Terms of Service

1. Eligibility and Authority

The Services are intended for business use by individuals who are at least eighteen (18) years old and capable of entering into legally binding agreements.

If you access or use the Services on behalf of a dental practice, corporation, partnership, limited liability company, governmental entity, nonprofit organization, or other entity, you represent and warrant that you have authority to bind that entity to these Terms.

2. Services

CompliDent provides cloud-based software intended to help dental practices and other organizations organize, document, and manage compliance activities. Depending on the subscription or features purchased, the Services may include:

• HIPAA Security Risk Assessment workflows and related compliance assessments;
• compliance task management and remediation tracking;
• policy and procedure management;
• employee training tracking and administrative records;
• vendor and business-associate management records;
• document and evidence storage for permitted business-compliance materials;
• audit trails, logs, reports, dashboards, and related compliance tools; and
• other features identified in an order form, subscription plan, or product documentation.

The Services are not an electronic health record, patient-management system, clinical record repository, imaging system, claims platform, patient portal, clinical communications platform, or consumer-health-data repository. Customer must not use the Services for patient care, clinical decision-making, claims processing, or storage or transmission of Prohibited Health Data.

3. No Legal, Medical, or Professional Advice

The Services provide software tools, templates, workflows, educational content, and automated outputs for compliance-management purposes. They do not constitute legal advice, medical advice, accounting advice, cybersecurity consulting, or other professional advice.

Although attorneys, dentists, compliance professionals, engineers, or other subject-matter experts may contribute to the design or content of the Services, use of the Services does not create an attorney-client, dentist-patient, consultant-client, fiduciary, or other professional relationship with CompliDent or any contributor.

Customer is responsible for obtaining advice from its own legal counsel and other qualified professionals regarding HIPAA, state privacy and health-data laws, employment requirements, cybersecurity obligations, and other laws or standards applicable to Customer.

4. Customer Compliance Responsibilities

The Services are intended to assist Customer’s compliance efforts but do not guarantee legal, regulatory, contractual, accreditation, insurance, or cybersecurity compliance. Customer remains solely responsible for its organization’s compliance program and decisions.

Without limiting the foregoing, Customer is responsible for:

• determining which laws, regulations, contractual requirements, and professional standards apply to Customer;
• maintaining its own HIPAA compliance program and HIPAA Notice of Privacy Practices, when applicable;
• conducting and documenting any legally required risk analyses, risk management activities, training, policies, notices, and breach-response activities;
• reviewing assessments, reports, templates, recommendations, scores, tasks, and other outputs before relying on or implementing them;
• ensuring that information submitted to the Services is accurate, lawful, authorized, and permitted under these Terms;
• ensuring that no Prohibited Health Data is submitted to the Services;
• maintaining appropriate internal security controls and workforce practices; and
• complying with all applicable federal, state, local, and international laws.

5. Accounts and Authorized Users

Customer must provide accurate and complete account information and keep it current. Customer is responsible for maintaining the confidentiality of account credentials and for all activity occurring through accounts under Customer’s control, except to the extent caused by CompliDent’s breach of these Terms or applicable law.

Customer may authorize employees, contractors, or other personnel to use the Services (“Authorized Users”) within the limits of the applicable subscription. Customer is responsible for ensuring that Authorized Users comply with these Terms and the Acceptable Use Policy.

Customer must promptly notify CompliDent if it suspects unauthorized access to an account, compromise of credentials, or other misuse of the Services.

6. Subscription Plans, Renewal, and Fees

Certain Services require a paid subscription. Fees, included features, usage limits, subscription term, and billing frequency are stated in the applicable checkout page, order form, subscription plan, or other written agreement.

Unless otherwise stated in an applicable order form or required by law, subscriptions automatically renew for successive periods equal to the initial subscription period until canceled. Customer may cancel in the manner made available through the Services or by contacting CompliDent. Cancellation stops future renewal charges but does not retroactively refund fees already earned or paid except as required by law or expressly stated in an applicable agreement.

Customer authorizes CompliDent and its payment processor to charge the payment method provided for fees, applicable taxes, and authorized renewals. Past-due amounts may result in suspension or termination. Customer is responsible for taxes associated with the Services, other than taxes imposed on CompliDent’s net income, unless applicable law provides otherwise.

7. Trial, Free, and Promotional Access

CompliDent may offer trials, free plans, beta access, discounts, or promotional features at its discretion and may modify or discontinue them subject to applicable law and any written commitment made to Customer.

Unless otherwise stated, trial or promotional access may have limited functionality, support, storage, or retention. Customer is responsible for exporting permitted Customer Data before a trial or promotional period ends if the Services provide an export function.

8. Customer Data

“Customer Data” means information, records, documents, task data, assessments, notes, reports, audit trails, and other content that Customer or its Authorized Users submit to or generate through the Services on behalf of Customer, excluding CompliDent Operational Data and excluding Prohibited Health Data, which is not permitted Customer Data.

As between the parties, Customer retains its rights in Customer Data. Customer grants CompliDent and its service providers a non-exclusive, worldwide, limited license to host, copy, process, transmit, display, back up, secure, and otherwise use Customer Data solely as necessary to provide, maintain, support, secure, and improve the Services as permitted by these Terms, the Privacy Policy, any applicable Data Processing Addendum (“DPA”), and Customer’s documented instructions.

Customer represents and warrants that it has all rights, permissions, notices, consents, and other legal authority necessary to submit Customer Data and permit the processing described in these Terms.

9. CompliDent Operational Data and De-identified Data

“CompliDent Operational Data” means account, billing, authentication, security, telemetry, diagnostic, performance, usage, and similar data that CompliDent collects or generates to operate, secure, administer, support, analyze, and improve the Services, as described in the Privacy Policy. CompliDent may process such data for its own legitimate business purposes subject to applicable law.

CompliDent may also use feedback and information that has been lawfully aggregated or de-identified so that it cannot reasonably be linked to an identified or identifiable individual, subject to applicable law and contractual restrictions. CompliDent will not use identifiable Customer Data for unrelated advertising or marketing purposes.

10. Prohibited Health Data; No PHI

For purposes of these Terms, “PHI” means Protected Health Information as defined by HIPAA and 45 C.F.R. Parts 160 and 164. “Prohibited Health Data” means: (a) PHI; (b) information that identifies, is reasonably capable of being associated with, or could reasonably be linked to an individual and reveals, describes, or relates to the individual’s past, present, or future physical or mental health, dental condition, diagnosis, treatment, care, prescription, procedure, health-care services, insurance, or payment for health care; (c) consumer health data, consumer health information, or substantially similar information regulated under applicable state privacy or health-data law; and (d) other identifiable patient information.

PHI AND OTHER PROHIBITED HEALTH DATA ARE STRICTLY PROHIBITED.

Customer and Authorized Users must not upload, enter, transmit, import, synchronize, attach, store, submit through support, email to CompliDent, or otherwise make Prohibited Health Data available through any part of the Services. This prohibition applies to all input surfaces and features, including assessments, tasks, notes, comments, filenames, evidence uploads, policy documents, training records, vendor records, screenshots, links, integrations, support requests, and communications.

Without limitation, Customer must not submit patient charts, clinical notes, treatment plans, diagnoses, prescriptions, medical or dental histories, identifiable appointment or procedure information, dental radiographs, photographs, intraoral scans or images, laboratory records, insurance claims, explanations of benefits, identifiable health-care billing records, or identifiers combined with health, treatment, insurance, or payment information in a manner that constitutes Prohibited Health Data.

The standard Services are not offered as a HIPAA business-associate service. CompliDent does not enter into a Business Associate Agreement (“BAA”) for the standard Services. Customer must not use the Services to create, receive, maintain, or transmit PHI on behalf of a HIPAA covered entity or business associate.

Customer acknowledges that whether HIPAA or other legal obligations apply in a particular circumstance is determined by applicable law and the actual facts, not solely by contractual labels. Nothing in these Terms limits any obligation that applicable law may impose based on information CompliDent actually receives or maintains.

11. De-identification of Compliance Evidence

If a document, screenshot, record, or other evidence useful to a compliance workflow contains or is derived from Prohibited Health Data, Customer must de-identify the information before transmitting it to CompliDent.

If information is derived from PHI, de-identification must satisfy 45 C.F.R. § 164.514, including the Safe Harbor or Expert Determination method, as applicable. Merely removing a patient’s name or a limited number of direct identifiers is not sufficient unless the resulting information satisfies the applicable de-identification standard.

For other Prohibited Health Data, Customer must de-identify the information in accordance with applicable law so that it is no longer identifiable or reasonably linkable to an individual. Customer is solely responsible for reviewing content before submission and confirming that it is permitted Customer Data.

12. Discovery and Removal of Prohibited Health Data

If Customer discovers that Prohibited Health Data has been submitted to the Services, Customer must promptly remove it if able to do so and notify CompliDent at getcomplident@gmail.com without including PHI, patient-identifying information, or other Prohibited Health Data in the notice.

Customer expressly authorizes CompliDent, subject to applicable law, to restrict access to, quarantine, securely return, securely delete, or securely destroy Prohibited Health Data submitted in violation of these Terms. Upon becoming aware that Prohibited Health Data has been submitted to or is being maintained through the Services, CompliDent will promptly take reasonable steps to restrict further access to or processing of the information, investigate and document the submission, and securely return or destroy the information as appropriate and permitted by applicable law.

CompliDent will not intentionally use or disclose Prohibited Health Data except as reasonably necessary to identify, locate, contain, secure, investigate, document, return, or destroy the prohibited information; respond to a security incident; protect legal rights; or comply with applicable law.

An accidental or unauthorized submission does not authorize continued storage or processing of Prohibited Health Data, amend the parties’ agreements, or create a right to use the Services for such information.

13. Privacy and Data Processing

CompliDent’s collection and processing of Personal Information is described in the CompliDent Privacy Policy. The Privacy Policy is a notice of CompliDent’s privacy practices and does not require Customer or any individual to waive rights provided by applicable privacy law.

Depending on the processing activity, CompliDent may act as a controller, business, processor, service provider, contractor, or similar party as described in the Privacy Policy. Where CompliDent processes Customer Data solely on Customer’s behalf, the applicable DPA, if any, governs that processing.

If a DPA applies and conflicts with these Terms regarding processing of Personal Information, the DPA controls solely with respect to that processing. No DPA, order form, integration, instruction, or other agreement authorizes Customer to submit Prohibited Health Data unless CompliDent expressly agrees in a separate written agreement signed by an authorized representative that specifically modifies Section 10; the standard Services do not include such authorization.

14. Acceptable Use and Restrictions

Customer must comply with the CompliDent Acceptable Use Policy, which is incorporated into these Terms. In addition, Customer and Authorized Users must not:

• submit or process Prohibited Health Data;
• use the Services for unlawful, fraudulent, deceptive, abusive, harassing, or infringing activity;
• attempt unauthorized access to accounts, systems, networks, data, or security controls;
• circumvent technical restrictions, usage limits, authentication, or security measures;
• introduce malware, malicious code, or content designed to disrupt or compromise the Services;
• reverse engineer, decompile, disassemble, or attempt to derive source code except to the extent such restriction is prohibited by applicable law;
• copy, modify, distribute, sublicense, resell, lease, or provide the Services to third parties except as expressly authorized;
• use automated scraping, harvesting, or extraction tools except through an authorized API or written permission;
• remove proprietary notices or misrepresent ownership or source of the Services;
• publish benchmarks or performance tests without CompliDent’s prior written consent, except where such restriction is prohibited by law; or
• use CompliDent confidential information, non-public documentation, or the Services to develop or train a competing product in violation of applicable law or contractual obligations.

15. Intellectual Property

The Services and all associated software, source code, object code, designs, logos, trademarks, databases, interfaces, documentation, workflows, graphics, text, templates, and proprietary technology are owned by CompliDent or its licensors and are protected by intellectual-property laws.

Except for the limited access rights expressly granted in these Terms, no ownership or intellectual-property rights are transferred to Customer.

16. License to Use the Services

Subject to Customer’s compliance with these Terms and payment of applicable fees, CompliDent grants Customer a limited, non-exclusive, non-transferable, non-sublicensable, revocable right during the subscription term to access and use the Services for Customer’s internal business and compliance-management purposes.

17. Feedback

If Customer voluntarily provides ideas, suggestions, comments, enhancement requests, or other feedback about the Services (“Feedback”), Customer grants CompliDent a perpetual, irrevocable, worldwide, royalty-free right to use, reproduce, modify, commercialize, and incorporate the Feedback without restriction or obligation, provided CompliDent does not publicly identify Customer as the source without permission.

18. Third-Party Services and Integrations

The Services may rely on or integrate with third-party providers, including cloud infrastructure, databases, payment processors, authentication providers, communications services, analytics, monitoring, support tools, and other service providers.

CompliDent is not responsible for independent third-party products or services outside CompliDent’s control. Customer is responsible for reviewing the privacy, security, and contractual terms of third-party integrations that Customer elects to enable and for ensuring that those integrations are used lawfully.

Customer must not configure an integration in a manner that causes Prohibited Health Data to be transmitted to CompliDent.

19. Information Security

CompliDent maintains administrative, technical, and physical safeguards designed to protect Personal Information and permitted Customer Data appropriate to the nature, volume, and sensitivity of the information and the risks presented by the processing, as further described in the Privacy Policy and any applicable security documentation.

No method of transmission, storage, or security control is completely secure. Customer acknowledges that the Services are not approved, certified, or offered as a HIPAA-compliant repository, transmission system, consumer-health-data repository, or patient-data platform.

20. Confidentiality

Each party may receive non-public information of the other party that is designated as confidential or that reasonably should be understood to be confidential given the nature of the information and circumstances of disclosure (“Confidential Information”).

The receiving party will use Confidential Information only as necessary to perform or exercise rights under these Terms and will protect it using reasonable care, but no less than the care used to protect its own similar confidential information. The receiving party may disclose Confidential Information to personnel, professional advisers, and service providers who have a need to know and are subject to confidentiality obligations.

Confidential Information does not include information that the receiving party can demonstrate: (a) is or becomes public through no breach of these Terms; (b) was lawfully known without restriction before disclosure; (c) is received lawfully from a third party without confidentiality duty; or (d) is independently developed without use of the disclosing party’s Confidential Information.

If disclosure is legally required, the receiving party may disclose the minimum required information and, where legally permitted, will provide reasonable prior notice to the disclosing party.

These confidentiality obligations survive termination for five (5) years, except that trade secrets remain protected for as long as they qualify as trade secrets under applicable law.

21. Availability, Maintenance, and Changes to the Services

CompliDent will use commercially reasonable efforts to operate the Services, but the Services may experience maintenance, updates, outages, errors, or interruptions caused by technology, third parties, internet conditions, security events, or other circumstances.

Unless an applicable Service Level Agreement expressly states otherwise, CompliDent does not guarantee any particular uptime, availability percentage, response time, recovery point, recovery time, or uninterrupted operation.

CompliDent may modify features from time to time, provided that it will not materially reduce core paid functionality during a prepaid subscription term without providing a commercially reasonable alternative or remedy, except where changes are necessary for security, legal compliance, third-party dependency changes, or prevention of abuse.

22. Suspension

CompliDent may suspend or restrict access to all or part of the Services when reasonably necessary to:

• address a material or repeated violation of these Terms or the Acceptable Use Policy;
• respond to submission or suspected submission of Prohibited Health Data;
• prevent or respond to a security incident, fraud, abuse, or material risk to the Services or other users;
• comply with law, court order, or governmental request;
• address overdue undisputed fees after any required notice; or
• protect CompliDent’s rights, systems, customers, or third parties.

Where reasonably practicable and consistent with security and legal obligations, CompliDent will provide notice of a suspension and an opportunity to cure. CompliDent may act without advance notice when immediate action is reasonably necessary.

23. Termination and Effect of Termination

Either party may terminate these Terms as provided in an applicable order form, subscription plan, or other written agreement. CompliDent may terminate for material breach if Customer fails to cure the breach within a reasonable period after notice, unless the breach is incapable of cure or immediate termination is reasonably necessary due to unlawful activity, security risk, repeated submission of Prohibited Health Data, or other serious misuse.

Upon termination or expiration: (a) Customer’s right to access the Services ends; (b) licenses granted to Customer terminate; (c) outstanding fees become due; and (d) Customer Data will be handled in accordance with the applicable agreement, Privacy Policy, DPA, and CompliDent’s deletion processes.

CompliDent may provide a limited period for export of permitted Customer Data where supported by the Services. Prohibited Health Data is not subject to any export or retention right and will be addressed under Section 12.

24. Service Disclaimers

THE SERVICES ARE PROVIDED “AS IS” AND “AS AVAILABLE.”

TO THE MAXIMUM EXTENT PERMITTED BY LAW, COMPLIDENT DISCLAIMS ALL WARRANTIES, WHETHER EXPRESS, IMPLIED, STATUTORY, OR OTHERWISE, INCLUDING WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, NON-INFRINGEMENT, ACCURACY, REGULATORY COMPLIANCE, AND THAT THE SERVICES WILL BE ERROR-FREE, SECURE, OR UNINTERRUPTED.

COMPLIDENT DOES NOT WARRANT THAT USE OF THE SERVICES, COMPLETION OF AN ASSESSMENT, IMPLEMENTATION OF A TASK, OR ACHIEVEMENT OF A SCORE OR STATUS WILL SATISFY HIPAA OR ANY OTHER LAW, REGULATION, CONTRACT, AUDIT, INSURANCE REQUIREMENT, OR PROFESSIONAL STANDARD.

25. Limitation of Liability

TO THE MAXIMUM EXTENT PERMITTED BY LAW, COMPLIDENT AND ITS AFFILIATES, LICENSORS, OFFICERS, DIRECTORS, MEMBERS, MANAGERS, EMPLOYEES, AND CONTRACTORS WILL NOT BE LIABLE FOR INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, CONSEQUENTIAL, OR PUNITIVE DAMAGES, OR FOR LOSS OF PROFITS, REVENUE, GOODWILL, DATA, BUSINESS OPPORTUNITY, OR BUSINESS INTERRUPTION, ARISING OUT OF OR RELATING TO THE SERVICES OR THESE TERMS, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

TO THE MAXIMUM EXTENT PERMITTED BY LAW, COMPLIDENT’S TOTAL AGGREGATE LIABILITY ARISING OUT OF OR RELATING TO THE SERVICES OR THESE TERMS WILL NOT EXCEED THE FEES ACTUALLY PAID BY CUSTOMER TO COMPLIDENT FOR THE SERVICES DURING THE TWELVE (12) MONTHS IMMEDIATELY PRECEDING THE EVENT FIRST GIVING RISE TO THE CLAIM.

The limitations in this Section apply to the fullest extent permitted by law. Some jurisdictions do not allow certain exclusions or limitations, in which case the applicable limitation will apply only to the extent legally enforceable.

26. Indemnification

Customer will defend, indemnify, and hold harmless CompliDent and its affiliates, officers, directors, members, managers, employees, contractors, and agents from third-party claims, liabilities, damages, judgments, penalties, losses, costs, and reasonable attorneys’ fees arising out of or relating to:

• Customer Data or Customer’s submission, collection, use, disclosure, or processing of information through the Services;
• Customer’s or an Authorized User’s violation of these Terms or the Acceptable Use Policy;
• Customer’s submission or transmission of PHI or other Prohibited Health Data to CompliDent;
• Customer’s violation of applicable law or the rights of a third party; or
• Customer’s negligence, willful misconduct, or unauthorized use of the Services.

CompliDent will provide reasonably prompt notice of an indemnified claim and reasonable cooperation at Customer’s expense. Customer may control the defense and settlement, except Customer may not settle a claim in a manner that admits wrongdoing by, imposes liability on, or requires non-monetary obligations from CompliDent without CompliDent’s prior written consent.

27. Export Controls and Sanctions

Customer will comply with applicable United States export-control, sanctions, and trade laws. Customer must not access, use, export, re-export, or make the Services available in violation of such laws.

28. Force Majeure

Neither party will be liable for delay or failure to perform caused by events beyond its reasonable control, including natural disasters, severe weather, war, terrorism, civil unrest, labor disputes, utility or internet outages, governmental actions, epidemics, cyberattacks by third parties, or failures of third-party infrastructure, except that this Section does not excuse Customer’s obligation to pay fees already due.

29. Governing Law

These Terms are governed by the laws of the Commonwealth of Virginia, without regard to conflict-of-laws principles, except to the extent applicable law requires otherwise.

30. Venue

Any lawsuit or judicial proceeding arising out of or relating to these Terms or the Services must be brought exclusively in the Halifax County Virginia Circuit Court located in the Commonwealth of Virginia, and each party consents to personal jurisdiction and venue in those courts.

31. Informal Dispute Resolution

Before filing a lawsuit, the parties will make a good-faith effort to resolve the dispute through informal negotiations for at least thirty (30) days after one party provides written notice describing the dispute and requested resolution.

This Section does not prevent either party from seeking temporary, preliminary, or other injunctive relief when reasonably necessary to protect confidential information, intellectual property, security, or against unauthorized use of the Services.

32. Assignment

Customer may not assign or transfer these Terms, by operation of law or otherwise, without CompliDent’s prior written consent, except to a successor in connection with a merger or sale of substantially all of Customer’s assets upon written notice if the successor agrees to be bound by these Terms and is not a direct competitor of CompliDent.

CompliDent may assign these Terms in connection with a merger, acquisition, financing, reorganization, corporate restructuring, or sale of all or substantially all of its business or assets.

33. Notices and Electronic Communications

Customer agrees that CompliDent may provide operational, billing, security, legal, and other service-related notices electronically, including by email, in-product notice, or posting within the Services, where permitted by law.

Formal legal notices to CompliDent must be sent to the contact information in Section 39 or to any updated legal-notice address published by CompliDent. Notices are effective when received, subject to applicable law.

34. Order of Precedence and Incorporated Policies

These Terms should be read together with any applicable order form, Acceptable Use Policy, Privacy Policy, Cookie Policy, DPA, Service Level Agreement, and other written agreement expressly incorporated by reference.

If documents conflict, the following order of precedence applies unless a document expressly states otherwise: (1) a negotiated order form or enterprise agreement signed by both parties; (2) an applicable DPA, solely for data-processing obligations; (3) an applicable Service Level Agreement, solely for service-level commitments; (4) these Terms; and (5) the Acceptable Use Policy and other incorporated policies.

No document, including a DPA or order form, authorizes submission of Prohibited Health Data unless it expressly and specifically modifies Sections 10 through 12 in a writing signed by an authorized representative of CompliDent. The standard Services do not include such authorization or a BAA.

35. Changes to These Terms

CompliDent may update these Terms from time to time to reflect changes in the Services, legal requirements, security practices, or business operations. CompliDent will post the updated Terms and revise the Last Updated date. If a change materially reduces Customer’s rights or materially increases Customer’s obligations during a then-current paid subscription term, CompliDent will provide additional notice when required by law or commercially reasonable under the circumstances.

Unless otherwise required by law, updated Terms apply prospectively from their stated effective date. Continued use after the effective date constitutes acceptance of the updated Terms where legally enforceable.

36. Entire Agreement

These Terms, together with the applicable order form, Acceptable Use Policy, DPA, Service Level Agreement, and other documents expressly incorporated by reference, constitute the entire agreement between the parties regarding the Services and supersede prior or contemporaneous agreements on the same subject, except for a separately signed agreement that expressly states it controls.

The Privacy Policy describes CompliDent’s privacy practices and should be read together with these Terms. Nothing in these Terms or any incorporated policy requires an individual to waive statutory privacy rights.

37. Severability and Waiver

If any provision of these Terms is held unlawful or unenforceable, it will be enforced to the maximum extent permitted and the remaining provisions will remain in effect.

A failure or delay to enforce any provision is not a waiver. Any express waiver must be in writing and applies only to the specific instance stated.

38. Survival

Sections that by their nature should survive termination will survive, including provisions concerning Customer Data rights, Prohibited Health Data, de-identification, removal of prohibited data, intellectual property, confidentiality, fees owed, disclaimers, limitation of liability, indemnification, governing law, venue, dispute resolution, and any accrued rights or obligations.

39. Contact Information

CompliDent, LLC Attn: Legal Email: getcomplident@gmail.com Website: https://www.getcomplident.com

If you discover that PHI or other Prohibited Health Data has been submitted to the Services, contact CompliDent promptly at getcomplident@gmail.com with the subject line “Prohibited Health Data Removal Request.” Do not include PHI, patient-identifying information, or other Prohibited Health Data in the notice.