Terms of Service

1. Agreement

These Terms of Service govern access to and use of PHI Uploader, a secure document request and upload service for healthcare workflows. "Customer" means the organization using the service, and "PHI Uploader" means the product and the legal entity that provides it after the customer order or pilot agreement is accepted.

If Customer uses PHI Uploader to create, receive, maintain, or transmit Protected Health Information, Customer must first complete onboarding and enter into a Business Associate Agreement with PHI Uploader.

2. Service

PHI Uploader lets authorized customer users create document request packets, send protected upload links, receive files from request recipients, scan staged uploads, generate submission artifacts, and deliver approved files to the customer-designated Google Drive destination.

The service is not an electronic health record, clinical decision support system, emergency communication system, or long-term medical records archive.

3. Customer Responsibilities

• Use PHI Uploader only through approved customer accounts and authorized personnel.
• Maintain a valid Google Workspace environment and BAA coverage for the destination Drive workflow.
• Configure request templates, recipients, and destinations accurately.
• Do not upload test PHI before the BAA, onboarding checklist, and access controls are complete.
• Promptly revoke access for users who no longer need the service.
• Maintain Customer's own HIPAA policies, notices, retention rules, and patient request processes.

4. Accounts and Access

Customer is responsible for all activity under its accounts. PHI Uploader may require multi-factor authentication for administrators and may suspend or limit access when needed to protect the service, Customer data, or other users.

5. Data and PHI

Customer owns its submitted files, answers, request content, and related data. PHI Uploader processes Customer data only to provide, secure, maintain, support, and improve the service, and only as allowed by the applicable agreement and BAA.

Customer should not send PHI to support channels, email, analytics tools, or any system outside the approved PHI workflow unless a separate approved process is in place.

6. Security

PHI Uploader uses administrative, technical, and operational safeguards designed for sensitive healthcare document workflows, including protected links, access controls, encrypted secrets, private staging storage, malware scanning, audit events, and PHI-safe operational logging.

No service can guarantee that unauthorized access, outages, or data loss will never occur. Customer must keep its own endpoint, account, Drive, and workforce controls in place.

7. Acceptable Use

• Do not attempt to bypass authentication, authorization, scanning, rate limits, or audit controls.
• Do not use PHI Uploader to store unlawful, malicious, infringing, or abusive content.
• Do not submit malware, test signatures, or security scans except through an approved testing process.
• Do not use the service for emergency care instructions or time-critical clinical communications.

8. Third-Party Services

PHI Uploader depends on approved infrastructure and customer-authorized Google services. Customer remains responsible for its Google Workspace configuration, user permissions, Drive folder structure, and downstream handling of delivered files.

9. Fees, Pilot Terms, and Changes

Fees, pilot duration, support commitments, usage limits, and renewal terms should be documented in the applicable order form, pilot agreement, or statement of work. PHI Uploader may update these terms by posting a revised version or giving notice as required by the customer agreement.

10. Suspension and Termination

Either party may terminate according to the applicable order or pilot agreement. PHI Uploader may suspend access where continued use creates a security, legal, compliance, or operational risk. PHI handling at termination is governed by the BAA.

11. Disclaimers and Liability

The service is provided according to the applicable customer agreement and documentation. Warranty, indemnity, liability, and governing-law terms should be handled in the counsel-reviewed customer agreement.

12. Related Documents

Review the Privacy Policy and Business Associate Agreement before any real-PHI pilot.