Client Portal Terms of Service

1. Agreement and Scope

These Client Portal Terms of Service (the “Terms”) are a binding agreement between Bomi Health, Inc. (“Bomi,” “we,” “us,” or “our”) and the adult individual who accesses or uses the Bomi client portal either for themselves or as a Provider-verified parent or legal guardian of an unemancipated minor (“you” or “your”).

“Bomi EHR” means Bomi’s hosted electronic health record and its related clinical, scheduling, documentation, communication, practice-administration, claims, billing, payments, and Client Portal software features. The “Client Portal” means the client-facing component of Bomi EHR through which a patient or client may interact with a participating healthcare professional or practice (your “Provider”). Available features may include appointments, forms, documents, messages, telehealth access, insurance and billing information, payments when enabled by your Provider, and other functions enabled by your Provider.

“Bomi Managed Billing” means Bomi’s separately purchased managed billing service. It is not part of Bomi EHR or the Client Portal, even if your Provider directs information from Bomi Managed Billing to appear in the Client Portal or otherwise integrates the two products.

The “Patient” is the person whose Provider record is associated with the Client Portal profile. If you use the Client Portal for yourself, you are also the Patient. A minor Patient may have a Client Portal profile, but the portal user and contracting party is the Provider-verified adult parent or legal guardian authorized to act as the “Guardian User.” The Guardian User controls the account associated with the minor Patient’s profile and uses the Guardian User’s own contact information and credentials. A minor Patient is not issued separate login credentials, does not control the Guardian User account, and does not accept these Terms.

These Terms govern the Bomi-operated Client Portal. They do not govern Bomi Managed Billing, public Bomi marketing sites, your Provider’s professional services or financial policies, or an independent third-party service. If a Client Portal feature presents product-specific terms, those terms control only for that feature to the extent they conflict with these Terms; otherwise, these Terms control your use of the Client Portal.

You accept these Terms only by taking the affirmative acceptance action presented in the Client Portal. If you do not agree, do not use the Client Portal. These Terms include the limited software license in Section 13; no separate end-user license agreement is required for the Client Portal.

2. Your Provider and Bomi Have Different Roles

Your Provider, not Bomi, provides healthcare or other professional services to the Patient. The Patient’s and, where applicable, your relationship with the Provider is governed by the Provider’s own notices, consents, policies, financial terms, and professional obligations. These Terms govern only your use of Bomi’s Client Portal and do not change any agreement with the Provider.

Your Provider chooses whether to offer the Client Portal, which features to enable, who may access a profile, and how to use and retain the records in its account, subject to applicable law. Bomi provides technology to the Provider and generally processes clinical and portal information on the Provider’s behalf under Bomi’s agreement with the Provider, including a Business Associate Agreement when HIPAA applies.

If your Provider separately purchases Bomi Managed Billing, the Provider may direct Bomi to exchange Portal Data (defined in Section 10) between Bomi EHR and Bomi Managed Billing to keep records consistent and support the Provider’s separate clinical-software and managed-billing workflows. That exchange does not make Bomi Managed Billing part of Bomi EHR or the Client Portal. Bomi will make the exchange only as permitted by the Provider’s instructions, the applicable Business Associate Agreement, and law.

To the maximum extent permitted by law, you release Bomi and its officers, directors, employees, and agents from claims arising solely from your Provider’s clinical or professional acts or omissions, diagnosis or treatment, fees or billing decisions, record content, scheduling, communications, or failure to respond. This release does not apply to Bomi’s own acts or omissions, Bomi’s contractual or legal obligations, a claim based on both Bomi’s and the Provider’s conduct, or a right that cannot lawfully be released.

Your Provider is an independent professional or business and is not Bomi’s employee, agent, partner, or joint venturer. Bomi does not employ, direct, control, or supervise the Provider’s professional judgment, care, workforce, or business operations. The Provider has no authority to make a representation, warranty, or commitment for Bomi or otherwise bind Bomi.

3. Eligibility

Every portal user must be at least eighteen years old and at least the applicable age of majority or otherwise legally capable of entering these Terms where the user resides, must use their own private email address, and must access only a profile they are currently authorized to use. The Client Portal supports: (a) an adult Patient using an account for themselves; and (b) a Provider-verified Guardian User using an adult-controlled account associated with an unemancipated minor Patient’s profile. The Client Portal does not support minor-controlled credentials, emancipated-minor self-access, an adult personal representative, delegate, other proxy, or a shared mailbox.

If you are a Guardian User, you represent that your identity and relationship to the Patient are accurate and that you have current legal authority to use the Client Portal for the Patient. You must promptly tell the Provider if your authority changes, is disputed, expires, or ends. Portal access does not itself establish custody, consent to treatment, authority to sign a particular document, or a right to receive any record.

Guardian access is available only when the Provider has enabled it, verified current authority, and determined that guardian access is lawful. Because the current Client Portal does not apply record-level confidentiality restrictions separately for different Guardian Users, the Provider must not make a record or other item portal-visible unless the Provider has determined that it may lawfully be disclosed to each Guardian User who can access that profile. If the Provider cannot make that determination, guardian access must not be enabled or must be suspended. Separate guardians use separate accounts, and their actions and Provider message threads are attributed separately.

Disabling or limiting Client Portal access does not limit any right the Guardian User or minor Patient may have to receive particular records through another legally required method or electronic format. The Provider remains responsible for responding to record-access requests and furnishing legally required access outside the Client Portal when the Client Portal cannot present the permitted information without also disclosing restricted information.

The Client Portal is available through participating United States healthcare Providers and supports Provider use of records subject to 42 C.F.R. Part 2 (“Part 2 Records”) under Bomi’s applicable agreement with the Provider. The Provider is responsible for determining whether Part 2 applies, identifying Part 2 Records, obtaining and honoring required consents and written revocations, and configuring legally authorized access and disclosure settings. Bomi applies the Provider’s configured controls and lawful instructions within supported product boundaries, but does not independently determine whether a particular record is subject to Part 2, automatically classify or segment Part 2 Records, or decide whether a particular disclosure is permitted. Portal access does not expand your legal right to receive a record.

Availability of a particular Provider service, record, feature, or access right may depend on applicable federal and state law, the Provider’s professional obligations, and the Provider’s configuration. These legal or Provider-specific limitations do not mean that Bomi excludes a particular United States state from general Client Portal availability. The Guardian User feature is technically available only where enabled by the Provider; availability does not mean that guardian access is lawful in a particular state or circumstance, and the Provider must make and document that determination before enabling access. Your Provider must confirm the restrictions applicable to your access before inviting you, and you represent that the eligibility information associated with your access is accurate.

A Provider may configure a profile as a couple profile that two adults share. Each member is a separate adult Patient who accesses the profile for themselves, must satisfy every eligibility requirement in this Section, and must use their own private email address. One account may not represent both members of a couple, and the two members may not share an email address or mailbox. Each member accesses the shared profile through their own separate authorization, and a Provider may end one member’s access without ending the other member’s access. A couple profile is for two adults; it is not the Guardian User feature and does not provide access for a minor.

Bomi or your Provider may request reasonable verification and may restrict or disable Client Portal access if eligibility information is missing, changes, or appears inaccurate. Loss of portal access does not delete the Provider’s underlying record or prevent you from contacting the Provider through another available method. Do not use or attempt to use the Client Portal if any restriction in this Section is not satisfied.

4. Access and Account Security

You must provide accurate information and use only a profile you are authorized to access. The Client Portal may use secure email links, passwords, passcodes, or other authentication methods. You are responsible for protecting your email account, devices, authentication links, and other credentials and for activity caused by your failure to take reasonable precautions.

Do not forward an authentication link or permit an unauthorized person to use your access. Promptly contact your Provider and Bomi support at [email protected] if you suspect unauthorized access, an incorrect profile association, or loss of a device or credential. We may require additional verification before restoring or changing access.

A Guardian User must use their own account and must not provide the minor Patient, another guardian, or any other person with the Guardian User’s credentials, authentication links, or independent access to the account. Each separately authorized guardian must use their own invitation, email address, and account so actions and communications remain attributable to the correct person.

5. Provider-Controlled Features and Information

The Provider controls which portal functions are available and may approve, reject, or modify requests made through them. Information in the Client Portal may be incomplete, delayed, or limited by the Provider’s settings and applicable law. Contact the Provider directly to correct clinical or demographic information, obtain a complete copy of a health record, ask about authorized access, or ask about information that is not displayed.

A Guardian User may see only the information the Provider has chosen to make available under the Provider’s current authorization decision. Portal access is not a complete statement of a guardian’s, Patient’s, or other person’s record-access rights, and information absent from the portal may need to be requested directly from the Provider.

A request submitted through the Client Portal is not accepted until the Provider confirms it when confirmation is required. This includes appointment, prescription, referral, billing, record, and other requests related to care. Do not assume that a message or request has been reviewed merely because the Client Portal shows that it was sent.

Shared couple profiles. If your Provider uses a couple profile, some information is shared with the other member and some remains private to you. Appointments and scheduling for the couple are shared, so each member can see the couple’s appointment times, locations, and cancellations. Your documents and intake answers, insurance details, private messages with the Provider, your transactional-text choices, your contact details, and your notifications remain private to you and are not shown to the other member through the Client Portal. Billing information for the couple, including invoices, balances, payment history, and any saved payment method, is shown only to the member the Provider designates as financially responsible. A group message thread, if enabled, is shared with the Provider and both members. Do not submit information through a shared feature that you do not want the other member to see, and contact your Provider with questions about what a particular feature shares.

6. No Medical Services or Emergency Use

Bomi is not a healthcare provider, does not practice medicine or psychotherapy, and does not diagnose, treat, prescribe, or make clinical decisions. Information and software provided by Bomi do not replace professional judgment or advice from your Provider. Your Provider is solely responsible for its professional services and for deciding how and when to respond to you.

DO NOT USE THE CLIENT PORTAL FOR AN EMERGENCY OR OTHER TIME-SENSITIVE MEDICAL OR MENTAL-HEALTH NEED. The Client Portal is not monitored continuously. If you may be experiencing an emergency, call 911 or the emergency service available where you are, or go to the nearest emergency facility. Contact your Provider through the urgent-contact method the Provider has given you for time-sensitive, non-emergency needs.

In the United States, you may also call or text 988 to reach the 988 Suicide & Crisis Lifeline for suicide, mental-health, or substance-use crisis support. The 988 Lifeline does not replace 911 or emergency medical services when there is immediate danger or a medical emergency.

7. Electronic Communications and Signatures

You consent to receive portal-access links, appointment and billing notices, security alerts, legal notices, and other service-related communications electronically at the contact information associated with your profile. Messages may be sent by Bomi on the Provider’s behalf. Standard carrier, data, or messaging charges may apply. Where available, you may manage optional reminder preferences, but essential account, security, legal, and transaction communications cannot be disabled while you use the relevant service.

If you provide a mobile number and affirmatively opt in to text messages, you consent to receive recurring transactional texts from or on behalf of Bomi and your Provider about Client Portal access, appointments, forms, billing, security, and other transactional matters. Messages may be sent using an automatic telephone dialing system or other automated technology. Consent to transactional texts is not a condition of purchasing goods or receiving care, except that a requested text-based feature cannot operate without it. Message frequency varies. Message and data rates may apply.

Reply STOP to cancel texts from the sending number and HELP for help. After STOP, you may receive one confirmation message. You may also change available preferences or contact your Provider. Carriers are not liable for delayed or undelivered messages. Keep your number current and do not provide a number you are not authorized to use. Marketing texts, if ever offered, require separate consent and are not authorized by these Terms.

Email, text messages, and push notifications may appear on lock screens, shared devices, shared telephone accounts, or shared email accounts and may reveal the existence of a relationship with a Provider, an appointment, or a billing matter. Use only private contact information that you control. Bomi and the Provider will seek to limit sensitive content in these communications; clinical details should be accessed through the secure Client Portal.

You agree that electronic records, acknowledgments, and signatures may satisfy legal writing and signature requirements to the extent permitted by law. You may request a paper copy from your Provider. You are responsible for maintaining a supported browser, device, and ability to access electronic records. Withdrawing consent to electronic transactions may prevent use of some Client Portal features.

A Guardian User may acknowledge or sign a record only when the Provider offers that action and the Guardian User has legal authority to do so. A portal signature records the identity and action of the Guardian User; it is not the minor Patient’s signature and does not create authority that the Guardian User does not otherwise possess.

You may withdraw consent to electronic records or update the email, mobile number, or other contact information used for Client Portal communications through available settings or by contacting your Provider. For communications Bomi sends for its own account, you may also contact [email protected]. A withdrawal takes effect after a reasonable processing period, does not affect the validity of records or signatures provided before it takes effect, and may require the Provider to suspend electronic access or use another lawful process. You are responsible for keeping your contact information current.

8. Appointments and Telehealth

Scheduling features are tools for communicating with your Provider. Provider policies govern cancellations, late arrivals, missed appointments, fees, and whether a requested time is accepted. Bomi is not responsible for the Provider’s availability or scheduling decisions.

If telehealth access is offered, Bomi provides or connects you to the technology used for a remote session; the Provider delivers the care. Telehealth may not be appropriate or lawful in every circumstance or location. You must provide accurate location and emergency-contact information when requested, use a reasonably private and safe setting, and follow the Provider’s telehealth instructions. A session will not be recorded by Bomi unless separate notice is provided and all legally required permissions are obtained.

These Terms are not informed consent to receive telehealth care. The Provider, not Bomi, is responsible for providing and documenting legally required telehealth notices and consents; verifying identity, physical location, emergency contact information, and professional licensure; determining whether telehealth is appropriate; and providing any legally required alternative.

The Client Portal and telehealth technology are designed for use with United States Providers and United States-based care. Bomi does not represent that a feature is appropriate, available, or lawful outside the United States. If you access the Client Portal or travel outside the United States, you are responsible for local-law and connectivity considerations, and your Provider may be unable to deliver telehealth care across a state or national border. Portal information may be processed in the United States and other locations used by authorized service providers under applicable safeguards.

9. Billing and Payment Features

The Client Portal may display billing information supplied through your Provider’s use of Bomi EHR, such as balances, invoices, and payment history. If your Provider separately purchases Bomi Managed Billing, the Client Portal may also display billing information received from that service; displaying it does not make Bomi Managed Billing part of Bomi EHR or the Client Portal.

When your Provider enables a payment feature, the Client Portal may allow you to make a payment to your Provider or save a payment method for the Provider’s use. Payment card details are collected directly by a payment processor in processor-hosted fields; Bomi and its payment providers may process payment tokens, limited payment-method details, and transaction instructions to facilitate a payment. You represent that you are authorized to use the selected payment method and authorize the disclosed charge. Payment-provider terms may also apply.

If your Provider wants to use a saved payment method for recurring payments, automatic payments, cancellation or no-show fees, or other future charges initiated when you are not actively using the Client Portal, the Provider must obtain any separate express authorization required by applicable law and payment-network rules. Before you authorize those charges, the Provider must disclose the amount or how it will be calculated; the timing, frequency, or event that will trigger a charge; any applicable cancellation and refund policy; and how you may revoke or cancel the authorization. Saving a payment method, making a one-time payment, or accepting these Terms does not by itself authorize any other charge.

Bomi provides payment technology and may transmit payment tokens and transaction instructions at your or your Provider’s direction, as applicable. Bomi does not set Provider charges or independently authorize your Provider to charge you. Each charge remains subject to your authorization, applicable law, and applicable payment-processor and card-network rules. A Provider’s financial policy does not expand your authorization or override those requirements.

Your Provider is the merchant and is responsible for its charges, estimates, insurance submissions, refunds, payment records, and billing decisions. Direct questions or disputes about those matters to the Provider. Contact Bomi support for a suspected technical error or unauthorized access to the Client Portal, but contact your financial institution promptly about an unauthorized financial transaction.

For a couple profile, the Client Portal presents these billing and payment features, including balances, invoices, payment history, and any saved payment method, only to the member the Provider designates as financially responsible. The other member does not see the couple’s billing information through the Client Portal and should contact the Provider with billing questions.

10. Your Content and Portal Data

“Portal Data” means information, records, forms, messages, files, images, audio, video, billing information, authority-verification records, and other content submitted to or generated through your use of the Client Portal, including Protected Health Information (“PHI”). As among you, the Patient, your Provider, and Bomi, Bomi claims no ownership of Patient or Provider content, including clinical records, forms, communications, files, billing records, signatures, and guardian documentation. Bomi retains its rights in the Client Portal, Bomi technology, and Operational Data concerning the security, performance, operation, and use of the Client Portal, provided that Bomi’s ownership of Operational Data does not authorize any use or disclosure of PHI or personal information prohibited by the BAA, the Client Portal Privacy Policy, the Provider agreement, or applicable law. Rights and duties concerning the health record are determined by applicable law and the relevant relationship with the Provider.

You retain any rights you have in content you submit. To the extent you have authority to do so, you authorize Bomi and its contracted service providers to host, transmit, reproduce, display, and otherwise process that content only as reasonably necessary to provide, secure, maintain, support, debug, test, analyze, and improve the Client Portal and Bomi EHR for you and your Provider; follow lawful Provider and user instructions; prevent fraud, security incidents, or technical problems; and comply with law. Identifiable Portal Data may be used for those purposes only as permitted by the Provider’s agreement, the applicable Business Associate Agreement, the Client Portal Privacy Policy, and law.

Where the Provider’s agreement and law permit, you also authorize Bomi to create information that is properly deidentified or aggregated in a manner that does not identify and cannot reasonably be linked to you or your Provider, and to use that information for analytics, benchmarking, research, security, debugging, testing, product development, and improvement of Bomi EHR. PHI must satisfy HIPAA’s deidentification standard before any such use, whether the resulting information is described as deidentified or aggregated. Bomi will not attempt to reidentify it or attribute it to you or your Provider. This authorization for properly deidentified or non-identifying aggregated information survives deletion of identifiable Portal Data; the authorization for identifiable content ends when that content is deleted, except for protected backups, legal retention, and other processing permitted by the Provider’s agreement and law.

Bomi does not sell or license Portal Data, whether identifiable or deidentified, to data brokers, advertisers, employers, insurers, or unrelated third parties. Bomi may disclose properly deidentified or non-identifying aggregated information only to contracted service providers acting for Bomi under written use and reidentification restrictions or in benchmark, research, or similar outputs that do not identify and cannot reasonably be linked to an individual or Provider.

You must have authority to submit content concerning another person. Do not submit information that is knowingly false, unlawful, infringing, malicious, or outside the purpose for which your Provider made the Client Portal available.

11. Privacy and Health Information

The Client Portal Privacy Policy explains how Bomi handles personal information in connection with the Client Portal. It is not your Provider’s HIPAA Notice of Privacy Practices and does not replace that notice. Contact your Provider with questions about its privacy practices, your health record, or a patient-rights request.

When Bomi processes PHI for a Provider, Bomi acts as the Provider’s business associate or subcontractor business associate, as applicable, and the governing Business Associate Agreement controls Bomi’s use and disclosure of that PHI. Nothing in these Terms authorizes either Bomi or a Provider to use or disclose information in violation of applicable privacy law.

12. Acceptable Use

You will not, and will not help another person to:

• access a profile, record, feature, or system without authorization, or misrepresent identity, relationship, or authority;
• interfere with the security, integrity, availability, or operation of the Client Portal, including by introducing malicious code or evading access controls;
• probe or test vulnerabilities except as authorized under Bomi’s Vulnerability Disclosure Policy;
• scrape, copy, reverse engineer, or create derivative works from the Client Portal except to the limited extent a restriction is prohibited by law;
• harass, threaten, defraud, impersonate, or violate the privacy, intellectual-property, or other rights of another person; or
• use the Client Portal for an unlawful purpose or in a way that materially harms Bomi, a Provider, or another user.

Bomi’s Copyright and DMCA Policy identifies its registered designated agent and governs copyright notices, counter-notices, restoration, repeat infringers, and related content restrictions. Subject to that Policy, applicable law, and Bomi’s agreement with your Provider, Bomi may investigate, quarantine, remove, disable, preserve, or restrict access to affected Portal Data when Bomi reasonably believes the action is necessary to address infringement or other unlawful or Terms-violating content. Bomi has no general obligation to monitor Portal Data.

Bomi will limit an action to affected material, users, or functions where reasonably practicable; preserve original healthcare records when required; and provide notice and an opportunity to respond where reasonably practicable and lawful. Repeated infringement may result in restrictions, suspension, or account termination in appropriate circumstances, but loss of portal access does not determine whether a Provider must retain or provide a health record.

13. Bomi Technology, Mobile Apps, and Limited License

13.1 General License

Bomi and its licensors own the Client Portal, software, documentation, designs, trademarks, and related intellectual property, excluding Portal Data. Subject to these Terms, Bomi grants you a limited, revocable, nonexclusive, nontransferable, nonsublicensable license to access and use the Client Portal for your personal, noncommercial interaction with your Provider for yourself or, if you are a Guardian User, for the minor Patient while the Provider authorizes that access. This is a license, not a sale, and Bomi reserves all rights not expressly granted.

If you voluntarily provide feedback about Bomi’s technology, Bomi may use it without restriction or payment, but will not identify you or use Portal Data merely because it accompanies feedback. Third-party or open-source components remain subject to their applicable licenses.

You represent that you are not located in a country or region subject to a United States government embargo or designated by the United States government as supporting terrorism and are not listed on a United States government prohibited- or restricted-party list. This representation applies to all Client Portal use, including the web and any App distributed through Apple’s App Store, Google Play, or another channel.

13.2 Mobile App License

If Bomi offers a mobile application (an “App”), the license in Section 13.1 includes a limited, revocable, nonexclusive, nontransferable, nonsublicensable license to install and use the compiled App on devices you own or control for your personal, noncommercial use of the Client Portal. You must comply with applicable app-store, operating-system, wireless-service, and third-party terms. You are responsible for device compatibility, permissions you choose to grant, and carrier or data charges. Bomi may provide updates, and some updates may be required for security or continued operation.

13.3 Apple App Store Terms

If you obtain an App through Apple’s App Store, you and Bomi acknowledge that these Terms are between you and Bomi, not Apple, and that Bomi, not Apple, is solely responsible for the App and its content. Your license is limited to use on Apple-branded products that you own or control as permitted by the Apple Media Services Usage Rules, including use by associated accounts through Family Sharing, volume purchasing, or Legacy Contacts where those rules allow. Family Sharing, volume-purchase, and Legacy Contact rights apply only to the App license and do not grant any person access to a Client Portal profile or Portal Data. Such access always requires separate authorization under the Provider’s instructions and the Client Portal’s access controls.

Bomi, not Apple, is responsible for maintenance and support and for addressing claims concerning the App, including product-liability, legal or regulatory compliance, consumer-protection, privacy, and intellectual-property claims. Apple has no maintenance or support obligation. If the App fails to conform to an applicable warranty, you may notify Apple, and Apple may refund any purchase price paid for the App; to the maximum extent permitted by law, Apple has no other warranty obligation. Nothing here limits Bomi’s responsibility beyond what applicable law permits.

Direct App questions, complaints, and claims to [email protected] or Bomi Health, Inc., 1111B S Governors Ave STE 6453, Dover, DE 19904; any telephone support contact will also appear in the App Store listing. Apple and its subsidiaries are third-party beneficiaries of these Terms for an Apple-distributed App and, upon your acceptance, may enforce these Terms against you as such a beneficiary.

13.4 Google Play Terms

If you obtain an App through Google Play, you and Bomi acknowledge that these Terms are between you and Bomi, not Google, and that Bomi, not Google, is responsible for the App, its content, support, and any claims concerning it. To the extent required by the Google Play Developer Distribution Agreement, your license to perform, display, and use the installed App is nonexclusive, worldwide, and perpetual; your access to the Client Portal and Provider-controlled services remains subject to these Terms. Your use must comply with the Google Play terms then in effect. Google is a distributor and has no responsibility or liability under these Terms.

14. Third-Party Services

The Client Portal may link to or interoperate with services selected by you or your Provider, such as payment, calendar, mapping, video, or insurance services. Independent third-party services are governed by their own terms and privacy notices. Bomi is not responsible for an independent third party’s acts or omissions after information is sent at your or the Provider’s direction.

This limitation does not apply to a service provider Bomi selects to operate the Client Portal and does not reduce Bomi’s obligations under applicable law, these Terms, or its agreement with the Provider.

15. Availability and Changes to the Client Portal

Bomi uses commercially reasonable efforts to maintain the Client Portal, but maintenance, emergencies, internet or telecommunications failures, third-party outages, and events beyond reasonable control may interrupt access. Bomi does not guarantee that every feature will always be available, uninterrupted, secure, or error-free.

Bomi and the Provider may add, modify, or discontinue features. When practicable, Bomi will provide notice before a material change that significantly reduces portal functionality, unless a shorter period is reasonably necessary for security, safety, or law. Contact your Provider through another available channel if an interruption affects a time-sensitive, non-emergency matter.

16. Suspension, Termination, and Records

Your right to use the Client Portal ends when you or your Provider closes the profile, the Provider stops using Bomi or disables your access, your authority to act for another person ends, the Patient reaches the applicable age of majority or is no longer an unemancipated minor, or these Terms are terminated. A former Guardian User does not automatically receive self-access to the Patient’s account or records. Bomi may suspend or restrict only the affected access, profile, or feature to the extent reasonably practicable when needed to address an imminent security threat, suspected fraud, unlawful activity, a material breach of these Terms, a dispute about authority, or a binding legal requirement.

When reasonably practicable and lawful, Bomi or the Provider will provide notice and an opportunity to resolve the issue. Loss of portal access does not determine whether a Provider must retain, provide, or amend a health record. Contact the Provider to request records or continued access. Bomi will continue to protect and process retained Portal Data under applicable law and its agreement with the Provider.

You may stop using the Client Portal at any time and ask your Provider to disable or close your Client Portal profile. If you cannot reach the Provider or need technical help with that request, contact [email protected]; Bomi may refer the request to the Provider because the Provider controls the underlying record. Ending your portal relationship or access does not delete, amend, or determine the retention of Provider records, and it does not affect rights you may have to obtain those records from the Provider.

17. Disclaimers

TO THE MAXIMUM EXTENT PERMITTED BY LAW, THE CLIENT PORTAL IS PROVIDED “AS IS” AND “AS AVAILABLE.” EXCEPT FOR EXPRESS OBLIGATIONS IN THESE TERMS OR APPLICABLE LAW, BOMI DISCLAIMS IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, AND NONINFRINGEMENT. BOMI DOES NOT WARRANT THAT THE CLIENT PORTAL WILL BE UNINTERRUPTED OR ERROR-FREE OR THAT INFORMATION PROVIDED BY A PROVIDER OR ANOTHER USER IS ACCURATE OR COMPLETE.

These disclaimers do not limit Bomi’s obligations concerning privacy, security, or PHI under applicable law or its agreement with the Provider. Some jurisdictions do not allow particular disclaimers, so those disclaimers apply only to the extent permitted by law.

18. Limitation of Liability

TO THE MAXIMUM EXTENT PERMITTED BY LAW, BOMI AND ITS AFFILIATES, OFFICERS, DIRECTORS, EMPLOYEES, AGENTS, AND LICENSORS WILL NOT BE LIABLE FOR INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, OR PUNITIVE DAMAGES, OR LOST PROFITS, REVENUE, GOODWILL, OR DATA, ARISING OUT OF OR RELATING TO THE CLIENT PORTAL OR THESE TERMS, EVEN IF ADVISED THAT SUCH DAMAGES ARE POSSIBLE.

TO THE MAXIMUM EXTENT PERMITTED BY LAW, BOMI’S TOTAL AGGREGATE LIABILITY ARISING OUT OF OR RELATING TO THE CLIENT PORTAL OR THESE TERMS WILL NOT EXCEED THE GREATER OF THE AMOUNT YOU PAID DIRECTLY TO BOMI FOR CLIENT PORTAL USE DURING THE TWELVE MONTHS BEFORE THE EVENT GIVING RISE TO LIABILITY OR $150.

The exclusions and cap do not apply to liability that cannot lawfully be excluded or limited, including liability for Bomi’s fraud or willful misconduct to the extent applicable law prohibits its exclusion or limitation. They do not create a right to relief otherwise unavailable or reduce Bomi’s obligations to the Provider under a Business Associate Agreement.

19. Indemnification

To the extent permitted by applicable law, you will defend and indemnify Bomi and its officers, directors, employees, and agents against a third-party claim to the extent caused by content you submit without legal authority, your unauthorized or unlawful use of the Client Portal, or your material breach of these Terms. This obligation does not apply to a claim caused by Bomi’s act or omission or your good-faith exercise of a legal right.

Bomi must promptly notify you of a covered claim and provide reasonable cooperation at your expense. Delay relieves an obligation only to the extent it materially prejudices the defense. Bomi may, at its option, assume exclusive control of the defense and settlement with counsel of its choice, and you will reasonably cooperate. You may not settle a claim in a way that admits fault by, imposes liability on, or imposes a nonmonetary obligation on Bomi without Bomi’s written consent. Bomi will not settle a claim it controls in a way that requires you to admit fault or undertake a nonmonetary obligation without your written consent, not to be unreasonably withheld.

20. Disputes

20.1 Informal Resolution

The notice and sixty-day process in this Section 20.1 do not apply to an individual claim brought in small claims court. Before filing any other lawsuit or an arbitration demand, the claimant must send the other party an individualized written notice that includes the claimant’s name and contact information, the email associated with the Client Portal if applicable, a description of the facts and legal basis of the dispute, the specific relief sought, and the claimant’s personal signature. The parties will allow sixty days after receipt of a complete notice for a good-faith effort to resolve the dispute. Either party may request an individualized telephone or video settlement conference during that period, and the claimant and an authorized Bomi representative will personally participate. Applicable limitation periods and filing deadlines are tolled from receipt of a complete notice until the end of the sixty-day period. This process does not prevent a party from seeking temporary relief needed to avoid imminent and irreparable harm.

20.2 Individual Arbitration and Federal Arbitration Act

The Federal Arbitration Act, 9 U.S.C. §§ 1–16 (“FAA”), governs the interpretation and enforcement of this Section. Except for an individual claim eligible for small claims court or a claim seeking temporary or permanent injunctive relief for misuse of intellectual property, confidential information, or Portal Data, an unresolved dispute will be resolved by binding individual arbitration administered by the American Arbitration Association (“AAA”) under its then-current Consumer Arbitration Rules by one neutral arbitrator. If the requirements below for a Coordinated Filing are met, the AAA’s then-current Mass Arbitration Supplementary Rules also apply.

Arbitration will occur remotely or, if an in-person hearing is required, at a reasonably convenient location in your state of residence, unless the parties agree otherwise. The arbitrator may award any remedy available to an individual claimant in court, including public injunctive relief where applicable law permits it. Consumer fees will not exceed the amount assigned to the consumer by the applicable AAA rules, and Bomi will pay the amounts those rules assign to the business. If AAA is unavailable or unwilling to administer an arbitration consistent with this Section, the parties will confer in good faith on a substitute. If they cannot agree, a court may appoint an arbitrator as the FAA permits, and the arbitrator will select fair procedures consistent with this Section.

20.3 Coordinated Mass Filings

A “Coordinated Filing” exists when twenty-five or more similar arbitration demands or notices of dispute are asserted against Bomi within one hundred eighty days and the claimants are represented or assisted by the same or coordinated counsel or organization, or when AAA designates the matters as a mass arbitration under its rules. Each claimant must complete the individualized informal-resolution process in Section 20.1. The AAA Mass Arbitration Supplementary Rules apply, including appointment of a Process Arbitrator and availability of global mediation, except as modified by the fair staged process below.

1. Claimants’ counsel and Bomi will each select up to ten demands for an initial group of no more than twenty bellwether cases. Each bellwether case remains an individual arbitration with its own neutral arbitrator and award. An outcome does not bind a claimant or Bomi in another case, and all participating claimants and counsel will have access to each bellwether award to the extent permitted by law and the AAA rules.
2. Remaining demands will be held in abeyance while the bellwether cases proceed. Limitation periods and filing deadlines for those demands are tolled during the stay. Apart from fees applicable to initiating the coordinated process, case-specific administrative and arbitrator fees for a stayed demand become due only when that demand is selected to proceed, unless the Process Arbitrator or AAA rules require otherwise.
3. Within thirty days after the last initial bellwether award, the parties will participate in good faith in a global mediation for at least sixty days unless they agree to a different period. No settlement binds a claimant without that claimant’s individual written consent.
4. Unresolved demands will then proceed in successive groups of no more than fifty, with groups administered concurrently to the extent practicable. Each demand remains an individual arbitration, each claimant has a meaningful opportunity to be heard, and no decision has precedential or binding effect in another claimant’s case. The Process Arbitrator may adjust timing or group size when reasonably necessary for a fair and efficient process, but may not eliminate a claimant’s individual hearing rights.
5. A claimant whose demand has not been assigned to an active group within twelve months after global mediation ends may elect to continue in individual arbitration without further staging or to file an individual action in a court of competent jurisdiction.

The staged process applies equally to coordinated claims asserted by or against Bomi. If a court finally determines that a portion of this Section 20.3 is unenforceable as to a claimant, that portion will be severed and the claimant may proceed in individual arbitration without the unenforceable procedure; the remaining provisions and other individual arbitrations continue.

20.4 Class Waiver and Public Injunctive Relief

YOU AND BOMI WAIVE A JURY TRIAL AND WILL BRING CLAIMS ONLY IN AN INDIVIDUAL CAPACITY, NOT AS A CLASS, COLLECTIVE, CONSOLIDATED, OR REPRESENTATIVE ACTION. THE ARBITRATOR MAY NOT CONDUCT CLASS OR REPRESENTATIVE ARBITRATION OR COMBINE CLAIMS WITHOUT EVERY AFFECTED PARTY’S WRITTEN CONSENT. Coordinated administration under Section 20.3 does not combine claims or make an award binding on a nonparty.

Nothing in these Terms waives a right to seek public injunctive relief where that right cannot lawfully be waived. A claimant may seek such relief in individual arbitration. If applicable law requires a particular claim for public injunctive relief to be decided by a court, that claim will be severed and may proceed in court after the arbitrable claims are completed, unless law requires a different sequence. If a final decision holds the class or representative-action waiver unenforceable as to a particular claim, that claim must proceed in court and not in class or representative arbitration.

20.5 Opt-Out, Governing Law, and Court Proceedings

You may opt out of arbitration by sending written notice to the notice addresses in Section 21 within thirty days after you first accept these Terms. If you timely opt out, neither party will be bound to arbitrate disputes with the other. An individual claim eligible for small claims court may be brought in any court of competent jurisdiction. For any other court proceeding, if you timely opt out, the arbitration provision is otherwise unenforceable, or a claim is not arbitrable, exclusive jurisdiction lies in the state and federal courts located in Delaware, unless applicable law requires a different forum. Delaware substantive law governs these Terms without regard to conflict-of-law rules, except that the FAA governs arbitration and mandatory protections of your state of residence continue to apply.

A timely arbitration opt-out remains effective notwithstanding any later update to these Terms, and you are not required to opt out again. If Bomi materially changes this Section 20, an affected user may opt out of the revised arbitration terms by the same opt-out method within thirty days after receiving notice of the change; a user who does so remains subject to the most recent version of this Section 20 that the user accepted and did not opt out of. A change to this Section 20 does not apply to a dispute for which either party provided notice to the other before the change’s effective date.

21. Changes, Notices, and General Terms

Changes. Bomi may update these Terms to reflect changes in law, security, the Client Portal, or business operations. We will post the updated date. Bomi will provide at least thirty days’ advance notice of a materially adverse change through the Client Portal or by email, unless a shorter period is reasonably necessary to comply with law or address an urgent security or safety risk. We will obtain consent where law requires it. Changes do not retroactively authorize a materially different use of Portal Data. A change to the arbitration provision is subject to the additional protections in Section 20.5.

Notices. Ordinary contractual notices may be sent by authenticated email. Bomi may send a notice to the email address associated with your profile. You may send a notice to [email protected] from the email address associated with your profile or another address Bomi reasonably verifies as controlled by you. An email notice is received on the earlier of the recipient’s written acknowledgment or the next business day after sending if the sender receives no automated delivery-failure message or other reliable notice that it was not received. An arbitration opt-out may be sent to that email address or by mail to Bomi Health, Inc., Attn: Legal, 1111B S Governors Ave STE 6453, Dover, DE 19904.

A notice commencing litigation or arbitration, a subpoena, service of process, or a similar formal legal paper must be delivered as required by applicable law, the relevant court or tribunal rules, or the parties’ agreed procedure. Courier delivery is not required for an ordinary contractual notice. Privacy questions and requests may be sent to [email protected].

California consumer notice. A California user may report an unresolved complaint about the Client Portal to the Complaint Assistance Unit of the Division of Consumer Services of the California Department of Consumer Affairs by writing to 1625 North Market Blvd., Suite N-112, Sacramento, CA 95834, or calling (800) 952-5210.

Miscellaneous. You may not transfer these Terms or your portal access. Bomi may assign these Terms in connection with a merger, reorganization, or sale of substantially all relevant assets to a successor that assumes Bomi’s obligations. If a provision is unenforceable, it will be modified to the minimum extent necessary and the remainder will continue. A waiver must be written and applies only to the stated instance. Sections that by their nature should survive termination do survive, including Sections 2, 3, 6, 9 through 12, Section 13 solely as to ownership, use restrictions, feedback rights, app-store beneficiary provisions, and accrued rights, but not any license grant, and Sections 14 and 16 through 21. Except for Apple and its subsidiaries solely as expressly stated in Section 13.3, and any other app-store party solely to the extent required by applicable distribution terms, these Terms do not confer any right or remedy on a third party, including a Provider. These Terms are the complete agreement between you and Bomi concerning your use of the Client Portal and do not alter your separate relationship with your Provider.