Provider Tools Terms of Service

Last updated: October 6, 2026

These Primary.Health Provider Tools Terms of Service (these “Terms”) are a legally binding agreement between Primary Diagnostics, Inc. d/b/a Primary.Health (“Primary.Health,” “we,” “us,” or “our”) and the health care provider organization, individual health care provider, public health agency, or other organization on whose behalf a Provider Tool is enabled (“Customer”). The “Provider Tools” are the software applications that Primary.Health makes available to health care providers and public health agencies, including Health by Primary.Health, our web-based record system at my.primary.health (“Health”), and Vax by Primary.Health, some of which operate within Customer’s electronic health record (“EHR”) workflow through a third-party platform. The Provider Tools, together with related settings tools, websites, support, and other services, are the “Services.” Section 7 contains additional terms for Health, and Schedule 1 contains product-specific terms for Vax by Primary.Health (“Product Terms”).

THE SERVICES ARE INTENDED SOLELY FOR USE BY LICENSED HEALTH CARE PROFESSIONALS AND THEIR AUTHORIZED WORKFORCE MEMBERS IN THE UNITED STATES. THE SERVICES SUPPORT, BUT DO NOT REPLACE, THE INDEPENDENT CLINICAL JUDGMENT OF CUSTOMER’S CLINICIANS, AND THEY ARE NOT FOR USE IN EMERGENCIES.

Acceptance. By clicking “Add Now,” “I Agree,” or a similar button or checkbox, whether in the Vim marketplace, Epic’s Showroom, or another EHR or third-party marketplace, when first logging in to a Provider Tool, or within a Provider Tool, or by accessing or using the Services, the individual taking that action (“you”) agrees to these Terms on behalf of Customer. If you do not have authority to bind Customer, or if Customer does not agree to these Terms, you must not enable, access, or use the Services. YOU REPRESENT AND WARRANT THAT YOU HAVE FULL LEGAL AUTHORITY TO BIND CUSTOMER TO THESE TERMS AND, IF CUSTOMER IS A COVERED ENTITY OR BUSINESS ASSOCIATE UNDER HIPAA, TO THE BAA.

PLEASE READ THESE TERMS CAREFULLY. THEY INCLUDE A DISCLAIMER OF WARRANTIES (SECTION 12), LIMITATIONS OF LIABILITY (SECTION 13), AND A WAIVER OF THE RIGHT TO PARTICIPATE IN ANY CLASS ACTION OR REPRESENTATIVE PROCEEDING (SECTION 16).

Related Agreements. The following are incorporated into and form part of these Terms: (a) the business associate agreement that Customer accepts when it enables a Provider Tool (the “BAA”), which governs Primary.Health’s creation, receipt, maintenance, transmission, use, and disclosure of Protected Health Information in connection with the Services, and a copy of which is available within the Services or on request; (b) the Product Terms for each Provider Tool that Customer enables; (c) for any Provider Tool with e-prescribing features, the Primary.Health E-Prescribing Terms (the “E-Prescribing Terms”), which Primary.Health presents during the initial setup of e-prescribing features and which remain available in the e-prescribing settings within the Provider Tools; (d) any Program/License Agreement that Customer itself signs (as defined in Section 2(g)); and (e) any additional terms, notices, or policies for specific features, programs, or jurisdictions that we present within the Services or otherwise make available to Customer (“Additional Terms”). Our collection and use of personal information about Authorized Users is described in our Privacy Policy at https://www.primary.health/privacy-policy/ (the “Privacy Policy”), including its section on health care professionals who use our Provider Tools. Use of Primary.Health’s public websites is also subject to our Terms of Service at https://www.primary.health/terms-of-service/, but these Terms control with respect to the Services, and the arbitration provisions of those Terms of Service do not apply to the Services.

Changes to these Terms. We may modify these Terms from time to time. We will post the modified Terms and update the “Last updated” date above. For material changes, we will provide at least thirty (30) days’ advance notice through the Services, by email to Customer’s administrator, or by other reasonable means, except that changes required by law or needed to address a security risk may take effect sooner. Changes will not apply retroactively. Customer’s continued use of the Services after a change takes effect constitutes acceptance of the modified Terms. If Customer does not agree to a change, its sole remedy is to stop using the Services and terminate these Terms under Section 15. We may require Customer to accept modified Terms to continue using the Services.

1. Definitions

Capitalized terms have the meanings below or as defined elsewhere in these Terms. Capitalized terms that are used but not defined in these Terms and that are defined in the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations (“HIPAA”) have the meanings given in HIPAA.

(a) “Authorized User” means an individual who is an employee, contractor, medical staff member, or other workforce member of Customer and whom Customer permits to access and use the Services on Customer’s behalf.

(b) “Customer Data” means all data and information, including Protected Health Information, that is submitted to or through the Services by or on behalf of Customer or its Authorized Users, or that Primary.Health receives on Customer’s behalf from Customer’s EHR (including through a Platform), a Data Source, or a Third-Party Service in connection with the Services. Customer Data does not include De-Identified Data or Usage Data.

(c) “Data Source” means any third party from which the Services retrieve, or to which the Services transmit, information on Customer’s behalf, including immunization information systems and other public health systems, health information exchanges, e-prescribing networks and intermediaries, and pharmacies, clinics, and other health care providers.

(d) “De-Identified Data” means information that has been de-identified in accordance with 45 C.F.R. § 164.514(a)–(c).

(e) “Medical Group” means Primary Diagnostics Medical Group P.A. d/b/a Primary.Health Medical, an affiliate of Primary.Health.

(f) “Platform” means a third-party platform, marketplace, or integration program, such as Vim, Epic’s Showroom, or another EHR vendor’s marketplace, through which a Provider Tool is procured, made available, or connected to Customer’s EHR, and the provider of that platform, marketplace, or program.

(g) “Protected Health Information” or “PHI” has the meaning given in 45 C.F.R. § 160.103.

(h) “Third-Party Services” means third-party products, services, networks, and content that interoperate with or are made available through the Services, including Platforms, Customer’s EHR, and Data Sources.

(i) “Usage Data” means technical, statistical, and usage information relating to the operation and use of the Services, such as feature usage, performance metrics, error logs, and configuration information, excluding PHI unless it has been de-identified.

2. The Services

(a) Description. The Services consist of the Provider Tools that Customer enables, as described in the applicable Product Terms and any documentation that Primary.Health makes available, and such other features as Primary.Health may make available from time to time.

(b) Fees. Customer pays no fees for the Services unless Customer signs its own Program/License Agreement. Customer is responsible for any fees charged by third parties, including any Platform, any laboratory, Customer’s EHR vendor, and Customer’s internet and device providers.

(c) Access Through Platforms. Some Provider Tools are procured or accessed through a Platform. Customer is responsible for maintaining its own agreement with, and any account, software, browser extension, application authorization, or configuration required by, each Platform and its EHR vendor. A Platform is not a party to these Terms and is not responsible for the Services. Primary.Health does not control any Platform or Customer’s EHR and is not responsible for their availability, performance, or data handling.

(d) Changes to the Services. Primary.Health may modify, update, or discontinue any feature of the Services at any time. Primary.Health will use commercially reasonable efforts to provide at least thirty (30) days’ notice (or, for Health, the longer notice described in Section 7(i)) before discontinuing a Provider Tool in its entirety or discontinuing any feature for which the applicable Product Terms require notice, unless earlier discontinuation is required by law, by a Data Source or Third-Party Service, or to address a security risk.

(e) Beta Features. Primary.Health may make available features identified as beta, pilot, preview, or similar (“Beta Features”). Beta Features are provided for evaluation, may be incomplete or contain errors, may be modified or discontinued at any time, and are provided without warranty or support commitments of any kind.

(f) Support. Primary.Health will provide reasonable support for the Services through support@primary.health or other channels identified within the Services. Support requests that Customer submits through a Platform may be routed to Primary.Health.

(g) Programs and Sponsors. Customer’s access to the Services is provided through a program (a “Program”) that an organization (a “Sponsor”) has established with Primary.Health under an order form, statement of work, master license agreement, or similar agreement (a “Program/License Agreement”). Sponsors may include public health agencies, health care provider organizations, health plans, life sciences companies, and Primary.Health itself. A Customer that purchases or licenses the Services for its own use is the Sponsor of its own Program. When Customer accesses the Services through a Program: (i) these Terms and the BAA govern Customer’s use of the Services, and Customer is not a party to the Sponsor’s Program/License Agreement; (ii) the Sponsor pays for Customer’s access; (iii) the Sponsor may determine which Provider Tools and features are available, which providers are eligible, and how the Program is configured; may require Customer to accept Program terms that Primary.Health presents within the Services, which are Additional Terms; and may end the Program or Customer’s participation; (iv) Primary.Health will identify the Sponsor to Customer at sign-up or within the Services, and will share with the Sponsor only (A) Customer’s enrollment status and usage information about Customer that the Program is configured to report, which Primary.Health provides only in aggregate form that does not identify any patient (and, to the extent that information is derived from Network Data (as defined in the E-Prescribing Terms), only as the Surescripts Agreement (as defined in the E-Prescribing Terms) permits), (B) de-identified information (including aggregated de-identified information), and (C) PHI that Customer authorizes the Program to share and that the BAA and applicable law permit, such as reports to a public health agency, and will not share PHI, or prescribing or administration data about identifiable providers, with a Sponsor that is a life sciences company; (v) no Sponsor may control or influence the Clinical Content, recommendations, or display of options in the Services, and Customer’s access is not conditioned on referring patients to, or ordering, prescribing, or purchasing any item or service from, the Sponsor or anyone else; (vi) Customer is responsible for confirming that it may accept access sponsored by the Sponsor under the laws and policies that apply to it; and (vii) if the Program or Customer’s participation ends, Primary.Health will notify Customer as soon as practicable, make Customer’s records available for export under Sections 7(h) and 9(d), and offer Customer the option to continue under its own Program/License Agreement.

3. Eligibility, Accounts, and Authorized Users

(a) Eligibility. The Services are available only to health care providers and other organizations located in the United States that are eligible under a Program, and to their Authorized Users; they are not intended for use by patients or other consumers.

(b) Authorized Users. Customer will ensure that (i) only Authorized Users access the Services; (ii) each Authorized User uses unique credentials that are not shared; (iii) access is limited to Authorized Users who need it to perform their job functions; and (iv) each Authorized User complies with these Terms. Customer is responsible for all acts and omissions of its Authorized Users and for all activity under their credentials. Customer will promptly revoke access for any individual who is no longer authorized and will notify Primary.Health promptly upon learning of any unauthorized access to or use of the Services.

(c) Organization Administrator. Customer will designate at least one administrator who is authorized to manage Customer’s configuration of the Services (including the settings described in the applicable Product Terms) and to receive notices on Customer’s behalf. If an individual Authorized User enables a Provider Tool, Customer may confirm, modify, or disable that enablement through its administrator or by contacting Primary.Health.

(d) Verification. Primary.Health and, for e-prescribing, Surescripts may verify the identity, licensure, National Provider Identifier, prescriptive authority, and organizational authority of Customer and its Authorized Users, and may condition, suspend, or limit access to any feature pending successful verification.

4. Customer Responsibilities

(a) Compliance with Law. Customer will use the Services in compliance with all applicable laws and professional standards, including HIPAA and state health privacy laws; laws governing the practice of medicine, nursing, and pharmacy and prescribing; public health reporting and registry laws; consent and minor-consent laws; the federal Anti-Kickback Statute and similar state laws; and the Telephone Consumer Protection Act.

(b) Consents and Notices. Customer is solely responsible for providing any notices to, and obtaining and maintaining any consents or authorizations from, patients and their parents, guardians, or personal representatives that are required by applicable law or by any Data Source for Customer’s use of the Services, including, as applicable, for querying and reporting to Data Sources, e-prescribing and the use of any medication history or benefit information, scheduling with third parties, and communications sent to patients through the Services. Customer is responsible for honoring any patient opt-out, restriction, or confidentiality election, including elections under state registry participation laws and minor consent laws, and for configuring the Services or informing Primary.Health as necessary for Primary.Health to honor those elections.

(c) Authorization to Act on Customer’s Behalf. Customer authorizes Primary.Health to act on Customer’s behalf and under Customer’s legal authority, as Customer’s technology vendor and data submitter, for the limited purposes of querying, reporting to, and exchanging information with Data Sources in connection with the Services, as further described in the applicable Product Terms. Primary.Health may do so using Customer’s own IIS access or, where Customer has none, IIS query access held by the Medical Group on Customer’s behalf.

(d) Documentation and Accuracy. Customer is responsible for the accuracy, completeness, and timeliness of all Customer Data submitted through the Services and for meeting all documentation, recordkeeping, and reporting obligations that apply to it. The Services may assist with data capture, but they do not relieve Customer of those obligations.

(e) EHR Write-Back. The Services may write information to Customer’s EHR, including through a Platform. Customer is responsible for reviewing information written to its EHR, for its EHR configuration, and for promptly notifying Primary.Health of any information that appears to have been written inaccurately or to the wrong patient record.

(f) Acceptable Use. Customer will not, and will not permit any person to: (i) use the Services to access records of any individual who is not a current or prospective patient of Customer with a legitimate treatment purpose (or, for a public health agency, a legitimate public health purpose authorized by law), or use the Services or information obtained through them for marketing, employment, insurance underwriting, law enforcement, or any other purpose unrelated to Customer’s provision of health care, except as required by law; (ii) copy, modify, reverse engineer, resell, or create derivative works of the Services, or use them to develop or benchmark a competing product; (iii) use automated means to access the Services or extract data except through interfaces that Primary.Health provides; (iv) interfere with the Services, attempt to gain unauthorized access, circumvent any security control, or transmit malicious code; or (v) access or use the Services, or permit Customer Data to be accessed through them, from outside the United States, or otherwise in violation of these Terms, the terms of any Third-Party Service, or applicable law.

(g) Equipment and Connectivity. Customer is responsible for obtaining and maintaining all equipment, software, and internet connectivity needed to access the Services and for the security of its devices, networks, and EHR.

5. Clinical Decision Support; No Medical Advice

(a) Support for Clinical Judgment. The Services provide information and calculations intended to support licensed health care professionals. The Services do not provide medical advice and do not replace the independent professional judgment of Customer’s clinicians. Customer and its clinicians are solely responsible for all clinical decisions and actions, including whether to recommend, prescribe, or administer any treatment, product, or vaccine; screening for and evaluation of contraindications and precautions; informed consent and shared clinical decision-making; and all care provided to each patient.

(b) Clinical Content. Some Provider Tools apply clinical guidelines, schedules, or other content published by third parties (“Clinical Content”). Primary.Health does not endorse, recommend, or require the use of any particular Clinical Content. Customer acknowledges that Clinical Content may differ among publishers; may be revised, withdrawn, stayed, enjoined, or otherwise affected by legislative, regulatory, or judicial action, sometimes with little notice; and is applied through Primary.Health’s implementation as computable logic, which may not capture every nuance, condition, or product-specific requirement and may not reflect changes immediately. Customer is responsible for confirming that the Clinical Content applied and the resulting outputs are appropriate for each patient, including by consulting the published source and FDA-approved product labeling.

(c) Basis for Recommendations. The Services are designed to display the information on which each calculation is based, such as the source records, the Clinical Content applied, and the applicable rule, so that Authorized Users can independently review that basis. Authorized Users should not rely primarily on any calculation or other output of the Services to make a clinical decision.

(d) Coverage, Reimbursement, and Legal Status. Clinical decisions, and the Clinical Content that Customer selects, may affect insurance coverage and cost-sharing, eligibility for public programs, the availability of liability protections, and the legal requirements that apply to Customer and to other professionals. Primary.Health does not make, and the Services do not reflect, any determination regarding coverage, reimbursement, program eligibility, liability protection, or legal requirements for any patient, product, or service.

(e) Not for Emergencies or Time-Critical Use. The Services are not designed for, and must not be used for, emergency or other time-critical clinical decision-making.

(f) No Provider-Patient Relationship. Primary.Health is not a health care provider with respect to the Services, does not practice medicine, nursing, or pharmacy, and does not have a provider-patient relationship with any of Customer’s patients through the Services.

6. Third-Party Services, Data Sources, E-Prescribing, and Patient Communications

(a) Third-Party Services Generally. Third-Party Services are provided by third parties, not Primary.Health, and Customer’s use of them may be subject to separate terms and privacy policies. Primary.Health does not control and is not responsible for any Third-Party Service, including its availability, accuracy, security, or data practices. A Third-Party Service may modify, suspend, or terminate its interoperation with the Services, or require Primary.Health to suspend features that rely on it, at any time, and Primary.Health will have no liability to Customer for any such action.

(b) Data Sources. Information that the Services retrieve from Data Sources is provided by third parties that Primary.Health does not control. Customer acknowledges that a Data Source may not participate in, or be connected to, the Services at all times; that each Data Source determines what information it will return or accept under its own laws, policies, and agreements; that information in a Data Source may be incomplete, delayed, duplicated, or inaccurate; and that the matching processes used by the Services may not correctly match every record to the correct patient. Customer is responsible for confirming patient identity and, as clinically appropriate, verifying information with the patient and other available records.

(c) E-Prescribing. E-prescribing features are available only to Authorized Users who are licensed prescribers authorized to prescribe the applicable product under the laws of the state in which they practice and who satisfy all identity-proofing, enrollment, and other requirements of Primary.Health and Surescripts, LLC (“Surescripts”). E-prescribing features become available to Customer only after Primary.Health completes Customer’s enrollment with Surescripts. Prescriptions transmitted through the Services are issued by Customer’s prescribers, who are solely responsible for their content and appropriateness. E-prescribing features are not certified for, and must not be used for, controlled substances. Use of e-prescribing features is subject to the E-Prescribing Terms. Primary.Health does not guarantee that any pharmacy will receive, accept, fill, or administer any prescription, or that any product will be in stock, covered by insurance, or available at any particular cost.

(d) Patient Communications. If the Services send appointment confirmations, reminders, or other communications to patients at Customer’s direction, Primary.Health sends those communications on Customer’s behalf. Customer represents and warrants that it has obtained all consents required under the Telephone Consumer Protection Act and other applicable laws for such communications to be sent to the contact information that Customer provides. Customer will not use the Services to send marketing communications. Primary.Health will process opt-out requests that it receives in accordance with applicable law and make them available to Customer.

7. Health (my.primary.health)

This Section 7 applies to Customer’s use of Health.

(a) Description. Health is a web-based record system that enables Customer’s Authorized Users, through a provider portal that they access with their own credentials (the “Provider Portal”), to document health care services provided to patients, order tests from the laboratories and other recipients that Customer selects, receive and manage results, report immunizations and other information to public health authorities, and manage cases.

(b) Access Based on Permissions and Patient Requests. Health gives Authorized Users access to PHI only as Customer permissions them, so that they can perform the services that patients have requested from Customer or that Customer is otherwise authorized to perform (or, for a Customer that is a public health agency, public health activities authorized by law). Customer will (i) assign each Authorized User only the access needed for that user’s role; (ii) review access periodically and promptly remove access that is no longer needed; (iii) train its Authorized Users on, and enforce, its privacy and security policies, including sanctions for misuse; and (iv) ensure that Authorized Users do not access the records of any patient, including themselves, family members, or coworkers, except as needed to perform their job duties. Authorized Users who wish to view their own records should use Primary.Health’s patient portal at my.primary.health. Primary.Health may require each Authorized User to accept a user acknowledgment covering confidentiality, permitted use, credentials, and monitoring, and Customer will cause its Authorized Users to comply with it.

(c) Monitoring and Misuse. Primary.Health maintains audit logs of access to PHI in Health and may monitor use of the Provider Portal. Access by an Authorized User that is not permitted by Customer’s policies or applicable law is Customer’s responsibility, including any resulting breach assessment and notification, except to the extent caused by Primary.Health’s breach of the BAA. Primary.Health will notify Customer of any such access that it discovers, may suspend the Authorized User’s access, and will provide the audit log information that Customer reasonably requests to investigate.

(d) Patient-Requested Services. Patients may request services from Customer through Primary.Health’s patient-facing websites, applications, and portals, which are governed by Primary.Health’s Terms of Service and Privacy Policy. When a patient requests a service from Customer, Primary.Health makes the information needed for that service available to Customer’s Authorized Users and holds the resulting records on Customer’s behalf under the BAA. Primary.Health will not make records that Customer creates in Health available to another health care provider or organization except at the patient’s direction, as Customer directs, or as the BAA and applicable law permit.

(e) Patient Access and Results Release. If Customer enables patient access, Primary.Health will make records and results available to patients through its patient portal at my.primary.health on Customer’s behalf. Customer is responsible for configuring when and how results and other records are released, including any delay or restriction that state law requires for sensitive results, the confidentiality of services that minors may consent to on their own, and parent or guardian access, and for meeting its own obligations under federal rules on patient access to electronic health information. Unless the parties agree otherwise in writing, Customer will not use Health to maintain records subject to 42 C.F.R. Part 2 or psychotherapy notes, and Customer is responsible for configuring Health for any other information that requires special handling under applicable law, such as reproductive health information.

(f) Test Orders and Results. Orders placed through Health are sent to the laboratories and other recipients that Customer selects. Primary.Health does not perform testing and does not require Customer to use any particular laboratory. Customer is responsible for ensuring that each order is placed by an individual authorized by applicable law to order the test; for medical necessity and documentation; for specimen collection, labeling, and handling; for its arrangements with each laboratory; and for reviewing results and notifying patients, including of critical results. Primary.Health does not guarantee that any laboratory will receive, accept, or timely process any order or return results through Health, and Customer will follow up through other means when results are not received.

(g) Documentation, Immunization Reporting, and Case Management. Customer is responsible for the accuracy and completeness of the services it documents in Health, including vaccine product, lot number, dose, date of administration, and administering provider, and for meeting its documentation obligations, including the recordkeeping requirements of 42 U.S.C. § 300aa-25, the vaccine information materials required by 42 U.S.C. § 300aa-26, and the reporting of adverse events to the Vaccine Adverse Event Reporting System as required by law. When Customer uses Health to report immunizations, reportable conditions, cases, or other information to immunization information systems or other public health authorities, Primary.Health transmits the information as Customer configures, but Customer remains responsible for its reporting obligations, including by reviewing and resolving any error or rejection notifications and using an alternative method when a report is not completed. Any enrollment, site, or user agreement that a public health authority requires for such reporting is an Additional Term.

(h) Records, Retention, and Export. As between the parties, Customer is the custodian of the records it creates or maintains in Health and is responsible for retaining them as applicable law requires. During the term, Customer may export its records from Health. After Customer’s access to Health ends for any reason, Primary.Health will, upon Customer’s request made within ninety (90) days, make Customer’s records available for export in a standard electronic format, and may offer continued read-only access or archival storage under a Program/License Agreement. Primary.Health will retain and then return or destroy PHI as described in the BAA. Customer will maintain reasonable downtime procedures for periods when Health is unavailable; any service level commitments appear only in a Program/License Agreement. This Section 7(h) supplements Section 9(d).

(i) Notice Before Discontinuation. Because Customer may rely on Health as a system of record, Primary.Health will provide at least ninety (90) days’ notice before discontinuing Health or terminating Customer’s access to Health under Section 15(c)(iv), unless a Program/License Agreement provides otherwise. If a Program or Customer’s participation in it ends sooner, Primary.Health will notify Customer as soon as practicable and make Customer’s records available for export under Section 7(h).

8. No Inducement

The Services are not provided in exchange for, and nothing in these Terms requires or is intended to induce, any referral, order, prescription, purchase, or recommendation of any item or service, and Customer and its clinicians remain free to choose any product, laboratory, pharmacy, location, or vendor consistent with their independent professional judgment. No Sponsor or other third party controls or influences the Clinical Content, recommendations, or display of options in the Services (Section 2(g)(v)). Customer will not seek reimbursement from any payer, or claim any cost on any cost report, for the value of the Services provided free of charge.

9. Privacy, Security, and Data Rights

(a) Protected Health Information. Primary.Health will create, receive, maintain, transmit, use, and disclose PHI in connection with the Services only as permitted by the BAA. In the event of any conflict between these Terms and the BAA with respect to PHI, the BAA controls. If Customer is not a covered entity or business associate under HIPAA (for example, a public health agency that is not a covered entity), the BAA does not apply. In that case, Primary.Health creates, receives, maintains, transmits, uses, and discloses the information it processes for Customer solely on Customer’s behalf and under Customer’s legal authority (including, for a public health agency, the authority granted to the agency by applicable public health law), in accordance with these Terms and any Program/License Agreement that Customer signs, and protects that information with the safeguards described in Section 9(e). If Customer is a public health agency that is also a covered entity, the BAA applies in addition to that authority.

(b) License to Customer Data. As between the parties, Customer retains all rights in Customer Data. Customer grants Primary.Health and its subcontractors a non-exclusive, royalty-free license to host, copy, store, transmit, display, process, and otherwise use Customer Data solely to (i) provide, maintain, secure, support, and improve the Services for Customer; (ii) create De-Identified Data as permitted by Section 9(c) and the BAA; (iii) provide data to Surescripts as described in the E-Prescribing Terms; and (iv) comply with applicable law. Primary.Health will not sell Customer Data and will not use PHI for advertising or marketing.

(c) De-Identified Data and Usage Data. To the extent permitted by the BAA and applicable law, and subject to any restriction in the terms of any Data Source, Primary.Health may create De-Identified Data from Customer Data. Primary.Health may also collect and generate Usage Data. Primary.Health may use and disclose De-Identified Data and Usage Data for any lawful purpose, including to operate, analyze, and improve its products and services, to support research and public health activities, and to publish aggregated insights, provided that Primary.Health will not publicly identify Customer or any Authorized User without Customer’s consent and will not attempt to re-identify any De-Identified Data. Notwithstanding the foregoing, Primary.Health will not create De-Identified Data from, or otherwise aggregate or analyze, Network Data (as defined in the E-Prescribing Terms) except as permitted by the Surescripts Agreement (as defined in the E-Prescribing Terms).

(d) Data Export. During the term of these Terms and for ninety (90) days after termination, upon Customer’s written request, Primary.Health will make available to Customer an export of the Customer Data then maintained by Primary.Health, in a commercially reasonable format, to the extent reasonably practicable. Customer acknowledges that documentation written to Customer’s EHR remains in Customer’s EHR and that information transmitted to a Data Source is maintained by that recipient.

(e) Security. Primary.Health will maintain administrative, physical, and technical safeguards designed to protect Customer Data, consistent with the HIPAA Security Rule, and will host and process Customer Data in the United States. No system is completely secure, and except as expressly provided in the BAA, Primary.Health does not guarantee that Customer Data will not be subject to unauthorized access or loss.

(f) Automated Processing. The Services use automated algorithms, including machine learning, to match, reconcile, and de-duplicate records and to perform calculations. Primary.Health will not use PHI to train artificial intelligence or machine learning models except as necessary to provide the Services to Customer or using De-Identified Data.

(g) Authorized User Information. Primary.Health’s collection, use, and disclosure of personal information about Authorized Users is described in the Privacy Policy.

10. Intellectual Property; Feedback

(a) Ownership. The Services, including all software, algorithms, Clinical Content implementations, user interfaces, documentation, and other content made available by Primary.Health, and all intellectual property rights in them, are owned by Primary.Health or its licensors. Published Clinical Content remains the property of its respective publishers, and a reference to any Clinical Content or its publisher does not imply that the publisher endorses, sponsors, or is affiliated with Primary.Health or the Services.

(b) Right to Use. Subject to Customer’s compliance with these Terms, Primary.Health grants Customer a limited, revocable, non-exclusive, non-transferable, non-sublicensable right, during the term of these Terms, for its Authorized Users to access and use the Services within the United States solely for Customer’s internal clinical and administrative purposes. All rights not expressly granted are reserved.

(c) Trademarks. The Primary.Health and Vax by Primary.Health names and logos are trademarks of Primary.Health. Other names and marks displayed through the Services belong to their respective owners. Nothing in these Terms grants Customer any right to use any Primary.Health trademark.

(d) Feedback. If Customer or any Authorized User provides suggestions, comments, or other feedback regarding the Services (“Feedback”), Primary.Health may use the Feedback for any purpose without obligation to Customer. Feedback does not include PHI, and any PHI included in Feedback will be handled only as permitted by the BAA.

11. Confidentiality

Each party (the “Recipient”) will protect the non-public business, technical, and financial information of the other party that is disclosed in connection with these Terms and that is marked or would reasonably be understood to be confidential (“Confidential Information”) using at least reasonable care, and will use and disclose such information only as necessary to exercise its rights and perform its obligations under these Terms. Confidential Information does not include information that is or becomes public through no fault of the Recipient, was known to the Recipient without restriction before disclosure, is independently developed without use of the Confidential Information, or is rightfully received from a third party without restriction. The Recipient may disclose Confidential Information as required by law after giving the disclosing party reasonable notice, where legally permitted. Primary.Health may disclose Customer’s name, identifiers, contact information, and information about Customer’s use of the e-prescribing features to Surescripts as required by the Surescripts Agreement (as defined in the E-Prescribing Terms), including for customer reporting, audits, directory listings, and notices about the availability of the e-prescribing features. PHI is governed by the BAA and not by this Section.

12. Disclaimers

(a) EXCEPT AS EXPRESSLY PROVIDED IN THE BAA, THE SERVICES, INCLUDING ALL INFORMATION, RECORDS, CALCULATIONS, AND OTHER OUTPUTS, ARE PROVIDED “AS IS” AND “AS AVAILABLE,” WITHOUT WARRANTY OF ANY KIND. TO THE MAXIMUM EXTENT PERMITTED BY LAW, PRIMARY.HEALTH DISCLAIMS ALL WARRANTIES, WHETHER EXPRESS, IMPLIED, OR STATUTORY, INCLUDING ANY WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, NON-INFRINGEMENT, ACCURACY, AND QUIET ENJOYMENT, AND ANY WARRANTIES ARISING FROM COURSE OF DEALING, COURSE OF PERFORMANCE, OR USAGE OF TRADE.

(b) WITHOUT LIMITING THE FOREGOING, AND EXCEPT AS REQUIRED UNDER HIPAA, THE BAA, OR APPLICABLE LAW, PRIMARY.HEALTH DOES NOT WARRANT THAT THE SERVICES WILL BE UNINTERRUPTED, SECURE, OR ERROR-FREE; THAT INFORMATION RETRIEVED FROM ANY DATA SOURCE, OR ANY FORECAST OR OTHER CALCULATION, WILL BE COMPLETE, ACCURATE, OR CURRENT; OR THAT ANY TRANSMISSION TO A THIRD PARTY WILL BE RECEIVED OR ACTED UPON.

(c) PRIMARY.HEALTH IS NOT RESPONSIBLE FOR ANY CLINICAL DECISION, TREATMENT, PRESCRIPTION, VACCINE ADMINISTRATION, OR OTHER HEALTH CARE SERVICE PROVIDED OR NOT PROVIDED BY CUSTOMER, ITS AUTHORIZED USERS, ANY LABORATORY, PHARMACY, CLINIC, OR OTHER THIRD PARTY, OR FOR ANY THIRD-PARTY SERVICE.

13. Limitation of Liability

(a) TO THE MAXIMUM EXTENT PERMITTED BY LAW, IN NO EVENT WILL PRIMARY.HEALTH OR ITS AFFILIATES, OR ITS OR THEIR OFFICERS, DIRECTORS, EMPLOYEES, AGENTS, SUPPLIERS, OR LICENSORS, BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, OR PUNITIVE DAMAGES, OR FOR ANY LOSS OF PROFITS, REVENUE, GOODWILL, USE, OR DATA, OR COST OF SUBSTITUTE SERVICES, ARISING OUT OF OR RELATING TO THESE TERMS OR THE SERVICES, REGARDLESS OF THE THEORY OF LIABILITY AND EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

(b) TO THE MAXIMUM EXTENT PERMITTED BY LAW, PRIMARY.HEALTH’S TOTAL AGGREGATE LIABILITY ARISING OUT OF OR RELATING TO THESE TERMS OR THE SERVICES WILL NOT EXCEED THE GREATER OF (I) THE AMOUNTS PAID BY CUSTOMER TO PRIMARY.HEALTH FOR THE SERVICES DURING THE TWELVE (12) MONTHS BEFORE THE EVENT GIVING RISE TO THE CLAIM AND (II) ONE HUNDRED U.S. DOLLARS (US $100); PROVIDED THAT CLAIMS ARISING UNDER THE BAA ARE SUBJECT TO THE LIMITATION OF LIABILITY IN THE BAA RATHER THAN THIS SECTION 13(b).

(c) THE LIMITATIONS IN THIS SECTION 13 APPLY EVEN IF ANY LIMITED REMEDY FAILS OF ITS ESSENTIAL PURPOSE, AND THEY REFLECT AN ALLOCATION OF RISK THAT IS AN ESSENTIAL BASIS OF THE PARTIES’ BARGAIN, INCLUDING THAT PRIMARY.HEALTH PROVIDES THE SERVICES FREE OF CHARGE. SOME JURISDICTIONS DO NOT ALLOW THE EXCLUSION OR LIMITATION OF CERTAIN DAMAGES, SO SOME OF THESE LIMITATIONS MAY NOT APPLY.

14. Indemnification

(a) By Customer. Customer will defend, indemnify, and hold harmless Primary.Health, its affiliates, and its and their respective officers, directors, employees, agents, licensors, and service providers (the “Primary.Health Parties”) from and against all third-party claims, actions, demands, and proceedings (including claims by Surescripts or any Network Data Source, as defined in the E-Prescribing Terms), and all resulting losses, damages, liabilities, settlements, penalties, fines, costs, and expenses (including reasonable attorneys’ fees), to the extent arising out of or relating to (i) any clinical decision, treatment, prescription, vaccine administration, or other health care service provided or not provided by Customer or its Authorized Users, including the selection or application of any Clinical Content; (ii) Customer Data, including Customer’s failure to provide any required notice or obtain any required consent or authorization; (iii) Customer’s or its Authorized Users’ breach of these Terms, the Product Terms (including any Jurisdiction Terms), or the E-Prescribing Terms, or violation of applicable law; or (iv) any claim for payment submitted by or on behalf of Customer. Nothing in this Section 14 limits either party’s obligations under the BAA.

(b) Procedure. Primary.Health will give Customer prompt written notice of any claim for which it seeks indemnification; a delay relieves Customer only to the extent it is materially prejudiced. Customer will control the defense and settlement with counsel reasonably acceptable to Primary.Health, but may not settle any claim that imposes an obligation on, or admits fault by, a Primary.Health Party without Primary.Health’s written consent. Primary.Health may participate at its own expense and may assume the defense at Customer’s expense if Customer fails to defend diligently.

15. Term, Suspension, and Termination

(a) Term. These Terms take effect when Customer first accepts them or first accesses the Services, whichever is earlier, and continue until terminated under this Section 15.

(b) Termination by Customer. Customer may terminate these Terms at any time by disabling the Provider Tools (including through any Platform) and providing written notice to Primary.Health at contracts@primary.health.

(c) Suspension and Termination by Primary.Health. Primary.Health may suspend or terminate Customer’s or any Authorized User’s access to all or part of the Services, or terminate these Terms, (i) immediately upon notice if Customer or an Authorized User breaches these Terms, the Product Terms (including any Jurisdiction Terms), or the E-Prescribing Terms or, subject to the notice and cure period in Section 5.2 of the BAA, breaches the BAA; (ii) immediately if Primary.Health reasonably believes suspension is necessary to prevent harm to patients, Customer Data, the Services, or third parties, or to comply with law or the requirements of a Data Source or Third-Party Service; (iii) if Customer’s account has been inactive for twelve (12) consecutive months; or (iv) for any other reason upon thirty (30) days’ notice (or, for Health, the notice described in Section 7(i)). Primary.Health will use reasonable efforts to notify Customer before a suspension where practicable and to restore access promptly once the reason for the suspension is resolved.

(d) Effect of Termination. Upon termination, Customer’s right to access and use the Services ends; Primary.Health will cease querying and reporting to Data Sources on Customer’s behalf; and Primary.Health will return or destroy PHI as provided in the BAA, subject to Customer’s export rights under Sections 7(h) and 9(d). Customer is responsible for ensuring that it has an alternative means of meeting its reporting and other obligations as of the effective date of termination.

(e) Survival. Sections 1, 4(a), 4(b), 4(d), 5, 6(b), 7(c), 7(h), 8, 9, 10, 11, 12, 13, 14, 15(d), 15(e), 16, and 17 of these Terms, Sections 1, 3, 4, 5, and 6(a) of Schedule 1, the provisions of the E-Prescribing Terms that are stated to survive, and any other provision that by its nature should survive, will survive termination of these Terms.

16. Governing Law; Disputes; Class Action Waiver

(a) Governing Law and Venue. These Terms are governed by the laws of the State of California, without regard to its conflict of laws principles, and by applicable federal law. Each party submits to the exclusive jurisdiction of the state and federal courts located in San Francisco, California, for any action arising out of or relating to these Terms or the Services, except that either party may seek injunctive or other equitable relief in any court of competent jurisdiction to protect its intellectual property, Confidential Information, or PHI.

(b) Informal Resolution. Before filing any action, a party will first notify the other party in writing, and the parties will attempt in good faith to resolve the dispute informally for at least thirty (30) days.

(c) Class Action Waiver. CUSTOMER AND PRIMARY.HEALTH AGREE THAT EACH MAY BRING CLAIMS AGAINST THE OTHER ONLY IN ITS INDIVIDUAL CAPACITY AND NOT AS A PLAINTIFF OR CLASS MEMBER IN ANY PURPORTED CLASS OR REPRESENTATIVE PROCEEDING.

17. General

(a) Entire Agreement; Order of Precedence. These Terms, together with the BAA, the Product Terms, the E-Prescribing Terms, and any Additional Terms, constitute the entire agreement between Customer and Primary.Health regarding the Services and supersede all prior or contemporaneous agreements and understandings regarding the Services. In the event of a conflict, the following order of precedence applies: (i) the BAA, with respect to PHI; (ii) the E-Prescribing Terms, with respect to e-prescribing; (iii) any Program/License Agreement that Customer itself signs, to the extent it expressly modifies these Terms; (iv) the Product Terms, with respect to the applicable Provider Tool; (v) Additional Terms, with respect to the feature, program, or jurisdiction to which they apply; and (vi) these Terms. Any purchase order or other terms proposed by Customer, other than a Program/License Agreement signed by Primary.Health, are void. A Sponsor’s Program/License Agreement does not change Customer’s rights under these Terms except through Program terms presented to Customer within the Services.

(b) Assignment. Customer may not assign or transfer these Terms without Primary.Health’s prior written consent. Primary.Health may assign these Terms, together with the BAA, to an affiliate or to a successor in connection with a merger, acquisition, reorganization, or sale of all or substantially all of the assets or business to which these Terms relate. Any attempted assignment in violation of this Section is void.

(c) Notices. Primary.Health may provide notices to Customer through the Services, by email to the administrator or other contact associated with Customer’s account, or by mail. Customer will provide legal notices to Primary.Health by email to contracts@primary.health and by mail to Primary Diagnostics, Inc. d/b/a Primary.Health, Attn: Contracts, 595 Pacific Ave, FL4, San Francisco, CA 94133, with a copy to privacy@primary.health for any notice relating to privacy or security. Customer is responsible for keeping its contact information current.

(d) Force Majeure. Neither party will be liable for any failure or delay in performance caused by events beyond its reasonable control, including natural disasters, epidemics, acts of government, war, terrorism, civil unrest, labor disputes, and failures of utilities, networks, or Third-Party Services, or cyberattacks that could not have been prevented by reasonable security measures.

(e) Independent Contractors; No Third-Party Beneficiaries. The parties are independent contractors. Except for the limited authorization described in Section 4(c), nothing in these Terms creates a partnership, joint venture, agency, fiduciary, or employment relationship. Except for the Primary.Health Parties under Section 14 and the third-party beneficiaries identified in the E-Prescribing Terms, there are no third-party beneficiaries of these Terms.

(f) Electronic Records. Customer consents to entering into these Terms electronically and to receiving notices electronically. Primary.Health will maintain an electronic record of Customer’s acceptance, which may include the date and time of acceptance, the identity and IP address of the accepting user, the version of these Terms accepted, and Customer’s organization and account identifiers. A printed version of these Terms and of any electronic notice will be admissible in any proceeding to the same extent as other business records.

(g) Miscellaneous. No waiver will be effective unless in writing, and no failure or delay in exercising any right will operate as a waiver. If any provision of these Terms is held unenforceable, it will be enforced to the maximum extent permissible and the remaining provisions will remain in effect. Headings are for convenience only. The words “include” and “including” mean “including without limitation.”

(h) Contact. Questions about these Terms may be directed to Primary.Health at support@primary.health or by mail to Primary Diagnostics, Inc. d/b/a Primary.Health, 595 Pacific Ave, FL4, San Francisco, CA 94133.

SCHEDULE 1 – VAX BY PRIMARY.HEALTH PRODUCT TERMS

These Product Terms apply to Vax by Primary.Health (“Vax”) and form part of the Terms. Capitalized terms used but not defined in this Schedule have the meanings given in the Terms. Except as provided in Section 17(a) of the Terms, if these Product Terms conflict with the Terms with respect to Vax, these Product Terms control.

1. Definitions

(a) “Guideline” means an immunization schedule, recommendation, or clinical guideline supported by Vax and published by a professional society, governmental body, or other organization, such as the American Academy of Pediatrics (“AAP”), the American Academy of Family Physicians (“AAFP”), or the Centers for Disease Control and Prevention and its Advisory Committee on Immunization Practices (“CDC/ACIP”). Guidelines are Clinical Content.

(b) “Immunization Information System” or “IIS” means an immunization registry or immunization information system operated by or on behalf of a state, territorial, local, or tribal public health jurisdiction.

(c) “Vim” means the Vim Connect middleware platform, Vim Hub, Vim Console, Vim Canvas marketplace, and related services through which Vax is made available within Customer’s EHR, and the provider of those services. Vim is a Platform.

2. Vax Services

(a) Description. Vax is designed to help Customer identify and address immunization needs at the point of care. Depending on the features Customer enables, Vax may (i) retrieve immunization records for Customer’s patients from IIS and other Data Sources and present a reconciled, de-duplicated immunization history; (ii) calculate due, overdue, and catch-up doses under a Guideline selected by Customer; (iii) enable Customer to document vaccines administered in its facilities and transmit that information to the applicable IIS; (iv) enable Customer’s prescribers to transmit vaccine prescriptions to pharmacies through the Surescripts network; and (v) enable Customer to schedule patients for vaccination at participating third-party clinics and pharmacies.

(b) Access Through Platforms. Vax may be procured or accessed through Vim or another Platform, and Section 2(c) of the Terms applies to each such Platform.

3. IIS Participation and Reporting

Under Section 4(c) of the Terms, Customer authorizes Primary.Health to query and report to IIS and other Data Sources on Customer’s behalf in connection with Vax. Customer will maintain, or will authorize Primary.Health to facilitate, any enrollment, registration, site agreement, user agreement, or other arrangement that an IIS requires for such querying and reporting, and will comply with the terms of those arrangements (“Jurisdiction Terms”), which are incorporated into these Product Terms as Additional Terms to the extent applicable. Customer remains solely responsible for complying with its immunization reporting obligations under applicable law, including by reviewing and resolving any error, rejection, or failed-transmission notification made available through Vax and by using an alternative reporting method when a transmission is not completed. Where Customer does not have its own IIS query access, Primary.Health may retrieve immunization records that Customer’s patients request from Customer through IIS query access held by the Medical Group on Customer’s behalf, as Customer, the treating provider, has authority to request those records from each IIS. Queries are logged and may be made available to the IIS; reporting of administered doses requires Customer’s own IIS enrollment.

4. Vaccine Documentation

Customer is responsible for the accuracy, completeness, and timeliness of the vaccine information it documents through Vax, including product, lot number, dose, date of administration, and administering provider, and for all vaccine documentation, recordkeeping, vaccine information statement, adverse event reporting, and public vaccine program obligations under applicable law, including 42 U.S.C. §§ 300aa-25 and 300aa-26 and the Vaccines for Children program.

5. Guidelines

(a) Guideline Selection. Customer, through its administrator or Authorized Users as configured, selects the Guideline or Guidelines that Vax applies. Section 5 of the Terms applies to each Guideline, including Customer’s responsibility to confirm that the selected Guideline and the resulting calculations are appropriate for each patient by consulting the published Guideline and FDA-approved product labeling.

(b) Vaccine Coverage and Legal Status. The Guideline that Customer selects and the vaccines it recommends or administers may affect insurance coverage, eligibility for public vaccine programs, liability protections and compensation programs (including the National Vaccine Injury Compensation Program and the Public Readiness and Emergency Preparedness Act), school and child care requirements, and professionals’ authority to administer vaccines under state law. Section 5(d) of the Terms applies to each of these matters.

6. Immunization Records, Queries, IIS Reporting, and Scheduling

(a) Immunization Records. Section 6(b) of the Terms applies to IIS and other Data Sources. Not every IIS participates in or is connected to Vax at all times; each IIS determines what information it returns under its own laws, policies, and agreements, including consent, opt-out, and age-based rules; doses administered by providers that do not report to an IIS may not appear; and reconciliation may not correctly combine or distinguish every dose.

(b) Queries. Customer authorizes Primary.Health to submit patient identifiers and other information reasonably necessary for record matching to those Data Sources that Primary.Health reasonably determines are likely to hold immunization records for the patient in context, in each case consistent with the BAA, applicable law, and applicable Jurisdiction Terms.

(c) IIS Reporting. If Customer enables IIS reporting, Primary.Health will transmit immunization administration information documented through Vax to the IIS configured for Customer’s facility, in the format and through the connection that the IIS requires. Transmission does not guarantee that the IIS will accept, process, or correctly record the information. Primary.Health will make available through Vax any acknowledgment, error, or rejection message that it receives from the IIS. If Customer also reports immunizations to an IIS through another method, such as an existing EHR interface, Customer is responsible for configuring Vax and its other reporting methods to avoid duplicate or conflicting submissions.

(d) Scheduling with Third-Party Locations. Vax may display appointment availability at third-party clinics, pharmacies, and other locations (“Third-Party Locations”) and enable Customer to request appointments for its patients. Customer will book an appointment only with the agreement of the patient or the patient’s personal representative and, where practicable, in accordance with the patient’s stated preferences. Availability information is provided by Third-Party Locations and may be inaccurate or change without notice. Each Third-Party Location is solely responsible for the services it provides, including determining whether it can lawfully and appropriately vaccinate the patient (for example, based on age, state law, prescription requirements, product availability, insurance network participation, or participation in public vaccine programs such as the Vaccines for Children program), and the patient’s relationship with a Third-Party Location is governed by that location’s terms and privacy practices. Primary.Health does not recommend or endorse any Third-Party Location. Third-Party Locations are displayed based on factors such as proximity, availability, and patient preference, and Primary.Health does not accept payment from any Third-Party Location for listings, placement, or bookings.