2. Accounts and permitted users
Customer is responsible for information submitted during onboarding, for designating authorized users, and for all activity under its tenant account. Credentials are personal and may not be shared. Customer must promptly disable access for separated or unauthorized workforce members and notify ImgVlt of suspected compromise.
Customer may use the Service only for lawful healthcare imaging, workflow, reporting, administration, and related business purposes consistent with its plan, documentation, the BAA, and applicable law.
3. Calendar-month billing, earned charges, and corrections
Subscriptions are monthly and renew automatically until canceled. Billing periods are America/New_York calendar months. Every plan includes the stated $25 monthly platform fee. Fixed current-month charges are collected in advance and prior-month variable charges are settled on the first. New activations and partial months are not prorated.
A study earns one charge for the month in which it is created and one additional charge at 12:00 AM Eastern on each first of the month while it remains open. Completing or deleting a study after a monthly charge is earned stops later months but does not reverse the earned month. A study is completed only through the Service's authorized Sign & Release workflow.
Except where required by law or for a confirmed duplicate, erroneous, or unauthorized charge, platform fees, package fees, usage charges, reading-service charges, fax charges, branding charges, funded variable-use balances, taxes, and partial billing periods are non-refundable once earned or charged. Approved corrections are recorded as auditable credits, reversals, or adjustments and do not rewrite finalized invoice history.
Customer authorizes ImgVlt and its payment processor to charge the payment method on file for activation amounts, recurring fees, usage, replenishment of an eligible PAYG variable-use balance, taxes, and other amounts due. Failed payment may immediately pause new uploads, orders, reporting, faxing, downloads, exports, and other new service activity. Existing PHI remains available for authorized on-screen viewing for continuity of care, but downloadable and exportable copies remain locked until the applicable invoice is paid. ImgVlt may change pricing prospectively after at least seven days' notice, effective on a later calendar-month boundary.
4. Customer data and instructions
As between the parties, Customer retains its rights in data, images, videos, documents, reports, patient information, and other content submitted to the Service ("Customer Data"). Customer grants ImgVlt and its authorized subprocessors a limited right to host, copy, transmit, transform, display, and otherwise process Customer Data as necessary to provide, secure, maintain, support, and improve the Service; comply with law; and perform the activities expressly permitted below and in the BAA.
Customer represents that it has all rights, notices, permissions, patient authorizations, and legal authority required to submit Customer Data and instruct ImgVlt to process it. Customer remains responsible for the accuracy, clinical appropriateness, and lawfulness of Customer Data and its instructions.
5. PHI, de-identification, research, and training
When ImgVlt handles protected health information ("PHI") as Customer's business associate, that handling is governed by the BAA. ImgVlt will not sell PHI or use PHI for advertising.
Customer expressly directs and authorizes ImgVlt to de-identify PHI in accordance with 45 C.F.R. 164.514 using the Safe Harbor method or Expert Determination, as appropriate. De-identification may require removal or transformation of identifiers in structured fields, free text, file metadata, DICOM headers, burned-in annotations, image pixels, audio, video, and documents.
Only after information has been properly de-identified so that it neither identifies nor provides a reasonable basis to identify an individual, Customer grants ImgVlt a perpetual, worldwide, royalty-free right to use, reproduce, analyze, combine, retain, and create derivative works from that de-identified information for service analytics, quality assurance, security, benchmarking, product development, scientific and operational research, and the development, training, testing, validation, and improvement of machine-learning and artificial-intelligence systems.
ImgVlt may disclose properly de-identified information to approved service providers, technology vendors, and research collaborators only under written restrictions that prohibit re-identification or attempted re-identification, patient contact, patient-level advertising, sale of patient profiles, combination with other information for re-identification, and use outside the approved purpose. ImgVlt will not disclose a re-identification key or mechanism. ImgVlt and its recipients may not use de-identified information to make treatment, eligibility, employment, insurance, or credit decisions about an identifiable person.
De-identified information created before termination may be retained and used after termination subject to these restrictions. Customer must notify ImgVlt of any privacy notice, individual restriction, consent limitation, or other condition that legally prevents the authorized de-identification or secondary use.
6. HIPAA and other regulated data
Customer and ImgVlt will comply with their respective obligations under applicable privacy and security laws. Customer may not use a public contact form, demo form, or other non-production channel to submit PHI. Customer may not submit substance-use-disorder records subject to 42 C.F.R. Part 2, genetic data subject to special restrictions, or other specially regulated information unless the parties have first agreed in writing that the Service is configured and authorized for that data.
7. Clinical responsibility and no medical advice
ImgVlt provides workflow and information-management software. It is not a healthcare provider, does not practice medicine, and does not independently diagnose, interpret studies, prescribe treatment, or replace professional judgment. Templates, rules, calculations, generated language, measurements, recommendations, and other outputs must be reviewed and approved by qualified healthcare professionals before clinical use. Customer is solely responsible for patient care, clinical decisions, final reports, signatures, coding, and regulatory compliance.
8. Acceptable use
Customer and users may not: access another tenant's data; defeat access controls; share accounts; probe or test security without written permission; upload malicious code; interfere with availability; use the Service unlawfully; infringe intellectual-property or privacy rights; scrape or resell the Service; reverse engineer the Service except where law expressly permits; use the Service to build a competing product from non-public features; or use any data to identify a person after de-identification.
9. Security and confidentiality
ImgVlt will maintain reasonable administrative, technical, and physical safeguards appropriate to the Service and, for electronic PHI, the safeguards required by the BAA and applicable HIPAA Security Rule provisions. No system is completely secure, and Customer is responsible for its endpoints, networks, identity systems, workforce practices, exports, and local copies.
Each party will protect the other party's non-public business, technical, security, and financial information using reasonable care and will use it only to perform the parties' relationship, except when disclosure is authorized or required by law.
10. Third-party services
The Service may interoperate with payment processors, cloud infrastructure, communications providers, integrations, and other third-party services. Third-party services may have separate terms and privacy practices. ImgVlt is responsible for its subprocessors to the extent required by the BAA or applicable law, but is not responsible for third-party products selected, controlled, or separately contracted by Customer.
11. Intellectual property and feedback
ImgVlt and its licensors own the Service, software, documentation, designs, trademarks, and related intellectual property, excluding Customer Data. No rights are granted except the limited right to use the Service during an active subscription. Customer may provide feedback, and ImgVlt may use that feedback without restriction or compensation, provided it does not identify Customer or disclose PHI.
12. Service changes, availability, and support
ImgVlt may update the Service to improve security, performance, compliance, or functionality. ImgVlt does not guarantee uninterrupted or error-free operation unless a separate written service-level agreement says otherwise. Planned maintenance, emergency maintenance, internet failures, third-party outages, and events beyond reasonable control may affect availability.
13. Suspension, termination, and data return
ImgVlt may pause new service activity for nonpayment, security risk, unlawful activity, material breach, or conduct that threatens patients, other customers, or the Service. During a payment dispute, existing PHI remains available for authorized on-screen viewing for continuity of care, while downloadable and exportable copies remain locked until the applicable invoice is paid. Customer cancellation requires at least 60 days' notice and becomes effective at the first America/New_York month-end occurring at least 60 days after the request, unless a signed order form requires a longer period.
After the exact final invoice is paid, Customer receives a 15-day authorized download and export window. An unpaid final invoice provides no export window and may make clinical data eligible for deletion seven days after the first failed collection attempt. Return, deletion, destruction, and any permitted retention of PHI remain governed by the BAA, applicable federal and state law, legal holds, backup limitations, and documented retention settings. Unknown or unresolved retention requirements prevent automatic destruction. Payment obligations survive service end and lawful data deletion.
14. Disclaimers
To the maximum extent permitted by law, the Service is provided "as is" and "as available." ImgVlt disclaims implied warranties of merchantability, fitness for a particular purpose, title, and non-infringement. ImgVlt does not warrant that outputs are clinically correct, that all defects will be corrected, or that the Service will meet every legal or operational requirement of Customer.
15. Limitation of liability
To the maximum extent permitted by law, neither party will be liable for indirect, incidental, special, consequential, exemplary, or punitive damages, or for lost profits, revenues, goodwill, or business interruption, even if advised of the possibility. Except for amounts Customer owes, a party's fraud, willful misconduct, infringement, indemnification obligations, or liabilities that cannot lawfully be limited, each party's aggregate liability arising from the Service will not exceed the fees Customer paid to ImgVlt for the Service during the 12 months before the event giving rise to the claim. A signed order form or BAA may state different limits for specified claims.
16. Indemnification
Customer will defend and indemnify ImgVlt and its personnel from third-party claims arising from Customer's unlawful Customer Data, lack of required authority or consent, clinical decisions, misuse of the Service, or material breach of these Terms. ImgVlt will provide prompt notice and reasonable cooperation and will allow Customer to control the defense, subject to ImgVlt's right to participate and approve any settlement that admits fault or imposes obligations on ImgVlt.
17. Changes and notices
ImgVlt may update these Terms prospectively. Material changes will be communicated through the Service, by email, or through a required re-acceptance. The version accepted by Customer remains recorded. Continued use after an effective update constitutes acceptance only where permitted by law; ImgVlt may require an authorized administrator to affirmatively accept material changes.
18. General
Neither party may assign the agreement without the other's consent, except in connection with a merger, acquisition, corporate reorganization, or sale of substantially all assets, provided the assignee assumes the obligations. Neither party is responsible for delay caused by events beyond reasonable control. If a provision is unenforceable, it will be limited to the minimum extent necessary and the remainder will continue. Failure to enforce a provision is not a waiver. These Terms, the BAA, applicable order forms, and incorporated policies are the entire agreement concerning the Service.
Any governing-law or venue provision in a signed order form applies. Before filing a non-urgent business dispute, the parties will attempt in good faith to resolve it through authorized representatives.
19. Contact
Questions, notices, cancellations, and billing disputes may be sent to [email protected]. Do not include PHI in ordinary email.