Terms of Service

To become a Partner and access the TouchpointPT platform, the Partner must be at least 18 years of age and a licensed healthcare entity, group practice, or individually licensed practitioner in good standing with all applicable state and federal licensing authorities and maintain such status throughout the term of the partnership.

Subject to the Partner's compliance with these Terms and any applicable subscription agreement, TouchpointPT grants the Partner a limited, non-exclusive, non-transferable, revocable license to:

• Access and use the TouchpointPT platform for the purpose of delivering and managing health services to the Partner's patients.

This license does not include the right to sublicense, resell, or redistribute the platform or any component thereof. All rights not expressly granted herein are reserved by TouchpointPT.

The Partner is solely responsible for the clinical care, professional conduct, and patient outcomes associated with services delivered through the platform. The Partner agrees to:

• Ensure that all practitioners using the platform under the Partner account hold active, valid licenses appropriate for the services they provide.
• Obtain all necessary patient consents required by federal or state law.
• Provide and maintain/update all documents required for the patient to begin treatment.
• Comply with all applicable federal, state, and local laws and regulations governing the practice of healthcare, including telehealth-specific requirements in every jurisdiction where patients are located.
• Maintain appropriate clinical documentation standards and ensure records created on the platform satisfy professional and legal requirements.
• Supervise all clinical staff and ensure that services are delivered within each practitioner's authorized scope of practice.
• Protect the security of all account credentials and ensure that access is limited to authorized personnel only.
• Promptly report any known or suspected security incidents, data breaches, or unauthorized access to TouchpointPT.
• Cooperate with TouchpointPT in implementing reasonable security and compliance measures.

The Partner acknowledges and agrees that:

• TouchpointPT acts solely as a data custodian with respect to all Protected Health Information (PHI) and clinical records held on the platform. The Partner is and remains the data owner of all patient information and clinical records created or stored through the platform. TouchpointPT does not claim any ownership rights over PHI and holds all such data solely on behalf of and at the direction of the Partner.
• The Partner is responsible for determining its own status as a Covered Entity or Business Associate under HIPAA and for ensuring compliance with all applicable HIPAA Privacy, Security, and Breach Notification Rules.
• TouchpointPT operates as a Business Associate to the Partner in connection with the provision of platform services that involve the creation, receipt, maintenance, or transmission of Protected Health Information (PHI).
• The Partner and TouchpointPT shall execute a Business Associate Agreement (BAA) prior to the Partner onboarding patients or transmitting any PHI through the platform. The partner will have an opportunity to review and sign the BAA separately from these Terms. The BAA will govern the specific obligations of TouchpointPT as a Business Associate and the Partner as a Covered Entity or Business Associate under HIPAA.
• The Partner is responsible for ensuring that their patients are informed about how their health information may be used and disclosed in connection with the platform.
• The Partner shall not use the platform to store or transmit information beyond what is necessary and permitted under applicable law.

The Partner, as the Covered Entity or Business Associate under HIPAA, is solely responsible for fulfilling all applicable obligations under the HIPAA Privacy Rule, Security Rule, and Breach Notification Rule with respect to PHI it creates, receives, maintains, or transmits. TouchpointPT does not supervise, advise on, or assume responsibility for the Partner's independent HIPAA compliance obligations.

The Partner is solely responsible for fulfilling any breach notification obligations applicable to its own operations under HIPAA and applicable state law. TouchpointPT will notify the affected Partner of any breach of unsecured PHI occurring at or by TouchpointPT, as required under the applicable BAA, without unreasonable delay and no later than sixty (60) calendar days after discovery.

Access to the TouchpointPT platform is subject to fees as set forth in the Partner's applicable subscription or service agreement. The Partner agrees that:

• Platform subscription fees are separate from and independent of any fees the Partner charges to patients for clinical services.
• TouchpointPT is not responsible for the Partner's billing practices, fee schedules, insurance claims, or collection activities related to patient care.
• Failure to pay platform fees when due may result in suspension or termination of platform access.
• All platform fees are non-refundable except as expressly provided in the applicable subscription agreement or as required by law.
• The Partner is solely responsible for all financial transactions with patients, including collecting payments, issuing refunds, and resolving billing disputes. TouchpointPT has no obligation or authority to issue refunds to patients on behalf of the Partner.

To the extent the Partner uses the TouchpointPT platform to collect payment from patients for clinical services, the Partner is required to connect and maintain a valid Stripe Connect Standard account. The Partner acknowledges and agrees that:

• The Partner is solely responsible for creating, verifying, and maintaining their Stripe account in compliance with Stripe's Terms of Service and all applicable financial regulations.
• TouchpointPT acts only as a facilitator of the payment integration and is not a party to payment transactions between the Partner and their patients. All funds collected from patients are received directly by the Partner through their Stripe account.
• The Partner is fully responsible for all patient-facing financial transactions processed through their Stripe account, including but not limited to collecting payments, issuing refunds, responding to disputes and chargebacks, and maintaining accurate records of all transactions.
• TouchpointPT is not responsible for any transaction failures, processing errors, account holds, fund disbursement delays, or disputes arising from the Partner's Stripe account.
• Any refunds issued to patients for clinical services are the sole responsibility of the Partner and must be managed directly through the Partner's Stripe account or as otherwise agreed between the Partner and the patient.
• The Partner agrees to promptly respond to chargebacks, payment disputes, and inquiries initiated through Stripe in accordance with Stripe's policies and applicable law.
• TouchpointPT reserves the right to suspend or revoke the Partner's access to payment processing features on the platform if the Partner's Stripe account is suspended, terminated, or found to be non-compliant.

By connecting a Stripe account to the TouchpointPT platform, the Partner authorizes TouchpointPT to facilitate the transmission of transaction data between the platform and Stripe solely for the purpose of enabling payment processing. This authorization does not grant TouchpointPT any control over the Partner's Stripe account, funds, or financial operations.

The Partner agrees not to:

• Use the platform for any unlawful purpose or in violation of any applicable professional, ethical, or regulatory standard.
• Allow unlicensed individuals to deliver clinical services to patients through the platform.
• Share login credentials across accounts or allow unauthorized access to the platform.
• Attempt to reverse engineer, decompile, modify, or create derivative works from any component of the platform.
• Use the platform to deliver services in jurisdictions where the Partner is not licensed or where such services are not legally permitted.
• Misrepresent the Partner's identity, organizational affiliation, or licensure status.
• Engage in conduct that could damage the reputation of TouchpointPT or that violates the rights of patients or third parties.

TouchpointPT owns all rights, title, and interest in and to the platform, including all software, designs, trademarks, and proprietary content. The Partner retains ownership of any clinical content or materials the Partner independently creates and uploads to the platform, subject to a limited license granted to TouchpointPT to host and display such content as necessary to provide the Services.

The Partner may not use TouchpointPT's name, logo, or trademarks in any marketing, advertising, or public communication without prior written approval from TouchpointPT.

For the avoidance of doubt, TouchpointPT does not claim ownership of any patient health information, Protected Health Information (PHI), or clinical records that are entered, created, or stored through the platform. All such data is owned by the Partner and/or the applicable patient. TouchpointPT holds patient data and PHI solely in its capacity as a data custodian on the Partner's behalf, subject to the terms of the applicable Business Associate Agreement.

The Partner represents and warrants that:

• All information provided during registration and throughout the partnership is accurate, complete, and current.
• The Partner has full authority to enter into this agreement on behalf of the clinic, group, or organization.
• All practitioners using the platform on behalf of the Partner are duly licensed and in compliance with applicable scope-of-practice requirements.
• The Partner will obtain and maintain all required patient consents, including telehealth-specific informed consent, prior to using the platform for patient care.
• The Partner's use of the platform will comply with all applicable laws, including but not limited to HIPAA, state telehealth regulations, and professional licensing requirements.

The Partner agrees to release, indemnify, defend, and hold harmless TouchpointPT, Genuine Intelligence, LLC, and their respective officers, directors, employees, agents, and successors from and against any and all claims, damages, losses, liabilities, costs, and expenses (including reasonable attorneys' fees) arisen directly or indirectly out of, or that relates directly or indirectly to, TouchpointPT.com or services provided by TouchpointPT (including any interactions with, or act or omission of, Recipients or any third-party links).

TouchpointPT's liability to the Partner is limited to issues arising directly from platform functionality. TouchpointPT is not liable for clinical outcomes, patient disputes, regulatory penalties arising from the Partner's practice, or any indirect, incidental, consequential, or punitive damages, even if advised of the possibility of such damages. In no event shall TouchpointPT's aggregate liability to the Partner exceed the total platform fees paid by the Partner in the three (3) months preceding the claim.

This agreement begins upon the Partner's acceptance of these Terms and continues until terminated by either party. Either party may terminate with thirty (30) days' written notice. TouchpointPT may terminate or suspend the Partner's access immediately and without notice if:

• The Partner materially breaches these Terms and fails to cure such breach within ten (10) days of written notice.
• The Partner engages in conduct that poses a risk of harm to patients or to the platform.
• Required platform fees remain unpaid for more than thirty (30) days.

Upon termination, the Partner's access to the platform will cease. As a data custodian on behalf of the Partner, TouchpointPT does not retain any ownership rights over the Partner's data; the Partner remains fully responsible for ensuring continued compliance with all applicable data retention laws, including those imposed by HIPAA and applicable state law, for the remainder of any applicable retention period. The Partner must make arrangements for data transition, storage, or retrieval prior to or promptly following termination. TouchpointPT will cooperate reasonably with the Partner in facilitating data transition in accordance with the Post-Termination Data Retention & HIPAA Compliance section of these Terms.

Federal law, including the Health Insurance Portability and Accountability Act (HIPAA) and applicable state regulations, requires that Protected Health Information (PHI) and clinical records be retained for a minimum number of years, with TouchpointPT retaining data for seven (7) years to satisfy both HIPAA and any applicable state laws that may require longer retention periods. TouchpointPT acts solely as a data custodian with respect to all PHI stored on the platform and does not own any patient data or clinical records. The Partner is and remains the data owner of all patient information generated through the platform.

Upon termination or non-renewal of a Partner's subscription, the Partner remains solely and independently responsible for ensuring continued compliance with all applicable HIPAA and state data retention obligations for the duration of any remaining retention period. Prior to or promptly following termination, the Partner must select one of the following options for managing their data:

• Long-Term Storage Through TouchpointPT: The Partner may elect to continue paying a reduced long-term archival storage fee to TouchpointPT to retain the Partner's data in a read-only format on the platform's HIPAA-compliant infrastructure for the remainder of the applicable retention period. This option covers secure archival access only and does not include active platform features. Applicable fees and terms will be provided upon written request. Should TouchpointPT cease operations, the Partner will be required to choose from one of the other options provided.
• Third-Party HIPAA-Compliant Storage: The Partner may arrange for the secure transfer of their data to a third-party HIPAA-compliant storage provider of the Partner's choosing. TouchpointPT will cooperate in facilitating a secure, documented transfer to the designated provider, subject to the execution of appropriate data transfer agreements and Business Associate Agreement documentation with the receiving party. The Partner is responsible for all costs, compliance obligations, and security measures associated with the transfer and ongoing management of their data.
• Transferred Account Under Partner Billing: The Partner may request that their data be migrated to a standalone storage account with the Partner's own billing details attached. This account will be subject to applicable administrative and storage fees and will not include full platform access.
• Self-Managed Download: The Partner may request a complete export and download of their data directly from the platform. By selecting this option, the Partner assumes full and sole responsibility for the secure storage, access controls, encryption, audit logging, breach notification, and all other HIPAA Privacy and Security Rule obligations applicable to any PHI contained in the downloaded data. Once the data has been delivered to the Partner, TouchpointPT's custodial responsibilities with respect to that data cease. TouchpointPT shall bear no liability for any unauthorized access, disclosure, loss, or regulatory penalties arising from the Partner's handling of self-managed downloaded data.

If a Partner fails to make a selection or take action within sixty (60) days following the effective date of termination, TouchpointPT will send written notice to the Partner's last known email address. If no response or arrangement is made within thirty (30) days of such notice, TouchpointPT reserves the right to permanently delete the Partner's data from the platform in accordance with its data retention and disposal policies. TouchpointPT shall bear no liability for any regulatory penalties, fines, audits, or claims arising from the Partner's failure to timely arrange for compliant data retention following termination.

The Partner's obligations under this section survive the termination or expiration of the subscription agreement and these Terms for as long as any applicable data retention obligation remains in effect.

This agreement is governed by the laws of the State of Ohio, without regard to conflict of law principles. Any dispute arising out of or relating to this agreement shall be resolved by binding arbitration in Ohio in accordance with the rules of the American Arbitration Association. Class arbitrations and class actions are not permitted. If the arbitration clause is found unenforceable, disputes shall be resolved exclusively in the state or federal courts located in Ohio.

TouchpointPT reserves the right to update these Partner terms at any time. Material changes will be communicated to Partners via email or in-platform notification no less than thirty (30) days prior to taking effect. The Partner's continued use of the platform after the effective date of changes constitutes acceptance of the updated terms. If the Partner does not agree to the updated terms, the Partner must discontinue use and notify TouchpointPT in writing.