LEGAL

Terms of Service

The short, readable version. Your signed order form and BAA control where they differ.

The service

HealthXfer provides a hosted platform for requesting, fulfilling, and auditing exchanges of medical records between healthcare facilities. We are infrastructure — the plumbing between your systems and outside requestors. Clinical and disclosure decisions remain yours.

Your responsibilities

• Use the service only for lawful record exchange, with appropriate patient authorization or another permitted basis under HIPAA.
• Keep credentials and org API keys confidential; revoke keys for organizations you no longer work with.
• Verify recipient details before fulfilling a request — HealthXfer surfaces checks, but a human (or your configured automation rules) makes the call.
• Pay subscription fees per your order form. Annual plans are invoiced upfront; PO / Net 30 available.

Our responsibilities

• Operate the service with commercially reasonable skill and care, targeting high availability (uptime SLA per plan).
• Handle PHI only as described in the BAA and our Privacy Policy.
• Give at least 30 days' notice of material changes to these terms or pricing.

Limits

The service is provided "as is" to the maximum extent permitted by law. Our aggregate liability is capped at fees paid in the twelve months before the claim. Neither party is liable for indirect or consequential damages. Nothing here limits liability that cannot be limited by law.

Term & termination

Either party may terminate for material breach uncured after 30 days' notice. On termination we deactivate your tenant; the PHI vault design means identifiers are already purged or expire within 72 hours.

Contact

Questions: sales@healthxfer.com