Synchronizer Terms of Use

This Synchronizer Terms of Use (the “Agreement”) is a binding agreement between you (“Practice” or “you“) and VMC MAR COM Inc., a Delaware corporation d/b/a HeyDonto with offices located at 10258 Hardin Valley Rd #2 Knoxville, TN 37932 (“HeyDonto”). HeyDonto and Practice may be referred to herein collectively as the “Parties” or individually as a “Party”. This Agreement governs your use of HeyDonto’s Synchronizer (the “Synchronizer“), which allows you to connect to and extract data (“Practice Data”) from an electronic health records system or similar record system and transmit such Practice Data to Authorized Third Parties (as defined in Section 1(d)).

BY ACCEPTING THIS AGREEMENT, WHETHER BY CLICKING “AGREE”, SIGNING A AN ORDER FORM, OR OTHERWISE, YOU (A) ACKNOWLEDGE THAT YOU HAVE READ AND UNDERSTAND THIS AGREEMENT; (B) ARE AUTHORIZED TO ENTER INTO THIS AGREEMENT ON BEHALF OF THE ORGANIZATION YOU REPRESENT; AND (C) ACCEPT THIS AGREEMENT AND AGREE THAT YOU ARE LEGALLY BOUND BY ITS TERMS. IF YOU DO NOT AGREE TO THESE TERMS, DO NOT ACCEPT THIS AGREEMENT AND DO NOT INSTALL THE SYNCHRONIZER.

1. Synchronizer

1. License Grant. Subject to the terms and conditions of this Agreement, HeyDonto hereby grants Practice a non-exclusive, non-sublicensable, and non- transferable (except in compliance with Section 9(g)) license during the Term to install and use the Synchronizer within Practice’s system solely for the purpose of allowing authorized third parties to access, retrieve and use Practice Data.
2. Use Restrictions. Practice shall not use the Synchronizer for any purposes beyond the scope of the license granted in this Agreement. Without limiting the foregoing and except as otherwise expressly set forth in this Agreement, Practice shall not at any time, directly or indirectly: (i) copy, modify, or create derivative works of the Synchronizer, in whole or in part; (ii) rent, lease, lend, sell, sublicense, assign, distribute, publish, transfer, or otherwise make available the Synchronizer; (iii) reverse engineer, disassemble, decompile, decode, adapt, or otherwise attempt to derive or gain access to the source code of the Synchronizer, in whole or in part; (iv) remove any proprietary notices from the Synchronizer; or (v) use the Synchronizer in any manner or for any purpose that infringes, misappropriates, or otherwise violates any intellectual property right or other right of any person, or that violates any applicable law.
3. Reservation of Rights. HeyDonto reserves all rights not expressly granted to Practice in this Agreement. Except for the limited rights and licenses expressly granted under this Agreement, nothing in this Agreement grants, by implication, waiver, estoppel, or otherwise, to Practice or any third party any intellectual property rights or other right, title, or interest in or to the Synchronizer.
4. Authorized Third Party. The Synchronizer enables third parties to request access to and gain access to Practice Data. Prior to any third-party gaining access to Practice Data, Practice will receive an email notification, sent to an account designated by Practice, informing them of the access request by the named third party. Practice shall have the sole authority to grant or deny access to their Practice Data to such third party (such party, once authorized, an “Authorized Third-Party”). It is solely the Practice’s responsibility to ensure that, before granting the Authorized Third-Party access, Practice has entered into a written agreement with such third party to permit such Authorized Third-Party to access their Practice Data.
5. HIPAA. In the event the use of the Synchronizer requires the disclosure of any PHI as defined by HIPAA, and it is likely that HeyDonto will be considered a “Business Associate” as that term is defined under HIPAA, the Parties agree to, and hereby do, enter into the Business Associate Agreement (“BAA”) attached hereto as Exhibit A.
6. Information Security. HeyDonto maintains robust information security practices to protect data and systems. Details of HeyDonto’s current Sychronizer Security Policy can be found at [https://heydonto.com/data-transition-policy/ & https://heydonto.com/data-usage-ethical-guidelines/ ]. HeyDonto’s security practices are described in the posted policy, which may be updated from time to time.

2. Practice Responsibilities

1. General. Practice shall be solely responsible and liable for all uses of the Synchronizer resulting from access provided by Practice, directly or indirectly, whether such access or use is permitted by or in violation of this Agreement.
2. Consumer Consent. Practice represents and warrants that it has obtained, and will maintain, all necessary consents, authorizations, and permissions required from individuals or other third parties whose information is being shared through the Synchronizer. Practice is solely responsible for ensuring that the collection, use, and disclosure of such information complies with all applicable laws and regulations, including but not limited to privacy and data protection laws. Prior to sharing any individual’s or other third party’s information, Practice shall ensure that it has all requisite rights and consents to permit HeyDonto and any Authorized Third Parties to access and use such information as contemplated under this Agreement.
3. Authorized Install. Practice represents and warrants that it has the full right, power and authority to install the Synchronizer on its systems and otherwise to integrate and have access to Practice’s record management system (including record management systems provided by third party vendors). Practice acknowledges and agrees that it is solely responsible for the installation and use of the Synchronizer within its system, and shall be solely and fully liable for any liabilities, damages, losses, costs, or expenses arising from such installation or use, including but not limited to any unauthorized access, data breaches, or violations of applicable laws and regulations.

3. Fees

The Synchronizer is provided to Practice at no charge. Practice acknowledges and agrees that Authorized Third Parties requesting access to the Synchronizer or to Practice’s data through the Synchronizer may be subject to fees charged by HeyDonto. Practice shall have no responsibility for any such fees imposed on Authorized Third Parties.

4. Intellectual Property Ownership; Practice Data; Aggregated Data; Feedback

1. HeyDonto IP. Practice acknowledges that, as between Practice and HeyDonto, HeyDonto owns all right, title, and interest, including all intellectual property rights, in and to the Synchronizer.
2. Practice Data. HeyDonto acknowledges that, as between HeyDonto and Practice, Practice owns all right, title, and interest, including all intellectual property rights, in and to the Practice Data. Practice hereby grants HeyDonto a non-exclusive, royalty-free, worldwide license to reproduce, distribute, and otherwise use and display the Practice Data and perform all acts with respect to the Practice Data as may be necessary for HeyDonto to provide the Synchronizer services to Practice.
3. Aggregated Data. Notwithstanding anything to the contrary in this Agreement, HeyDonto may monitor Practice’s use of the Synchronizer and collect and compile Aggregated Statistics (as defined below). As between HeyDonto and Practice, all right, title, and interest in Aggregated Statistics, and all intellectual property rights therein, belong to and are retained solely by HeyDonto. Practice agrees that HeyDonto may (i) make Aggregated Statistics publicly available in compliance with applicable law, and (ii) use Aggregated Statistics to the extent and in the manner permitted under applicable law. “Aggregated Statistics” means data and information related to Practice’s use of the Synchronizer that is used by HeyDonto in an aggregate and anonymized manner, including to compile statistical and performance information related to the provision and operation of the Synchronizer.
4. Feedback. If Practice or any of its employees or contractors sends or transmits any communications or materials to HeyDonto by mail, email, telephone, or otherwise, suggesting or recommending changes to the Synchronizer, including without limitation, new features or functionality relating thereto, or any comments, questions, suggestions, or the like (“Feedback“), HeyDonto is free to use such Feedback irrespective of any other obligation or limitation between the Parties governing such Feedback.

5. Warranty Disclaimer 

THE SYNCHRONIZER IS PROVIDED “AS IS” AND HEYDONTO HEREBY DISCLAIMS ALL WARRANTIES, WHETHER EXPRESS, IMPLIED, STATUTORY, OR OTHERWISE. HEYDONTO SPECIFICALLY DISCLAIMS ALL IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, AND NON-INFRINGEMENT, AND ALL WARRANTIES ARISING FROM COURSE OF DEALING, USAGE, OR TRADE PRACTICE. HEYDONTO MAKES NO WARRANTY OF ANY KIND THAT THE SYNCHRONIZER, OR ANY PRODUCTS OR RESULTS OF THE USE THEREOF, WILL MEET PRACTICE’S OR ANY OTHER PERSON’S REQUIREMENTS, OPERATE WITHOUT INTERRUPTION, ACHIEVE ANY INTENDED RESULT, BE COMPATIBLE OR WORK WITH ANY SYNCHRONIZER, SYSTEM OR OTHER SERVICES, OR BE SECURE, ACCURATE, COMPLETE, FREE OF HARMFUL CODE, OR ERROR FREE.

6. Practice Indemnification 

Practice shall indemnify, hold harmless, and, at HeyDonto’s option, defend HeyDonto from and against any losses resulting from any third-party claim based on Practice’s (i) negligence or willful misconduct; or (ii) use of the Synchronizer in a manner not authorized or contemplated by this Agreement; (iii) use of the Synchronizer in combination with the unauthorized use of any data, software, record management system, hardware, equipment, or technology; (iv) modifications to the Synchronizer not made by HeyDonto; or (v) any violation of applicable law, provided that Practice may not settle any third- party claim against HeyDonto unless HeyDonto consents to such settlement (which HeyDonto may provide in its sole discretion), and further provided that HeyDonto will have the right, at its option, to defend itself against any such third-party claim or to participate in the defense thereof by counsel of its own choice.

7. Limitations of Liability 

IN NO EVENT WILL HEYDONTO BE LIABLE UNDER OR IN CONNECTION WITH THIS AGREEMENT UNDER ANY LEGAL OR EQUITABLE THEORY, INCLUDING BREACH OF CONTRACT, TORT (INCLUDING NEGLIGENCE), STRICT LIABILITY, AND OTHERWISE, FOR ANY: (a) CONSEQUENTIAL, INCIDENTAL, INDIRECT, EXEMPLARY, SPECIAL, ENHANCED, OR PUNITIVE DAMAGES; (b) INCREASED COSTS, DIMINUTION IN VALUE OR LOST BUSINESS, PRODUCTION, REVENUES, OR PROFITS; (c) LOSS OF GOODWILL OR REPUTATION; (d) USE, INABILITY TO USE, LOSS, INTERRUPTION, DELAY OR RECOVERY OF ANY DATA, PRACTICE DATA, OR BREACH OF DATA OR SYSTEM SECURITY; OR (e) COST OF REPLACEMENT GOODS OR SERVICES, IN EACH CASE REGARDLESS OF WHETHER HEYDONTO WAS ADVISED OF THE POSSIBILITY OF SUCH LOSSES OR DAMAGES OR SUCH LOSSES OR DAMAGES WERE OTHERWISE FORESEEABLE. IN NO EVENT WILL HEYDONTO’S AGGREGATE LIABILITY ARISING OUT OF OR RELATED TO THIS AGREEMENT UNDER ANY LEGAL OR EQUITABLE THEORY, INCLUDING BREACH OF CONTRACT, TORT (INCLUDING NEGLIGENCE), STRICT LIABILITY, AND OTHERWISE EXCEED $1,000 US.

8. Term and Termination

1. Term. This Agreement commences upon Practice’s installation of the Synchronizer and remains in effect for as long as Practice continues to use the Synchronizer, unless earlier terminated in accordance with the terms of this Agreement. Either Party may terminate this Agreement at any time by providing written notice to the other Party; provided, however, Practice shall not terminate this Agreement unless and until it has terminated all agreements with Authorized Third Parties that require access to the Synchronizer to provide the applicable services. Upon termination, Practice shall cease all use of the Synchronizer and delete all copies in its possession, including any backup or archival copies.
2. Termination. In addition to any other express termination right set forth in this Agreement, either Party may terminate this Agreement, effective on written notice to the other Party, if the other Party breaches this Agreement, and such breach: (A) is incapable of cure; or (B) being capable of cure, remains uncured 30 days after the non- breaching Party provides the breaching Party with written notice of such breach
   
3. Effect of Expiration or Termination. Upon expiration or earlier termination of this Agreement, the licenses granted hereunder will also terminate (except for the license in Section 1(e)). Practice shall cease using and delete, destroy, or return all copies of the Synchronizer and certify in writing to HeyDonto that the Synchronizer has been deleted or destroyed.

9. Miscellaneous

1. Entire Agreement. This Agreement, together with any other documents incorporated herein by reference and all related Exhibits, constitutes the sole and entire agreement of the Parties with respect to the subject matter of this Agreement and supersedes all prior and contemporaneous understandings, agreements, and representations and warranties, both written and oral, with respect to such subject matter. In the event of any inconsistency between the statements made in the body of this Agreement, the related Exhibits, and any other documents incorporated herein by reference, the following order of precedence governs: (a) first, this Agreement, excluding its Exhibits; (b) second, the Exhibits to this Agreement as of the Effective Date; and (c) third, any other documents incorporated herein by reference.
2. Notices. All notices, requests, consents, claims, demands, waivers, and other communications hereunder (each, a “Notice“) must be in writing and addressed to the Parties at the addresses set forth on the first page of this Agreement (or to such other address that may be designated by the Party giving Notice from time to time in accordance with this Section). All Notices must be delivered by personal delivery, nationally recognized overnight courier (with all fees pre-paid), facsimile[, or email] (with confirmation of transmission), or certified or registered mail (in each case, return receipt requested, postage pre-paid). Except as otherwise provided in this Agreement, a Notice is effective only: (i) upon receipt by the receiving Party, and (ii) if the Party giving the Notice has complied with the requirements of this Section.
3. Force Majeure. In no event shall HeyDonto be liable to Practice, or be deemed to have breached this Agreement, for any failure or delay in performing its obligations under this Agreement, if and to the extent such failure or delay is caused by any circumstances beyond HeyDonto’s reasonable control, including but not limited to: (i) acts of God; (ii) flood, fire, earthquake, or explosion; (iii) war, invasion, hostilities (whether war is declared or not), terrorist threats or acts, riot or other civil unrest; (iv) government order, law, or actions; (v) embargoes or blockades in effect on or after the date of this Agreement; and (vi) national or regional emergency; and [(vii) strikes, labor stoppages or slowdowns, or other industrial disturbances; and (viii) shortage of adequate power or transportation facilities.
4. Amendment and Modification; Waiver. No amendment to or modification of this Agreement is effective unless it is in writing and signed by an authorized representative of each Party. No waiver by any Party of any of the provisions hereof will be effective unless explicitly set forth in writing and signed by the Party so waiving. Except as otherwise set forth in this Agreement, (i) no failure to exercise, or delay in exercising, any rights, remedy, power, or privilege arising from this Agreement will operate or be construed as a waiver thereof, and (ii) no single or partial exercise of any right, remedy, power, or privilege hereunder will preclude any other or further exercise thereof or the exercise of any other right, remedy, power, or privilege.
5. Severability. If any provision of this Agreement is invalid, illegal, or unenforceable in any jurisdiction, such invalidity, illegality, or unenforceability will not affect any other term or provision of this Agreement or invalidate or render unenforceable such term or provision in any other jurisdiction. Upon such determination that any term or other provision is invalid, illegal, or unenforceable, the Parties hereto shall negotiate in good faith to modify this Agreement so as to effect the original intent of the Parties as closely as possible in a mutually acceptable manner in order that the transactions contemplated hereby be consummated as originally contemplated to the greatest extent possible.
6. Governing Law; Submission to Jurisdiction. This Agreement is governed by and construed in accordance with the internal laws of the State of Delaware without giving effect to any choice or conflict of law provision or rule that would require or permit the application of the laws of any jurisdiction other than those of the State of Delaware. Any legal suit, action, or proceeding arising out of this Agreement or the licenses granted hereunder will be instituted exclusively in the federal courts of the United States or the courts of the State of Delaware, and each Party irrevocably submits to the exclusive jurisdiction of such courts in any such suit, action, or proceeding.
7. Assignment. Practice may not assign or transfer any of its rights or delegate any of its obligations hereunder, in each case whether voluntarily, involuntarily, by operation of law or otherwise, without the prior written consent of HeyDonto, which consent shall not be unreasonably withheld, conditioned, or delayed. Any purported assignment, transfer, or delegation in violation of this Section is null and void. No assignment, transfer, or delegation will relieve the assigning or delegating Party of any of its obligations hereunder. This Agreement is binding upon and inures to the benefit of the Parties hereto and their respective permitted successors and assigns.
8. Export Regulation. The Synchronizer may be subject to US export control laws, including the Export Control Reform Act and its associated regulations. Practice shall not, directly or indirectly, export, re-export, or release the Synchronizer to, or make the Synchronizer accessible from, any jurisdiction or country to which export, re-export, or release is prohibited by law, rule, or regulation. Practice shall comply with all applicable federal laws, regulations, and rules, and complete all required undertakings (including obtaining any necessary export license or other governmental approval), prior to exporting, re-exporting, releasing, or otherwise making the Synchronizer available outside the US.
   

Exhibit A: Business Associate Agreement

Definitions

Catch-all definition:

The following terms used in this Agreement shall have the same meaning as those terms in the HIPAA Rules: Breach, Data Aggregation, Designated Record Set, Disclosure, Health Care Operations, Individual, Minimum Necessary, Notice of Privacy Practices, Protected Health Information, Required By Law, Secretary, Security Incident, Subcontractor, Unsecured Protected Health Information, and Use.

Specific definitions:

1. Business Associate. “Business Associate” shall generally have the same meaning as the term “Business Associate” at 45 CFR 160.103, and in reference to the party to this agreement, shall mean HeyDonto.
2. Covered Entity. “Covered Entity” shall generally have the same meaning as the term “Covered Entity” at 45 CFR 160.103, and in reference to the party to this agreement, shall mean the Practice.
3. HIPAA Rules. “HIPAA Rules” shall mean the Privacy, Security, Breach Notification, and Enforcement Rules at 45 CFR Part 160 and Part 164.

Obligations and Activities of Business Associate

Business Associate agrees to:

1. Not use or disclose protected health information other than as permitted or required by the Agreement or as required by law;
2. Use appropriate safeguards, and comply with Subpart C of 45 CFR Part 164 with respect to electronic protected health information, to prevent use or disclosure of protected health information other than as provided for by the Agreement;
3. Report to Covered Entity any use or disclosure of protected health information not provided for by the Agreement of which it becomes aware, including breaches of unsecured protected health information as required at 45 CFR 164.410, and any security incident of which it becomes aware;
4. In accordance with 45 CFR 164.502(e)(1)(ii) and 164.308(b)(2), if applicable, ensure that any subcontractors that create, receive, maintain, or transmit protected health information on behalf of the Business Associate agree to the same restrictions, conditions, and requirements that apply to the Business Associate with respect to such information;
5. Make available protected health information in a designated record set to the Covered Entity as necessary to satisfy Covered Entity’s obligations under 45 CFR 164.524;
   
6. Make any amendment(s) to protected health information in a designated record set as directed or agreed to by the Covered Entity pursuant to 45 CFR 164.526, or take other measures as necessary to satisfy Covered Entity’s obligations under 45 CFR 164.526;
7. Maintain and make available the information required to provide an accounting of disclosures to the Covered Entity as necessary to satisfy Covered Entity’s obligations under 45 CFR 164.528;
8. To the extent the Business Associate is to carry out one or more of Covered Entity’s obligation(s) under Subpart E of 45 CFR Part 164, comply with the requirements of Subpart E that apply to the Covered Entity in the performance of such obligation(s); and
9. Make its internal practices, books, and records available to the Secretary for purposes of determining compliance with the HIPAA Rules.

Permitted Uses and Disclosures by Business Associate

1. Business Associate may only use or disclose protected health information as set forth in this Agreement.
2. Business Associate is authorized to de-identify protected health information in accordance with 45 CFR §164.514(a)-(c). Business Associate may use and disclose such de- identified information for any lawful business purpose, including but not limited to analytics, research, product development, and marketing. Business Associate shall ensure that the de- identification process complies with all applicable laws and regulations, and that the de- identified information cannot be used to re-identify any individual
3. Business Associate may use or disclose protected health information as required by law.
4. Business Associate agrees to make uses and disclosures and requests for protected health information consistent with Covered Entity’s minimum necessary policies and procedures.
5. Business Associate may not use or disclose protected health information in a manner that would violate Subpart E of 45 CFR Part 164 if done by Covered Entity, except for the specific uses and disclosures set forth below.

Provisions for Covered Entity to Inform Business Associate of Privacy Practices and Restrictions

1. Covered Entity shall notify Business Associate of any limitation(s) in the notice of privacy practices of Covered Entity under 45 CFR 164.520, to the extent that such limitation may affect Business Associate’s use or disclosure of protected health information.
2. Covered Entity shall notify Business Associate of any changes in, or revocation of, the permission by an individual to use or disclose his or her protected health information, to the extent that such changes may affect Business Associate’s use or disclosure of protected health information.
   
3. Covered Entity shall notify Business Associate of any restriction on the use or disclosure of protected health information that Covered Entity has agreed to or is required to abide by under 45 CFR 164.522, to the extent that such restriction may affect Business Associate’s use or disclosure of protected health information.

Term and Termination

1. Term. The term of this Business Associate Agreement shall commence as set forth in the Agreement between the Parties and shall continue for the duration specified therein, unless earlier terminated in accordance with the Agreement.
2. Obligations of Business Associate Upon Termination. Upon termination of this Agreement for any reason, Business Associate shall return to Covered Entity or, if agreed to by Covered Entity, destroy all protected health information received from Covered Entity, or created, maintained, or received by Business Associate on behalf of Covered Entity, that the Business Associate still maintains in any form. Business Associate shall retain no copies of the protected health information. Notwithstanding the foregoing, this obligation does not apply to any de-identified protected health information that Business Associate has created in accordance with 45 CFR §164.514(a)-(c). Business Associate may retain and continue to use such de-identified information for any lawful business purpose, even after termination of this Agreement.
3. Survival. The obligations of Business Associate under this Section shall survive the termination of this Agreement.

Miscellaneous

1. Regulatory References. A reference in this Agreement to a section in the HIPAA Rules means the section as in effect or as amended.
2. Amendment. The Parties agree to take such action as is necessary to amend this Agreement from time to time as is necessary for compliance with the requirements of the HIPAA Rules and any other applicable law.
3. Interpretation. Any ambiguity in this Agreement shall be interpreted to permit compliance with the HIPAA Rules.