Our services agreement

Part 1. Order and Statement of Work

1. The project

2. Proof of concept

3. Price and payments

Fixed price for the project: $ (US dollars). Each payment is 25% of the fixed price. If a proof of concept was chosen, its $500 fee is credited against Payment 1.

4. Data used for development and testing

5. Where the work runs

6. Health information

7. Open-source software in this project

8. Signatures

By signing, each party agrees to this Order, the Standard Terms in Part 2 and, if chosen in section 6, Exhibit B. Electronic signatures and signed copies count as originals.

1. Definitions

• Order: Part 1, signed by both parties, including its Statement of Work.
• Deliverables: what the Order says AI Web Center will deliver, made for the Client.
• AI Web Center Materials: tools, code, templates, libraries and know-how AI Web Center had before the project or develops independently of it, including improvements to them.
• Client Materials: data, documents, software, trademarks and other content the Client provides.
• Personal Information: information that identifies, or can reasonably be linked to, a particular person or household, as defined by applicable privacy law.
• De-identified Data: data from which Personal Information has been removed or replaced so that it can no longer reasonably identify a person.
• Business day: Monday to Friday, excluding US federal holidays.

2. The work and changes

2.1AI Web Center will perform the work described in the Order in a professional and workmanlike manner.

2.2Either party may ask for a change in writing (email is enough). Before doing any work outside the Order, AI Web Center will send a written estimate of its effect on price and timeline. The change is part of the project only once the Client approves the estimate in writing.

2.3Timelines in an Order are estimates. They move by the time any Client delay, decision or late payment adds.

3. Proof of concept

This section applies only if the Order says "Yes" to a proof of concept.

3.1The $500 fee is due at signing and is not refundable once work has started. AI Web Center delivers the proof of concept as described in the Order.

3.2After delivery, the Client has 10 business days to decide:

1. Go ahead: the Client pays Payment 1, less the $500 already paid, and the project continues on this Agreement's terms.
2. Stop: the Client tells AI Web Center in writing, or does not pay Payment 1 within 30 days of delivery. This Agreement then ends. The Client owes nothing more, and the proof of concept remains AI Web Center Materials.

3.3If the proof of concept shows that the project is materially different from what the Order assumed (for example, the data is far less complete or consistent than described), either party may propose a revised price or scope in writing within the same 10 business days. If the parties do not agree in writing within 10 further business days, this Agreement ends as described in 3.2(b).

3.4AI Web Center does not start the project until Payment 1 is received.

4. Fees and payment

4.1AI Web Center invoices each payment when it becomes due under the Order. Invoices are due within 14 days.

4.2If an invoice is more than 14 days overdue, AI Web Center may pause work after giving 5 business days' written notice, until it is paid. Any hosting provided under section 11.1 continues for 30 days after such notice.

4.3Fees do not include taxes, which the Client pays where they apply (other than taxes on AI Web Center's income). Third-party costs, such as software licenses, domains or cloud services, are the Client's, and only once the Client has approved them in writing.

5. Acceptance

5.1When a milestone is delivered, the Client has 10 business days to test it against the Order and either accept it or send a written list of the ways it does not meet the Order.

5.2AI Web Center fixes the listed items and delivers again, and the Client then has 5 business days to re-test the fixed items.

5.3A milestone is accepted when the Client accepts it in writing, when the testing period ends without a written list, or when the Client starts using it for its business, whichever comes first.

5.4"Using it for its business" means using the milestone in live operations: with real customers, real transactions, or real data that the Client relies on. Testing, demonstrations, training, and a trial run with a few users on test or de-identified data do not count.

6. Working together

Good software is built with the people who know the business. AI Web Center brings the building; the Client brings the knowledge of how its work is done. To keep the project moving, the Client will:

1. Share what the work needs: information, examples, documents, data and access to systems, and tell AI Web Center if any of it changes.
2. Answer in reasonable time: reply to questions and requests within 5 business days, or say when an answer will come.
3. Make decisions: name one contact person who can answer questions and approve choices, such as which of two business rules is the right one.
4. Test and give feedback on each milestone within the times in section 5.

When the project waits on something from the Client, the timeline moves by that time, and AI Web Center will say so in writing. If the project has waited on the Client for more than 30 days in a row, AI Web Center may invoice the work done so far on the current milestone, in proportion to its progress, and pick the project up again when the Client is ready.

The Client confirms that it has the right to provide the Client Materials to AI Web Center for this project, and that providing them is lawful.

7. Ownership

7.1When the Client has paid all fees for a project in full, AI Web Center assigns to the Client all rights in the Deliverables made for that project, except AI Web Center Materials and open-source components.

7.2Where AI Web Center Materials are part of the Deliverables, AI Web Center grants the Client a perpetual, non-exclusive, royalty-free license to use, copy and modify them as part of the Deliverables, effective on full payment.

7.3Until full payment, the Client may use the Deliverables only to test and review them.

7.4Open-source components stay under their own licenses, listed in the Order where known. A Deliverable that is a conversion of, or is derived from, software licensed under the GNU General Public License is itself licensed to the Client under that license, and the Client receives its source code.

7.5The Client keeps all rights in the Client Materials. AI Web Center may use them only for this Agreement.

7.6AI Web Center may name the Client or describe the project publicly only with the Client's written permission.

8. AI-assisted development

8.1AI Web Center uses AI coding tools in its work. It reviews and tests everything it delivers, and is responsible for the Deliverables in the same way as if it had written every line itself.

8.2AI Web Center will not put Personal Information or protected health information into any AI tool. For the Client's work it will use only AI services that, under their terms for AI Web Center's account or with training turned off in that account's settings, do not use what AI Web Center sends to train their models. AI Web Center will not send feedback ratings on sessions that contain the Client's work.

8.3The Client agrees that its source code and other Client Materials (without Personal Information) may be processed by such AI services for this project.

9. Confidentiality

9.1Each party will keep the other's non-public business, technical and customer information confidential, use it only for this Agreement, and share it only with people who need it for this Agreement and are bound to keep it confidential.

9.2This does not apply to information that is or becomes public through no fault of the receiving party, that the receiving party already had or develops independently, or that it receives lawfully from someone else. A party may disclose information when the law requires it, after notifying the other party where allowed.

9.3These duties last for three years after this Agreement ends, and for trade secrets and Personal Information as long as they remain so.

10. Data protection and security

10.1De-identified data for development. Development and testing use De-identified Data, prepared as chosen in the Order (Option A or B). If AI Web Center finds Personal Information in data it was told is de-identified, it stops using that data, tells the Client, and deletes it.

10.2When AI Web Center handles Personal Information (Option B, hosting under 11.1, or access to the Client's systems under 11.2), it acts as the Client's service provider and:

1. processes it only to perform this Agreement and on the Client's documented instructions;
2. does not sell or share it, and does not keep, use or disclose it for any other purpose or outside its relationship with the Client;
3. does not combine it with personal information from other sources, except as the law allows for a service provider;
4. complies with the obligations that apply to it as a service provider under the California Consumer Privacy Act and other applicable privacy law, gives the information the same level of protection those laws require, and tells the Client if it can no longer meet these obligations;
5. lets the Client take reasonable steps to confirm compliance and to stop and fix any unauthorized use;
6. uses a subcontractor (such as a hosting company) only under written terms at least as protective as these, and remains responsible for it.

10.3Who does what.

10.4Incidents. If AI Web Center becomes aware of unauthorized access to Client data in its care, it will tell the Client without undue delay and within 72 hours, share what it knows, and help the Client respond.

10.5At the end. Within 30 days after the work ends, AI Web Center returns Client data on request and then deletes its copies, except copies the law requires it to keep, which stay protected by this Agreement. It confirms the deletion in writing on request.

11. Hosting and server access

11.1On AI Web Center's server. AI Web Center keeps the server's software up to date, serves the application over encrypted connections, limits access to those who need it, and makes regular backups as described in the Order. The server is located in the United States. AI Web Center uses commercially reasonable efforts to keep the application available but does not guarantee uninterrupted service. Either party may end hosting with 30 days' written notice; AI Web Center then provides the application and its data to the Client in a standard format and deletes them as in 10.5.

11.2On the Client's server. The Client gives AI Web Center its own named account with access by SSH key, not a shared password, and may change or revoke that access at any time. The Client is responsible for the server, its security and its backups, and makes a backup before each scheduled change. AI Web Center keeps its keys secure, changes only what the work needs, and tells the Client what it changed.

12. Warranty

12.1For 30 days after final acceptance, AI Web Center will fix, at no charge, any defect that makes the Deliverables fail to meet the Order, if the Client reports it in writing. This does not cover problems caused by changes made by others, the Client's systems or data, or third-party software and services.

12.2Except as stated in this Agreement, the Deliverables and services are provided as is, and AI Web Center makes no other warranties, express or implied, including warranties of merchantability, fitness for a particular purpose and non-infringement.

13. Limits of liability

13.1Neither party is liable for lost profits, lost revenue, lost data or business interruption, or for indirect, incidental, special or consequential damages, even if told they were possible.

13.2Each party's total liability arising out of or relating to this Agreement is limited to the fees the Client paid or owes under the Order in the 12 months before the event giving rise to the claim.

13.3These limits do not apply to the Client's obligation to pay fees, or to liability for fraud, willful misconduct, gross negligence, or violation of law, or in any other case where California law (including Civil Code section 1668) does not allow liability to be limited.

14. Claims from others

14.1AI Web Center will defend the Client against a third-party claim that the Deliverables, as delivered, infringe that party's copyright or misappropriate its trade secret, and pay the resulting damages awarded or agreed in settlement. This does not apply to Client Materials, open-source components, or changes or combinations made by anyone other than AI Web Center.

14.2The Client will defend AI Web Center against a third-party claim arising from the Client Materials or from the Client's use of Personal Information, and pay the resulting damages awarded or agreed in settlement.

14.3The party asking for defense must tell the other promptly, let it control the defense and settlement, and cooperate reasonably. This section is subject to section 13.

15. Ending this Agreement

15.1Either party may end this Agreement for any reason with 15 days' written notice. The Client then pays for accepted milestones, plus the work done on the current milestone in proportion to its progress. On that payment, the Client receives the rights under section 7 in the work paid for.

15.2Either party may end this Agreement by written notice if the other materially breaches it and does not fix the breach within 15 days of written notice.

15.3Sections 7, 9, 10, 13, 14, 16 and 17, and any unpaid fees, survive the end of this Agreement.

16. Disputes

16.1Talk first. A party with a dispute sends written notice describing it. The parties then try in good faith to resolve it for 30 days, and may agree to use a mediator.

16.2Arbitration. If the dispute is not resolved within 30 days of the notice, any controversy or claim arising out of or relating to this Agreement, or its breach, will be settled by arbitration administered by the American Arbitration Association under its Commercial Arbitration Rules, before a single arbitrator, in Orange County, California. Judgment on the award may be entered in any court having jurisdiction.

16.3Exceptions. Either party may bring a claim in small claims court instead, if the claim is within that court's jurisdiction. Either party may ask a court for an injunction to protect its confidential information or intellectual property.

16.4Costs. In any proceeding to collect unpaid fees, the prevailing party may recover its reasonable attorneys' fees and costs.

16.5Law. This Agreement is governed by the laws of the State of California, without regard to its conflict-of-laws rules, and the arbitration provisions by the Federal Arbitration Act.

17. General

17.1AI Web Center is an independent contractor. Nothing in this Agreement makes the parties partners, employer and employee, or agents of each other.

17.2Notices are given by email to the addresses in the Order, and take effect on the business day after they are sent.

17.3Neither party is responsible for delays caused by events beyond its reasonable control, other than payment obligations.

17.4Neither party may transfer this Agreement without the other's written consent, except to a successor of its whole business that agrees in writing to be bound by it.

17.5If a part of this Agreement is unenforceable, the rest stays in effect. A waiver must be in writing. This Agreement, with its Order and any Exhibit, is the parties' entire agreement on its subject and replaces earlier proposals and discussions. Changes must be in writing and signed (electronically is fine) by both parties.

B1. Permitted uses and disclosures

Business Associate may use and disclose PHI only to perform the services in the Order, as required by law, and for its own proper management and administration or to carry out its legal responsibilities as permitted by 45 CFR 164.504(e)(4). It will follow the minimum necessary standard and will not use or disclose PHI in a way that would violate the HIPAA Rules if done by Covered Entity.

B2. Business Associate's obligations

Business Associate will:

1. not use or disclose PHI other than as permitted by this Exhibit or required by law;
2. use appropriate safeguards, and comply with Subpart C of 45 CFR Part 164 (the Security Rule) for electronic PHI, to prevent use or disclosure other than as this Exhibit provides;
3. report to Covered Entity any use or disclosure not provided for by this Exhibit, including breaches of unsecured PHI as required by 45 CFR 164.410, and any security incident it becomes aware of, without unreasonable delay and in no case later than 10 business days after discovery; unsuccessful attempts such as pings, port scans and blocked log-in attempts need no individual report;
4. ensure, under 45 CFR 164.502(e)(1)(ii) and 164.308(b)(2), that any subcontractor that creates, receives, maintains or transmits PHI on its behalf agrees in writing to the same restrictions, conditions and requirements;
5. make PHI in a designated record set available to Covered Entity within 10 business days of a request, as needed for Covered Entity to meet 45 CFR 164.524 (access);
6. make amendments to PHI in a designated record set as directed by Covered Entity under 45 CFR 164.526;
7. keep and provide, within 10 business days of a request, the information Covered Entity needs to give an accounting of disclosures under 45 CFR 164.528;
8. to the extent it carries out Covered Entity's obligations under Subpart E of 45 CFR Part 164, comply with the requirements of Subpart E that apply to Covered Entity in performing them;
9. make its internal practices, books and records available to the Secretary for determining compliance with the HIPAA Rules;
10. not put PHI into any AI tool, and use PHI in development or testing only after it has been de-identified under 45 CFR 164.514.

B3. Covered Entity's obligations

Covered Entity will tell Business Associate of any limitation in its notice of privacy practices, any change or revocation of an individual's permission, and any restriction it has agreed to, to the extent they affect Business Associate's use or disclosure of PHI. Covered Entity will not ask Business Associate to use or disclose PHI in a way not permitted for Covered Entity under the HIPAA Rules, and will provide only the minimum PHI necessary.

B4. Term and termination

B4.1This Exhibit lasts as long as the Agreement and ends when all PHI has been returned or destroyed as in B4.3.

B4.2If Covered Entity determines that Business Associate has violated a material term of this Exhibit, Covered Entity may end the Agreement if Business Associate does not cure the violation within 30 days of written notice.

B4.3Within 30 days after the Agreement ends, Business Associate returns to Covered Entity or destroys all PHI it maintains in any form, keeps no copies, and confirms this in writing. If return or destruction is not feasible, it extends the protections of this Exhibit to that PHI and limits further uses and disclosures to the purposes that make return or destruction infeasible, for as long as it keeps it.

B5. Other terms

A reference to a section of the HIPAA Rules means that section as in effect or amended. The parties will amend this Exhibit as needed for compliance with changes to the HIPAA Rules. Any ambiguity is resolved to permit compliance with the HIPAA Rules. This Exhibit creates no rights for anyone other than the parties. Sections B2(a), B4.3 and this section survive the end of the Agreement.