Terms of Use

1. Acceptance of these Terms

These Terms of Use ("Terms") govern access to and use of the MedCRM Platform operated by Cardio AI ("Cardio AI," "we," "us"). By creating an account or using the Platform, the healthcare organization ("Customer") and each authorized user ("you") agree to these Terms and to the Privacy Statement. If you do not agree, do not use the Platform.

2. Eligibility & accounts

The Platform is for use by healthcare organizations and their authorized staff. The first account created for an organization's email domain becomes the organization owner/administrator; subsequent accounts on that domain join the organization and require administrator approval before gaining privileges. You are responsible for the accuracy of registration information, for maintaining the confidentiality of credentials, and for all activity under your account. Notify us promptly of any unauthorized use.

3. License to use

Subject to these Terms and payment of applicable fees, we grant the Customer a limited, non-exclusive, non-transferable, revocable right to access and use the Platform for its internal healthcare operations during the subscription term. We reserve all rights not expressly granted.

4. Healthcare & medical disclaimer

The Platform is a practice-management and workflow tool. It is not a medical device and does not provide medical advice, diagnosis, or treatment. Any analytics, risk indicators, agent outputs, or suggestions are informational aids that require independent review and sign-off by qualified clinicians and coders. Automated or "agent" features that touch clinical or billing decisions are gated and must not be relied upon for clinical or reimbursement decisions unless and until the Customer has configured, validated, and approved the relevant integrations. Licensed professionals remain solely responsible for all clinical, coding, and billing judgments.

5. Customer responsibilities

• Use the Platform in compliance with all applicable laws and professional standards.
• Obtain and maintain all patient consents and authorizations required for the data you process.
• Configure roles, approvals, and access appropriately and manage your users.
• Validate any third-party integration (FHIR, HL7, PACS, payer/X12) before relying on it.
• Maintain your own records and backups as required by law and your policies.

6. PHI & compliance

You may process Protected Health Information in the Platform only after executing a Business Associate Agreement with Cardio AI and completing any required compliance review. Until then, use only test or de-identified data. The Platform's security features (role-based access, audit logging, session expiry, encryption in transit) support—but do not by themselves establish—your regulatory compliance. Public telehealth video and public test integration endpoints are not HIPAA-compliant and must not be used with PHI.

7. Prohibited uses

• Uploading PHI without a BAA and completed compliance review.
• Attempting to breach security, access other organizations' data, or bypass access controls.
• Reverse engineering, reselling, or providing the Platform to third parties except as permitted.
• Uploading malware or unlawful, infringing, or harmful content.
• Using the Platform to make autonomous clinical or billing decisions without professional review.
• Interfering with the integrity or performance of the Platform.

8. Subscriptions & billing

Paid features are offered under subscription tiers (e.g., Free, Pro, Enterprise). Fees, billing frequency, and included features are as presented at purchase. Unless stated otherwise, fees are non-refundable, subscriptions renew automatically until cancelled, and we may change pricing prospectively with notice. Payment processing is handled by Stripe under its terms; you authorize applicable charges. Taxes are your responsibility.

9. Intellectual property

The Platform, including its software, design, and trademarks (including "MedCRM" and "Cardio AI"), is owned by Cardio AI and its licensors and is protected by law. Customer retains all rights to the data it enters ("Customer Data"). Customer grants us a limited license to host and process Customer Data solely to provide the Platform and as permitted by the BAA.

10. Third-party services

The Platform may interoperate with third-party services (payment, video, FHIR/HL7/PACS systems). We are not responsible for third-party services, and your use of them is governed by their terms. Availability of integrations does not imply endorsement or compliance of the connected system.

11. Disclaimer of warranties

THE PLATFORM IS PROVIDED "AS IS" AND "AS AVAILABLE" WITHOUT WARRANTIES OF ANY KIND, WHETHER EXPRESS, IMPLIED, OR STATUTORY, INCLUDING IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT. WE DO NOT WARRANT THAT THE PLATFORM WILL BE UNINTERRUPTED, ERROR-FREE, OR SECURE, OR THAT OUTPUTS WILL BE ACCURATE OR COMPLETE.

12. Limitation of liability

TO THE MAXIMUM EXTENT PERMITTED BY LAW, CORVERXIS AND ITS AFFILIATES WILL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, OR FOR LOSS OF PROFITS, DATA, OR GOODWILL. OUR TOTAL AGGREGATE LIABILITY ARISING FROM OR RELATED TO THE PLATFORM WILL NOT EXCEED THE AMOUNTS PAID BY THE CUSTOMER FOR THE PLATFORM IN THE TWELVE (12) MONTHS PRECEDING THE CLAIM. SOME JURISDICTIONS DO NOT ALLOW CERTAIN LIMITATIONS, SO SOME OF THE ABOVE MAY NOT APPLY.

13. Indemnification

The Customer will defend, indemnify, and hold harmless Cardio AI from claims, damages, and costs arising from the Customer's data, its use of the Platform in violation of these Terms or law, or its failure to obtain required consents or execute a required BAA before processing PHI.

14. Termination

Either party may terminate as set out in the applicable order or agreement. We may suspend or terminate access for breach, non-payment, or to protect the Platform or others. Upon termination, your right to use the Platform ceases; we will make Customer Data available for export for a limited period as described in your agreement, then delete or de-identify it per the BAA and law.

15. Governing law

These Terms are governed by the laws of the jurisdiction specified in the Customer's order or, if none, the jurisdiction in which Cardio AI is established, without regard to conflict-of-laws rules. The parties submit to the exclusive jurisdiction of the courts located there, except that either party may seek injunctive relief where appropriate.

16. Changes to these Terms

We may update these Terms from time to time. Material changes will be communicated through the Platform or to the Customer's administrator, and continued use after the effective date constitutes acceptance.

17. Contact