Terms of Service

The Service includes optional functionality to connect to Electronic Health Record systems and transmit clinical documentation directly to those systems. When EHR Integration is used:

• An authorized User or account administrator connects to an EHR system through a secure OAuth authorization flow
• EHR connections may be established at the personal account level or at the organizational account level, depending on the User's account structure
• Users may search for and link patients in the Service to corresponding patient records in the connected EHR system
• Users may submit finalized clinical documentation (e.g., SOAP notes) to the connected EHR system, where it becomes part of the patient's medical record
• Once submitted, clinical documentation cannot be recalled, modified, or deleted by SOAP-E — the submitted document is governed by the EHR system's own policies and the Covered Entity's record management practices
• EHR Integration availability may vary by subscription plan, account type, and feature eligibility

The Service includes functionality to record audio of clinical encounters for the purpose of generating documentation. When audio recording is used:

• Audio is captured through the device microphone and uploaded to secure AWS servers (encrypted in transit and at rest)
• A secure transcription service converts audio to text with speaker identification
• Audio files are automatically deleted within 24 hours of processing
• All processing occurs within AWS under a HIPAA Business Associate Agreement; PHI is not used to train AI models

The Service is designed to support compliance with HIPAA by implementing administrative, physical, and technical safeguards consistent with industry standards. However, compliance depends on proper configuration and lawful use by Users.

SOAP-E does not guarantee that use of the Service alone will ensure HIPAA compliance.

You may not upload, process, or store PHI using the Service unless a valid BAA has been fully executed between you (or your organization) and SOAP-E.

SOAP-E is not acting as a Business Associate under HIPAA unless and until a BAA has been fully executed. Any PHI uploaded, processed, or stored prior to BAA execution is:

• Unauthorized and strictly prohibited
• Outside the scope of HIPAA protections
• Not covered by Business Associate obligations
• Processed at your sole risk and liability

SOAP-E expressly disclaims any Business Associate status, duties, or liabilities with respect to any data uploaded prior to BAA execution.

In the event of a conflict between these Terms and a BAA, the BAA shall control with respect to PHI.

You are solely responsible for:

• Obtaining any required patient consents
• Ensuring accuracy and appropriateness of documentation
• Complying with all applicable healthcare laws, regulations, and professional standards

When using the audio recording functionality, you are solely responsible for:

• Obtaining informed consent from the patient (or their authorized representative) prior to each recording session, including disclosure that audio will be recorded, transcribed by AI, and processed to generate clinical documentation
• Complying with all applicable federal and state recording consent laws, including all-party (two-party) consent requirements in states such as California, Connecticut, Florida, Illinois, Maryland, Massachusetts, Michigan, Montana, New Hampshire, Oregon, Pennsylvania, and Washington
• Obtaining consent from a parent, legal guardian, or other authorized representative when the patient is a minor (under 18 years of age), and documenting the guardian's name and relationship to the patient
• Maintaining appropriate documentation of consent for each recording session as required by applicable law and professional standards

The Service provides consent management tools, including a consent modal, standing consent tracking, and a printable patient disclosure template, to assist you in meeting these obligations. However, these tools do not constitute legal advice, and the adequacy of consent procedures remains your responsibility.

When using the EHR Integration functionality, you are solely responsible for:

• Reviewing and verifying the accuracy, completeness, and clinical appropriateness of all documentation before submitting it to an EHR system — once submitted, the document may become part of the permanent medical record and cannot be recalled by SOAP-E
• Ensuring that any EHR connection established through the Service is authorized by the applicable healthcare organization and complies with that organization's policies and credentialing requirements
• Maintaining valid EHR credentials and authorizations — if credentials expire or are revoked, submissions will fail until the connection is re-established
• Selecting the correct EHR connection and patient record when submitting documentation — SOAP-E is not responsible for documentation submitted to an incorrect EHR system or patient record
• Complying with all terms, policies, and acceptable use requirements of the EHR vendor in addition to these Terms
• Understanding that EHR systems are independent third-party services not operated, controlled, or warranted by SOAP-E — SOAP-E is not responsible for EHR system availability, data handling after submission, data retention or deletion practices within the EHR, or any actions taken by the EHR vendor

SOAP-E does not guarantee that any particular EHR system will accept submissions, that submitted documentation will appear in any particular format within the EHR, or that the EHR system will be available at any given time. Submission failures will be reported through the Service, and Users are responsible for monitoring submission status and re-submitting if necessary.

The Service uses probabilistic machine-learning models. AI-Generated Content:

• May contain inaccuracies, omissions, or bias
• May produce different outputs for similar inputs
• Is not guaranteed to be complete or clinically appropriate

You retain full responsibility for:

• All clinical documentation
• All clinical decisions
• Verifying AI-Generated Content before use

The Service is not intended to function as a regulated medical device and has not been cleared or approved by the U.S. Food and Drug Administration.

The Service may not be used:

• As a diagnostic or treatment tool
• For autonomous clinical decision-making without human review
• As the sole source of clinical documentation without verification
• To provide real-time clinical guidance in patient care
• In emergency or time-critical clinical decision-making
• To replace clinical judgment or professional standards of care

Violations of these prohibited uses may result in immediate termination and constitute a material breach of these Terms.

Data retention is governed by the following hierarchy:

• For PHI: The executed BAA controls retention, deletion, and return obligations
• For non-PHI personal information: The Privacy Policy governs retention periods
• These Terms defer to both the BAA (for PHI) and Privacy Policy (for other personal information)

Audio recordings of clinical encounters are automatically deleted within 24 hours of processing. Transcripts and AI-generated documentation derived from audio recordings are retained as PHI and governed by the BAA retention policy. Consent records documenting patient authorization for each recording session are retained for audit and compliance purposes.

Users may submit requests to delete specific patient data through the Service. Deletion requests are subject to:

• Review and processing by SOAP-E in accordance with the BAA and applicable law
• Applicable federal and state medical record retention requirements, which may mandate minimum retention periods
• Legal hold, litigation, or regulatory investigation requirements that may delay or prevent deletion

SOAP-E will process deletion requests without unreasonable delay and notify the requesting User upon completion.

Following termination:

• PHI will be handled in accordance with BAA requirements (return, destruction, or continued protection)
• Data may be retained for a limited period as required by law, regulatory compliance, or backup retention schedules
• Aggregated, de-identified data may be retained indefinitely

The foregoing limitation of liability does not apply to:

• HIPAA violations caused by SOAP-E's failure to comply with applicable HIPAA requirements
• Costs associated with breach notification under 45 CFR Part 164, Subpart D
• Regulatory fines, penalties, or sanctions imposed on Covered Entity due to SOAP-E's non-compliance with HIPAA obligations
• Gross negligence or willful misconduct by SOAP-E
• SOAP-E's violation of its confidentiality obligations
• Claims arising from SOAP-E's breach of the executed BAA

Except as provided below, disputes shall be resolved by binding arbitration administered by the AAA. You waive the right to a jury trial and class actions, except where prohibited by law.

You may opt out of arbitration within 30 days of account creation by written notice to support@soap-e.com.

The following matters are excluded from arbitration and may be brought in court:

• Government enforcement actions, including HIPAA enforcement by HHS or OCR
• Requests for equitable relief, including injunctions related to security incidents, data breaches, intellectual property misuse, or unauthorized use of the Service
• Regulatory cooperation and compliance obligations under HIPAA or other healthcare laws
• Emergency breach response and notification requirements
• Claims for which arbitration is prohibited by applicable law