software is licensed in object code form only, except as provided in Section 6.2 (Limited Source Available License). Some Software may be offered under open source licenses that OpenCoreEMR will make available upon request; provisions in those licenses may expressly override terms of this Section 3.1.

3.2 License to OpenCoreEMR. Subject to these Terms, Customer grants OpenCoreEMR a non-exclusive, non-transferable license to use the Customer Data during the Term solely as necessary to provide the Services. This Section 3.2 does not limit Section 4 (De-Identified Data) or OpenCoreEMR’s rights in Usage Data.

3.3 Registration; Customer of Record. The individual who registers an account must identify the legal entity on whose behalf the account is established, together with that entity’s legal name and National Provider Identifier where applicable. That entity is the Customer of Record and is the party to these Terms for all purposes. Customer agrees to provide true, accurate, current, and complete registration information and to keep it current. Customer of Record is responsible for all activity occurring under its account, including activity by its Authorized Users, and may designate administrators to manage access. An individual who accepts these Terms without authority to bind the identified entity is personally responsible for use of the Services under that account until the entity ratifies the acceptance.

3.4 Authorized Users. Customer will require each Authorized User to have unique credentials, will not permit credential sharing, will train Authorized Users on their obligations under these Terms, and will promptly notify OpenCoreEMR when an Authorized User’s authorization ends. Customer is responsible for its Authorized Users’ compliance with these Terms. Customer will notify OpenCoreEMR immediately of any unauthorized use of credentials or any other breach of security.

3.5 Verification. Customer’s access to the Services, or to particular features, may be subject to verification of Customer’s identity and professional credentials. OpenCoreEMR may suspend or terminate access if it is unable to verify Customer’s qualifications, or if OpenCoreEMR has reasonable grounds to believe that registration information is untrue, inaccurate, or incomplete.

3.6 No Property Interest in Account. Customer acknowledges that it has no ownership or other property interest in the account itself, as distinct from the Customer Data within it. OpenCoreEMR may reclaim usernames at any time, including where a third party claims a username violates its rights.

3.7 Usage Data. Notwithstanding anything to the contrary, OpenCoreEMR may collect, generate, and use Usage Data for all legally permissible purposes, including analytics and benchmarking. Usage Data may include telemetry related to AI model usage and performance (for example, prompt volume, latency, and error metrics). OpenCoreEMR does not use Customer Data to train models except as expressly permitted under Section 7.

3.8 Equipment. Customer must provide all equipment and software necessary to connect to the Services and is solely responsible for any Internet connection, mobile, or similar fees it incurs.

4. DE-IDENTIFIED DATA; RETENTION; AUTHORIZED USES

4.1 Grant and Assignment. Notwithstanding anything to the contrary in these Terms, and subject to the BAA and applicable law, Customer hereby grants to OpenCoreEMR a worldwide, non-exclusive, sub-licensable (through multiple tiers), transferable, royalty-free, perpetual and irrevocable right to create, generate, derive, use, reproduce, retain, display, perform, disclose, license, sell, distribute, commercialize, create derivative works of, and otherwise exploit De-Identified Data for any lawful purpose, including analytics, benchmarking, research, product development, the training, fine-tuning, evaluation, validation, and development of artificial intelligence and machine learning models and systems, whether by OpenCoreEMR or by third parties, model evaluation, service improvement, market insights, and creation of data products. Customer hereby irrevocably assigns and transfers to OpenCoreEMR all right, title, and interest in and to De-Identified Data and any derivative works, data products, analyses, models, statistics, benchmarks, insights, or other materials created from or based on De-Identified Data, and Customer retains no right, title, or interest in the same or in the proceeds of any license, sale, or other commercialization thereof.

4.2 Consideration. Customer acknowledges and agrees that the rights granted and assigned under Section 4.1 are principal consideration for OpenCoreEMR making the Services available to Customer at no charge, and that OpenCoreEMR would not make the Services available on those terms absent those rights.

4.3 No Re-Identification. OpenCoreEMR will not use or disclose De-Identified Data in a manner that identifies or reasonably could be used to identify Customer, any patient, or any individual. OpenCoreEMR will not attempt to re-identify any individual from De-Identified Data, and will contractually prohibit any third party to whom it discloses De-Identified Data from attempting to re-identify any individual, except to the extent expressly permitted by HIPAA, the BAA, or applicable law.

4.4 Restricted Categories. Customer will not submit to the Services, without first notifying OpenCoreEMR in writing and obtaining OpenCoreEMR’s written acknowledgment, any records subject to 42 C.F.R. Part 2 (substance use disorder treatment records), Title X family planning records, or any other category of information subject to a consent or authorization regime more restrictive than HIPAA under federal or state law. Customer is responsible for identifying such records. As an additional safeguard, and without limiting Customer’s responsibility, OpenCoreEMR will apply automated screening designed to identify and exclude from De-Identified Data those records bearing diagnosis, procedure, or service codes or other indicators associated with the categories described in this Section 4.4, and may exclude records by category, jurisdiction, or data type where OpenCoreEMR determines that inclusion would be inconsistent with applicable law. OpenCoreEMR will exclude records identified under this Section 4.4 from De-Identified Data.

4.5 Customer Representations and Obligations. Customer represents and warrants that (a) it has all rights, authorizations, and consents necessary to grant the rights in this Section 4; (b) its notice of privacy practices accommodates the uses described in this Section 4; and (c) it has not agreed to any restriction under 45 C.F.R. § 164.522 that would be inconsistent with this Section 4. Where OpenCoreEMR makes available notice of privacy practices language, or consent, notice, or authorization forms, for use in connection with Recordings, Transcriptions, or the uses described in this Section 4, Customer will adopt and use them without modification except as OpenCoreEMR approves in writing. OpenCoreEMR is under no obligation to make any such language or forms available. Where OpenCoreEMR has not made a form available, or where Customer elects to use its own, Customer is solely responsible for ensuring that its notices, consents, and authorizations are sufficient under applicable law to support the uses described in this Section 4.

4.6 Survival. This Section 4 survives termination or expiration of these Terms, and OpenCoreEMR’s rights in De-Identified Data created before termination are not affected by termination or by deletion or return of the underlying Customer Data.

4.7 Retention and Processing. During the Term, OpenCoreEMR may store, retain, process, and transmit Customer Data, PHI, AI Content, Recordings, and Transcriptions as reasonably necessary to perform transcription, de-identification, expert determination, quality assurance, validation, and model evaluation, and to create, verify, and maintain De-Identified Data. Following termination or expiration of these Terms, OpenCoreEMR may continue to retain and process identifiable Customer Data, PHI, Recordings, and Transcriptions solely (a) for the period necessary to complete de-identification processing already underway, not to exceed ninety (90) days after the later of termination or the close of any export period under Section 10.3; (b) where the data is covered by an active, unrevoked Patient Authorization under Section 4.8; or (c) as required or permitted by applicable law or Section 10.4. At the end of the period described in subsection (a), OpenCoreEMR will de-identify or delete the identifiable data, subject to Section 10.4. OpenCoreEMR may retain and use De-Identified Data indefinitely, and this sentence and Sections 4.1 through 4.4 survive termination without limitation.

4.8 Authorized Uses. Where an individual has provided a Patient Authorization, OpenCoreEMR may use and disclose the PHI covered by that Patient Authorization in accordance with its terms and applicable law, including for the training, fine-tuning, evaluation, and development of artificial intelligence and machine learning models by OpenCoreEMR or third parties, and including disclosures for which OpenCoreEMR receives remuneration. OpenCoreEMR may make Patient Authorization mechanisms available through the Services, and Customer will make those mechanisms available to individuals as OpenCoreEMR reasonably directs. Customer will promptly notify OpenCoreEMR of any revocation of a Patient Authorization of which it becomes aware. OpenCoreEMR will honor revocations prospectively; a revocation does not require OpenCoreEMR to retrieve or unwind uses or disclosures already made in reliance on the Patient Authorization, or to alter or retrain any model already developed. This Section 4.8 operates independently of the de-identification pathway in Sections 4.1 through 4.4.

4.9 Recordings. Customer is solely responsible for obtaining all consents required to create Recordings under applicable federal and state law, including any law requiring the consent of all parties to a recorded communication, and for obtaining any consent required under applicable biometric privacy law with respect to voice or facial data. Customer will not create or upload Recordings of any individual who has not provided the required consent. Where OpenCoreEMR makes available an in-product consent confirmation, notice, or attestation mechanism in connection with recording, Customer and its Authorized Users will use that mechanism and will complete it accurately; a confirmation submitted through that mechanism is a representation by Customer that the required consents have been obtained. OpenCoreEMR may, at its discretion, transcribe Recordings and delete the source Recording following transcription, and may disable recording features or exclude Recordings and data derived from them by jurisdiction or category. Nothing in this Section 4.9 limits OpenCoreEMR’s rights in the resulting Transcriptions or in De-Identified Data.

5. RESTRICTIONS; ACCEPTABLE USE

5.1 Customer will not, and will not permit any third party to: (i) misappropriate or infringe OpenCoreEMR IP; (ii) reverse engineer, decompile, disassemble, or otherwise attempt to discover the source code, object code, or underlying structure, ideas, or algorithms of the Platform, except to the extent this restriction is expressly prohibited by applicable law; (iii) modify, translate, adapt, merge, or create derivative works based on the Platform; (iv) use the Services in any manner that would constitute white-labeling or OEM’ing the Platform for a third party; (v) use or view the Platform for the purpose of developing a competitive product or service; (vi) license, sell, rent, lease, transfer, assign, distribute, host, or otherwise commercially exploit the Services, including for service bureau or time-sharing purposes; (vii) permit any person other than an Authorized User to access the Services; (viii) access the Services other than through a commercial browser, an OpenCoreEMR-provided application, or a documented API; (ix) use any automated process to scrape or download data from the Services, except that OpenCoreEMR grants operators of public search engines revocable permission to index publicly available portions of the Website; (x) frame the Services or use OpenCoreEMR Marks in metatags or hidden text; or (xi) remove or obscure any copyright, trademark, or other proprietary notice.

5.2 Customer will not use the Services to transmit unlawful, infringing, threatening, abusive, harassing, defamatory, deceptive, fraudulent, or obscene material; to impersonate any person or entity; to transmit unsolicited bulk communications; to interfere with the operation of the Services or other customers’ use of them; to introduce viruses, worms, or similar harmful code; or to circumvent any technical or security measure OpenCoreEMR has implemented.

5.3 Customer is solely responsible for determining whether its access to and use of the Services (including any integrations, workflows, automations, or connections it configures) complies with Customer’s agreements with third parties and any applicable third-party terms. OpenCoreEMR has no obligation to monitor or ensure such compliance.

5.4 Monitoring and Enforcement. OpenCoreEMR reserves the right, but has no obligation, to: (a) investigate any suspected violation of these Terms; (b) take any action with respect to Customer Data that OpenCoreEMR deems necessary where it reasonably believes such data violates these Terms, infringes the rights of any person, threatens the safety of any person, or could create liability for OpenCoreEMR; (c) refer any illegal or unauthorized use of the Services to law enforcement; and (d) suspend or terminate access under Section 10.2. OpenCoreEMR has no obligation to pre-screen Customer Data.

6. OWNERSHIP; SOURCE AVAILABLE LICENSE; OPEN SOURCE

6.1 Ownership. As between the Parties, Customer owns all right, title, and interest in and to the Customer IP, and OpenCoreEMR owns all right, title, and interest in and to the OpenCoreEMR IP, including all computer code, user interfaces, methods of operation, and Documentation. Nothing in these Terms confers in either Party any right of ownership in the other Party’s IP. Section 4 governs De-Identified Data notwithstanding this Section 6.1. OpenCoreEMR’s Marks may not be used without permission. Third-party trademarks appearing in the Services are the property of their respective owners.

6.2 Limited Source Available License. Subject to Customer’s compliance with these Terms, OpenCoreEMR grants Customer a limited right to access and review the source code form of the Software (“Source Code”) solely for Customer’s internal review, testing, and evaluation purposes. Customer may not: (a) distribute, sublicense, sell, publish, or otherwise make the Source Code available to any third party for any purpose; or (b) use the Source Code for or in any production or commercial purpose, including developing, marketing, or selling any product similar or related to the Software. Notwithstanding the foregoing, Customer may modify and publish patches to the Source Code for the sole purpose of making contributions back to OpenCoreEMR (such modifications, “Contributions”). If Customer makes any Contributions, Customer agrees that such Contributions are the sole property of OpenCoreEMR and hereby assigns to OpenCoreEMR its entire right, title, and interest in any such Contributions and any intellectual property rights embodied therein. Customer further agrees to execute any assignments, oaths, declarations, and other documents as may be requested by OpenCoreEMR to effect the foregoing. This Section 6.2 applies regardless of whether Customer has purchased paid Services.

6.3 Feedback. Any ideas, suggestions, or proposals Customer submits to OpenCoreEMR (“Feedback”) are provided at Customer’s own risk and without obligation of confidentiality. Customer represents that it has all rights necessary to submit the Feedback, and grants OpenCoreEMR a fully paid, royalty-free, perpetual, irrevocable, worldwide, non-exclusive, sublicensable right to use, reproduce, modify, create derivative works of, and otherwise exploit the Feedback for any purpose.

6.4 Open Source. The Platform incorporates or is built upon OpenEMR and other open-source software (“Open Source Software”). OpenCoreEMR will use commercially reasonable efforts to comply with applicable Open Source Software license terms in connection with its provision of the Services, but makes no representation that Open Source Software is free from defects or security vulnerabilities. Nothing in these Terms restricts Customer’s rights under the applicable open-source licenses; however, OpenCoreEMR is not responsible for Customer’s modification, self-hosting, distribution, or use of any Open Source Software outside the Services.

6.5 Copyright Complaints. It is OpenCoreEMR’s policy to terminate the access of any user who repeatedly infringes copyright. If Customer believes that material on the Services infringes its copyright, please provide OpenCoreEMR’s designated agent with: (a) an electronic or physical signature of the person authorized to act on behalf of the copyright owner; (b) a description of the work claimed to be infringed; (c) a description of the location of the allegedly infringing material; (d) contact information; (e) a statement of good faith belief that the use is not authorized; and (f) a statement, under penalty of perjury, that the information is accurate and that the complainant is authorized to act. Designated agent: CEO, OpenCoreEMR Inc., 455 Market St., Suite 1940, PMB 629461, San Francisco, CA 94105, legal@opencoreemr.com.

7. ARTIFICIAL INTELLIGENCE TERMS

7.1 “Input” means prompts, instructions, data, schemas, or other content Customer submits to the Services. “Output” means content returned by the Services in response to Input. Input and Output together are “AI Content.” As between the Parties, AI Content is Customer Data, and as between the Parties Customer owns Output subject to third-party rights and applicable law. Customer is solely responsible for Input (including its accuracy, quality, and legality) and for verifying Output for Customer’s use cases. OpenCoreEMR does not represent that Output will not infringe third-party rights, particularly where Output is based on Customer’s Input, Third-Party Data, or Customer’s configurations.

7.2 OpenCoreEMR will not disclose identifiable AI Content to any third-party foundation model provider for training purposes, and will configure its third-party model providers not to use identifiable AI Content for their training, except where Customer explicitly opts in in writing (including via a product setting). If OpenCoreEMR must engage a provider that cannot support a no-training configuration for a given feature, OpenCoreEMR will give notice and Customer may disable that feature or provide written opt-in. This Section 7.2 does not apply to De-Identified Data, which is governed exclusively by Section 4, or to PHI used or disclosed pursuant to a Patient Authorization under Section 4.8.

7.3 The Services may use one or more third-party artificial intelligence or machine learning service providers (each, a “Model Provider”). Customer must comply with applicable model-usage policies that OpenCoreEMR surfaces or links in the Documentation. OpenCoreEMR may substitute Model Providers or models provided the Services’ core functionality is not materially degraded, and will provide notice of material changes.

7.4 Output may be incomplete, misleading, or hallucinatory, and results generated by machine learning are probabilistic. The Services are not a substitute for professional, legal, financial, clinical, or compliance judgment. Customer must apply appropriate human review and assumes responsibility for all use of Output, including whether Output is suitable for any Customer application.

7.5 The Services may consume or act upon data from third-party systems, applications, or platforms (“Third-Party Data”) and may connect to Customer’s systems per Customer’s configurations. OpenCoreEMR is not responsible for the accuracy, completeness, or suitability of any Third-Party Data. Customer is solely responsible for obtaining all rights and permissions to access, use, and process Third-Party Data. Customer acknowledges the Services can automate actions across Customer-configured systems, and Customer is solely responsible for testing, approval flows, rate limits, role-based controls, and guardrails it configures, and for reviewing Output before execution where appropriate.

7.6 Customer may submit PHI to the Services solely in accordance with Section 12 and the BAA. Customer shall not submit payment card data subject to PCI DSS or other data classified as highly sensitive or regulated unless expressly agreed in writing by OpenCoreEMR.

7.7 If there is a conflict between this Section 7 and the Documentation regarding AI model training or provider-policy compliance, this Section 7 controls.

8. THIRD-PARTY PRODUCTS AND SERVICES

8.1 OpenCoreEMR may make available, and the Services may integrate with, certain third-party applications, services, or products (“Third-Party Products”). Where the provider of a Third-Party Product requires a separate agreement with Customer, Customer’s use is subject to that agreement, and any exchange of information (including any entitlement to retrieve Customer Data generated through such Third-Party Products) is between Customer and that provider. OpenCoreEMR makes no warranties and assumes no liability for Customer’s use of Third-Party Products. Where no separate agreement is required, use of the Third-Party Product is deemed part of the Services and subject to these Terms.

8.2 The Services may contain links to third-party websites. Those sites are not under OpenCoreEMR’s control, and OpenCoreEMR does not review, endorse, or make any representation regarding them. Customer accesses them at its own risk and should review their terms and privacy practices.

8.3 Subscription Billing Processor. OpenCoreEMR uses Stripe, Inc. and its affiliates as its third-party service provider for payment services relating to Customer’s own subscription payments to OpenCoreEMR, if any (the “Payment Processor”). By purchasing paid Services, Customer agrees to be bound by Stripe’s Privacy Policy (currently at https://stripe.com/us/privacy) and Terms of Service (currently at https://stripe.com/us/terms), and authorizes OpenCoreEMR and Stripe to share payment information and instructions to the minimum extent required to complete Customer’s transactions. This Section 8.3 is distinct from the embedded payment processing services described in Section 16.

8.4 Advertising. OpenCoreEMR may display third-party advertising within the Services, including point-of-care advertising from pharmaceutical and life sciences companies, and may use a third-party ad server platform to deliver and measure that advertising. OpenCoreEMR does not disclose PHI to advertisers or ad platforms and does not permit advertisers to target individual patients. Advertising practices are further described in OpenCoreEMR’s Privacy Policy.

9. FEES FOR PAID SERVICES

9.1 The Services identified by OpenCoreEMR as free are provided at no charge. OpenCoreEMR may offer paid Services, features, or transaction-based services, which are subject to the pricing and terms presented at the time of purchase and to any applicable Order. No contract for paid Services exists until OpenCoreEMR accepts Customer’s order by confirmatory email or other appropriate means.

9.2 Customer agrees to pay all fees and charges to its account in accordance with the fees, charges, and billing terms in effect when a fee becomes due. Customer must provide a valid payment method and authorizes OpenCoreEMR to invoice that method for all fees as they become due, without additional notice or consent. Customer will promptly notify OpenCoreEMR of any change to its billing information. Except as expressly stated in these Terms or required by applicable law, all fees are non-refundable.

9.3 Automatic Renewal. Where Customer purchases a paid subscription, that subscription will automatically renew at the end of each subscription period for an additional equivalent period at OpenCoreEMR’s then-current price, unless Customer cancels at least thirty (30) days before the renewal date through the account settings page or by contacting OpenCoreEMR at https://opencoreemr.com/contact/. Upon cancellation, Customer may use the subscription through the end of the then-current period and will not receive a prorated refund. If OpenCoreEMR does not receive payment on renewal, Customer agrees to pay all amounts due on demand, and OpenCoreEMR may suspend or terminate the subscription.

9.4 Taxes. All fees are exclusive of sales, use, value added, excise, and similar taxes and import duties, and Customer is liable for all such taxes other than taxes on OpenCoreEMR’s income. If Customer is required by law to withhold or deduct any amount, Customer will gross up payment so that OpenCoreEMR receives the full invoiced amount. Customer will provide official receipts or other evidence of tax payment upon request.

9.5 Price Changes. OpenCoreEMR may change its pricing or introduce fees for Services previously provided at no charge, effective upon notice given in accordance with Section 1.5. Customer’s continued use of the affected Services after the effective date constitutes acceptance of the change; if Customer does not agree, Customer’s remedy is to stop using the affected Services and terminate under Section 10.

9.6 Free Trials and Promotions. Any free trial or promotional access must be used within the specified period. At the end of that period, further use of the applicable Service requires payment of the applicable fee.

10. TERM; TERMINATION; DATA EXPORT

10.1 These Terms commence on the Effective Date and continue until terminated (the “Term”).

10.2 Customer may terminate at any time by closing its account and notifying OpenCoreEMR. OpenCoreEMR may terminate or suspend these Terms or Customer’s access, in whole or in part: (a) immediately if Customer materially breaches these Terms and fails to cure within thirty (30) days after written notice; (b) immediately and without notice if Customer’s use jeopardizes the security, integrity, or availability of the Services or of any other customer’s data, if Customer is excluded from a federal or state health care program, if Customer ceases to be qualified to provide health care services, if payment cannot be charged when due, or if provision of the Services becomes unlawful; or (c) on thirty (30) days’ notice for convenience.

10.3 Upon termination: (i) Customer will pay all amounts due through the termination date; (ii) upon written request to OpenCoreEMR within sixty (60) days after termination, OpenCoreEMR will make available to Customer the Customer Data in its possession, encrypted using industry-standard protocols, via a secure electronic delivery method, and Customer must download it within thirty (30) days thereafter; and (iii) OpenCoreEMR will not intentionally delete Customer Data constituting PHI or patient records during that sixty (60) day request period or during any timely requested export period, except as required by law or the BAA.

10.4 To the extent Customer Data includes PHI, patient records, or other clinical records, OpenCoreEMR’s return, retention, deletion, and destruction obligations are subject to the BAA, applicable law, and any legally required preservation, retention, audit, litigation-hold, or regulatory obligations. Nothing in these Terms requires OpenCoreEMR to delete or purge records in backup or archival systems kept in the normal course of business.

10.5 If Customer does not request a copy of the Customer Data within the sixty (60) day period, or requests it but fails to download it within the thirty (30) day period, OpenCoreEMR has no obligation to continue maintaining Customer Data except as required by applicable law, the BAA, OpenCoreEMR’s standard backup and archive retention practices, or bona fide legal, regulatory, audit, security, or compliance obligations.

10.6 For clarity, the return, deletion, and destruction obligations in this Section 10 do not apply to Usage Data or De-Identified Data, which OpenCoreEMR may retain and use in accordance with these Terms, the BAA, and applicable law, and are subject to OpenCoreEMR’s retention and processing rights under Section 4.7 and its rights under Section 4.8 with respect to PHI covered by a Patient Authorization.

10.7 Termination of the Services includes removal of access and barring of further use. Where Customer’s access has been terminated for breach, Customer agrees not to re-register for the Services under a different name or account.

10.8 Sections 2, 4, 5, 6, 9 (as to amounts accrued), 10, 11, 12, and 15, and any other provisions which by their nature would reasonably be considered to survive, will survive termination.

11. REPRESENTATIONS; DISCLAIMERS; INDEMNIFICATION; LIABILITY

11.1 Each Party represents and warrants that it has the full corporate right, power, and authority to enter into these Terms and to perform the acts required of it, and that it will comply with all applicable laws, rules, and regulations, including applicable data privacy regulations.

11.2 Customer represents and warrants that: (a) it has obtained all necessary rights and authorizations to submit Customer Data for the purposes contemplated by these Terms; (b) it is responsible for the lawfulness, accuracy, content, and legality of Customer Data and for providing notice to and obtaining consents from individuals as required by applicable data protection laws; (c) its use of the Services will not violate any agreement between Customer and a third party; and (d) it is solely responsible for compliance with all laws applicable to its health care operations, including HIPAA, Medicare and Medicaid billing requirements, clinical recordkeeping rules, and state medical privacy laws, and for configuring the Services consistent with those obligations.

11.3 Clinical Responsibility. Customer acknowledges that the Services are a software tool intended to assist with clinical documentation and practice operations and are not intended to provide medical diagnosis, treatment recommendations, or clinical decision-making. OpenCoreEMR does not practice medicine or provide medical services. Customer is solely responsible for all medical decisions, patient care, and compliance with applicable clinical standards, and for maintaining appropriate contingency plans for clinical operations, including downtime procedures and record access continuity.

11.4 EXCEPT AS EXPRESSLY SET FORTH IN THESE TERMS, AND TO THE EXTENT PERMITTED BY APPLICABLE LAW, NEITHER PARTY MAKES ANY REPRESENTATIONS OR WARRANTIES OF ANY KIND, EITHER EXPRESS OR IMPLIED, ORAL OR WRITTEN, INCLUDING WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT. OPENCOREEMR SPECIFICALLY DISCLAIMS ANY REPRESENTATION OR WARRANTY (A) THAT THE SERVICES WILL MEET CUSTOMER’S REQUIREMENTS; (B) THAT THE OUTPUT OF THE SERVICES IS ACCURATE OR RELIABLE; OR (C) THAT THE SERVICES WILL BE TIMELY, UNINTERRUPTED, SECURE, OR ERROR-FREE. THE SERVICES AND ANY OUTPUT ARE PROVIDED “AS IS” AND “AS AVAILABLE,” WITH ALL FAULTS. NO ADVICE OR INFORMATION OBTAINED FROM OPENCOREEMR OR THROUGH THE SERVICES CREATES ANY WARRANTY NOT EXPRESSLY MADE IN THESE TERMS. ANY BETA OR EARLY ACCESS FEATURES ARE OFFERED FOR EXPERIMENTAL PURPOSES WITHOUT WARRANTY OF ANY KIND AND MAY BE MODIFIED OR DISCONTINUED AT OPENCOREEMR’S SOLE DISCRETION.

11.5 Indemnification by Customer. Customer shall indemnify, defend, and hold harmless OpenCoreEMR and its Affiliates and their respective officers, directors, employees, agents, and suppliers from and against any and all losses, costs, liabilities, and expenses, including reasonable attorneys’ fees, arising out of any third-party claim relating to: (i) Customer Data being inaccurate, incomplete, or containing errors; (ii) Customer Data having been collected in violation of applicable law; (iii) Customer Data violating any third-party intellectual property, privacy, or publicity right; (iv) Customer’s use of the Services in violation of these Terms or applicable law; (v) Customer’s breach of any agreement between Customer and a third party arising from Customer’s use or configuration of the Services; (vi) Customer’s use of Output; (vii) automated actions or workflows Customer initiates via the Services; or (viii) Customer’s breach of Model Provider policies referenced in Section 7.3. This provision does not require Customer to indemnify OpenCoreEMR for OpenCoreEMR’s own fraud, deception, misrepresentation, or unconscionable commercial practice.

11.6 The indemnification obligations in this Section 11 are conditioned upon: (i) prompt notice by the party seeking indemnity of any claim; (ii) complete control of the defense and settlement of the claim by the indemnifying party; and (iii) reasonable cooperation by the indemnified party. OpenCoreEMR reserves the right, at its own cost, to assume the exclusive defense and control of any matter otherwise subject to indemnification by Customer.

11.7 EXCEPT WITH RESPECT TO CUSTOMER’S INDEMNIFICATION OBLIGATIONS IN SECTION 11.5, CUSTOMER’S BREACH OF SECTION 5, AND EITHER PARTY’S GROSS NEGLIGENCE OR WILLFUL MISCONDUCT, AND TO THE FULLEST EXTENT PERMITTED BY LAW: (A) IN NO EVENT WILL EITHER PARTY BE LIABLE FOR ANY LOSS OF PROFITS, REVENUE, OR DATA, OR FOR ANY SPECIAL, INCIDENTAL, INDIRECT, PUNITIVE, EXEMPLARY, OR CONSEQUENTIAL DAMAGES, OR FOR DAMAGES DUE TO BUSINESS INTERRUPTION OR PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES, ARISING FROM OR IN CONNECTION WITH THESE TERMS, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES; AND (B) IN NO EVENT WILL EITHER PARTY’S AGGREGATE LIABILITY IN CONNECTION WITH THESE TERMS FOR ANY CLAIMS (WHETHER IN CONTRACT, TORT, OR OTHERWISE) EXCEED THE GREATER OF ONE THOUSAND DOLLARS (USD $1,000.00) OR THE TOTAL FEES PAID OR PAYABLE BY CUSTOMER TO OPENCOREEMR DURING THE TWELVE (12) MONTHS PRECEDING THE DATE ON WHICH THE CLAIM AROSE.

11.8 THE FOREGOING LIMITATIONS DO NOT APPLY TO LIABILITY FOR DEATH OR PERSONAL INJURY CAUSED BY A PARTY’S NEGLIGENCE, OR FOR ANY INJURY CAUSED BY A PARTY’S FRAUD OR FRAUDULENT MISREPRESENTATION. CERTAIN JURISDICTIONS DO NOT ALLOW THE EXCLUSION OR LIMITATION OF CERTAIN DAMAGES; IF THOSE LAWS APPLY, SOME OR ALL OF THE ABOVE EXCLUSIONS MAY NOT APPLY. THE LIMITATIONS OF DAMAGES SET FORTH ABOVE ARE FUNDAMENTAL ELEMENTS OF THE BASIS OF THE BARGAIN BETWEEN OPENCOREEMR AND CUSTOMER.

12. CONFIDENTIALITY; SECURITY; HIPAA; DATA PROTECTION

12.1 All data and information of either Party (“Disclosing Party”) received or accessed by the other (“Receiving Party”) that is identified or marked as confidential, or that a reasonable person would believe to be confidential given its nature and the circumstances of disclosure, is “Confidential Information.” Confidential Information does not include information that (w) is or becomes public other than through the Receiving Party; (x) was already in the Receiving Party’s possession on a non-confidential basis; (y) is received from a third party not bound by confidentiality obligations; or (z) is independently developed without use of the Confidential Information. OpenCoreEMR Confidential Information includes all OpenCoreEMR IP; Customer Confidential Information includes all Customer Data.

12.2 The Receiving Party shall maintain Confidential Information in strict confidence, disclose it only to those with a need to know who are under confidentiality obligations at least as restrictive as these Terms, and not use it for any purpose other than as expressly permitted. The Receiving Party remains liable for the acts and omissions of any party to whom it discloses Confidential Information. Where the Receiving Party is compelled to disclose Confidential Information pursuant to a valid legal order, it shall, unless prohibited by law, notify the Disclosing Party in advance, provide a meaningful opportunity to contest the order, and limit disclosure to that which is strictly necessary. The obligations in this Section 12 survive termination for five (5) years, and indefinitely with respect to trade secrets.

12.3 OpenCoreEMR shall implement and maintain a written information security program reasonably designed to: (i) ensure the security, integrity, and confidentiality of Confidential Information; (ii) protect against anticipated threats or hazards; and (iii) protect against unauthorized access or use. The program shall contain physical, technical, and administrative controls appropriate to the type of Confidential Information received, and shall include regularly scheduled risk assessments and adjustments. Except where prohibited by law, OpenCoreEMR shall: (w) inform Customer of any breach of Confidential Information (a “Security Incident”) within seventy-two (72) hours after confirmation; (x) provide reasonable updates as material developments become available; (y) provide a summary of the known scope, affected data, and remediation steps within a commercially reasonable time; and (z) comply with its own legal obligations regarding notifications, provided that neither Party shall issue any public statement identifying the other without prior written consent, except as required by law.

12.4 HIPAA. To the extent Customer provides PHI through the Services, OpenCoreEMR acts as a “Business Associate” and Customer as a “Covered Entity” or “Business Associate,” as applicable, and the BAA governs. If there is a conflict between these Terms and the BAA with respect to PHI, the BAA controls, except that Section 4 (De-Identified Data) controls over the BAA with respect to its subject matter. Customer shall not enter into, and shall not require OpenCoreEMR to enter into, a business associate agreement containing terms that would restrict or eliminate OpenCoreEMR’s rights under Section 4 unless expressly agreed by OpenCoreEMR in writing.

12.5 Data Processing Addendum. OpenCoreEMR’s Data Processing Addendum, in its current version as of the Effective Date, located at https://opencoreemr.com/dpa/, is incorporated into and subject to these Terms by reference (the “DPA”), as it may be updated from time to time, provided that updates will not materially reduce Customer’s data protection rights in a manner inconsistent with applicable law. For purposes of the DPA: (a) these Terms constitute the “DPA Setup Page” and the “Agreement” as those terms are used in the DPA; (b) the “DPA Effective Date” is the Effective Date of these Terms; (c) the Subprocessor List is located at https://www.opencoreemr.com/subprocessors; and (d) the default Schedules identified in the DPA apply. Notwithstanding the order of precedence stated in the DPA, Section 4 (De-Identified Data) of these Terms controls over the DPA with respect to its subject matter, and the creation, ownership, and commercialization of De-Identified Data is a permitted business purpose under Section 2.6 of the DPA. OpenCoreEMR’s retention and processing rights under Section 4.7 and its rights under Section 4.8 are further reflected in Section 2.7 of the DPA.

13. COMMUNICATIONS

13.1 By entering into these Terms or using the Services, Customer and its Authorized Users agree to receive communications from OpenCoreEMR, including by email, text message, call, and push notification through the Services. Such communications may be generated by automatic telephone dialing systems. Communications may include operational messages concerning the account or use of the Services, updates concerning features, communications concerning promotions run by OpenCoreEMR or its third-party partners, and news concerning OpenCoreEMR and industry developments. Standard text messaging charges applied by the recipient’s carrier will apply.

TO OPT OUT OF PROMOTIONAL EMAILS, USE THE UNSUBSCRIBE OPTION IN THE PROMOTIONAL EMAIL ITSELF. TO OPT OUT OF PROMOTIONAL CALLS OR TEXTS, TEXT “END” TO (707) 641-2302 FROM THE MOBILE DEVICE RECEIVING THE MESSAGES. YOU ARE NOT REQUIRED TO CONSENT TO RECEIVE PROMOTIONAL TEXTS OR CALLS AS A CONDITION OF USING THE SERVICES. TO OPT OUT OF ALL TEXTS OR CALLS, INCLUDING OPERATIONAL OR TRANSACTIONAL MESSAGES, TEXT “STOPALL” TO (707) 641-2302 FROM THE MOBILE DEVICE RECEIVING THE MESSAGES. OPTING OUT OF ALL TEXTS MAY IMPACT USE OF THE SERVICES.

14. INTERNATIONAL USERS; EXPORT CONTROL

14.1 The Services are controlled and offered by OpenCoreEMR from its facilities in the United States. OpenCoreEMR makes no representation that the Services are appropriate or available for use in other locations. Those who access the Services from other jurisdictions do so on their own initiative and are responsible for compliance with local law, including local health information privacy, medical records, and data localization requirements. Customer acknowledges that de-identification under 45 C.F.R. § 164.514 is a standard established under United States law and may not satisfy the requirements of other jurisdictions.

14.2 Customer may not use, export, import, or transfer any Services except as authorized by U.S. law, the laws of the jurisdiction in which Customer obtained the Services, and any other applicable laws. In particular, the Services may not be exported or re-exported (a) into any United States embargoed country, or (b) to anyone on the U.S. Treasury Department’s list of Specially Designated Nationals or the U.S. Department of Commerce’s Denied Persons List or Entity List. Customer represents and warrants that it is not located in a country subject to a U.S. Government embargo or designated as a terrorist-supporting country, and is not listed on any U.S. Government list of prohibited or restricted parties. Customer will not use the Services for any purpose prohibited by U.S. law.

15. GENERAL PROVISIONS

15.1 Governing Law; Venue; Jury Waiver. These Terms will be governed by the laws of the State of California, without resort to its conflict of law principles, and each Party irrevocably consents to the exclusive jurisdiction of the state or federal courts located in San Francisco County, California over any suit, action, or proceeding arising out of or relating to these Terms. The United Nations Convention on Contracts for the International Sale of Goods does not apply. THE PARTIES UNCONDITIONALLY AND IRREVOCABLY WAIVE ANY RIGHT TO TRIAL BY JURY IN ANY ACTION, SUIT, OR PROCEEDING ARISING OUT OF OR RELATING TO THESE TERMS.

15.2 Order of Precedence; Negotiated Agreements. If Customer has entered into a separate written agreement with OpenCoreEMR, signed by authorized representatives of both parties, governing Customer’s access to or use of the Services (a “Negotiated Agreement”), then solely with respect to that Customer: (a) the Negotiated Agreement controls over these Terms to the extent of any direct conflict; and (b) these Terms otherwise remain in full force and effect and apply to all matters not expressly addressed in the Negotiated Agreement. The absence from a Negotiated Agreement of a provision addressing a subject covered by these Terms is not a conflict for purposes of this Section. Acceptance of these Terms by an individual in connection with registering for or accessing the Services does not amend, supersede, or waive any provision of a Negotiated Agreement, and no such acceptance constitutes an amendment to a Negotiated Agreement unless made in writing and signed by authorized representatives of both parties as required by that agreement. In the event of a conflict among the documents comprising the agreement between the Parties, the following order of precedence applies: (i) any Negotiated Agreement; (ii) any Order; (iii) the BAA, subject to Section 12.4; (iv) these Terms; and (v) the DPA and any other policies incorporated by reference, subject to Section 12.5.

15.3 Assignment. Customer may not assign, subcontract, delegate, or otherwise transfer these Terms or its rights and obligations, in whole or in part, without OpenCoreEMR’s prior written consent, except to an Affiliate or in connection with a merger or sale of all or substantially all of Customer’s assets or capital stock, so long as the assignee assumes all of Customer’s obligations and is not a direct competitor of OpenCoreEMR. OpenCoreEMR may assign these Terms freely, including in connection with a merger, acquisition, or sale of assets. Any attempted assignment in violation of this Section is void. These Terms bind and inure to the benefit of the Parties’ respective successors and permitted assigns.

15.4 Publicity. OpenCoreEMR may identify Customer as an OpenCoreEMR customer, and use Customer’s Marks, on OpenCoreEMR’s website and in its customer lists. Any other use requires Customer’s prior written consent in each instance, not to be unreasonably withheld.

15.5 Notices. Notices to OpenCoreEMR shall be sent to OpenCoreEMR Inc., 455 Market St., Suite 1940, PMB 629461, San Francisco, CA 94105, Attention: Legal Department, or to legal@opencoreemr.com, and are deemed given when received. Notices to Customer may be sent to the email address associated with Customer’s account or posted within the Services, and are deemed given when sent or posted. Customer is responsible for keeping its account email address current; OpenCoreEMR’s dispatch of an email to the last address provided constitutes effective notice even if that address is no longer valid.

15.6 Questions and Complaints. Questions, complaints, or claims with respect to the Services may be directed to https://opencoreemr.com/contact/.

15.7 Force Majeure. Neither Party will be liable for any delay or failure to perform resulting from causes outside its reasonable control, including acts of God, pandemics, war, terrorism, riots, embargoes, acts of civil or military authority, fire, flood, accident, strikes, or shortages of transportation facilities, fuel, energy, labor, or materials, provided that the affected Party gives prompt written notice and uses commercially reasonable efforts to resume performance.

15.8 General. These Terms, together with the documents referenced in Section 15.2, contain the entire agreement between the Parties concerning their subject matter and supersede all prior or contemporaneous agreements or understandings, whether written or oral, other than a Negotiated Agreement. The Parties are independent contractors, and nothing in these Terms creates a joint venture, partnership, or principal-agent relationship. No waiver or failure to enforce any provision on one occasion is a waiver of that or any other provision on any other occasion. No term may be amended or waived except as provided in Section 1.5 or by mutual written agreement. If any provision is determined to be void, illegal, or unenforceable, that provision will be construed to reflect as nearly as possible the original intent of the Parties and enforced to the maximum extent allowed, and all other provisions will remain in full force and effect.

16. PAYMENT PROCESSING AGREEMENT

This Payment Processing Agreement is entered into between OpenCoreEMR Inc. (“Platform”) and the customer entity using the payment acceptance features of the Services (“Merchant”). This Section 16 governs Merchant’s use of the payment processing features described below and supplements the remainder of these Terms.

16.1 Processing Services. In addition to its core services offering, Platform offers embedded payment processing services, which includes credit card, debit card, ACH, and other payment processing services, as may be offered from time to time (collectively the “Processing Services”). For clarity, the Processing Services described in this Section 16 are distinct from the Stripe payment processing used for Merchant’s own subscription payments to Platform described in Section 8.3.

16.2 Fees and Taxes. Related to the Processing Services, Platform will charge Merchant according to the fees listed below (“Processing Fees”). All Processing Fees are exclusive of taxes.

Processing Fees	Rate
Card Transaction Volume Fee	2.90%
Transaction Per Item Fee (Card & ACH)	$0.30
Refund Per Item Fee (Card & ACH)	$0.30
Chargeback & ACH Return Fee	$20.00
Account Updater (Per Card Updated)	$0.25

If Merchant has an alternative pricing agreement with Platform, Merchant should refer to that agreement for official pricing.

16.3 Fair Use Policy. Platform may increase the Card Transaction Volume Fee or Per Item Transaction Fee if Merchant’s (a) American Express credit card payment dollar volume exceeds twenty percent (20%) of total monthly credit card payments; (b) corporate credit card payment volume exceeds ten percent (10%) of total monthly credit card payments; or (c) credit card payments for transaction amounts greater than one thousand dollars ($1,000.00) exceeds three percent (3%) of total monthly credit card payments. Such increases shall become effective only after Platform has provided Merchant written notice setting forth the changes.

16.4 Processing Terms and Conditions. By using the Processing Services, Merchant agrees to the Processing Terms and Conditions available at https://legal.rainforestpay.com/processingterms, which may be amended at any time on notice.

16.5 Term. This Payment Processing Agreement begins on the date Merchant first uses the Processing Services and continues until terminated by either party in accordance with Section 10 of these Terms.