Terms of service

You own every patient record, clinical note, document and financial record entered into your workspace. We hold it as a processor acting on your instructions, and we claim no licence over it beyond what is required to run the service for you.

You can export the whole of it at any time — as FHIR R4 bundles or CSV, through the interface or the API — without asking us and without an additional fee. This remains true while an account is suspended and after a subscription has ended.

Plans are billed per provider seat. The first provider is included in the plan price; further seats are charged at the plan's additional-provider rate and prorated to the day they are added or removed. Administrative staff, receptionists, nurses, pharmacists and billers do not consume a seat.

Monthly subscriptions renew monthly and can be cancelled at any time, effective at the end of the current period. Annual subscriptions are paid in advance at ten months' price and can be cancelled with a pro-rata refund of the unused whole months.

AI features draw on a monthly credit allowance included in your plan. Beyond the allowance, either metered top-ups apply or the features stop, depending on the cap you set. The cap defaults to stopping, so nobody is surprised by an invoice.

Prices are exclusive of sales tax and VAT, which are added according to your billing address. We give 30 days' notice before a price change affects an existing subscription, and it takes effect at your next renewal rather than mid-period.

We may make a workspace read-only where an invoice is materially overdue after notice, where use breaches the acceptable-use terms below, or where continuing would put other customers' data at risk.

Suspension never deletes records and never removes export access. A clinic must be able to retrieve its patients' data regardless of the state of its account — putting patient care downstream of our accounts receivable is not a position this product takes.

Do not use CareVault to store data you have no lawful basis to hold, to access records you are not authorised to access, to circumvent the audit trail, or to probe or attack the service or other tenants. Security research is welcome through the channel below rather than against production.

You are responsible for the accounts you create, for revoking access when someone leaves, and for the accuracy of what your staff record. We give you the tools — role-based permissions, mandatory MFA, IP allowlisting, session revocation, an anomaly report — but we cannot operate your access control for you.

We target 99.9% monthly availability and publish maintenance in advance. Enterprise agreements attach service credits to that figure; on other plans it is a target we work to rather than a contractual commitment, and we would rather say so than imply otherwise.

Planned maintenance is scheduled outside clinic hours in your workspace's region wherever it is possible to do so.

We treat your data as confidential and apply the safeguards described on the security page. We sign a Data Processing Agreement with every customer and a Business Associate Agreement with customers handling protected health information under HIPAA.

We give advance notice before adding a subprocessor, and you may object.

The controls are described in detail on the security page, including the subprocessor register.

Neither party excludes liability for death or personal injury caused by negligence, for fraud, or for anything else that cannot lawfully be excluded.

Subject to that, our aggregate liability in any twelve-month period is limited to the fees you paid us in that period. We are not liable for loss of profit, loss of goodwill, or indirect loss.

Clinical responsibility sits with the treating clinician. We are not liable for a clinical decision, and nothing in the product transfers that responsibility to us.

You may terminate at any time from your workspace's billing settings. We may terminate for material breach that is not remedied within 30 days of notice.

On termination the workspace becomes read-only and export-only for 90 days so you can retrieve everything. After that, data is processed under the retention policy on your account and under the statutory medical-record retention period that applies to you — which is frequently measured in decades and which neither of us can shorten by agreement.

Sections 1, 6, 7 and this section survive termination.

We give 30 days' notice by email before a material change. Continuing to use the service after that constitutes acceptance; if you would rather not accept, you may terminate and receive a pro-rata refund of any prepaid period.

legal@carevault.app for contractual questions, security@carevault.app to report a vulnerability, privacy@carevault.app for data protection matters.