Terms of Service

By accessing or using the UM-AI® platform ("Service"), you ("User," "you," or "your") agree to be bound by these Terms of Service ("Terms"). If you do not agree to these Terms, do not access or use the Service.

These Terms constitute a legal agreement between you and SSP Development LLC ("Company," "we," "us," or "our"). Your use of the Service is also governed by our Privacy Policy, which is incorporated by reference into these Terms.

UM-AI® is an AI-powered utilization management platform designed to assist healthcare organizations in evaluating medical consultation requests. The Service provides:

• AI-driven clinical decision support across 55 medical specialties using OpenAI GPT-4o
• Evidence-based evaluation using database-driven medical protocols
• Real-time analytics, reporting, and AI learning engine for continuous improvement
• Multi-tenant architecture with role-based access control (User, Manager, Super Admin, UMdirector)
• EHR integration through VIM Canvas SDK for seamless clinical workflow
• HIPAA-compliant infrastructure and data handling
• Medical imaging utilization management module

3.1 Eligibility

You must:

• Be at least 18 years old
• Be a licensed healthcare professional or authorized healthcare organization representative
• Have the legal authority to enter into these Terms
• Comply with all applicable laws and regulations

3.2 Account Registration

• Provide accurate, complete, and current information
• Maintain the confidentiality of your account credentials
• Notify us immediately of any unauthorized account access
• Accept responsibility for all activities under your account
• Provide your clinical role and office location for organizational tracking

You may use the Service solely for:

• Legitimate healthcare utilization management purposes
• Clinical decision support within your scope of practice
• Generating analytics and reports for your organization
• Training and educational purposes related to utilization management

You may NOT use the Service to:

• Replace professional medical judgment or clinical decision-making
• Provide direct patient care or treatment recommendations
• Violate any applicable laws, regulations, or professional standards
• Access or attempt to access another organization's data
• Reverse engineer, decompile, or attempt to extract source code
• Interfere with or disrupt the Service's functionality
• Upload malicious code, viruses, or harmful content
• Share account credentials with unauthorized persons

7.1 HIPAA Compliance

• We execute Business Associate Agreements (BAAs) with covered entities
• All PHI is handled in accordance with HIPAA regulations
• Users must ensure they have proper authorization to share PHI

7.2 Data Ownership

• You retain ownership of your organization's data
• We may use aggregated, de-identified data to improve our AI models
• We do not claim ownership of any PHI or clinical data

7.3 PHI Handling — Vim Marketplace User-Level Activation

UM-AI is distributed in the Vim Marketplace at the individual clinician (user) level. Each clinician installs and activates UM-AI inside their own EHR session independently of any organization-wide enrollment. The clinician — not the covered entity — is the party who accepts these Terms and the Privacy Policy at sign-up, and that acceptance is the legal basis for every PHI exchange that subsequently occurs through the Vim Canvas widget. The following terms govern those exchanges:

• What we receive: When you (the clinician) open a patient chart and invoke UM-AI from the Vim Canvas sidebar, the Vim SDK forwards to UM-AI the structured clinical context the EHR has authorized you to view — patient demographics, the active referral or imaging order, primary and secondary diagnoses (ICD-10), problem list, ordering provider identity, insurance plan name, and free-text reasons or notes attached to the order. We do not pull data outside the chart you are actively viewing, and we do not pull data from charts you have not opened.
• How we process it: The clinical context is forwarded over TLS 1.2+ to UM-AI's evaluation service, where the GPT-4o model produces an approve/deny recommendation with a written justification. PHI is held in process memory only for the duration of the request. We do not write the patient name, date of birth, free-text symptoms, free-text notes, or any other free-text PHI field to long-term storage. The audit log records only the MRN / account number, ICD-10 code, requested specialty or imaging study, and the AI decision — sufficient for billing reconciliation and clinical-decision audit.
• Authority you confirm at sign-up: By accepting the PHI Handling disclosure during registration you affirm, in your own capacity as the licensed clinician operating the widget, that you have a legitimate clinical relationship with each patient whose chart you submit to UM-AI and that you are permitted to disclose that patient's PHI to UM-AI for utilization-management purposes under HIPAA's Treatment, Payment, or Healthcare Operations exception, or under a separate written authorization from the patient. This affirmation is your individual act; it does not require, and is not contingent on, any pre-existing organizational Business Associate Agreement.
• Business Associate framework (optional, not a precondition): SSP Development LLC will execute a Business Associate Agreement with any covered entity that requests one — the BAA template is published openly at /baa and may be countersigned at any time before, during, or after user-level activation. Execution of an organizational BAA is NOT a prerequisite for an individual clinician to use UM-AI through the Vim widget; the clinician-level acceptance of these Terms and the Privacy Policy at sign-up is itself sufficient authority for the PHI exchange. Where a BAA is in place it supersedes any conflicting term in this section as between the organization and SSP Development LLC.
• Right to revoke: You may withdraw your user-level activation at any time by uninstalling the UM-AI widget from the Vim Marketplace, by deleting your UM-AI account from the in-app settings page, or by emailing privacy@umgpt.ai. Revocation stops all future PHI processing immediately; it does not retroactively erase audit-log entries we are required to retain for HIPAA §164.316.
• Sub-processors that may receive PHI: the OpenAI GPT-4o inference endpoint (under OpenAI's BAA, no training on UM-AI traffic), Neon Postgres (audit-log storage, BAA on file), Replit autoscale runtime (compute, BAA on file). The full sub-processor list is published in the Privacy Policy and Trust Center.

The Service, including all software, AI models, algorithms, and content, is owned by SSP Development LLC and is protected by copyright, trademark, and other intellectual property laws. You are granted a limited, non-exclusive, non-transferable license to use the Service in accordance with these Terms.

Billing Model

UM-AI offers multiple subscription plans for organizations and individual providers. Specific plan details, pricing, and included usage are described on our Pricing page.

General Billing Terms (all plans):

• All fees are non-refundable unless otherwise stated in your plan agreement.
• Subscriptions are billed automatically on a monthly cycle.
• Where applicable, usage overages are charged automatically at the end of each billing cycle.
• Unused prepaid balances do not carry over to the next billing period.
• Price changes require 30 days advance written notice.
• Accounts may be suspended after 30 days of non-payment.

Free Trial:

Eligible new users may receive a free trial with full access to AI evaluation capabilities. Trial limits and eligibility are described on the Pricing page. No payment information is required during the trial period.

Important Terms:

• No Refunds: Fees paid are non-refundable unless otherwise specified in your plan agreement.
• No Credits: Unused prepaid balance does not carry over to the next billing period.
• Automatic Billing: Where applicable, overages are charged automatically at the end of each billing cycle.
• Price Changes: 30 days advance written notice required.
• Non-Payment: Accounts may be suspended after 30 days of non-payment.

TO THE MAXIMUM EXTENT PERMITTED BY LAW, SSP DEVELOPMENT LLC SHALL NOT BE LIABLE FOR:

• Any indirect, incidental, special, or consequential damages
• Any damages arising from clinical decisions or patient care
• Any losses due to service interruptions or data loss
• Any damages exceeding the amount paid for the Service in the preceding 12 months

You agree to indemnify and hold harmless SSP Development LLC from any claims, damages, or expenses arising from your use of the Service, violation of these Terms, or any clinical decisions made using the Service.

Either party may terminate these Terms at any time. We may suspend or terminate your access immediately for violation of these Terms. Upon termination, you must cease all use of the Service, and we will provide you with your data in a standard format.