ChartVoyant Practice Services Agreement

Companion documents: CV-BAA-002 customer BAA (attached here as Exhibit C) · CV-BAA-001 vendor register · CV-POL-001 policies · CV-IRP-001 incident response and breach notification

---

0. How this Agreement is organised

Who is who. The Company is the business associate and the vendor. The Practice is the covered entity and the customer. That direction is fixed by what the software does.

Scope. This Agreement carries the commercial terms. The Business Associate Agreement at Exhibit C governs protected health information and nothing else; where the two conflict on any matter concerning PHI, the BAA controls.

What a complete signed set looks like. This Agreement, plus a completed Exhibit A (Order Form), plus a signed Exhibit C (Business Associate Agreement). Exhibits B and D are terms, not separate signatures. A practice that has signed this Agreement without a completed Exhibit A has agreed to no price, and one without a signed Exhibit C must not be sent PHI.

---

1. Parties and background

This Practice Services Agreement (the "Agreement") is entered into as of the Effective Date stated in Exhibit A by and between:

Geach Medical, PLLC, a Tennessee professional limited liability company trading as ChartVoyant, of Cleveland, Tennessee (the "Company"); and

the practice identified in Exhibit A (the "Practice").

The Company operates ChartVoyant, a cloud-hosted electronic medical record and practice-workflow platform. The Practice wishes to use it to document care, run its schedule, and bill for services. In doing so the Company will create, receive, maintain and transmit protected health information on the Practice's behalf, which makes the Company a business associate of the Practice under HIPAA.

The parties agree as follows.

---

2. Definitions

Capitalized terms not defined here have the meanings given in HIPAA (45 CFR Parts 160 and 164).

"Authorized User" — an individual the Practice authorizes to access the Service under the Practice's account: its clinicians, staff and contractors.

"BAA" — the Business Associate Agreement at Exhibit C.

"Effective Date" — the date stated in Exhibit A.

"HIPAA" — the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations, as amended, including the HITECH Act.

"Order Form" — Exhibit A, which identifies the Practice, the plan, the fees and the billing contact.

"PHI" — protected health information as defined at 45 CFR §160.103.

"Practice Data" — all data the Practice or its Authorized Users enter into, upload to, or generate through the Service, including PHI, clinical documentation, schedules, billing records and account configuration. Practice Data does not include the Service itself or Usage Data.

"Service" — the ChartVoyant platform made available to the Practice under this Agreement, including any modules identified in the Order Form.

"Usage Data" — technical and operational records the Company generates about the operation of the Service: request logs, error traces, performance counters, feature-usage counts, and the volume metrics used to compute fees. Usage Data contains no PHI and no Practice Data content.

---

3. The Service — and what it is not

3.1 Grant. Subject to this Agreement, the Company grants the Practice a non-exclusive, non-transferable, non-sublicensable right during the Term for its Authorized Users to access and use the Service for the Practice's own internal clinical, administrative and billing operations.

3.2 Documentation software, not a clinician. The Service is documentation and workflow software. Nothing it produces is medical advice, a diagnosis, or a treatment recommendation, and nothing in it creates a physician-patient relationship between the Company and any patient.

3.3 Every clinical output is a draft. The Service includes features that draft clinical text, suggest codes, and surface information for review. Every such output is a draft for a licensed clinician to review, edit and approve. The Service is designed to keep a human in the loop, it carries a "why suggested" trail for its suggestions, and it does not interpret images or diagnostic signals. The clinician remains solely responsible for every clinical decision, for the accuracy and completeness of the record, and for their own legal and professional obligations. The Company will not remove a clinician confirmation step from a clinical workflow.

3.4 Not a medical device. The Service is not intended to be, and has not been cleared or approved as, a medical device.

3.5 Certification. The Company makes no representation that the Service is certified health IT under the ONC Health IT Certification Program except to the extent expressly stated in the Order Form. Where a Practice's participation in a payment program depends on certified technology, that is the Practice's determination to make.

3.6 Changes to the Service. The Company may modify the Service. Where a change materially reduces core functionality the Practice relies on, the Company will give at least 30 days' notice, and the Practice may terminate under §5.3 if the change is materially adverse to it.

---

4. Fees and payment

4.1 Fees. The Practice pays the fees stated in the Order Form. Fees are charged per provider, per month, with a minimum of one provider.

There is one plan and it includes every feature of the Service. There is no functionality held back for a higher tier. The Company's standard rates are:

What the add-on is, and what it is not. The optional add-on is the ✦ AI assistant tab — the conversational assistant inside the Service that answers questions about the practice and helps run it. It is $100 per provider per month on top of the base rate.

The add-on is not "AI" as a whole. The base subscription already includes every other AI-assisted feature of the Service, and turning the add-on off does not remove any of them: note drafting, ambient dictation, the in-chart AI panel, patient check-in assistance, clinical assist, and fax and document reading are all base subscription. The add-on gates one tab and nothing else.

4.1.1 Included AI credits. The AI assistant tab includes $20.00 per week of AI credits for each of the Practice's staff members, measured as the Company's cost of the underlying model calls. Each staff member's allowance is their own; it is not pooled, it does not carry over from one week to the next, and reaching it pauses that person's AI tab until the following week without affecting anyone else or any other part of the Service.

4.1.2 Raising the allowance (top-up). The Practice may raise any staff member's weekly credit allowance in steps of $10.00 per week. Each additional $10.00 per week of allowance costs $59.00 per staff member, per month.

Top-ups are bought per staff member, not per provider, and only for the people who need one — a practice can raise the allowance for two heavy users and leave everyone else on the included $20.00. A top-up applies for the billing month, renews with the monthly invoice until cancelled, and can be cancelled effective the next invoice. Unused allowance does not carry over from week to week or from month to month.

The rate that applies to the Practice is the one in the Order Form, which controls.

4.1.3 Implementation fee. A one-time implementation fee of $3,499.00 is charged on the Practice's first invoice. It covers onboarding: migrating the Practice's existing data, configuring providers, locations, templates and payers, and training the Practice's staff.

It is charged once, per office. It does not recur, it does not scale with the number of providers, and a Practice that later adds a provider or a location does not pay it again. The amount stated in the Order Form controls, and the Company may reduce or waive it there.

4.2 What counts as a provider. A provider is an individual credentialed in the Service to render and sign for services — a physician, nurse practitioner, physician assistant or equivalent. Front desk, billing and administrative accounts are not counted and are not separately charged. The count is taken on the day the charge is raised.

4.3 Billing. Fees are billed monthly in advance and charged automatically to the payment method the Practice keeps on file, on the day of the month stated in the Order Form. Card details are handled by the Company's payment processor; the Company does not store card numbers.

4.4 Changes in provider count. Adding a provider mid-month is charged on the next monthly invoice. Removing one takes effect on the next monthly invoice. The Company does not prorate mid-month.

4.5 Price changes. The Company may change its rates on at least 60 days' written notice. A Practice that does not accept the change may terminate under §5.2 before it takes effect; the change does not apply to a Practice that has terminated.

4.6 Taxes. Fees are exclusive of taxes. The Practice is responsible for any sales, use or similar taxes other than taxes on the Company's income.

4.7 Non-payment. If a charge fails, the Company will notify the Practice's billing contact in writing. If the amount remains unpaid 10 days after that notice, the Company may suspend access to the Service until it is paid.

The Company will not delete Practice Data for non-payment. Suspension withholds access; it does not destroy records. On payment, or on the Practice's written request for its data, access to export is restored. A medical record is a legal and clinical obligation of the Practice's, and using it as leverage in a billing dispute is not something this Agreement permits.

---

5. Term and termination

5.1 Term. This Agreement begins on the Effective Date and continues month to month until terminated. There is no minimum commitment.

5.2 Termination for convenience. Either party may terminate on 30 days' written notice, ending at the close of the monthly billing period in which the notice period expires. Fees already paid for that period are not refunded; no further fees are charged.

5.3 Termination for cause. Either party may terminate immediately on written notice if the other materially breaches this Agreement and does not cure the breach within 30 days of written notice of it, or immediately on the other's insolvency, assignment for the benefit of creditors, or comparable proceeding.

5.4 Termination of the BAA. The BAA terminates when this Agreement terminates, except that its obligations that survive by their terms — including return or destruction of PHI and the 6-year retention of records — survive.

5.5 Suspension for cause. The Company may suspend access without prior notice where it reasonably believes continued access presents an imminent security risk, exposes PHI to unauthorized access, or is unlawful. It will tell the Practice why as soon as practicable and restore access when the cause is resolved.

---

6. The Practice's obligations

6.1 Its own compliance. The Practice is a covered entity and remains responsible for its own HIPAA compliance, including maintaining its own Notice of Privacy Practices, obtaining any patient authorizations its own operations require, and its own workforce training and sanctions. This Agreement does not provide any of those.

6.2 Accounts. The Practice is responsible for its Authorized Users' acts and omissions in the Service as if they were its own. Accounts are individual: login credentials must not be shared, including with the Company. The Practice will promptly disable accounts for people who leave.

6.3 Accuracy of the record. The Practice is responsible for the accuracy, completeness and clinical appropriateness of everything recorded in the Service, including anything drafted by an automated feature and approved by its clinicians.

6.4 Lawful use. The Practice will use the Service in compliance with applicable law, including HIPAA, state medical-records law, and the controlled-substance requirements applicable to it. In Tennessee those include mandatory electronic prescribing of controlled substances (T.C.A. § 63-1-160) and Controlled Substance Monitoring Database checking; the Service supports these workflows, and meeting them remains the prescriber's legal obligation.

6.5 Acceptable use. The Practice and its Authorized Users will not: attempt to gain unauthorized access to any system or account; probe, scan or test the security of the Service without the Company's prior written permission; reverse engineer or attempt to derive the source of the Service except where that right cannot be waived by law; scrape or bulk-extract other than through the Service's own export features; interfere with or overload the Service; upload malware; resell or provide the Service to a third party; or use the Service to store data for any entity other than the Practice.

6.6 Cooperation. The Practice will give the Company the information it reasonably needs to provide the Service, and will promptly report any suspected unauthorized access to its account.

---

7. Practice Data, ownership, and what the Company may not do with it

7.1 The Practice owns its data. As between the parties, the Practice owns all Practice Data. The Company acquires no ownership of it and no license to it except the limited right to process it in order to provide the Service, as further limited by the BAA.

7.2 The Company's use of PHI is limited by the BAA. Nothing in this Agreement grants the Company any right to use or disclose PHI beyond what the BAA permits. Where this Agreement and the BAA conflict on PHI, the BAA controls.

7.3 No sale, no advertising. The Company does not sell Practice Data or personal information, does not share it with advertisers, data brokers or list vendors, and does not use it for advertising.

7.4 No model training on Practice Data. The Company does not train, fine-tune or otherwise improve any artificial-intelligence model on Practice Data, and contracts with its model providers so that they do not either. Where an AI feature processes PHI, it does so only through a vendor the Company has a signed BAA with, under no-train and short-retention terms; the platform is built to refuse a model vendor that is not on that list.

7.5 De-identified and aggregate data. The Company may use Usage Data to operate, secure, support and improve the Service, and to compute fees. The Company may not de-identify Practice Data or create aggregate datasets from it without the Practice's prior written consent, which the Practice may withhold. If the parties later agree to it, the terms go in an amendment, not here.

7.6 Feedback. If the Practice sends the Company suggestions or feedback about the Service, the Company may use them freely, without compensation or obligation. Feedback must not contain PHI.

---

8. Privacy

8.1 The privacy notice for the Service. Exhibit D states how the Company handles information in connection with the Service. It applies in addition to, and does not narrow, the BAA.

8.2 The website policy is a different document. The Privacy Policy and Terms of Service published at chartvoyant.com cover that website and the public demo only. They do not govern the Practice's deployment. Where they conflict with this Agreement, this Agreement controls.

8.3 Subprocessors. The Company uses third-party service providers — cloud hosting and storage, email and fax transport, a clearinghouse, e-prescribing, and AI model providers — to deliver the Service. Any provider that could encounter PHI is covered by a signed business associate agreement before PHI reaches it. The current list is maintained in the Company's vendor register (CV-BAA-001) and is available to the Practice on request.

8.4 Breach notification. The Company's obligations on discovery of a breach of unsecured PHI are in the BAA. Separately, where a breach of unencrypted personal information of a Tennessee resident occurs, the Company complies with T.C.A. § 47-18-2107.

8.5 Requests from patients. Requests from patients to access, amend, or receive an accounting of their PHI are the Practice's to answer. The Service provides the means; the BAA states the Company's obligation to assist.

---

9. Security — what is true today

9.1 What the Service does. Traffic to and from the Service is encrypted in transit. Practice Data is stored encrypted at rest under a managed key service. Each practice's data is separated from every other practice's at the database layer, enforced by the database itself rather than by application code alone. Two-step sign-in with an authenticator app is available on every account and a practice can require it of its whole workforce. Every view and every change is written to an append-only, hash-chained audit trail that cannot be edited or deleted, including by the Company.

9.2 Ongoing assessment. The Company maintains a written security risk analysis under 45 CFR §164.308(a)(1)(ii)(A) (CV-SRA-001), reviews it at least annually and on material change, and will tell the Practice on request the status of any finding open at that time. No system is perfectly secure and the Company makes no representation to the contrary.

9.3 No assurance beyond this. The Company does not commit under this Agreement to a specific security certification, audit report, penetration-test report or right of inspection (§18.2). A Practice that requires any of those should raise it before signing.

---

10. Intellectual property

10.1 The Service. The Company and its licensors own the Service, the ChartVoyant name and logo, and all software, design, text and documentation in it. The Practice receives only the access right in §3.1.

10.2 No transfer. Nothing in this Agreement transfers ownership of the Service to the Practice or of Practice Data to the Company.

---

11. Confidentiality

11.1 Each party may receive information of the other that is marked confidential or that a reasonable person would understand to be confidential. Each will protect the other's confidential information with at least reasonable care, use it only to perform this Agreement, and disclose it only to people who need it and are bound to protect it.

11.2 These obligations do not apply to information that is public through no fault of the recipient, was already known to it without a duty of confidence, is independently developed, or is rightfully received from a third party. A party may disclose where the law requires, giving the other notice where it lawfully can.

11.3 PHI is governed by the BAA, not by this section.

---

12. Warranties and disclaimer

12.1 Mutual. Each party warrants that it has the authority to enter this Agreement.

12.2 The Company. The Company warrants that it will provide the Service with reasonable skill and care, and that it will not materially decrease the security protections described in §9.1 during the Term.

12.3 Disclaimer. EXCEPT AS EXPRESSLY STATED IN §12.2, THE SERVICE IS PROVIDED "AS IS" AND "AS AVAILABLE," WITHOUT WARRANTIES OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE AND NON-INFRINGEMENT. THE COMPANY DOES NOT WARRANT THAT THE SERVICE WILL BE UNINTERRUPTED, ERROR-FREE OR THAT IT WILL MEET THE PRACTICE'S REQUIREMENTS. Some of these exclusions may not apply where law does not permit them.

---

13. Limitation of liability

13.1 No indirect damages. TO THE FULLEST EXTENT PERMITTED BY LAW, NEITHER PARTY IS LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY OR PUNITIVE DAMAGES, OR FOR LOST PROFITS, REVENUE OR GOODWILL, ON ANY THEORY OF LIABILITY, EVEN IF ADVISED OF THE POSSIBILITY.

13.2 Cap. EACH PARTY'S TOTAL AGGREGATE LIABILITY ARISING OUT OF OR RELATING TO THIS AGREEMENT WILL NOT EXCEED THE TOTAL FEES PAID OR PAYABLE BY THE PRACTICE UNDER THIS AGREEMENT IN THE TWELVE (12) MONTHS IMMEDIATELY PRECEDING THE EVENT GIVING RISE TO THE CLAIM.

13.3 What the cap does not cover. §13.1 and §13.2 do not apply to:

(a) a party's breach of its confidentiality obligations under §11; (b) the Company's breach of the BAA, or its obligations with respect to PHI under §7.2, §7.3, §7.4 or §7.5; (c) either party's indemnification obligations under §14; (d) the Practice's obligation to pay fees; (e) a party's fraud, gross negligence or willful misconduct; or (f) any liability that cannot be limited by law.

---

14. Indemnification

14.1 By the Company. The Company will defend the Practice against a third-party claim that the Service as provided infringes a US patent, copyright or trade secret, and will pay damages finally awarded or agreed in settlement. If the Service becomes, or the Company believes it may become, the subject of such a claim, the Company may procure the right to continue using it, modify it so it is non-infringing, or terminate this Agreement and refund fees paid for the period after termination. This does not apply to a claim arising from Practice Data, from use in breach of this Agreement, or from combination with anything the Company did not supply.

14.2 By the Practice. The Practice will defend the Company against a third-party claim arising from Practice Data, from the Practice's or its Authorized Users' use of the Service in breach of this Agreement or applicable law, or from a clinical decision made by its clinicians, and will pay damages finally awarded or agreed in settlement.

14.3 Process. The indemnified party will promptly notify the indemnifying party of the claim, give it sole control of the defense and settlement (except that no settlement admitting liability or imposing a non-monetary obligation may be made without consent, not unreasonably withheld), and give reasonable cooperation at the indemnifying party's expense.

---

15. Data export, return and destruction

15.1 During the Term. The Practice may export its Practice Data at any time using the Service's export features, in a machine-readable format, at no additional charge.

15.2 After termination. For 30 days after termination the Practice retains read-only access sufficient to export Practice Data. The Company will not delete Practice Data during that window.

15.3 After the export window. At the end of the 30-day window, the Company returns or destroys PHI in accordance with the BAA, and destroys remaining Practice Data, except for copies retained in routine backups (which age out on their normal cycle and remain subject to the BAA and §11 while they exist) and anything the Company must retain by law.

15.4 Assisted export. If the Practice needs an export in a form its next system requires, the Company will provide reasonable assistance; the Company may charge for materially custom work, quoted and agreed in advance.

---

16. HIPAA and the BAA

16.1 The parties execute the BAA at Exhibit C concurrently with this Agreement. The Company will not receive PHI from the Practice before the BAA is signed by both parties.

16.2 The BAA is incorporated into and forms part of this Agreement. Where the two conflict on any matter concerning PHI, the BAA controls.

16.3 The Practice will not send PHI to the Company through any channel that is not part of the Service — in particular not through the public demo, and not by unencrypted email or SMS to the Company's general contact addresses.

---

17. General

17.1 Notices. Notices go to the addresses in the Order Form, by email with confirmation of receipt or by recognized overnight courier. Notice to the Company also goes to info@chartvoyant.com.

17.2 Assignment. Neither party may assign this Agreement without the other's written consent, except that either may assign it in whole to a successor in a merger, reorganization or sale of substantially all assets, on written notice. Any other attempted assignment is void.

17.3 Governing law and venue. This Agreement is governed by the laws of the State of Tennessee without regard to its conflict-of-laws rules. The parties consent to the exclusive jurisdiction and venue of the state and federal courts located in Bradley County, Tennessee, and the Eastern District of Tennessee.

17.4 Disputes. Before filing suit (other than for injunctive relief), the parties will escalate the dispute to a senior representative of each and attempt to resolve it in good faith for 30 days.

17.5 Force majeure. Neither party is liable for a failure to perform (other than payment) caused by an event beyond its reasonable control, provided it uses reasonable efforts to resume.

17.6 Independent contractors. The parties are independent contractors. Nothing here creates a partnership, joint venture, agency or employment relationship.

17.7 No third-party beneficiaries. Except as the BAA provides, this Agreement creates no rights in any third party, including patients.

17.8 Publicity. Neither party will use the other's name or marks publicly without prior written consent.

17.9 Amendment and waiver. This Agreement may be amended only in a writing signed by both parties, except that the Company may change fees under §4.5 and the Service under §3.6 on the notice those sections require. A failure to enforce a provision is not a waiver of it.

17.10 Severability. If a provision is held unenforceable, the rest remains in force.

17.11 Entire agreement; order of precedence. This Agreement and its Exhibits are the entire agreement between the parties on this subject and supersede all prior discussions. In the event of conflict, the order of precedence is: (1) the BAA (Exhibit C) on any matter concerning PHI; (2) the Order Form (Exhibit A); (3) the body of this Agreement; (4) Exhibits B and D.

17.12 Survival. Sections 2, 7, 10, 11, 12.3, 13, 14, 15, 16 and 17 survive termination.

17.13 Counterparts and electronic signature. This Agreement may be signed in counterparts and by electronic signature, each of which is an original.

---

18. Scope of the Company's commitments

The Company's obligations are those expressly stated in this Agreement and its Exhibits. This section states the boundaries of that undertaking so that they are settled before signature rather than in dispute afterwards.

18.1 Availability. This Agreement contains no availability percentage, support response time, maintenance window or service credit. The Service is provided on an as-available basis.

18.2 Verification. This Agreement grants no right of audit or inspection and does not commit the Company to deliver a security certification, an independent audit report or a penetration-test report. A Practice that requires any of these should raise it before signing so that it can be addressed in the Order Form or by amendment.

18.3 Recovery objectives. Backups are maintained and exercised under the Company's written program (CV-POL-001). This Agreement states no recovery time objective and no recovery point objective.

18.4 Residency and subprocessing. The Service is operated in the United States. This Agreement does not restrict where a subprocessor processes data, does not name the Company's model providers and does not commit the Company to a particular model. The protections that do apply are at §7.4 and §8.3.

18.5 Continuity. This Agreement provides no source-code escrow and no continuity arrangement on the Company's insolvency. The Practice's protection is the export right at §15.

18.6 Insurance. Neither party is required by this Agreement to carry or to evidence insurance.

18.7 Other state law. §17.3 chooses Tennessee law. A Practice located elsewhere remains subject to its own state's health-privacy and breach-notification law, which may impose obligations this Agreement does not address.

18.8 Transition assistance. Transition assistance is limited to §15.4. This Agreement commits the Company to no migration service, no defined output format for another vendor's importer and no reverse transition period.

---

19. Signatures

The parties execute this Agreement as of the Effective Date in Exhibit A.

GEACH MEDICAL, PLLC, trading as ChartVoyant

Signature: ______ Date: ____

Name: ________

Title: _______

THE PRACTICE (as named in Exhibit A)

Signature: ______ Date: ____

Name: ________

Title: _______

---

Exhibit A — Order Form

Complete one Order Form per practice. This exhibit, once completed and signed, sets the commercial terms. Where it conflicts with the body of the Agreement, this Order Form controls (§17.11).

Subscription

A provider is an individual credentialed in the Service to render and sign for services (§4.2). Front desk, billing and administrative accounts are not counted and are not charged.

Term

Modules and options

☐ Voice scribe   ☐ Prior-authorization automation   ☐ Patient portal   ☐ Fax intake   ☐ Patient payments   ☐ Phone agent

Modules are included in the base subscription where available; ticking one records that the Practice wants it switched on, not that it costs extra.

Signed

GEACH MEDICAL, PLLC (trading as ChartVoyant)

Signature: ______ Name: ____ Date: ___

PRACTICE

Signature: ______ Name: ____ Date: ___

---

Exhibit B — Terms of Service for the Practice's Authorized Users

These terms apply to every individual who accesses the Service under the Practice's account. The Practice will make them available to its Authorized Users. They do not replace the Agreement, and where they conflict with it or with the BAA, those control (§17.11).

B.1 Accounts are personal. Each Authorized User has their own account and their own credentials. Credentials must not be shared with anyone, including with colleagues, with the Practice's administrators, or with the Company. Two-step sign-in is available on every account, and the Practice may require it of everyone.

B.2 Everything is recorded. Every view and every change in the Service is written to an append-only, hash-chained audit trail that cannot be edited or deleted, including by the Company. Users should expect their access to patient records to be attributable to them personally.

B.3 Minimum necessary. Users access only the records they need for their role and the task in front of them. Curiosity about a patient's chart is not a permitted purpose.

B.4 The AI tab has a weekly allowance. Where the Practice has the ✦ AI assistant tab, each staff member has their own weekly AI credit allowance (§4.1.1). Reaching it pauses that person's AI tab until the following week. It does not affect anyone else, and it does not affect note drafting, dictation, the in-chart AI panel, clinical assist, or document reading — those are base subscription and keep working.

B.5 A clinician decides. Anything the Service drafts, suggests or codes is a draft for a licensed clinician to review, edit and approve. Approving a draft makes it the clinician's own work and the clinician's responsibility. Nothing in the Service is medical advice.

B.6 Prohibited conduct. Users will not share credentials; attempt to access records they are not authorized to see; attempt to gain unauthorized access to any system; probe or test the security of the Service without written permission; extract data other than through the Service's export features; upload malware; or use the Service for anything other than the Practice's operations.

B.7 Reporting. A user who suspects unauthorized access, a lost device, a phished credential, or a misdirected fax or message tells the Practice's administrator immediately, and the Practice tells the Company.

B.8 The public demo is separate. demo.chartvoyant.com runs on synthetic sample data, is not covered by any BAA, and must never receive real patient information.

B.9 Consequences. The Practice is responsible for its Authorized Users (§6.2). The Company may suspend an individual account it reasonably believes is compromised or is being used in breach of these terms, and will tell the Practice why.

---

Exhibit C — Business Associate Agreement

The Business Associate Agreement between the parties is CV-BAA-002, which is attached to and forms part of this Agreement.

It is signed separately and concurrently with this Agreement, and it must be signed before the Company receives any PHI (§16.1). Where this Agreement and the BAA conflict on any matter concerning PHI, the BAA controls (§7.2, §16.2, §17.11).

The BAA covers: permitted uses and disclosures, safeguards, reporting of security incidents and breaches, subcontractor flow-down, access, amendment and accounting rights, availability of records to HHS, term and termination, and return or destruction of PHI. It deliberately contains no commercial terms — those are in this Agreement, which is the "Underlying Agreement" the BAA refers to.

Attach the executed BAA behind this page. A signed set that is missing Exhibit C is not a complete set, and the Practice must not be sent PHI on it.

---

Exhibit D — Privacy Notice for the Service

This notice describes how the Company handles information in connection with the Practice's deployment. It is in addition to the BAA and narrows nothing in it.

D.1 PHI is governed by the BAA. Everything the Company does with protected health information is governed by Exhibit C and by no other document. This notice covers the rest.

D.2 What else the Company holds. Account and contact details for the Practice and its Authorized Users; the Practice's configuration; billing records (the Company's payment processor holds card details, the Company does not); and Usage Data — request logs, error traces, performance counters, feature-usage counts and the provider counts used to compute fees.

D.3 What the Company uses it for. To provide, secure, support and operate the Service; to compute and collect fees; to communicate with the Practice about the Service; and to meet legal obligations. That is the whole list.

D.4 What the Company does not do. It does not sell Practice Data or personal information. It does not share it with advertisers, data brokers or list vendors. It does not train, fine-tune or improve any AI model on Practice Data, and it contracts with its model providers so that they do not either (§7.4). It does not de-identify Practice Data or build aggregate datasets from it without the Practice's prior written consent (§7.5).

D.5 Who else can see it. Only subprocessors that help operate the Service — cloud hosting and storage, email and fax transport, the clearinghouse, e-prescribing, payment processing, and AI model providers — and only as needed. Any subprocessor that could encounter PHI is covered by a signed business associate agreement before PHI reaches it. The list is in CV-BAA-001 and is available on request (§8.3).

D.6 The Company's own staff. Company personnel access Practice Data only to operate, support or secure the Service, only where the Practice has asked for support or where an operational or security need requires it, and always subject to the same append-only audit trail (§9.1).

D.7 Where it is held and for how long. In the United States, on infrastructure operated by the Company's cloud provider under a signed business associate agreement. Practice Data is retained for the Term and for the 30-day export window afterward, then returned or destroyed per §15.3 and the BAA, except for routine backups aging out on their normal cycle and anything the law requires the Company to keep.

D.8 Security. As described in §9, including what is not yet finished.

D.9 Breach. As described in §8.4 and in the BAA.

D.10 Changes. The Company may update this notice; a change that materially reduces the protections in D.4 requires the Practice's written agreement (§17.9).

D.11 Contact. Geach Medical, PLLC (trading as ChartVoyant), Cleveland, Tennessee · info@chartvoyant.com · (762) 887-8412.

---

Version history