Terms of Service

1 Scope & How To Read This

CoralEHR serves three distinct audiences. Different sections of these Terms apply to each:

2 Marketing Website (coralehr.com)

2.1 Description

The marketing website provides:

• • Informational content about CoralEHR's electronic health record software for behavioral health practices
• • Blog articles on mental health, behavioral therapy, and practice management
• • Free clinical assessment tools based on validated clinical instruments
• • Demo scheduling through our Calendly integration
• • Newsletter with product and industry updates

2.2 Eligibility

You must be at least 18 years old to use the marketing website. If you are under 18, you may only use it with the involvement of a parent or guardian.

2.3 Clinical Assessment Tools — Important Disclaimers

Assessment tools available:

• • PHQ-9 — Depression screening
• • PHQ-2 — Brief depression screening
• • GAD-7 — Anxiety screening
• • ASRS — ADHD screening
• • CY-BOCS — OCD assessment
• • Mini-Cog — Cognitive impairment screening

Privacy of assessment data: All assessment processing occurs entirely within your web browser. Your responses are never transmitted to our servers. PDF results are generated locally on your device. See our Privacy Policy for details.

Limitation of liability for assessments: CoralEHR shall not be liable for any decisions made or actions taken based on the results of these assessment tools. You assume full responsibility for how you use and interpret assessment results.

3 EHR Subscription Service

This section applies to use of the CoralEHR EHR App by a licensed healthcare professional or practice (the "Practice").

3.1 Eligibility

You represent that you are a licensed healthcare professional in good standing, or an authorized agent of a licensed practice, and that your use of the EHR App is for the legitimate provision of healthcare services. You agree to use the EHR App only within the scope of your professional license and applicable law.

3.2 Account & Authentication

You are responsible for safeguarding your account credentials and for all activity that occurs under your account. Multi-factor authentication is mandatory. You must notify us immediately at support@coralehr.com of any unauthorized access.

3.3 Business Associate Agreement (Required Before PHI)

3.4 Subscription, Fees & Billing

• • The EHR App is offered on a subscription basis at the rates set forth in the applicable order form or pricing page.
• • Subscription billing is processed by Stripe, Inc. Card data is held by Stripe under PCI-DSS and never touches CoralEHR servers.
• • Fees are charged in advance for each billing period and are non-refundable except as required by law.
• • We may change subscription fees with at least thirty (30) days' notice. Continued use after the change constitutes acceptance.

3.5 Acceptable Use

You agree not to:

• • Use the EHR App for any purpose other than the provision of healthcare services to your patients
• • Enter PHI of patients who are not yours, or for whom you do not have authority to maintain a record
• • Share account credentials with anyone, including other clinicians within the same practice
• • Reverse engineer, decompile, or attempt to extract the source code of the EHR App
• • Use automated tools to scrape, mirror, or extract patient data outside the documented export functionality
• • Use the EHR App or any data within it to train machine learning or artificial intelligence models
• • Interfere with or disrupt the EHR App or the servers that host it
• • Use the EHR App in any way that violates applicable law or your professional licensure obligations

3.6 Practice Data Ownership

As between CoralEHR and the Practice, the Practice owns its patient records and PHI. CoralEHR is the processor of that data on the Practice's behalf as described in the BAA. CoralEHR retains all rights in the EHR App software itself, including improvements developed in the course of operating the service.

3.7 AI-Assisted Features

AI-assisted features (such as note drafting, summarization, and clinical decision support) are disabled by default. The Practice may enable them at its discretion. AI subprocessors are governed by the BAA and our AI processing disclosures. AI output is a draft for clinician review — never a clinical decision in itself. The clinician remains professionally and legally responsible for any content incorporated into a patient record.

3.8 Suspension & Termination

• • Either party may terminate the subscription for any reason on at least thirty (30) days' written notice.
• • Either party may terminate for material breach with a thirty (30)-day cure period, except where cure is not feasible.
• • We may suspend access without prior notice in response to a credible security or integrity threat to the EHR App or other Practices.
• • Upon termination, PHI handling follows the BAA's return-or-destroy obligations.

3.9 Service Availability

We aim for high availability of the EHR App but do not currently commit to a contractual service level outside of the BAA's safeguards. Maintenance windows are announced in advance where reasonably practicable. A formal SLA may be offered in a separate order form for enterprise plans.

4 Patient Portal

This section applies to patients who use the CoralEHR Patient Portal. By logging in, you agree to these Terms and the Privacy Policy.

4.1 Eligibility & Account Creation

• • Access is by invitation from your treating practice.
• • You must be at least 18 years old to maintain your own portal account. For minor patients, a parent or legal guardian holds the account in accordance with the practice's policies and applicable law.
• • You are responsible for the accuracy of the information you provide and for safeguarding your login credentials.

4.2 What the Portal Does

Through the Patient Portal you can:

• • Receive and respond to messages from your clinician
• • Complete intake forms and clinical assessments your clinician sends you
• • Upload documents (consent forms, insurance cards, etc.)
• • View invoices and pay your practice through Stripe
• • Manage appointment requests, where your practice has enabled that

4.3 Acceptable Use

When using the Patient Portal you agree not to:

• • Impersonate another person
• • Use the portal for any unlawful purpose
• • Upload malicious software or content
• • Attempt to access another patient's record
• • Use automated scripts to access the portal
• • Harass, threaten, or abuse your clinician, the practice, or CoralEHR staff

4.4 Records, Corrections & Deletion

Your clinical record is maintained by your practice as the HIPAA Covered Entity. Requests to amend or delete clinical records are directed to your practice, which then directs CoralEHR. Portal-only account data (login email, preferences) may be deleted by contacting your practice or by emailing support@coralehr.com.

4.5 Termination by Practice

Your practice may revoke your portal access at any time (for example, upon discharge from care). CoralEHR may also suspend access in response to a credible security threat or violation of these Terms.

5 Intellectual Property

The Website, EHR App, Patient Portal, and all their original content, features, and functionality are owned by Simplest Healthcare Inc. and are protected by international copyright, trademark, and other intellectual property laws.

The clinical assessment instruments (PHQ-9, GAD-7, etc.) are based on validated tools generally in the public domain for clinical use. Our implementation, design, and user interface remain our intellectual property.

You are granted a limited, non-exclusive, non-transferable license to:

• • Access and use the Website for personal, non-commercial purposes
• • Use the assessment tools for personal screening or clinical practice
• • Use the EHR App and Patient Portal solely for their intended purposes, subject to your subscription or invitation

You may not:

• • Reproduce, distribute, or create derivative works from our content or software
• • Use our Website, EHR App, or Patient Portal for commercial purposes outside the scope of your subscription
• • Remove any copyright or proprietary notices
• • Attempt to reverse engineer any software we provide

6 User Conduct

In addition to the audience-specific acceptable-use rules in §3.5 and §4.3, you agree not to:

• • Use any of our services in a way that violates applicable law
• • Attempt to gain unauthorized access to any part of our infrastructure
• • Interfere with, disrupt, or place excessive load on our servers
• • Use automated systems (bots, scrapers) without our written permission
• • Transmit any viruses, malware, or harmful code
• • Impersonate any person or entity, or misrepresent your professional credentials

7 Third-Party Links & Integrations

Our services may contain links to or integrate with third-party services (Stripe, Google Calendar, Calendly, Anthropic, and others). These are provided for the convenience or operation of features you enable. We do not control, endorse, or assume responsibility for the content, terms, or practices of any third party. Your use of a third-party service is subject to that party's own terms.

Where a third-party integration handles Google user data, see Privacy Policy §5. Where it handles PHI, see the BAA.

8 Disclaimer of Warranties

We specifically disclaim:

• • Any warranty that any service will be uninterrupted, secure, or error-free
• • Any warranty regarding the accuracy or reliability of any content, including AI-generated drafts
• • Any warranty that assessment tools will correctly identify any condition
• • Any implied warranties of merchantability, fitness for a particular purpose, or non-infringement

9 Limitation of Liability

TO THE MAXIMUM EXTENT PERMITTED BY LAW, SIMPLEST HEALTHCARE INC. SHALL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, INCLUDING:

• • Loss of profits, data, goodwill, or business opportunity
• • Personal injury or property damage
• • Damages arising from your use of the Website, EHR App, or Patient Portal
• • Damages arising from reliance on assessment results or AI-generated drafts

FOR THE MARKETING WEBSITE AND PATIENT PORTAL, IN NO EVENT SHALL OUR TOTAL LIABILITY EXCEED ONE HUNDRED DOLLARS ($100). FOR THE EHR SUBSCRIPTION SERVICE, IN NO EVENT SHALL OUR TOTAL LIABILITY EXCEED THE AMOUNT PAID BY THE PRACTICE TO US IN THE TWELVE (12) MONTHS PRECEDING THE EVENT GIVING RISE TO THE CLAIM.

10 Indemnification

You agree to indemnify, defend, and hold harmless Simplest Healthcare Inc., its officers, directors, employees, and agents from any claims, damages, losses, and reasonable attorneys' fees arising from:

• • Your use of the Website, EHR App, or Patient Portal
• • Your violation of these Terms
• • Your violation of any rights of another party, including any patient's rights under HIPAA
• • Any decisions or actions taken based on assessment results or AI-generated drafts
• • For EHR clinicians: any failure to maintain the licensure or professional standard required to provide care through the EHR App

11 Modifications & Termination

We may modify these Terms from time to time. We will update the "Version" and "Last updated" date at the top, and for material changes we will notify clinicians by email and prompt re-acknowledgment on next login.

We may terminate or suspend your access to any of our services at any time, without prior notice, for any reason, including breach of these Terms. EHR subscription termination follows §3.8; Patient Portal access follows §4.5.

12 Governing Law & Venue

These Terms shall be governed by the laws of the State of California, without regard to its conflict of law provisions, except to the extent preempted by federal law including HIPAA. Any legal action arising under these Terms shall be brought exclusively in the federal or state courts located in San Francisco County, California, and you consent to personal jurisdiction there.

13 General Provisions

• • Severability: If any provision is found unenforceable, the remaining provisions remain in full force.
• • No waiver: Our failure to enforce any right or provision is not a waiver of that right or provision.
• • Assignment: You may not assign these Terms without our prior written consent. We may assign them in connection with a merger, acquisition, or sale of assets.
• • Entire Agreement: These Terms, the Privacy Policy, and (for EHR clinicians) the BAA constitute the entire agreement between you and Simplest Healthcare Inc. with respect to the subject matter. In the event of conflict between these Terms and the BAA with respect to PHI, the BAA controls.