Terms of Service

These Terms of Service (the "Terms") are an agreement between Swift Parse LLC, a California limited liability company doing business as Schema Care ("Schema Care", "we", "us"), and the organization that uses Schema Care ("you", the "Customer").

They govern your use of the Schema Care website at schemacare.com, the app at app.schemacare.com, and every related service we provide (together, the "Service").

You accept these Terms when you create an account, click to agree, sign in, or use the Service. If you do not agree, do not use the Service.

If you buy a paid plan through an order form or a checkout page (an "Order"), the Order is part of this agreement. If an Order conflicts with these Terms, the Order controls for that Order. A signed Business Associate Agreement controls as described in the section on health data.

The Service is for businesses and other organizations, such as law firms, legal nurse consultants, insurers and claims teams. It is not for personal, family or household use.

You must be at least 18 years old to create an account. If you accept these Terms for an organization, you confirm that you have authority to bind it, and "you" means that organization.

You may not use the Service if you are barred from receiving services under the laws of the United States.

Each person who uses the app needs their own account. Sign-in uses Google, JustAuth or a link sent by email. Every account must also set up an authenticator app for multi-factor sign-in, and the Service asks for a code before it shows any record.

You are responsible for the people you add to your workspace, the roles you give them, the matters you grant them, and everything done through their accounts.

You must:

• keep sign-in links, authenticator devices and recovery codes private, and never share an account;
• remove a person's access promptly when they no longer need it;
• give us accurate account information and keep it current; and
• tell us at security@schemacare.com as soon as you learn of any unauthorized access to your account or your content.

We use reasonable administrative, technical and physical safeguards designed to protect your content. The page at schemacare.com/compliance describes the safeguards in place today and what is not done yet.

The Service reads medical records and produces organized documents, timelines, summaries and abstraction answers that cite their source pages. The Service includes only the features that are available in your account. Our website may describe features that are still in development.

We may change, add or remove features. If we remove a material feature of a paid plan during a period you have paid for, we will tell you in advance. If the change materially reduces the Service for you, you may end your paid plan and we will refund the fees you prepaid for the rest of that period.

We may offer features labelled beta, preview or similar. They are offered as they are, may change or be withdrawn at any time, and are not covered by any commitment in an Order.

"Health Data" means any medical record of a real person, and any information about a real person's physical or mental health, health care, or payment for health care. It includes protected health information as defined in 45 CFR 160.103, records protected by 42 CFR Part 2, and medical information protected by state law, whether or not HIPAA applies to you. It includes a copy, excerpt, screenshot, photo or summary of any of these.

You must not upload or send Health Data to Schema Care, through the Service or any other channel, unless a Business Associate Agreement between you and Schema Care (a "BAA") is in effect for the workspace the Health Data goes into. Until then, upload only synthetic records or records de-identified under 45 CFR 164.514.

An owner or admin of your workspace signs the BAA in the dashboard. Once signed, the BAA controls over these Terms for protected health information if the two conflict.

When you upload a file, you must mark it truthfully as synthetic, de-identified, or covered by a BAA. Even after a BAA is signed, the Service may refuse real records until our own vendor agreements are in place and we turn on real-record processing. Your workspace's Compliance page in the dashboard shows where those agreements stand.

Never email medical records or patient information to any Schema Care address. Our email is not covered by a BAA.

If Health Data reaches us in breach of this section, we may delete it without notice, refuse to process it, suspend the affected account until the cause is fixed, and handle the event as a security incident. Receiving it does not create a BAA or any duty that a BAA would create.

You are responsible for having every right, authorization and legal basis needed to give us the records you upload, such as a patient authorization, a subpoena or your own agreement with a covered entity.

Use the Service only for your organization's lawful business, and only for records you are entitled to process. You must not, and must not let anyone else:

• send Health Data in breach of the section above;
• upload anything you have no right to share, or anything unlawful, infringing or harmful;
• upload malware, or anything designed to disrupt, damage or gain access to a system;
• probe, scan or test the Service for vulnerabilities without our written permission (we welcome security reports at security@schemacare.com);
• get around the Service's sign-in, access controls, upload rules or usage limits, or reach data you have not been granted;
• interfere with the Service or place an unreasonable load on it;
• copy, scrape or harvest the Service by automated means other than features we provide;
• reverse engineer the Service, except where the law allows it despite this restriction;
• use the Service to build a competing product; or
• share an account, or use another person's account.

Our people follow an internal acceptable use policy that keeps real patient data out of any tool not covered by a BAA. These rules ask the same care of you.

"Customer Content" means the files and information you or your users put into the Service, and the results the Service produces from them ("Output"). As between you and us, you own Customer Content, including Output.

You give Schema Care a limited license to host, copy, process, transmit and display Customer Content only as needed to provide, secure and support the Service for you, to follow your instructions, and to comply with law. We do not sell Customer Content, and we do not use it for advertising.

We may use information about how the Service is used, such as page counts, feature use and error reports, to run, secure and improve the Service. That information does not include the text or images of your records.

We will not use your name or logo as a customer reference without your permission.

The Service uses optical character recognition and AI language models to read records and produce Output. Output is machine-generated abstraction. It can be wrong or incomplete, even when it cites a page and even when it clears your review threshold.

A qualified person must review Output before you rely on it. Output is not medical advice, legal advice, a medical opinion, or an underwriting or claims decision. Schema Care does not practice medicine or law. You are responsible for every decision you make using Output.

Schema Care does not use Customer Content or Output to train, fine-tune or evaluate any machine learning model. Our AWS account that processes records is opted out of AWS using customer content to improve its AI services.

Each party may receive non-public information from the other that is marked confidential or that a reasonable person would understand to be confidential ("Confidential Information"). Your Customer Content is your Confidential Information.

The receiving party will use the other's Confidential Information only to perform under these Terms, protect it with at least reasonable care, and share it only with its employees, contractors and service providers who need it for that purpose and are bound by duties of confidentiality at least as protective as these.

Confidential Information does not include information that is or becomes public through no fault of the receiving party, that the receiving party already knew or independently developed, or that it received from someone free to share it.

A party may disclose Confidential Information when the law requires it, after giving the other party prompt notice where the law allows, so that it can seek protection.

The Free plan costs nothing. A paid plan is governed by the Order or the pricing shown to you when you buy it, which states the price, the billing period and the payment terms.

We do not charge you for a paid plan unless you have agreed to it. Unless the Order says otherwise, fees exclude taxes, and fees you have paid are not refundable except as these Terms or the Order provide.

We may change the price of a plan for a future billing period by giving you at least 30 days' notice. The change does not affect a period you have already paid for.

Schema Care and its licensors own the Service, including its software, design, templates and documentation. These Terms do not transfer any of it to you.

While these Terms are in effect, we give you a limited, non-exclusive, non-transferable right to use the Service for your organization's internal business, subject to these Terms.

If you send us suggestions or feedback, we may use them without any obligation to you.

The Service runs on Amazon Web Services, which hosts the app and stores and processes uploaded records. We also use other service providers to run the Service, for example for sign-in, data storage, email delivery and AI model inference. We are responsible for our service providers' performance of our obligations under these Terms.

If you sign in with Google or JustAuth, that provider's own terms govern your account with it. We are not responsible for services that you choose to connect.

Except as these Terms expressly say, the Service and Output are provided "as is" and "as available". To the fullest extent the law allows, Schema Care disclaims all warranties, express or implied, including warranties of merchantability, fitness for a particular purpose, title and non-infringement. We do not promise that the Service will be uninterrupted or error-free, or that Output will be accurate or complete.

Schema Care makes no representation that using the Service, by itself, meets your obligations under HIPAA or any other law. Schema Care has not been independently audited or certified, and has no SOC 2 report.

To the fullest extent the law allows, neither party is liable to the other for any indirect, incidental, special, consequential or punitive damages, or for lost profits, revenue, data or goodwill, arising out of or relating to these Terms or the Service, even if told they were possible.

To the fullest extent the law allows, each party's total liability arising out of or relating to these Terms, the Service, any Order and any BAA, on any theory, is limited to the fees you paid Schema Care for the Service in the 12 months before the claim arose. Liability under a BAA counts toward this same limit and does not add to it.

These limits do not apply to liability for fraud or willful misconduct, or to any other liability that the law does not allow to be limited or excluded. They do not limit your obligation to pay fees you owe.

Each party (the "indemnifying party") will defend the other against any claim brought by a third party to the extent it arises from the indemnifying party's breach of these Terms, and will pay the damages finally awarded and the amounts agreed in a settlement it approves. For you, this includes a breach of the sections on health data and acceptable use.

The party seeking defense must tell the indemnifying party promptly about the claim, let it control the defense and settlement, and give reasonable help at its expense. The indemnifying party may not settle a claim in a way that admits fault for, or imposes an obligation on, the other party without its consent.

This section is inside the limitation of liability above and is each party's only remedy for third-party claims under it.

These Terms apply from when you accept them until your account ends. You may stop using the Service at any time and ask us to close your account by writing to hello@schemacare.com.

We may suspend access, in whole or in part, if we reasonably believe it is needed to protect the Service, other customers or the records in it, if you breach the sections on health data or acceptable use, if fees are overdue, or if the law requires it. Where we reasonably can, we will tell you first and limit the suspension to what is needed.

Either party may end these Terms if the other materially breaches them and does not fix the breach within 30 days after written notice. We may also end them for any reason with 30 days' notice, and will then refund any fees you prepaid for the period after the end date.

Within 30 days after your account ends, we delete your Customer Content from the Service. If you ask us in writing within that period, we will return it to you first, and then delete it.

Some data is kept longer. Audit log entries, which carry record ids but not record content, are kept for six years. Stored file versions and backups expire on their normal schedule. We keep data longer when the law requires it or under a legal hold, and we keep protecting anything we keep. A signed BAA's own terms on return and destruction of protected health information also apply.

The sections on health data, your content, confidentiality, fees owed, intellectual property, disclaimers, limitation of liability, indemnity, your content when your account ends, governing law and general terms survive the end of these Terms.

We may update these Terms. The version number and the "Last updated" date at the top of this page change with every update.

For a material change, we will give you at least 30 days' notice by email to your workspace's owners or in the dashboard before it takes effect. Other changes, such as fixing wording or updating contact details, take effect when we post them.

If you keep using the Service after a change takes effect, you accept the updated Terms. If you do not agree, stop using the Service and close your account before then. An Order or a signed BAA changes only as it says.

The laws of the State of California govern these Terms, without regard to conflict-of-law rules. The United Nations Convention on Contracts for the International Sale of Goods does not apply.

Any dispute arising out of or relating to these Terms or the Service must be brought only in the state or federal courts located in California, and each party consents to those courts' personal jurisdiction.

You agree to receive agreements, notices and other communications from us electronically, by email or in the Service, and that they satisfy any requirement that they be in writing.

Clicking to accept, signing in the dashboard, or typing your name to sign is an electronic signature. It has the same effect as a handwritten signature, including for a BAA.

Send legal notices to security@schemacare.com. Send everything else to hello@schemacare.com. Do not include medical records or patient information in any notice.

We send notices to the email address of your workspace's owners, or show them in the dashboard. An email notice is given when sent, unless we learn it was not delivered.

• Entire agreement. These Terms, any Order and any signed BAA are the whole agreement between us about the Service, and replace any earlier understanding about it. Terms in your purchase order or other paperwork do not apply.
• Severability. If a court finds part of these Terms unenforceable, that part is enforced as far as the law allows and the rest stays in effect.
• Assignment. Neither party may assign these Terms without the other's written consent, except to a successor in a merger, acquisition or sale of all or substantially all of its business or assets, with notice to the other party.
• No waiver. A party that does not enforce a right at one time keeps the right to enforce it later.
• Events outside our control. Neither party is liable for a delay or failure caused by events beyond its reasonable control, other than a failure to pay.
• Relationship. The parties are independent contractors. These Terms create no partnership, agency or employment relationship, and give no rights to anyone else.
• Interpretation. Headings are for convenience. "Including" means including without limitation.

Questions about these Terms go to hello@schemacare.com. Legal notices and security reports go to security@schemacare.com. Please do not email medical records. Neither address is covered by a BAA.

How we handle personal information about visitors and account holders is described in our Privacy Policy at schemacare.com/privacy.