← All legal documents

MDside Clinic Terms of Service

Draft under review. This document (v0.1) is a working draft undergoing legal review. It may change before it takes effect.

Effective date: [EFFECTIVE DATE]

These Terms of Service (the "Agreement") govern use of the MDside platform by the clinic organization identified at onboarding ("Clinic", "you") and are between Clinic and MDside AI LLC ("MDside"). By accepting during onboarding, you represent that you are authorized to bind the Clinic. Each staff member who signs in agrees to be bound in their individual use as well.

1. The Services

MDside provides a technology platform for telehealth approval workflows and related commerce:

  • Approval routing: patient Good Faith Exam (GFE) requests enter the platform from your hosted storefront or from your own systems via our API, and are routed to licensed providers for review.
  • AI-assisted review preparation: before provider review, the platform produces an automated preliminary safety screen (internal triage) and a draft clinical note from de-identified case data. These are decision support only (see Section 5).
  • Provider network review: independent licensed providers review each request and approve, decline, or request more information. Decisions are recorded immutably and returned to your systems by webhook or polling.
  • Hosted storefront (optional): an online store at <your-slug>.store.mdside.ai operated for your patients.
  • Dashboard: your staff can monitor your clinic's requests at app.mdside.ai.

MDside may improve or modify the Services; material reductions in functionality will be notified in advance.

2. Accounts and access

  • Sign-in uses one-time email codes. Accounts are individual; credential sharing is prohibited.
  • You are responsible for the acts and omissions of your staff, for keeping role assignments current, and for promptly removing access for departed personnel.
  • API keys are confidential. You are responsible for all submissions made with your keys and must rotate them immediately if compromised.

3. Clinic responsibilities

You represent, warrant, and covenant that:

  • You are a validly organized healthcare business, hold all licenses and registrations required for your operations in every state you configure as an operating state, and will keep your operating-state configuration accurate. The platform rejects submissions for patients outside your configured states; configuring a state is your representation that you may lawfully operate there.
  • You have the legal right and any required patient consents or authorizations to submit patient information to MDside for review.
  • Information you submit is accurate and submitted for a real patient encounter; you will not submit test, synthetic, or third-party data to production without MDside's written agreement.
  • You will complete business verification (KYB) and any certification MDside reasonably requires for medical commerce (e.g. LegitScript) when applicable to your use.
  • You will comply with all applicable laws, including HIPAA, state telehealth and pharmacy law, and prescribing regulations applicable to your practice.

4. HIPAA and the Business Associate Agreement

MDside acts as your business associate. The Business Associate Agreement at Exhibit A is incorporated into this Agreement and controls over it with respect to Protected Health Information. You may not submit PHI until the BAA is in effect. You will submit only the minimum necessary PHI; the platform's intake schema is deliberately limited to clinically relevant fields, and you must not attempt to route additional identifiers through free-text fields.

5. AI features - what they are and are not

  • The automated safety screen and draft clinical notes are generated from de-identified case data (names removed, DOB converted to age, identifying patterns redacted) via MDside's AI infrastructure.
  • AI output is decision support for the reviewing provider only. It is not a medical decision, diagnosis, or treatment recommendation, and you must not represent it as such to patients or anyone else.
  • Every approval decision is made by a licensed provider. If automated processing fails, the request remains unprocessed until resolved; the platform will not substitute templated output.
  • Internal triage signals are platform-internal and are not exposed through the API.

6. The provider relationship; no practice of medicine

MDside is a technology and administrative services company. MDside does not practice medicine, does not employ providers to render medical judgment on its behalf, and does not direct, control, or influence any provider's clinical decision. Reviewing providers exercise independent professional judgment. Nothing in this Agreement creates a medical group, professional entity, or employment relationship between MDside and any provider or clinic.

7. API and integration terms

  • Authentication uses per-integration keys bound to your clinic; decisions are delivered by HMAC-signed webhooks when configured, or by polling.
  • You must verify webhook signatures and secure your receiving endpoints; decisions contain PHI and your endpoint is your responsibility.
  • No reverse engineering, load testing without consent, resale of the API, or use of the Services to build a competing product.
  • MDside may impose reasonable rate limits.

8. Fees and payment

[PLACEHOLDER - pricing model not finalized. Anticipated: per-review fees and/or platform subscription, invoiced monthly; storefront payment processing fees passed through. AI usage may be metered per-clinic via a dedicated gateway key.] Fees are exclusive of taxes. Late amounts may accrue interest at the lesser of 1.5%/month or the legal maximum.

9. Data

  • Clinical records (submissions, notes, decisions, and the original raw submission) are retained for 7 years in accordance with medical record-keeping requirements. Removal from active view is a soft delete; clinical records are not hard-deleted during the retention period.
  • All PHI access is recorded in an append-only audit log.
  • On termination, PHI is returned or destroyed per the BAA, subject to the retention obligations above.
  • MDside may use de-identified data (per 45 CFR 164.514) to operate and improve the Services. [Attorney: confirm scope; see BAA Section 3.]

10. Intellectual property; confidentiality

MDside owns the platform and all related IP. You own your data. Each party will protect the other's confidential information with reasonable care and use it only under this Agreement. Feedback may be used without obligation.

11. Disclaimers

THE SERVICES ARE PROVIDED "AS IS". MDSIDE DISCLAIMS ALL IMPLIED WARRANTIES, INCLUDING MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT. MDSIDE DOES NOT WARRANT UNINTERRUPTED OR ERROR-FREE OPERATION AND MAKES NO WARRANTY REGARDING ANY CLINICAL DECISION, WHICH IS THE SOLE RESPONSIBILITY OF THE REVIEWING PROVIDER.

12. Limitation of liability

NEITHER PARTY IS LIABLE FOR INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES. EACH PARTY'S AGGREGATE LIABILITY IS CAPPED AT THE FEES PAID OR PAYABLE BY CLINIC IN THE 12 MONTHS BEFORE THE CLAIM. THESE LIMITS DO NOT APPLY TO: BREACH OF THE BAA OR CONFIDENTIALITY OBLIGATIONS, INDEMNIFICATION OBLIGATIONS, OR A PARTY'S GROSS NEGLIGENCE OR WILLFUL MISCONDUCT. [Attorney: consider a separate super-cap for data/BAA claims rather than full carve-out.]

13. Indemnification

  • By Clinic: claims arising from your patient care, your breach of Section 3 representations, data you submit without authority, or your staff's misuse of the Services.
  • By MDside: claims that the platform, as provided, infringes third-party IP rights.

Standard procedures apply (prompt notice, control of defense, reasonable cooperation).

14. Term, suspension, termination

  • The Agreement runs from acceptance until terminated. Either party may terminate for material breach uncured within 30 days of notice, or for convenience on [60] days' notice.
  • MDside may suspend immediately for: compliance concerns (including suspected unlicensed activity or submissions violating Section 3), security incidents, or non-payment. Clinic organizations in pending or suspended status cannot submit requests; this is enforced by the platform.
  • Sections that by their nature survive (data/retention, confidentiality, disclaimers, liability limits, indemnities, governing law) survive termination.

15. General

Governing law: [GOVERNING LAW STATE], excluding conflicts rules. Venue / dispute resolution: [VENUE / arbitration - attorney to advise]. No assignment without consent except to a successor in a merger or asset sale. Notices to Clinic go to the organization owner's email; notices to MDside go to [LEGAL EMAIL]. If a provision is unenforceable, the rest stands. This Agreement plus the BAA and any order form is the entire agreement. MDside may update these terms; material changes take effect on notice and re-acceptance at next sign-in.

Exhibit A: Business Associate Agreement