Version 3.4 - June 16, 2026
This Master Subscription Agreement (the "Agreement") is entered into as of the Effective Date set forth on the Order Form (Exhibit A) by and between:
Marketing Loop LLC, a Nevada limited liability company, with notice address legal@casemgmt.io ("Provider", "CaseMgmt", "we", "us", or "our"); and
The customer identified on the Order Form (Exhibit A) ("Customer", "you", or "your").
Provider and Customer are each a "Party" and together the "Parties".
1.1 "Affiliate" means any entity that directly or indirectly controls, is controlled by, or is under common control with the subject entity.
1.2 "Authorized User" means an employee, contractor, or agent of Customer authorized by Customer to access and use the Service.
1.3 "Confidential Information" means non-public information disclosed by one Party to the other, whether oral, written, or visual, that is identified as confidential or that a reasonable person would understand to be confidential given the nature of the information and the circumstances of disclosure. Customer Data is Customer's Confidential Information. The Service, including its source code, architecture, and technology, is Provider's Confidential Information.
1.4 "Customer Data" means electronic data and information submitted by or for Customer to the Service or generated within the Service for Customer, including patient records, case files, billing records, time entries, documents, and notes.
1.5 "Documentation" means the user-facing documentation and help materials for the Service, as updated from time to time and made available within the Service or at a URL provided by Provider.
1.6 "HIPAA" means the Health Insurance Portability and Accountability Act of 1996, as amended by the HITECH Act of 2009, and all regulations promulgated thereunder, including 45 C.F.R. Parts 160 and 164.
1.7 "Order Form" means a written or electronic order document referencing this Agreement that identifies the specific subscription, fees, term, and any custom terms applicable to Customer. The Order Form attached as Exhibit A is incorporated by reference.
1.8 "PHI" means "protected health information" as defined under HIPAA, that Provider receives from or on behalf of Customer in connection with providing the Service.
1.9 "Service" means the multi-tenant Software-as-a-Service platform offered by Provider under the name "CaseMgmt" and accessible via casemgmt.io and any subdomains thereof, including all features, modules, APIs, and Documentation, as updated from time to time.
1.10 "Subprocessor" means any third party engaged by Provider that processes Customer Data in the course of providing the Service (for example, infrastructure providers, transactional email providers, and fax providers).
2.1 Provision of the Service. Subject to Customer's compliance with this Agreement and timely payment of all fees, Provider shall make the Service available to Customer and its Authorized Users during the Term in accordance with the Order Form and Section 14 (Service Availability and Support).
2.2 Nature of the Service. The Service is a multi-tenant Software-as-a-Service platform operated, hosted, and maintained by Provider. Customer receives access to the Service as it exists from time to time. Customer does not receive a copy of the source code, infrastructure, build artifacts, or proprietary technology used to deliver the Service. The Service is provided as a subscription, not as work-for-hire or custom development.
2.3 Updates and Improvements. Provider may update, improve, modify, add to, or replace features of the Service from time to time in its sole discretion, provided that no update shall materially reduce the core functionality Customer has subscribed to without 30 days prior written notice. Provider shall use reasonable efforts to maintain backwards compatibility for documented API endpoints.
2.4 Customer Responsibility for Authorized Users. Customer is responsible for the acts and omissions of its Authorized Users as if they were Customer's own. Customer shall ensure that each Authorized User has reviewed and is bound by the Service's published terms of use. Customer shall not share account credentials between Authorized Users; each individual must have a separate login.
2.5 Acceptable Use. Customer shall not, and shall not permit any Authorized User to: (a) reverse engineer, decompile, or attempt to derive the source code of the Service; (b) circumvent any security or access controls; (c) use the Service to store or transmit any data unlawfully obtained or that Customer lacks the legal right to disclose to Provider as Customer's business associate; (d) introduce malicious code into the Service; (e) interfere with or disrupt the integrity or performance of the Service; (f) use the Service to send spam or unlawful communications; or (g) resell, lease, or sublicense the Service to a third party without Provider's written consent.
2.6 Trial and Demo Access. If Provider provides Customer with trial or evaluation access, such access is provided "AS IS" without warranties or SLA commitments, and may be terminated at any time at Provider's discretion. Customer Data created during a trial is retained if Customer converts to a paid subscription; otherwise Provider may retain or delete such data in its discretion, and any retained data remains protected under this Agreement (and Exhibit B, with respect to PHI) for as long as Provider retains it.
3.1 Subscription Fees. Customer shall pay the subscription fees set forth in the Order Form. Fees are stated in U.S. Dollars and are exclusive of all applicable taxes.
3.2 User Counts and Adjustments. Subscription charges adjust automatically with Customer's number of active Authorized Users. The Order Form sets the number of Authorized Users included in the base fee and the per-seat rates for additional users. If at any time the active Authorized User count exceeds the number included in the base fee, each additional user is billed at the applicable per-seat rate stated in the Order Form, prorated to the next regular billing date. If Customer deactivates Authorized Users, the corresponding per-seat charges decrease beginning with the next billing cycle; Provider does not issue mid-cycle refunds or credits for deactivated seats. Seat pricing may vary by user role, and a user's applicable rate may reflect the highest-priced role for which that user holds effective permissions in the Service. The active Authorized User count is determined by the Service and is viewable by Customer within the Service at any time.
3.3 Payment Terms. Unless otherwise specified in the Order Form, fees are billed monthly in advance, due on the day of each month identified in the Order Form, by ACH or another payment method specified in the Order Form. Payment shall be made without setoff or deduction.
3.4 Late Payment. If Customer fails to pay any undisputed fee by the due date, interest will accrue at the lesser of 1.5% per month or the maximum rate permitted by law, calculated from the due date until paid. Customer shall reimburse Provider for reasonable collection costs, including attorneys' fees, incurred in collecting overdue amounts.
3.5 Disputed Charges. Customer shall notify Provider in writing of any disputed fee within 15 days of the invoice date. The undisputed portion of any invoice remains due. The Parties shall work in good faith to resolve disputed amounts within 30 days.
3.6 Price Changes. Provider may modify subscription fees upon at least sixty (60) days prior written notice to Customer. Customer may terminate this Agreement before the new fees take effect by providing written notice within 30 days of Provider's notice; in such case the modified fees shall not apply and the Agreement shall terminate at the end of the then-current billing cycle. Continued use of the Service after the effective date of a fee change constitutes acceptance of the new fees.
3.7 Taxes. Fees do not include taxes. Customer is responsible for all sales, use, value-added, withholding, and similar taxes, excluding taxes on Provider's net income.
3.8 Returned Payments. Customer shall reimburse Provider for any returned ACH, NSF, or chargeback fees actually incurred.
3.9 Automatic Recurring Billing; Payment Processing.
(a) Recurring Charge Authorization. If Customer provides a payment method (credit card or ACH/bank account) through the Service's billing portal, Customer authorizes Provider, acting through its payment processor, to automatically charge that payment method on each billing date for all recurring subscription fees then due, including prorated additional-user fees under Section 3.2, until this Agreement is terminated and all accrued fees are paid. Customer may update or replace its payment method at any time through the billing portal.
(b) Payment Processor. Subscription payments are processed by Stripe, Inc. Provider does not store full payment card numbers or bank account credentials on its own systems; payment credentials are collected, stored, and processed by Stripe subject to Stripe's terms of service and PCI-DSS controls. Billing contact information shared with Stripe does not include PHI.
(c) Failed Charges. If an automatic charge fails, Provider may retry the charge and shall notify Customer. A failed charge does not relieve Customer of its payment obligations, and Sections 3.4 (Late Payment) and 6.1 (Suspension for Non-Payment) apply.
(d) Invoiced Billing. If the Order Form specifies invoiced billing instead of automatic charges, Customer shall pay each invoice by its due date using the method stated on the Order Form.
4.1 Initial Term. This Agreement begins on the Effective Date and continues for the initial term specified in the Order Form (the "Initial Term"). If no Initial Term is specified, the Initial Term is twelve (12) months.
4.2 Renewal. Following the Initial Term, this Agreement will automatically renew for successive renewal terms of equal length to the Initial Term (each a "Renewal Term", together with the Initial Term, the "Term"), unless either Party gives written notice of non-renewal at least thirty (30) days before the then-current term expires.
4.3 Month-to-Month Subscriptions. If the Order Form specifies a month-to-month subscription, either Party may terminate this Agreement at the end of any monthly billing cycle by giving written notice at least thirty (30) days before the desired termination date.
5.1 Termination for Material Breach. Either Party may terminate this Agreement upon thirty (30) days written notice if the other Party materially breaches this Agreement and fails to cure the breach within the 30-day notice period. The following are deemed material breaches by Provider that entitle Customer to immediate termination without a cure period:
(a) Unauthorized access to or use of Customer Data by Provider in violation of Section 8;
(b) Intentional or knowing deletion of Customer Data by Provider in violation of this Agreement;
(c) Direct contact or solicitation of Customer's patients by Provider using Customer Data in violation of Section 8.4;
(d) An uncured HIPAA breach by Provider as defined in Exhibit B (HIPAA BAA);
(e) Provider's assignment of this Agreement in violation of Section 17.7.
5.2 Termination for Insolvency. Either Party may terminate this Agreement immediately by written notice if the other Party becomes insolvent, files for bankruptcy, makes a general assignment for the benefit of creditors, ceases operations, or has a receiver appointed for substantially all of its assets.
5.3 Termination for Convenience.
(a) By Customer. Customer may terminate this Agreement for convenience at the end of any monthly billing cycle within the Initial Term or any Renewal Term by giving Provider thirty (30) days prior written notice; however, prepaid fees are non-refundable except as expressly stated in Section 5.4.
(b) By Provider. Provider may terminate this Agreement for convenience by giving Customer thirty (30) days prior written notice. In such case Provider shall refund any prepaid fees attributable to the period after the effective date of termination, and Customer's data export rights under Section 5.4(a) apply.
5.4 Effect of Termination.
(a) Data Export. Within thirty (30) days following termination or expiration of this Agreement, Provider shall, upon Customer's written request, provide Customer with one complete export of Customer Data in a standard, non-proprietary format (CSV, JSON, or SQL dump) at no additional charge, including original document files as described in Exhibit D. After the 30-day post-termination period, Provider may delete Customer Data in accordance with Section 5.4(c) and is no longer obligated to provide further export.
(b) Surviving Obligations. Sections concerning fees accrued before termination, indemnification, limitation of liability, confidentiality, intellectual property, governing law, dispute resolution, and any other provision that by its nature should survive termination, shall survive.
(c) Deletion of Customer Data. Within ninety (90) days following termination and any export under Section 5.4(a), Provider shall delete Customer Data from the live Service, subject to the following permitted retention: (i) Customer Data residing in routine backups that age out automatically per Provider's standard retention schedule (currently seven (7) days), which shall not be specifically recovered or accessed but allowed to expire in due course; (ii) Customer Data Provider is required to retain by applicable law, regulation, or legal hold; (iii) anonymized or de-identified data as permitted by Section 7.6.
(d) No Source Code or Infrastructure Transfer. For clarity, Provider has no obligation upon termination to provide Customer with source code, build artifacts, infrastructure credentials, or any other proprietary technology used to deliver the Service. Customer's right to the Service is a license, not an ownership interest.
(e) Refunds. If Provider terminates this Agreement for Customer's uncured material breach, no refunds are owed. If Customer terminates for Provider's uncured material breach under Section 5.1, Provider shall refund any prepaid fees attributable to the period after the effective date of termination.
6.1 Suspension for Non-Payment. If Customer's payment is more than fifteen (15) days past due (excluding amounts disputed in good faith under Section 3.5), Provider may suspend (but not delete) Customer's access to the Service after providing Customer with at least five (5) days prior written notice and an opportunity to cure. Suspension does not relieve Customer of its obligation to pay accrued fees.
6.2 Suspension for Security or Legal Risk. Provider may suspend Customer's access immediately if Provider reasonably determines, in its good-faith judgment, that continued access poses a security risk to the Service, other customers, or third parties, or violates applicable law. Provider shall notify Customer as soon as reasonably practicable and shall work in good faith with Customer to restore access once the risk is mitigated.
6.3 No Data Hostage. For the avoidance of doubt, no permitted suspension authorizes Provider to delete Customer Data or to refuse Customer's right to data export under Section 5.4(a).
7.1 Provider IP. Provider retains all right, title, and interest in and to the Service, including all software, source code, object code, design, architecture, algorithms, models, machine-learning weights, documentation, branding, trademarks, and all other intellectual property and proprietary technology comprising or used to deliver the Service, including any updates, improvements, derivatives, or feedback-incorporating modifications thereto. Nothing in this Agreement transfers ownership of any Provider intellectual property to Customer.
7.2 License to Customer. Provider grants Customer a non-exclusive, non-transferable, non-sublicensable, worldwide, revocable license during the Term to access and use the Service for Customer's internal business purposes in accordance with this Agreement and the Order Form.
7.3 Customer IP. Customer retains all right, title, and interest in and to Customer Data and to its name, logo, and other branding.
7.4 Feedback. If Customer provides feedback, suggestions, ideas, or improvement requests to Provider regarding the Service ("Feedback"), Customer grants Provider a perpetual, irrevocable, royalty-free, worldwide license to use the Feedback for any purpose, including to improve the Service. Feedback shall not include Customer Data and Provider shall not be required to attribute Feedback to Customer.
7.5 No Custom Development. This Agreement provides access to the Service as a multi-tenant SaaS platform. No custom development, bespoke modifications, or work-for-hire is included. Any feature development requested by Customer that Provider agrees to perform requires a separately executed Statement of Work, which shall address ownership and licensing of any deliverables specific to that work.
7.6 Anonymized and Aggregated Data. Provider may collect, generate, and use anonymized, aggregated, and de-identified data derived from Customer's use of the Service for purposes including improving the Service, generating analytics, and reporting on platform performance, in each case in compliance with HIPAA's de-identification standards under 45 C.F.R. § 164.514. Provider shall not, under this section, use or disclose PHI in a manner that would identify Customer, Customer's patients, or Customer's other Authorized Users.
8.1 Ownership. As between the Parties, Customer owns all Customer Data, including all PHI uploaded by or on behalf of Customer. Provider claims no ownership interest in Customer Data.
8.2 Provider's Limited License to Customer Data. Customer grants Provider a non-exclusive, royalty-free, worldwide license during the Term to host, store, transmit, process, copy (for backup, redundancy, and disaster-recovery purposes), and display Customer Data solely as necessary to provide and improve the Service in accordance with this Agreement and the HIPAA BAA in Exhibit B.
8.3 Permitted Uses of PHI. Provider's use and disclosure of PHI is governed by Exhibit B (HIPAA Business Associate Agreement). In the event of conflict between the body of this Agreement and Exhibit B with respect to PHI, Exhibit B controls.
8.4 Prohibited Uses. Provider shall not, and shall not permit any Subprocessor to:
(a) Sell, lease, license, or otherwise transfer Customer Data to a third party except as permitted by Exhibit B and Section 15 (Subprocessors);
(b) Use PHI to train Provider's general-purpose machine learning or AI models;
(c) Contact, solicit, or market to Customer's patients, providers, attorneys, adjusters, or other contacts identified within Customer Data, except as expressly authorized by Customer in writing;
(d) Use Customer's name, logo, or other branding in marketing or public materials without Customer's prior written consent, except that Provider may list Customer's name and logo on Provider's website and customer-list materials with format subject to Customer's reasonable approval.
8.5 Security. Provider shall implement and maintain administrative, technical, and physical safeguards designed to protect Customer Data in accordance with HIPAA Security Rule requirements (45 C.F.R. § 164.308, § 164.310, § 164.312) and industry standards, including:
(a) Encryption of Customer Data at rest using AES-256 or equivalent;
(b) Encryption of Customer Data in transit using TLS 1.2 or higher;
(c) Role-based access controls and per-user authentication;
(d) Audit logging of access to PHI;
(e) Periodic encrypted backups stored in infrastructure physically separate from the production database;
(f) A documented incident response plan;
(g) Background screening of Provider personnel with access to PHI, to the extent permitted by applicable law.
8.6 Customer Responsibilities for Data Accuracy. Customer is solely responsible for the accuracy, completeness, and legality of Customer Data, including ensuring that Customer has obtained all consents, authorizations, and rights necessary for Provider to receive and process Customer Data, including PHI, on Customer's behalf as a business associate under HIPAA. Provider is not liable for errors, omissions, or damages caused by inaccurate or incomplete Customer Data.
8.7 Customer Responsibility for Generated Outputs; No Professional Advice. The Service includes features that generate invoices, CMS-1500 and other claim forms, billing and diagnosis codes, batch billing calculations, and payroll figures from Customer-supplied data, rates, and configuration (collectively, "Generated Outputs"). Generated Outputs are tools to assist Customer and do not constitute professional advice. Customer is solely responsible for reviewing and verifying the accuracy, coding, and completeness of all Generated Outputs before they are submitted, filed, paid, or otherwise relied upon. Provider is not a medical billing service, claims clearinghouse, payroll provider, accountant, or tax, legal, or financial advisor, and does not provide professional advice of any kind. Customer is solely responsible for the regulatory and payer compliance of any claim, invoice, or filing it submits (including, without limitation, Medicare and Medicaid rules, payer requirements, and the federal False Claims Act) and for the wage, hour, and tax compliance of any payroll it runs using the Service. Customer shall defend and indemnify Provider against any third-party or governmental claim, audit, fine, or penalty arising from Generated Outputs that Customer submits, files, pays, or relies upon.
9.1 Mutual Obligation. Each Party (as "Recipient") shall (a) hold the other Party's (as "Discloser") Confidential Information in strict confidence, (b) use it only for purposes of performing under this Agreement, and (c) limit disclosure to its employees, contractors, advisors, and Subprocessors who have a legitimate need to know and who are bound by confidentiality obligations no less protective than those in this Agreement.
9.2 Exceptions. Confidential Information does not include information that (a) was rightfully in Recipient's possession without confidentiality obligation before disclosure; (b) becomes generally available to the public without Recipient's breach; (c) is rightfully received from a third party without confidentiality obligation; or (d) is independently developed by Recipient without reference to Discloser's Confidential Information.
9.3 Compelled Disclosure. If Recipient is legally compelled to disclose Confidential Information, it shall (where legally permitted) give Discloser prompt written notice and reasonable cooperation to allow Discloser to seek a protective order.
9.4 Term of Confidentiality. Each Party's obligations under this Section 9 continue for the longer of (a) five (5) years following termination of this Agreement, or (b) for trade secrets and PHI, indefinitely.
10.1 Mutual. Each Party represents and warrants that (a) it has the corporate power and authority to enter into and perform this Agreement; (b) the execution of this Agreement by its signatory has been duly authorized; and (c) its performance under this Agreement will not violate any other agreement to which it is a party or any applicable law.
10.2 Provider's Service Warranty. Provider warrants that during the Term the Service will substantially conform to the Documentation and will be provided in a professional and workmanlike manner. Customer's exclusive remedy and Provider's sole liability for breach of this warranty is for Provider to use commercially reasonable efforts to correct the non-conformity. If Provider fails to do so within thirty (30) days after Customer's written notice, Customer may terminate the affected portion of the Service and receive a refund of prepaid fees attributable to the period after termination.
10.3 Customer's HIPAA Authority. Customer represents and warrants that it is a covered entity or business associate under HIPAA with the authority to engage Provider as a business associate, and that Customer has all rights, consents, and authorizations necessary to provide PHI to Provider for the purposes contemplated by this Agreement.
10.4 Disclaimer. EXCEPT FOR THE EXPRESS WARRANTIES IN THIS SECTION 10, THE SERVICE IS PROVIDED "AS IS" AND "AS AVAILABLE". PROVIDER DISCLAIMS ALL OTHER WARRANTIES, EXPRESS OR IMPLIED, INCLUDING MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, AND ANY WARRANTY ARISING FROM COURSE OF DEALING OR USAGE OF TRADE. PROVIDER DOES NOT WARRANT THAT THE SERVICE WILL BE UNINTERRUPTED, ERROR-FREE, OR FREE FROM ALL SECURITY VULNERABILITIES.
10.5 Electronic Signatures. The Service provides electronic signature and electronic record features intended to support compliance with the federal Electronic Signatures in Global and National Commerce Act (ESIGN) and the Uniform Electronic Transactions Act (UETA). Provider does not warrant that any electronically signed document will be admissible, enforceable, or sufficient for any particular legal, regulatory, or evidentiary purpose, which depends on factors outside Provider's control. Customer is solely responsible for determining whether the Service's electronic signature features are appropriate for Customer's intended use and for verifying signer identity to the extent Customer's use requires.
11.1 Excluded Damages. EXCEPT FOR THE CARVE-OUTS IN SECTION 11.3, IN NO EVENT SHALL EITHER PARTY BE LIABLE FOR ANY INDIRECT, INCIDENTAL, CONSEQUENTIAL, SPECIAL, EXEMPLARY, OR PUNITIVE DAMAGES, OR FOR LOST PROFITS, LOST REVENUE, LOST DATA, OR LOST BUSINESS, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES AND REGARDLESS OF THE THEORY OF LIABILITY.
11.2 Liability Cap. EXCEPT FOR THE CARVE-OUTS IN SECTION 11.3, EACH PARTY'S TOTAL CUMULATIVE LIABILITY ARISING UNDER OR RELATED TO THIS AGREEMENT SHALL NOT EXCEED THE TOTAL FEES PAID OR PAYABLE BY CUSTOMER TO PROVIDER UNDER THIS AGREEMENT IN THE SIX (6) MONTHS IMMEDIATELY PRECEDING THE EVENT GIVING RISE TO THE CLAIM.
11.3 Carve-Outs. The limitations and exclusions in Sections 11.1 and 11.2 do NOT apply to:
(a) Each Party's indemnification obligations under Section 12;
(b) Customer's payment obligations under Section 3;
(c) Breach of confidentiality under Section 9, capped at two times (2x) the annual fees in effect at the time of breach;
(d) Knowing or intentional breach of the HIPAA BAA (Exhibit B) by a Party, capped at two times (2x) the cap in Section 11.2;
(e) A Party's gross negligence or willful misconduct.
11.4 Limitation Allocation. The Parties acknowledge that the fees reflect this allocation of risk and that the limitations and exclusions in this Section 11 are an essential basis of the bargain.
12.1 Indemnification by Provider. Provider shall defend Customer against any third-party claim alleging that the Service, as provided by Provider and used by Customer in accordance with this Agreement, infringes any U.S. patent, copyright, trademark, or trade secret of the third party (an "IP Claim"), and shall indemnify Customer for damages finally awarded by a court of competent jurisdiction (or amounts paid in settlement approved in writing by Provider) for such IP Claim. If the Service becomes, or in Provider's reasonable opinion is likely to become, the subject of an IP Claim, Provider may, at its option: (a) modify the Service to make it non-infringing; (b) obtain a license for Customer's continued use; or (c) terminate the Agreement and refund prepaid fees attributable to the period after termination. Provider's obligations under this Section 12.1 do not apply to claims arising from (i) modification of the Service by anyone other than Provider; (ii) combination of the Service with products or services not provided by Provider; (iii) Customer's continued use of the Service after Provider notifies Customer to stop; or (iv) Customer Data.
12.2 Indemnification by Customer. Customer shall defend Provider against any third-party claim arising from (a) Customer Data, including any allegation that Customer Data violates law, infringes the rights of a third party, or was uploaded without proper authorization; (b) misuse of the Service by Customer or its Authorized Users in violation of this Agreement; (c) credential sharing or unauthorized access resulting from Customer's failure to follow reasonable security practices; or (d) Customer's failure to comply with its obligations as a covered entity or business associate under HIPAA. Customer shall indemnify Provider for damages finally awarded (or settlements approved by Customer) for such claims.
12.3 Indemnification Procedure. The indemnified Party shall (a) promptly notify the indemnifying Party in writing of the claim; (b) give the indemnifying Party sole control of the defense and settlement, provided that no settlement requiring admission of liability or payment by the indemnified Party may be made without the indemnified Party's prior written consent; and (c) reasonably cooperate, at the indemnifying Party's expense.
12.4 Sole Remedy. This Section 12 states each Party's sole liability, and the other Party's exclusive remedy, for third-party claims subject to indemnification.
13.1 Customer-Directed Communications. The Service includes features that send communications to Customer's patients and contacts at Customer's direction, including SMS text messages (for example, form and signature links and notifications) and outbound faxes (for example, CMS-1500 forms and invoices). All such communications are sent on Customer's behalf and at Customer's instruction; Provider acts solely as Customer's service provider in transmitting them.
13.2 Customer Consent Obligations. Customer represents and warrants that, for each recipient to whom Customer directs communications through the Service, Customer has obtained and will maintain all consents and authorizations required by applicable law, including the Telephone Consumer Protection Act (TCPA), the Telemarketing Sales Rule, applicable state telemarketing and text-messaging laws, and applicable fax-marketing laws. Customer shall honor opt-out requests and shall not use the Service to send communications to recipients who have revoked consent.
13.3 Indemnification for Communications Claims. Customer shall defend and indemnify Provider against any third-party claim, regulatory action, fine, or penalty arising from communications sent through the Service at Customer's direction, including claims under the TCPA or analogous state laws, except to the extent caused by Provider's failure to transmit an opt-out that the Service recorded.
13.4 Insurance. Provider maintains commercially appropriate insurance for its business. Upon Customer's written request, Provider may provide a summary of coverage then in effect.
13.5 No Delivery Warranty. Communications features (including SMS, fax, and email) depend on third-party carriers and networks outside Provider's control. Provider does not warrant that any communication will be delivered, delivered on time, or received, and Provider is not responsible for delivery failures or delays or for any deadline (including any claim-filing or other regulatory deadline) that Customer relies on the Service to meet. Where receipt or timeliness matters, Customer is responsible for confirming delivery through independent means.
14.1 Availability. Provider shall use commercially reasonable efforts to make the production Service available at least 99.5% of the time in each calendar month (the "Availability Target"), measured by Provider's monitoring infrastructure and excluding:
(a) Scheduled maintenance windows for which Customer received at least 48 hours prior notice;
(b) Emergency maintenance reasonably required to address security vulnerabilities, with notice provided as soon as practicable;
(c) Outages caused by Customer, Customer's Authorized Users, or Customer's network or equipment;
(d) Outages caused by third-party infrastructure providers (for example, AWS, Stripe, Twilio) for which Provider exercises commercially reasonable diligence in vendor selection and incident response;
(e) Force majeure events under Section 17.4.
14.2 Scheduled Maintenance. Provider shall provide at least 48 hours advance written notice of any planned maintenance affecting Service availability, and shall use commercially reasonable efforts to schedule such maintenance during off-peak hours (defined as between 10:00 PM and 6:00 AM Eastern Time).
14.3 Support and Response Times. Provider shall make customer support available during Provider's normal business hours (Monday through Friday, 9:00 AM to 6:00 PM Eastern Time, excluding U.S. federal holidays). Provider uses good-faith efforts to respond to support requests submitted via Provider's designated channel within the following targets:
| Severity | Description | Initial Response Target |
|---|---|---|
| Critical | Service is fully unavailable to all Authorized Users | Within 4 business hours; outside business hours, as soon as reasonably practicable |
| High | A major feature is unavailable, or material performance degradation is occurring | Within 1 business day |
| Standard | Bugs, questions, configuration assistance, feature requests | Within 2 business days |
The targets above are good-faith service targets, not guaranteed response times; failure to meet a target is not a breach of this Agreement. Resolution times are best-effort and may depend on third-party vendors, complexity of the issue, and Customer cooperation. Provider does not commit to a guaranteed resolution time.
14.4 Data Backups. Provider shall perform automated backups of Customer Data no less than once every 24 hours, with backups encrypted at rest and stored in infrastructure physically separate from the production database (across multiple availability zones within Provider's hosting region). Provider shall maintain the ability to restore Customer Data to a point within the preceding seven (7) days.
14.5 Service Interruptions. The Availability Target is a good-faith operational target, not a guarantee, and failure to meet it is not a breach of this Agreement. Provider is not liable for, and Customer is not entitled to refunds, credits, or other compensation for, interruptions of the Service. As Customer's sole and exclusive remedy for sustained unavailability, if the Service's monthly availability falls below 95.0% in each of two (2) consecutive calendar months (excluding the items in Section 14.1(a) through (e)), Customer may terminate this Agreement upon written notice and shall receive a refund of any prepaid fees attributable to the period after termination.
14.6 Status Reporting. Provider monitors Service availability. Upon Customer's reasonable written request (no more than once per calendar quarter), Provider shall provide a summary of Service availability for the requested prior period within a reasonable time.
15.1 HIPAA. Provider's handling of PHI is governed by the HIPAA Business Associate Agreement attached as Exhibit B, which is incorporated into this Agreement by reference.
15.2 Subprocessors. Provider engages Subprocessors to deliver the Service. A current list of Subprocessors is attached as Exhibit C and is maintained at casemgmt.io/privacy. Provider shall:
(a) Ensure that each Subprocessor that has access to PHI has signed a HIPAA-compliant business associate agreement imposing obligations no less protective than those in Exhibit B;
(b) Remain responsible for Subprocessors' acts and omissions as if they were Provider's own;
(c) Provide Customer with at least 30 days prior written notice (or notice via the public Subprocessor list) of any new Subprocessor with access to PHI, except for emergency replacement of a Subprocessor whose service has been disrupted, in which case notice shall be provided as soon as reasonably practicable.
15.3 Customer Right to Object. If Customer reasonably objects to a new Subprocessor on legitimate compliance grounds, Customer shall notify Provider within 15 days of Provider's notice. The Parties shall work in good faith to resolve the objection. If they cannot, Customer may terminate this Agreement upon 30 days written notice and shall receive a prorated refund of prepaid fees attributable to the period after termination.
15.4 Audit Cooperation. Once per calendar year and not more often (except as required following a security incident or regulatory inquiry), Provider shall, upon reasonable advance written notice, make available to Customer the current SOC 2 Type II report of Provider's hosting infrastructure provider (Amazon Web Services), Provider's HIPAA risk assessment summary, and Provider's information security policies. Customer may not perform on-premise audits of Provider's facilities.
16.1 Informal Resolution. Before initiating any formal legal proceedings (other than for emergency injunctive relief), the Parties shall first attempt to resolve any dispute through good-faith negotiation between authorized representatives for at least fifteen (15) days after written notice of the dispute.
16.2 Binding Arbitration. If the dispute is not resolved through negotiation under Section 16.1, the dispute shall be finally resolved by binding arbitration administered by the American Arbitration Association under its Commercial Arbitration Rules, by a single arbitrator, seated in Clark County, Nevada (with the option of remote/videoconference proceedings by agreement of the Parties). Judgment on the award may be entered in any court of competent jurisdiction. Each Party bears its own attorneys' fees and an equal share of the arbitrator's fees, except as the arbitrator may award under Section 16.5 or applicable law. Either Party may instead bring an individual claim in small-claims court if it qualifies.
16.3 Class Action Waiver. EACH PARTY MAY BRING CLAIMS AGAINST THE OTHER ONLY IN ITS INDIVIDUAL CAPACITY, AND NOT AS A PLAINTIFF OR CLASS MEMBER IN ANY PURPORTED CLASS, CONSOLIDATED, MULTI-PARTY, OR REPRESENTATIVE PROCEEDING. THE ARBITRATOR MAY NOT CONSOLIDATE MORE THAN ONE PARTY'S CLAIMS AND MAY NOT PRESIDE OVER ANY FORM OF CLASS OR REPRESENTATIVE PROCEEDING.
16.4 Equitable Relief. Notwithstanding Sections 16.1 to 16.3, either Party may seek immediate injunctive or other equitable relief in any court of competent jurisdiction to protect its intellectual property rights or to prevent imminent breach of confidentiality, without first attempting informal resolution or mediation.
16.5 Attorneys' Fees. In any legal action brought to enforce or interpret this Agreement, the prevailing Party shall be entitled to recover its reasonable attorneys' fees and court costs from the non-prevailing Party.
17.1 Independent Contractors. The Parties are independent contractors. Nothing in this Agreement creates a partnership, joint venture, agency, fiduciary, or employment relationship.
17.2 Entire Agreement. This Agreement (including the Order Form, the HIPAA BAA in Exhibit B, and any other exhibits) is the entire agreement between the Parties regarding its subject matter and supersedes all prior agreements, proposals, and understandings, written or oral.
17.3 Order of Precedence. In the event of conflict, the order of precedence is: (a) Exhibit B (HIPAA BAA), with respect to PHI; (b) the Order Form; (c) the body of this Agreement; (d) other exhibits.
17.4 Force Majeure. Neither Party is liable for delay or failure to perform (other than payment obligations) caused by events beyond its reasonable control, including acts of God, war, terrorism, civil disturbance, government action, internet or telecommunications outage, pandemic, natural disaster, or failure of third-party services not within the affected Party's reasonable control.
17.5 Notices. All notices under this Agreement shall be in writing and delivered to the addresses set forth in the signature block or Order Form (or such other addresses as a Party may designate by notice). Notice is effective: (a) when delivered, if hand-delivered; (b) the next business day, if sent by overnight courier with tracking; (c) three business days after mailing, if sent by certified U.S. mail; or (d) on the day of transmission, if sent by email to a designated notice email address with confirmation of delivery. Provider's notice email is legal@casemgmt.io.
17.6 Governing Law. This Agreement is governed by the laws of the State of Nevada, without regard to conflict-of-laws principles. The Parties exclude application of the United Nations Convention on Contracts for the International Sale of Goods.
17.7 Assignment. Neither Party may assign this Agreement without the other Party's prior written consent, except that either Party may assign this Agreement without consent to a successor in connection with a merger, acquisition, or sale of substantially all its assets, provided the assignee assumes all obligations under this Agreement. Any unauthorized assignment is void.
17.8 No Third-Party Beneficiaries. This Agreement is for the benefit of the Parties only and does not create rights in any third party.
17.9 Severability. If any provision of this Agreement is held invalid or unenforceable, the remaining provisions shall remain in full force and effect, and the invalid or unenforceable provision shall be modified to the minimum extent necessary to make it enforceable while preserving the Parties' intent.
17.10 Waiver. No failure or delay by either Party in exercising any right under this Agreement shall constitute a waiver of that right.
17.11 Amendments. This Agreement may be amended only by a written instrument signed by authorized representatives of both Parties.
17.12 Counterparts and Electronic Signatures. This Agreement may be executed in counterparts, each of which is an original and which together form one agreement. Electronic signatures and acceptance through Provider's online signup flow (clickwrap) are valid and binding.
17.13 Compliance with Law. Each Party shall comply with all laws applicable to its performance under this Agreement.
17.14 Export Compliance. Customer shall not export, re-export, or transfer the Service in violation of U.S. export laws and regulations.
17.15 Publicity. Neither Party shall issue press releases or public statements about the existence or terms of this Agreement without the other Party's prior written consent, except that Provider may list Customer in its customer list and case studies as described in Section 8.4(d).
17.16 Headings. Section headings are for convenience only and shall not affect interpretation.
PROVIDER: Marketing Loop LLC
Signature: _______________________________
Printed Name: _______________________________
Title: _______________________________
Date: _______________________________
Notice Email: legal@casemgmt.io
CUSTOMER:
Company Legal Name: _______________________________
Signature: _______________________________
Printed Name: _______________________________
Title: _______________________________
Date: _______________________________
Notice Email: _______________________________
Customer Legal Name: _______________________________
Customer Address: _______________________________
Customer State / Entity Type: _______________________________
Order Effective Date: _______________________________
Initial Term: ☐ Month-to-month ☐ 12 months ☐ Other: ______________
| Item | Details |
|---|---|
| Plan tier | ☐ Starter ☐ Professional ☐ Business ☐ Enterprise / Custom |
| Fees | Per the plan selected above, at Provider's then-current published rates, billed monthly in advance. No fixed price is set in this Order Form. |
| Billing | Automatic, per Section A1a — the monthly charge adjusts to the number of active Authorized Users each cycle and is viewable in the Service. Referral Source (intake portal) users are included at no charge. |
| Payment method | ☐ Credit card (auto-charge via Stripe) ☐ ACH (auto-charge via Stripe) ☐ Invoiced / Other: __________ |
(Any custom or negotiated pricing for Customer is recorded in Section A3; if A3 is blank, Provider's published rates for the selected plan apply.)
The Service is billed on a per-seat basis that adjusts automatically to the number of active Authorized Users in Customer's account at the time of each billing cycle. The user counts above are not a fixed commitment; they establish the base allotment and the rates at which seats are charged. Customer may add or deactivate Authorized Users at any time through the Service. Adding a user applies the applicable per-seat rate, prorated for the remainder of the then-current billing cycle; deactivating a user reduces the charge beginning with the next billing cycle. Included seats are applied to the highest-priced roles first. The current active-user count and the resulting monthly charge are viewable by Customer's administrators within the Service. The fees that apply to Customer are those for Customer's selected plan, as stated in this Order Form or, for online self-service subscriptions, at Provider's then-current published rates for the selected plan. These fees are not fixed for the life of the Agreement: Provider may change fees on a going-forward basis in accordance with Section 3.6, which requires at least sixty (60) days' prior notice and allows Customer to terminate before an increase takes effect.
The subscription includes access to the following modules of the Service as they exist from time to time: patient and case management; referral intake portal; time tracking and payroll; invoicing, CMS-1500 generation, and batch billing; document management with email and fax send; form templates with patient-facing fill and e-signature links; reporting; in-app messaging; and QuickBooks Online integration (where included in the selected plan tier).
_______________________________________________________________
_______________________________________________________________
(If blank, there are no custom terms and the standard Agreement applies unmodified.)
This Business Associate Agreement ("BAA") is incorporated into and made part of the Master Subscription Agreement between the Parties. The Parties acknowledge that Customer is a Covered Entity or Business Associate under HIPAA and that Provider, in providing the Service, will create, receive, maintain, or transmit PHI on behalf of Customer, making Provider a Business Associate under 45 C.F.R. § 160.103.
Capitalized terms not defined here have the meanings given in the Privacy Rule (45 C.F.R. Parts 160 and 164, Subparts A and E), the Security Rule (45 C.F.R. Parts 160 and 164, Subparts A and C), and the Breach Notification Rule (45 C.F.R. Parts 160 and 164, Subpart D), collectively the "HIPAA Rules".
B2.1 Performance of the Service. Provider may use and disclose PHI only as necessary to perform its obligations under the MSA and the Service, as Required by Law, or as otherwise permitted in this BAA.
B2.2 Management and Administration. Provider may use PHI for its proper management and administration, to carry out its legal responsibilities, and for data aggregation services as defined in 45 C.F.R. § 164.501.
B2.3 De-Identified Data. Provider may de-identify PHI in accordance with 45 C.F.R. § 164.514(a)-(c) and may use de-identified data for any purpose, including improving the Service, generating analytics, and reporting, in each case provided that the de-identified data is not re-identified.
B2.4 Prohibited Uses. Except as expressly permitted, Provider shall not use or disclose PHI in a manner that would violate the HIPAA Rules if done by Customer. Provider shall not use PHI to train artificial intelligence or machine learning models.
B3.1 Safeguards. Provider shall implement administrative, technical, and physical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of electronic PHI, as required by the Security Rule.
B3.2 Reporting Breaches. Provider shall report to Customer:
(a) Any Breach of Unsecured PHI (as defined in 45 C.F.R. § 164.402) without unreasonable delay and in no event later than thirty (30) days after Provider's discovery of the Breach;
(b) Any Security Incident (as defined in 45 C.F.R. § 164.304) of which Provider becomes aware. Provider and Customer acknowledge that unsuccessful attempts at unauthorized access, such as routine pings and port scans, occur frequently against any internet-facing system and that periodic notice of such unsuccessful attempts is not required. Provider shall report such unsuccessful attempts upon Customer's reasonable written request.
B3.3 Contents of Breach Notice. Provider's notice of Breach shall include, to the extent then known: (a) a description of what happened; (b) the date of the Breach and date of discovery; (c) the types of PHI involved; (d) the steps Provider has taken to investigate, mitigate, and prevent recurrence; (e) any individuals or entities affected, if known.
B3.4 Subcontractors. Provider shall ensure that any Subprocessor with access to PHI agrees in writing to restrictions and obligations no less protective than those in this BAA.
B3.5 Access by Individuals. Within fifteen (15) business days of Customer's written request, Provider shall make PHI in a Designated Record Set held by Provider available to Customer or, at Customer's direction, to the Individual, to permit Customer to comply with 45 C.F.R. § 164.524.
B3.6 Amendments. Within fifteen (15) business days of Customer's written request, Provider shall make amendments to PHI in a Designated Record Set held by Provider as directed by Customer, to permit Customer to comply with 45 C.F.R. § 164.526.
B3.7 Accounting of Disclosures. Provider shall document disclosures of PHI as required for Customer to comply with 45 C.F.R. § 164.528, and shall provide such information to Customer within fifteen (15) business days of Customer's written request.
B3.8 Access by HHS. Provider shall make its internal practices, books, and records relating to its use and disclosure of PHI available to the Secretary of HHS for purposes of determining Customer's compliance with HIPAA.
B3.9 Mitigation. Provider shall mitigate, to the extent practicable, any harmful effect known to Provider of a use or disclosure of PHI by Provider in violation of this BAA.
B3.10 No Marketing or Sale. Provider shall not engage in any sale of PHI (as defined in 45 C.F.R. § 164.502(a)(5)(ii)) or use PHI for marketing communications without an individual's prior written authorization.
Customer shall:
(a) Notify Provider of any limitations in the Notice of Privacy Practices of Customer under 45 C.F.R. § 164.520 that may affect Provider's use or disclosure of PHI;
(b) Notify Provider of any changes in, or revocation of, the permission by an Individual to use or disclose his or her PHI that may affect Provider's use or disclosure of PHI;
(c) Not request Provider to use or disclose PHI in any manner that would not be permissible under the HIPAA Rules if done by Customer.
B5.1 Term. This BAA is effective on the Effective Date of the MSA and continues until all PHI is returned to Customer or destroyed.
B5.2 Termination for Material Breach. Either Party may terminate this BAA and the MSA if the other Party has materially breached this BAA and has not cured the breach within thirty (30) days of written notice (or as required by HIPAA, if shorter). If cure is not feasible, the non-breaching Party may terminate immediately.
B5.3 Effect of Termination. Upon termination of this BAA, Provider shall return or destroy all PHI received from or created on behalf of Customer, including all copies. If return or destruction is not feasible (for example, PHI in routine backups that age out automatically or PHI required to be retained by law), Provider shall extend the protections of this BAA to such PHI and limit further uses and disclosures to the purposes that make return or destruction infeasible, for as long as Provider maintains the PHI.
B6.1 Regulatory References. References to sections of the HIPAA Rules shall mean those sections as in effect from time to time.
B6.2 Amendment. The Parties shall amend this BAA as necessary to comply with applicable changes to HIPAA.
B6.3 Survival. Sections B3 (Provider obligations regarding PHI), B5.3 (effect of termination), and B6 survive termination.
B6.4 Interpretation. Any ambiguity shall be resolved in favor of the interpretation that complies with the HIPAA Rules.
The following third-party Subprocessors are engaged by Provider in delivering the Service as of June 16, 2026. This list is updated from time to time at casemgmt.io/privacy.
| Subprocessor | Purpose | PHI Access |
|---|---|---|
| Amazon Web Services, Inc. | Infrastructure hosting (compute, storage, database, network) | Yes (all Customer Data) |
| Stripe, Inc. | Subscription billing for SaaS fees | No (billing contact info only) |
| Twilio Inc. | SMS messaging for patient form links and notifications | Yes (recipient phone numbers, message bodies) |
| SRFax Inc. | Outbound e-fax for CMS-1500 forms and invoices | Yes (faxed documents) |
| Intuit Inc. (QuickBooks Online) | Optional, customer-initiated accounting integration | No (billing data only) |
| Customer-configured email provider (SMTP) | Sending documents and notifications by email at Customer's direction | Yes, where Customer emails documents containing PHI; transport occurs via the email account Customer configures and controls |
| ipapi.co | Geolocation of administrator login IP addresses for the account-security view | No (login IP addresses only; no patient data) |
Provider's own transactional and billing email (account, billing, and system notices) does not transmit PHI. Where Customer configures the Service to email documents containing PHI, those messages are transmitted through the email provider Customer designates, and Customer is responsible for that provider's HIPAA compliance.
Provider maintains business associate agreements with Subprocessors that access PHI as required by Section 15.2(a).
Upon termination or upon Customer's written request under Section 5.4(a), Provider shall provide Customer with one complete export of Customer Data in the format(s) and on the schedule specified below, at no additional charge.
An archive containing Customer's structured tenant data, including patients, cases, time entries, invoices, batch invoices, billing records, contacts (attorneys, adjusters, providers, case managers, paralegals, insurance companies), case notes, progress notes, care plans, assessments, and form submissions, in one or more standard, non-proprietary formats (CSV, JSON, or SQL) as Provider reasonably determines.
Provider's per-patient full-record export is available today and includes, for each patient: the structured record (JSON), a generated summary PDF, all original uploaded document files, all generated PDFs (CMS-1500 forms, invoices, signed forms), and a manifest (CSV) mapping each document to its original filename, upload timestamp, document type, and folder.
For a full-tenant export, Provider shall deliver the per-patient archives for all of Customer's patients, or a consolidated archive, within the delivery windows in Section D4.
Upon Customer's reasonable written request, Provider shall use commercially reasonable efforts to provide the structured data in an alternative standard format (CSV, JSON, or a PostgreSQL-compatible SQL dump).
Structured data export: delivered within ten (10) business days of Customer's written request via secure download link, with the link valid for at least seven (7) days.
Documents-included export: delivered within twenty-one (21) calendar days of Customer's written request; for tenants with very large document volumes (over 250 GB), the Parties shall agree on a delivery window in good faith.
Encryption: all exports shall be encrypted at rest, and download links shall use TLS 1.2 or higher.
Provider shall provide one-time exports during the Term, and the final post-termination export, at no charge. Additional exports during the Term, or expedited exports outside the standard timing in Section D4, may be billed at Provider's reasonable hourly rate, communicated to Customer in writing before performing the work.
Marketing Loop LLC - CaseMgmt.io SaaS Subscription Agreement v3.4 (2026-06-16). Questions: legal@casemgmt.io
Questions about this agreement: legal@casemgmt.io