longevitydocs.ai
Last updated: October 19, 2026
Operated by: LongevityDocs™, LLC
Contact: support@longevitydocs.org
By accessing or using longevitydocs.ai (the “Service”), operated by LongevityDocs™, LLC (“LongevityDocs™,” “we,” “us,” or “our”), you (“User”) agree to be bound by these Terms and Conditions (“Terms”). If you do not agree to these Terms in their entirety, you must not access or use the Service.
Longevitydocs.ai is an AI-powered intelligence platform designed exclusively for longevity medicine professionals. The Service includes the following features:
LongevityDocs™ reserves the right to modify, suspend, or discontinue any feature of the Service at any time with or without notice.
Access to the Service is restricted to licensed healthcare professionals (MDs and DOs) who satisfy at least one of the following:
By registering, you represent and warrant that you meet these eligibility requirements and that all information you provide is accurate and current. LongevityDocs™ reserves the right to verify credentials and to suspend or terminate access for any User who does not meet eligibility criteria. Unauthorized access is strictly prohibited.
Notwithstanding the foregoing eligibility requirements, LongevityDocs may, in its sole discretion, separately approve access for other individuals or organizations, subject to any access limitations or additional conditions it specifies.
Hippo AI, Hippo Clinic, and other AI-enabled features (collectively, the “AI Tools”) provide educational information and clinical decision support for licensed healthcare professionals. Outputs generated by the AI Tools do not constitute medical advice from LongevityDocs or an independent clinical diagnosis, prescription, or treatment decision, and do not replace the treating clinician’s professional judgment.
All clinical decisions must be made based on individual patient assessment, current evidence-based guidelines, and the treating physician’s independent professional judgment. AI-generated content may contain errors, omissions, or outdated information. Outputs may also contain bias, incorrect calculations, or fabricated citations. Users are solely responsible for verifying any AI output against current prescribing information, peer-reviewed literature, and authoritative clinical sources before applying it in any clinical context. Users must independently evaluate the basis and patient-specific applicability of outputs and must not rely primarily on AI-generated recommendations to make clinical decisions. If an output’s basis cannot be adequately verified, it must not be relied upon for clinical action.
When interacting with the AI Tools, you are always interacting with an artificial intelligence system, not a human physician or clinical advisor. Hippo™’s responses may draw from faculty-curated CLD curriculum content, peer-reviewed scientific literature, and community practitioner discussions. The evidence level and source type of any response should be evaluated by the treating physician before clinical application. A citation does not guarantee that the source supports the response or that the information is appropriate for a particular patient.
No Physician–Patient Relationship. Use of the AI Tools does not establish a physician–patient relationship with LongevityDocs, its employees, faculty, or contributors. LongevityDocs does not undertake to provide, manage, or supervise patient care.
Patient Information and Verification. Outputs may lack relevant patient history, examination findings, medications, allergies, or other clinical context. A patient-specific response does not establish clinical suitability. Users must verify patient identity and relevant information, including uploaded reports, extracted laboratory values, units, reference ranges, wearable data, and dictated or transcribed notes, before relying on them. Missing information or the absence of a warning does not establish that no clinical concern exists.
Clinician Review and Responsibility. AI-generated notes, summaries, care plans, and patient communications require review and approval by the responsible clinician before being adopted into the clinical record, communicated as clinical guidance, or implemented in patient care. Users remain responsible for prescribing, informed consent, documentation, follow-up, and practicing within their professional scope.
No Emergency Use or Continuous Monitoring. The AI Tools are not intended for emergency decision-making, emergency communications, or continuous patient monitoring. Task lists, notifications, and alerts may be incomplete or delayed and may not identify every urgent finding or required action. Except as expressly agreed in writing, LongevityDocs personnel do not undertake to review patient records or communications for clinical concerns or intervene in patient care. Users remain responsible for timely review of results and messages.
Service Availability. Interruptions, delayed messages, and integration or synchronization failures may occur. Users must maintain alternative workflows for time-sensitive care and appropriate access to records needed for continuity of care. These responsibilities do not limit LongevityDocs’ obligations under the applicable BAA or applicable law.
No Endorsement or Guaranteed Outcomes. References to therapies, products, providers, or laboratories do not constitute endorsement or establish safety, efficacy, regulatory approval, or suitability for a particular patient. Outputs may discuss investigational or off-label interventions. LongevityDocs does not guarantee any clinical outcome.
Application to Non-AI Clinical Features. The provisions above titled “Patient Information and Verification,” “No Emergency Use or Continuous Monitoring,” and “Service Availability” also apply to non-AI functions within Hippo Clinic and the Clinic Module, including manually entered records, uploaded reports, patient messaging, task lists, and notifications. Users remain responsible for reviewing clinical information, confirming its accuracy, responding to patient communications, and arranging appropriate follow-up, regardless of whether an AI Tool is involved.
Educational Content. Courses, webinars, recordings, articles, Lexicon entries, community discussions, and other educational materials available through the Service are provided for professional education and information. They do not constitute patient-specific medical advice from LongevityDocs or independently establish a standard of care. Users must evaluate the supporting evidence, currency, and applicability of such content before using it in patient care. Content may contain errors, reflect differing professional opinions, or become outdated. Except as expressly stated or required by law, LongevityDocs does not undertake to continuously review or update every item of content.
Independent Contributions. Statements and opinions expressed by faculty, speakers, members, and other contributors are their own and do not necessarily represent those of LongevityDocs. Hosting, publishing, or moderating content does not constitute endorsement of every statement, protocol, product, or recommendation. Users remain responsible for their contributions and any clinical decisions they make based on content obtained through the Service.
Professional Relationships. Accessing educational content or participating in community discussions does not, by itself, establish a physician–patient relationship with LongevityDocs, its personnel, or contributors. LongevityDocs does not undertake to provide, manage, or supervise patient care through these activities.
Education, Certification, and Credit. Completion of a LongevityDocs program or receipt of a certificate or designation does not confer a medical license, expand a User’s lawful scope of practice, or guarantee clinical competence, employment, or patient outcomes. The CLD designation is a LongevityDocs-issued credential and must not be represented as medical licensure or specialty board certification. Continuing education credit is available only for activities expressly designated for such credit and is subject to the stated eligibility, participation, and completion requirements. Users are responsible for confirming whether a program or credit satisfies their licensing or other professional requirements.
Directories and Job Listings. Member profiles, directory entries, and job listings are provided for informational and networking purposes. A listing or credential verification does not constitute an endorsement or guarantee of clinical competence, suitability, employment terms, or performance. Users are responsible for independently evaluating individuals, organizations, and opportunities before entering into professional or employment relationships.
Third-Party Resources and Commercial Relationships. References or links to third-party products, services, sponsors, or resources do not, by themselves, constitute endorsement or a guarantee of their claims, safety, effectiveness, or suitability. Transactions with independent third parties are governed by the applicable third-party agreements. This provision does not limit LongevityDocs’ obligations concerning service providers or subcontractors under applicable law or the BAA.
Applicability. This Section applies only to Users who enroll in a LongevityDocs certification program, apply for or hold a LongevityDocs credential, or use a LongevityDocs certification designation or badge. General platform access or membership does not, by itself, include enrollment in a certification program or confer any certification.
Award of Certification. Enrollment, payment, or participation does not guarantee certification. Certification is awarded only upon satisfaction of the eligibility, assessment, and completion requirements disclosed for the applicable program. Users must provide accurate information concerning their identity, qualifications, and professional licensure and comply with applicable academic integrity and assessment rules. LongevityDocs may withhold certification where these requirements have not been met.
Use of Designations and Badges. Upon award of a certification, LongevityDocs grants the recipient a limited, nonexclusive, nontransferable right to use the applicable designation and approved badge to accurately describe the credential earned, subject to these Terms and the applicable branding guidelines. All ownership rights in the designation, badge, and associated trademarks remain with LongevityDocs. Recipients may not alter or sublicense these materials or use them in a false or misleading manner.
No Misrepresentation or Endorsement. Recipients must not represent a LongevityDocs credential as medical licensure, specialty board certification, governmental approval, or authorization to practice beyond their lawful scope. Certification applies to the individual recipient and does not certify or accredit their clinic, employer, products, services, or treatment protocols. Recipients must not imply that LongevityDocs employs, supervises, sponsors, or guarantees their professional services or patient outcomes.
Maintenance and Renewal. Any expiration date, renewal requirements, continuing education obligations, or maintenance fees applicable to a credential will be disclosed in the applicable program requirements. Completion of a course does not, by itself, establish continuing active certification where separate maintenance requirements apply. Material changes to maintenance or renewal requirements will be communicated in advance and will not retroactively invalidate previously completed requirements.
Suspension and Revocation. LongevityDocs may withhold, suspend, or revoke a credential or permission to use its designation or badge for material misrepresentation, fraud, cheating, failure to satisfy applicable credential requirements, loss or restriction of professional licensure required for the credential, or material misuse of the credential or associated trademarks. Except where immediate suspension is reasonably necessary to address suspected fraud, patient safety concerns, or legal requirements, LongevityDocs will provide written notice of the grounds and a reasonable opportunity to respond before taking final action. A recipient may request review of a suspension or revocation by submitting a written request to support@longevitydocs.org within thirty days after notice.
Effect of Expiration, Suspension, or Revocation. A recipient whose credential expires, is suspended, or is revoked must promptly stop representing that they hold an active credential and discontinue use of the associated badge. The recipient must update websites, professional profiles, advertising, and other materials under their control accordingly. Accurate statements of historical program completion remain permitted, provided they do not imply current certification or continuing permission to use the badge.
Verification of Credentials. LongevityDocs may maintain credential records and confirm a recipient’s name, credential earned, award date, and current credential status to persons requesting verification, consistent with its Privacy Policy and applicable law.
Recording of Sessions. LongevityDocs may record webinars, classes, and group educational sessions, including participants’ names, images, voices, presentations, and contributions made through audio, video, or session chat. By accepting these Terms, you consent to recording your participation in these sessions for the purposes described in this Section. Additional notice or consent will be provided or obtained where required by applicable law. Participants may keep their cameras and microphones off and refrain from submitting contributions, although their display names may remain visible. Anyone who does not consent to recording should not participate in recorded sessions.
Educational Use. Subject to any consent required by applicable law, you grant LongevityDocs a nonexclusive, worldwide, royalty-free license to record, reproduce, transcribe, edit, caption, display, and distribute your voluntary session contributions, together with your name, image, and voice as captured, for delivering, archiving, and making the session and related educational materials available to members and program participants entitled to access them. This permission survives termination of your membership for those purposes. Editing must not materially misrepresent your statements or imply an endorsement you did not provide.
Publicity and Promotional Use. By accepting these Terms, you authorize LongevityDocs to use your name, professional title, image, voice, likeness, and excerpts of your voluntary contributions to recorded webinars, classes, and group educational sessions to advertise and promote LongevityDocs and its programs through websites, social media, email, and other marketing materials, without additional approval or compensation, to the extent permitted by applicable law. LongevityDocs may edit such materials for length, clarity, and format but may not materially misrepresent your statements or experiences or imply an endorsement you did not make. This permission does not extend to private messages, patient information, or endorsements of third-party products or services. Any additional consent required by applicable law will be obtained.
Participant Responsibilities. Participants must not disclose PHI or other confidential information in recorded educational sessions and must have the rights and permissions required for materials they contribute. Permission to submit PHI through designated platform features does not authorize its disclosure in a recorded educational session. Participants may not record, reproduce, or distribute sessions or other participants’ contributions without authorization from LongevityDocs and any additional consent required by law.
Privacy and Other Agreements. Recordings and related personal information will be handled in accordance with the Privacy Policy and applicable law. These permissions do not override the BAA, authorize prohibited uses of PHI, or supersede a separate speaker or contributor agreement.
By using the Service, you acknowledge and agree that LongevityDocs™ may collect and process the following categories of data:
LongevityDocs™ uses collected data for the following purposes:
You expressly acknowledge and agree that LongevityDocs™ may use your AI interaction data — including prompts, responses, feedback, and usage patterns — as well as anonymized or aggregated community content, to train, evaluate, and improve Hippo™ and other AI systems developed by LongevityDocs. The following safeguards apply:
LongevityDocs™ does not sell your personal data. We may share data with trusted third-party service providers operating under confidentiality obligations, legal authorities where required by applicable law, and successors in the event of a merger, acquisition, or sale of assets, subject to equivalent data protection commitments.
We retain personal data for as long as your account is active or as necessary to fulfill the purposes described in these Terms, subject to applicable legal retention requirements. You may request deletion of your account data by contacting support@longevitydocs.org.
Hippo™ and other AI-enabled features rely on artificial intelligence services operated by third-party providers on our behalf. When you use these features, the following data is sent to those providers, only to the extent needed to deliver the feature:
These providers process this data only to provide the requested function, under contractual confidentiality and data-protection obligations that provide at least the same level of protection as our Privacy Policy. The providers and the data each one receives are listed in Section 6 of our Privacy Policy.
Before your data is first sent to an AI provider, the app asks for your consent. You may withdraw it at any time by contacting support@longevitydocs.org; AI features are then unavailable while the rest of the Service remains available.
Users may submit, store, or share Protected Health Information (“PHI”) only through Hippo Clinic, the Clinic Module, or ROUNDS, subject to applicable law and the Business Associate Agreement (“BAA”) attached as Appendix 1 and incorporated into these Terms.
The BAA applies to the extent LongevityDocs creates, receives, maintains, or transmits PHI on behalf of a covered entity or business associate through these features. Acceptance of these Terms includes acceptance of the BAA where applicable. Users accepting on behalf of an organization represent that they have authority to bind that organization. If these Terms conflict with the BAA regarding PHI, the BAA controls.
Users are responsible for ensuring that they have the legal authority and any required permissions or authorizations to submit or disclose PHI, and that access is limited to authorized recipients. The BAA does not itself authorize disclosure to other members, including within ROUNDS.
PHI must not be submitted through any other feature of the Service. LongevityDocs will use and disclose PHI only as permitted by the applicable BAA and applicable law.
You retain ownership of content you submit through the Service. By posting content in community channels, you grant LongevityDocs™ a non-exclusive, royalty-free, worldwide license to display, store, and — subject to Section 8.3 — use that content to improve the Service and its AI systems. The foregoing license does not authorize use or disclosure of PHI beyond what is permitted by the applicable BAA and applicable law. Information properly de-identified under the BAA may be used for the purposes expressly permitted by Section 8.3 and the BAA, subject to applicable opt-out requests and any additional contractual restrictions.
You agree to:
Protecting Member Privacy. To support a trusted environment where members can share openly, please respect the privacy of other members’ nonpublic communications and confidential materials. You may not disclose, forward, publish, or share screenshots or recordings of these outside the authorized audience without the member’s permission. This does not restrict disclosures required by law, confidential disclosures to legal advisers, or good-faith reporting of suspected unlawful conduct to appropriate authorities. PHI remains subject to Section 9, the applicable BAA, and applicable law.
Content Responsibility and Moderation. Users are responsible for the legality, accuracy, and appropriateness of content they submit and for obtaining the rights and permissions necessary to share it. Users must not post defamatory, harassing, discriminatory, deceptive, or unauthorized promotional content.
Zero Tolerance for Objectionable Content and Abusive Users. Longevitydocs™ has zero tolerance for objectionable content and abusive users. Objectionable content includes content that is harassing, threatening, hateful, discriminatory, sexually explicit, violent or defamatory, spam, and content that infringes the rights of others. We may remove such content without notice and suspend or permanently ban the accounts responsible.
Reporting and Blocking. You can report any message, comment, job listing, profile or audio room that you believe violates these Terms using the Report option in the app, and you can block any member at any time; content from blocked members is hidden from you. Our moderation team reviews reports within 24 hours and takes appropriate action, which may include removing the content and banning the user who posted it.
LongevityDocs may review, restrict, or remove content and suspend or terminate access for violations of these Terms or to address legal, security, or safety concerns. Except as required by applicable law or expressly agreed in writing, LongevityDocs does not undertake to review every communication, verify every clinical statement, or identify every error or harmful recommendation. Moderation does not constitute clinical supervision or approval of content. Any action involving PHI remains subject to the applicable BAA and applicable law.
The Service operates on a token-based usage model for AI features, with limits that reset periodically. Access to specific features — including Communities, Practice dashboards, and advanced AI capabilities — is determined by your subscription tier. LongevityDocs™ reserves the right to adjust usage limits at any time. Abusive or excessive usage may result in temporary or permanent suspension of access without prior notice.
12.1 Ownership. As between LongevityDocs and Users, LongevityDocs and its licensors retain all rights in the software, platform architecture, proprietary AI models, designs, trademarks, and content owned or licensed by LongevityDocs and made available through the Service (“LongevityDocs Materials”). These include the CLD curriculum, lectures, slides, assessments, question banks, recordings, Lexicon compilations, curated research materials, and training materials, to the extent owned or licensed by LongevityDocs. Except for the permissions expressly granted in these Terms, no intellectual property rights are transferred to Users.
12.2 Limited License. Subject to compliance with these Terms and applicable subscription or program requirements, LongevityDocs grants you a limited, nonexclusive, nontransferable, nonsublicensable license to access and use the Service and LongevityDocs Materials for your professional education, internal practice operations, and authorized patient-care activities. Downloads, copying, and sharing are permitted only where expressly authorized by the Service, these Terms, or LongevityDocs in writing. This license does not permit resale, redistribution, or making the Service or LongevityDocs Materials available to unauthorized persons.
12.3 Restrictions on Use. Except as expressly authorized in writing or permitted by applicable law notwithstanding these restrictions, you may not:
These restrictions do not prohibit applying knowledge acquired through the Service in your professional practice or using clinical outputs as permitted below.
12.4 Trademarks and Credentials. LongevityDocs names, logos, designations, badges, and other brand identifiers may not be used without prior written permission, except as expressly permitted under the “Certification Requirements and Use of Credentials” section. You may not imply an affiliation, sponsorship, endorsement, or accreditation that LongevityDocs has not expressly authorized.
12.5 User Content and Patient Records. You retain any ownership rights you hold in content you submit. Nothing in this Section transfers ownership of patient records to LongevityDocs or limits patients’ or other parties’ rights under applicable law. LongevityDocs’ rights to process or use submitted content are governed by the other applicable provisions of these Terms and the BAA. No license in this Section expands LongevityDocs’ permitted uses or disclosures of PHI.
12.6 Clinical Outputs. Subject to these Terms, applicable law, and third-party rights, you may use, copy, adapt, incorporate into patient records, and share with authorized recipients patient-specific notes, summaries, care plans, and communications generated for you through authorized features. To the extent LongevityDocs holds intellectual property rights in those outputs, it grants you a nonexclusive, worldwide, royalty-free license for those purposes that survives termination of your account. Such use remains subject to the clinical-review and verification requirements in these Terms.
Outputs may not be unique, and other Users may receive similar outputs. LongevityDocs does not represent that every output is eligible for copyright protection or that you acquire exclusive rights in it. Permission to use clinical outputs does not authorize extraction or redistribution of underlying LongevityDocs Materials.
12.7 Feedback. If you voluntarily provide suggestions or feedback about the Service, you grant LongevityDocs a nonexclusive, worldwide, perpetual, irrevocable, royalty-free license to use and incorporate that feedback into its products and services without further approval or compensation. This license does not apply to PHI, patient records, confidential information, or independently developed materials merely included with the feedback, and does not transfer ownership of your underlying materials.
Your use of the Service is also governed by our Privacy Policy, which is incorporated into these Terms by reference. By using the Service, you also agree to the Privacy Policy.
If you are a California resident, you have rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), including the right to know, delete, correct, and opt out of sale or sharing of your personal information. LongevityDocs does not sell or share personal information for cross-context behavioral advertising. To exercise your California rights, contact support@longevitydocs.org with subject line “California Privacy Request.”
If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you have rights under the General Data Protection Regulation (GDPR) or applicable equivalent legislation, including rights of access, rectification, erasure, portability, and objection. LongevityDocs™, LLC is the data controller. International data transfers to the United States are conducted subject to appropriate safeguards including Standard Contractual Clauses where required.
To the extent permitted by applicable law, you agree to indemnify, defend, and hold harmless LongevityDocs and its officers, directors, employees, and affiliates against third-party claims and resulting damages, liabilities, and reasonable costs and attorneys’ fees, to the extent arising from: (a) your material breach of these Terms; (b) your unlawful use or misuse of the Service or its outputs; (c) your unauthorized submission or disclosure of information, including failure to obtain legally required consents or authorizations; (d) infringement of third-party rights through content you submit; or (e) your negligent or wrongful acts or omissions in providing patient care in connection with your use of the Service.
This obligation does not apply to the extent a claim arises from LongevityDocs’ negligence, willful misconduct, breach of these Terms or the applicable BAA, or violation of law.
LongevityDocs will promptly notify you of any claim, provided that delayed notice relieves you of your obligations only to the extent you are materially prejudiced by the delay. You will control the defense using counsel reasonably acceptable to LongevityDocs, and LongevityDocs will reasonably cooperate at your expense. LongevityDocs may participate in the defense through separate counsel at its own expense. You may not settle a claim in a manner that admits fault by, imposes any payment or other obligation on, or fails to fully release an indemnified party without that party’s prior written consent, not to be unreasonably withheld.
Disclaimer of Warranties. Except as expressly provided in these Terms, the applicable BAA, or another written agreement with LongevityDocs, and to the maximum extent permitted by applicable law, the Service and its content and outputs are provided “as is” and “as available.” LongevityDocs disclaims all warranties, express, implied, or statutory, including warranties of merchantability, fitness for a particular purpose, title, and non-infringement. LongevityDocs does not warrant that the Service or its outputs will be accurate, complete, current, clinically appropriate for a particular patient, uninterrupted, or error-free, or that use will produce any particular clinical or business outcome.
Excluded Damages. To the maximum extent permitted by applicable law, LongevityDocs and its officers, directors, employees, and affiliates will not be liable for indirect, incidental, special, consequential, exemplary, or punitive damages, or for lost profits, lost revenues, loss of data, or business interruption, arising out of or relating to these Terms or the Service, even if advised of the possibility of such damages.
Aggregate Liability Cap. To the maximum extent permitted by applicable law, the aggregate liability of LongevityDocs and its officers, directors, employees, and affiliates for all claims arising out of or relating to these Terms or the Service will not exceed the greater of (a) the fees paid to LongevityDocs for the Service by the User or the organization on whose behalf the User accesses the Service during the twelve months preceding the first event giving rise to liability, or (b) $100. Multiple claims or claims by multiple Users within the same organization will not increase this aggregate limit. The exclusions and limitations in this Section apply regardless of the theory of liability, including contract, warranty, tort (including negligence), or otherwise, and even if a limited remedy fails of its essential purpose.
Applicable Law and BAA. Nothing in this Section excludes or limits liability that cannot lawfully be excluded or limited. This Section does not relieve either party of its obligations under applicable law or the applicable BAA. Subject to applicable law, the exclusions and limitations in this Section apply to claims arising under the BAA unless the BAA expressly provides otherwise. If an express provision of the BAA conflicts with this Section, that provision of the BAA controls.
LongevityDocs™ reserves the right to update or modify these Terms at any time. Material changes will be communicated via email or a notice within the Service. Continued use of the Service following the effective date of any modification constitutes acceptance of the revised Terms. If you do not agree to a modification, you must discontinue use of the Service.
These Terms are governed by New York law. Unless applicable law requires otherwise, disputes must be brought exclusively in the state courts in New York County or the federal courts of the Southern District of New York, and each party consents to their jurisdiction.
These Terms and incorporated documents constitute the entire agreement concerning the Service, subject to any separate written agreement between the parties. The BAA controls any conflict concerning PHI. If a provision is unenforceable, the remaining provisions remain effective. Failure to enforce a provision does not waive it. Provisions intended by their nature to survive termination will remain effective.
For questions about these Terms, data practices, or opt-out requests:
We will respond to all verifiable requests within 30 days, or within the timeframe required by applicable law.
Conditional Application. This Business Associate Addendum (“BAA”) is incorporated into the LongevityDocs Terms and Conditions (“Terms”). It applies to the extent LongevityDocs creates, receives, maintains, or transmits Protected Health Information (“PHI”) on behalf of a Customer in a capacity that makes LongevityDocs a business associate or subcontractor under HIPAA. Hippo Clinic, the Clinic Module, and ROUNDS are the only features authorized for submission of PHI.
Acceptance of the Terms constitutes acceptance of this BAA where applicable. An individual accepting on behalf of an organization represents that they have authority to bind that organization. This BAA does not itself authorize disclosure of PHI to other members or recipients. If the Terms conflict with this BAA regarding PHI, this BAA controls.
1.1 Parties. This BAA is between LongevityDocs™, LLC (“Business Associate”) and the individual practitioner or organization identified as the contracting customer in the account registration or applicable written services agreement (“Customer”). Customer acts as a covered entity or as a business associate of a covered entity, as applicable. When Customer is a business associate, LongevityDocs acts as its subcontractor business associate. Together, LongevityDocs and Customer are the “Parties.”
1.2 Services. “Services” means the services provided by LongevityDocs under the Terms and any applicable written services agreement between the Parties, including authorized PHI processing through Hippo Clinic, the Clinic Module, and ROUNDS.
1.3 HIPAA Definitions. “HIPAA Rules” means the Privacy, Security, Breach Notification, and Enforcement Rules at 45 CFR Parts 160 and 164, as amended. Terms used but not defined in this BAA, including “Breach,” “business associate,” “covered entity,” “Designated Record Set,” “Electronic Protected Health Information” or “ePHI,” “Individual,” “Required By Law,” “Secretary,” “Security Incident,” “Subcontractor,” and “Unsecured PHI,” have the meanings assigned in the HIPAA Rules.
1.4 PHI. For purposes of this BAA, PHI and ePHI are limited to information received from, or created, received, maintained, or transmitted by Business Associate on behalf of, Customer in connection with the Services. Other capitalized terms have the meanings assigned in the Terms.
2.1 Permitted Uses, Disclosures, and Safeguards. Business Associate may use or disclose PHI only as necessary to provide the Services on behalf of Customer, as otherwise expressly permitted by this BAA, or as Required By Law. Business Associate will not use or disclose PHI in a manner that would violate the HIPAA Privacy Rule if done by Customer, except for permitted management and administration activities described below.
Business Associate may use PHI as necessary for its proper management and administration or to carry out its legal responsibilities. Disclosures for those purposes are permitted only where Required By Law or where Business Associate obtains reasonable assurances from the recipient that the information will remain confidential, will be used or further disclosed only as Required By Law or for the purpose for which it was disclosed, and that the recipient will notify Business Associate of any known breach of confidentiality.
Business Associate will establish, maintain, and use reasonable and appropriate administrative, physical, and technical safeguards to protect the confidentiality, integrity, and availability of ePHI and prevent unauthorized use or disclosure of PHI.
De-Identification and Model Improvement. Customer authorizes Business Associate to use PHI to create de-identified information in accordance with 45 CFR §164.514(a)–(c), using the Safe Harbor or Expert Determination method, as applicable. The de-identification process remains subject to this BAA’s safeguards. Only after the information satisfies those requirements and is no longer PHI may Business Associate use it to train, fine-tune, evaluate, validate, and improve AI models used in LongevityDocs products and services, subject to applicable law, applicable opt-out requests under the Terms, and any additional written restrictions agreed with Customer.
Business Associate will not use PHI to train or fine-tune AI models and will contractually prohibit its Subcontractors from doing so. Processing PHI to provide the Services as otherwise permitted by this BAA is not prohibited by this paragraph.
Business Associate will not attempt to re-identify de-identified information. Any service provider receiving such information must be contractually prohibited from re-identifying it or using it for its own purposes, including training or improving its own or other customers’ models.
Except for the de-identification and subsequent uses expressly authorized above, this BAA does not independently authorize use of Customer’s PHI for research, public-health activities, data aggregation across customers, or the creation or use of limited data sets for those purposes. Any such activity requires a separate written agreement with Customer and compliance with applicable law.
2.2 Breach and Incident Reporting. Business Associate will report to Customer, without unreasonable delay and in no event later than thirty calendar days after discovery: (a) any use or disclosure of PHI not permitted by this BAA; (b) any Breach of Unsecured PHI; and (c) any Security Incident of which Business Associate becomes aware, subject to the provision concerning Unsuccessful Security Incidents below. Discovery of a Breach will be determined in accordance with 45 CFR §164.410(a)(2).
For a Breach, Business Associate will provide, to the extent possible, identification of each Individual whose Unsecured PHI was or is reasonably believed to have been accessed, acquired, used, or disclosed. Business Associate will also provide other available information Customer needs to satisfy its notification obligations under 45 CFR §164.404(c), including the nature and timing of the Breach, the types of information involved, recommended protective steps, mitigation measures, and an appropriate contact for further information. Information not available with the initial report will be provided promptly as it becomes available.
Business Associate will take prompt action to mitigate, to the extent practicable, known harmful effects and will take further action required by applicable law.
The Parties acknowledge that routine unsuccessful attempts to access systems may occur. This paragraph constitutes notice of those “Unsuccessful Security Incidents,” and separate notice is not required for each occurrence. These include unsuccessful log-on attempts, port scans, pings, and similar attacks that do not result in unauthorized access, use, or disclosure of PHI or materially impair the integrity or availability of ePHI. An incident affecting the integrity or availability of ePHI is not excluded from reporting merely because no information was disclosed.
2.3 Subcontractors. Business Associate will ensure that Subcontractors that create, receive, maintain, or transmit PHI on its behalf enter into written agreements imposing the same applicable restrictions, conditions, and requirements that apply to Business Associate under this BAA, including compliance with the HIPAA Security Rule for ePHI, as required by 45 CFR §§164.502(e)(1)(ii) and 164.308(b)(2).
2.4 Access and Amendments. Where Business Associate maintains PHI in a Designated Record Set, it will, at Customer’s request and in the time and manner reasonably requested by Customer, make that PHI available to Customer or, as directed by Customer, to an Individual, as necessary to satisfy 45 CFR §164.524. Business Associate will make amendments as directed or agreed to by Customer as necessary to satisfy 45 CFR §164.526.
2.5 Accounting and Records. Business Associate will make available to Customer the information necessary to provide an accounting of disclosures under 45 CFR §164.528. Business Associate will make its internal practices, books, and records relating to the use and disclosure of PHI received from, or created or received on behalf of, Customer available to the Secretary for purposes of determining compliance with the HIPAA Rules. Any contractual confidentiality or security requirements will not restrict access required by law. Requests by Customer for such records remain subject to reasonable confidentiality and security requirements.
2.6 Responsibility for Patient Requests. Customer is responsible for evaluating and responding to Individuals’ requests to exercise rights under HIPAA concerning PHI processed on Customer’s behalf. Except as required by applicable law or expressly agreed in writing, Business Associate is not responsible for independently determining whether to grant or deny such requests and may refer Individuals to Customer. Nothing in this paragraph limits Business Associate’s obligations under Sections 2.4–2.5 of this BAA or applicable law.
2.7 Sale and Marketing Restrictions. Business Associate will comply with applicable HIPAA restrictions concerning the sale of PHI and uses or disclosures of PHI for marketing.
3.1 Privacy Practices, Permissions, and Restrictions. Customer will notify Business Associate of:
Customer will comply with applicable law and obtain any patient permissions, authorizations, or consents legally required to provide PHI to Business Associate and permit the processing contemplated by this BAA.
3.2 Permissible Requests. Customer will not request that Business Associate use or disclose PHI in a manner that would violate the HIPAA Rules if performed by Customer. Requests will comply with applicable minimum necessary requirements, except where those requirements do not apply.
The indemnification and limitations of liability provisions in the Terms govern the Parties’ performance under this BAA, to the extent permitted by applicable law. They do not relieve either Party of its obligations under the HIPAA Rules.
5.1 Effective Date and Duration. This BAA becomes effective upon Customer’s acceptance of the Terms if the Services then involve Business Associate’s processing of PHI on Customer’s behalf. If that processing begins later, this BAA becomes effective when it begins. No separate order form or signature is required where Customer has validly accepted the Terms.
This BAA continues for the duration of the applicable PHI-processing relationship unless terminated as provided below. Obligations concerning retained PHI survive termination as specified in Section 5.3.
5.2 Termination for Cause. If either Party determines that the other has materially breached this BAA, the nonbreaching Party may terminate this BAA and the affected Services. The nonbreaching Party may, but is not required to, provide an opportunity to cure where permitted by applicable law.
5.3 Effect of Termination. Upon termination, Business Associate will return or destroy all PHI received from Customer, or created or received on Customer’s behalf, that Business Associate maintains in any form, including PHI held by its Subcontractors or agents, and retain no copies except where return or destruction is infeasible.
Where return or destruction is infeasible, Business Associate will:
Nothing in this BAA creates contractual rights for any third party against either Party. This provision does not limit rights provided by applicable law.
References to the HIPAA Rules mean those rules as amended. Ambiguities will be interpreted to permit compliance with the HIPAA Rules. This BAA supersedes prior agreements between the Parties concerning its subject matter, except where a later written agreement expressly provides otherwise. If the Terms conflict with this BAA regarding PHI, this BAA controls.
The Parties will amend this BAA as necessary to comply with changes in the HIPAA Rules within the applicable compliance period.
Except to the extent preempted by federal law, this BAA is governed by the laws of the State of New York.
Obligations concerning retained PHI and provisions that by their nature are intended to continue after termination survive termination of this BAA.