These Terms govern your access to Curatios services delivered as a HIPAA-compliant business associate platform. By using the application, you agree to follow these requirements on behalf of your organization and the patients you serve.

Authorized Users

• Only workforce members who completed HIPAA privacy and security training may access PHI.
• Accounts are individual; sharing credentials or leaving sessions unattended is prohibited.

Acceptable Use

• Use the platform solely for treatment, payment, or healthcare operations approved under your Business Associate Agreement.
• Upload only accurate, timely information and refrain from introducing malicious code.
• Notify Curatios within one business day of any suspected security incident or unauthorized disclosure.

Data Ownership and Retention

Covered entities retain ownership of all PHI. Curatios stores PHI for the duration of the service agreement and purges data in accordance with contractual retention schedules and NIST media sanitization standards.

Service Commitments

• Curatios maintains technical and administrative safeguards that meet or exceed HIPAA Security Rule requirements.
• Scheduled maintenance windows will be communicated in advance except for emergency fixes addressing security events.

Limitation of Liability

Except as prohibited by law, Curatios is not liable for indirect or consequential damages arising from misuse of the platform. Remedies are limited to direct damages up to the fees paid in the preceding twelve months.

Contact

For contractual questions or incident reporting, email legal@curatios.com.