Legal

Version 2026-10-23 · Last updated October 23, 2026

Terms of Service

These Terms of Service ("Terms") are an agreement between [COMPANY LEGAL NAME], a [STATE] [limited liability company] doing business as InjuryTrack ("InjuryTrack," "we," "us"), and the healthcare practice that creates an account ("Customer," "you"). They govern Customer's use of the InjuryTrack web application, website and related services (the "Service"). The person who accepts these Terms represents that they are authorized to bind Customer. "Authorized User" means any individual who accesses the Service through Customer's account or credentials, including the account owner, administrators, providers, employees, contractors, agents and any other user Customer invites (sometimes called "sub-users"), and includes former Authorized Users for the obligations that survive. The Business Associate Agreement and Privacy Policy are part of these Terms; if they conflict with these Terms about protected health information, the Business Associate Agreement controls.

1. The Service

InjuryTrack is case-management software for practices that treat personal injury, no-fault and workers' compensation patients. It helps Customer organize cases, visits, referrals, correspondence, balances, settlements and team tasks. Features differ by plan, as shown on the pricing and billing pages. We may improve, change or retire features; we will not materially reduce the core functionality of a paid plan during a paid period without notice.

2. Accounts and users

Customer is responsible for: the people it invites as users and the roles and access it gives them; making sure each user signs in with their own account and two-factor authentication; keeping credentials and authenticator devices secure; promptly deactivating users who no longer need access; and all activity under its account. Users must be Customer's workforce members or agents acting for Customer. Customer will tell us promptly at support@injurytrack.app if it suspects unauthorized access.

Every Authorized User must personally accept the User Agreement before using the Service, and again whenever it changes; the Service records each acceptance (name, date, time, version and IP address). Customer will not give access to anyone who has not accepted it, will make its Authorized Users aware of section 13, and is responsible and liable for the acts and omissions of its Authorized Users and former Authorized Users, and of anyone who obtains access through Customer's account or credentials, as if they were Customer's own.

3. Free trial

New practices may receive a free trial (currently 14 days) that includes every feature and the limits of our top plan. No payment method is required to start a trial. A trial converts to a paid subscription only when Customer chooses a plan and adds a payment method. When the trial ends without a subscription, the account becomes read-only (see section 7).

4. Subscriptions, automatic renewal and payment

Automatic renewal. Paid plans are subscriptions that renew automatically at the end of each billing period — monthly or annually, as Customer chooses — and the payment method on file is charged the then-current price for the plan in advance of each period until Customer cancels. If Customer subscribes during a free trial, the remaining trial days are kept and the first charge is made when the trial would have ended. Prices and what each plan includes are shown before purchase.

Plan changes. Customer may switch plans or billing periods at any time in Plan & billing. An upgrade is charged the prorated difference for the rest of the current period and takes effect when that payment is confirmed. A downgrade takes effect immediately, and the unused portion is credited toward future charges. Limits of the new plan (open cases, users, features) apply from the change.

Price changes. We will give at least 30 days' notice by email before a price increase applies to an existing subscription; the new price applies from the next renewal after the notice period.

Payments. Payments are processed by Stripe; we do not receive or store card numbers. Fees are in U.S. dollars and exclude taxes, which Customer pays where applicable. If a payment fails, we may retry it and the account may become past due; if it remains unpaid, the account may become read-only until payment is made.

Promotional codes. Promotional codes and discounts apply only as stated when offered, have no cash value, cannot be combined unless stated, and may expire or be withdrawn.

Refunds. Except where the law requires otherwise or as stated in these Terms, fees already paid are non-refundable, including for partial periods after cancellation. [Attorney / owner to confirm refund policy — e.g. pro-rated refunds of annual plans canceled within 30 days.]

5. Cancellation

Customer may cancel at any time, online, in Plan & billing → Manage billing & invoices, or by emailing support@injurytrack.app. Cancellation stops future renewals; access continues to the end of the period already paid for. No cancellation fee applies.

6. Customer data

"Customer Data" means information Customer and its users enter into or upload to the Service, including patient information that is protected health information ("PHI"). As between the parties, Customer owns Customer Data. We use Customer Data only to provide, secure and support the Service for Customer, as permitted by the Business Associate Agreement, and as required by law. We do not sell Customer Data or use PHI for marketing, advertising or training of artificial-intelligence models.

We may use aggregated, de-identified usage information (for example, how often a feature is used, with no patient information) to operate and improve the Service.

7. Read-only access, export, retention and deletion

When a subscription ends (or a trial ends without one), the account becomes read-only: Customer can still sign in, view and export its records, but cannot add or change them. Customer Data stays available this way for 12 months after the subscription or trial ends. After that, we will delete it, after giving the account owner at least 30 days' notice by email. Customer may ask us to delete its data sooner, after it has exported what it needs. Deleted data is removed from the live system promptly and ages out of encrypted backups within 35 days. Return and destruction of PHI are also governed by the Business Associate Agreement.

8. Customer responsibilities

Customer is responsible for: the accuracy of the information it enters, imports or uploads (including EHR ledgers and appointment lists, which it should review in the preview before importing); its own HIPAA compliance program, including policies, workforce training, risk analysis and its Notice of Privacy Practices; having any patient authorization or other legal basis needed before sharing a patient's information with an attorney, insurer or other provider through the Service; the content of letters and messages it generates or sends; and complying with the laws that apply to its practice, billing, coding and patient communications.

9. Messages sent for Customer

The Service can send emails on Customer's behalf — for example, status update requests to a patient's attorney or the attorney's case manager, and alerts to Customer's own team. By turning these on, Customer authorizes us to send them in its name. We design these emails to contain no patient details; attorney requests carry a single-use secure link to a reply page that shows only what is needed to identify the client (name, date of injury, Customer's case number, last date of service and, if Customer allows, the balance). Customer is responsible for the recipients it enters and for having a basis to communicate with them about the patient. Replies are added to Customer's case records.

White label. On plans that include it, Customer may show the Service to its own team and to the attorneys it works with under Customer's name, logo and color, including on the reply page and on emails sent for Customer. Customer grants us a limited license to display the name and logo it uploads for that purpose and confirms it has the right to use them. White label changes only how the Service looks: we remain the provider under these Terms and the Business Associate Agreement, Customer may not resell or sublicense the Service to other practices, and the legal notices linked from the Service continue to apply. Branding stops showing if Customer's plan no longer includes it.

10. Acceptable use

Customer and its users will follow the Acceptable Use Policy. We may suspend access, with notice where practical, to stop a violation, a security threat or non-payment, and will restore it promptly once the issue is resolved.

11. Educational tool — not medical, legal or billing advice

The Service's care guide, timelines, alerts, suggestions, playbook, state-rule summaries, cost estimates and similar content are general information and organizational aids, as described in the clinical disclaimer. They are not medical, legal, billing or coding advice, and Customer's providers remain solely responsible for clinical decisions.

12. Third-party services

The Service relies on third parties for hosting, payments and email, listed under Subprocessors. Customer's use of Stripe's payment pages is also subject to Stripe's terms. We are not responsible for third-party services Customer chooses to use outside the Service, such as its EHR.

13. Ownership of the Service, restrictions and protection

13.1 Ownership. We and our licensors own all right, title and interest in and to the Service and everything that makes it up or comes from it, including its software (source and object code), architecture, database designs and data models, algorithms, rules engines and logic, the care guide, playbook, checklists, timelines, deadlines and their compilation, state-rule summaries and compilations, alerts and suggestions, letter and message templates and wording, calculations and estimates, workflows and the order and way features work together, screens, user interface, look and feel, text, graphics, videos, documentation and APIs, all updates, improvements and derivative works of any of them by anyone, and the InjuryTrack name, logos and other trademarks (together, "InjuryTrack Materials"). The InjuryTrack Materials are protected by copyright, trade secret, trademark and other laws. All rights not expressly granted in these Terms are reserved; no right or license is granted by implication, estoppel or otherwise.

13.2 License. Subject to these Terms and payment of fees, we grant Customer a limited, revocable, non-exclusive, non-transferable, non-sublicensable right, during its subscription (or trial), for its Authorized Users to access and use the Service solely for Customer's own internal management of its own patients' cases. Letters and reports Customer generates from Customer Data may be used by Customer for that purpose; the templates, wording and design behind them remain InjuryTrack Materials.

13.3 Restrictions. Customer will not, and will ensure that its Authorized Users and anyone acting for or with any of them will not, directly or indirectly — whether independently, together with others, through the assistance of others, or by assisting, advising, enabling, funding, encouraging or providing information to anyone else — do or attempt to do any of the following:

1. copy, reproduce, duplicate, frame, mirror, republish, download (other than Customer Data), store or distribute the Service or any InjuryTrack Materials, in whole or in part;
2. modify, translate, adapt or create derivative works of the Service or any InjuryTrack Materials, or merge them into any other product, template, spreadsheet, document or system;
3. reverse engineer, decompile, disassemble, decode or otherwise try to derive the source code, algorithms, rules, logic, data models, database structure, workflows or other underlying ideas of the Service;
4. access or use the Service or any InjuryTrack Materials, or any knowledge gained from them, to design, develop, build, code, configure, train, test, improve, market, sell or support any product or service — including software, an app, a website, a template or spreadsheet system, an artificial-intelligence model or agent, or a consulting or managed-service offering — that is the same as, substantially similar to, or competitive with the Service or any part, feature or function of it (a "Competing Product");
5. record, screenshot, photograph, video, transcribe, describe, summarize or otherwise capture or disclose the Service's screens, features, workflows, rules, checklists, timelines, templates, wording, feature set or non-public pricing to any third party, other than as needed to use the Service for Customer's own patients' cases (for example, sending a generated letter to the patient's attorney);
6. use any bot, scraper, crawler, script, browser extension, AI agent or other automated means to access, copy, extract, index or monitor the Service or InjuryTrack Materials, or use any of them to train, fine-tune, prompt-engineer, evaluate or benchmark any artificial-intelligence or machine-learning system;
7. perform or publish benchmarking, competitive analysis, feature comparisons or performance testing of the Service, or access it to monitor its availability, performance or functionality for competitive purposes, without our prior written consent;
8. sell, resell, rent, lease, lend, license, sublicense, distribute, time-share, white-label for others, offer as a service bureau, or otherwise make the Service available to anyone other than Customer's Authorized Users (white label under section 9 changes only appearance and does not permit any of this);
9. give access to, or share login, screens, documentation or InjuryTrack Materials with, any person or business that develops, sells or is planning a Competing Product, or anyone acting for one, or knowingly let such a person become an Authorized User;
10. remove, obscure or alter any proprietary notice, label or mark, or use the InjuryTrack name, logos or trademarks, or any confusingly similar name, logo, trade dress or domain name, except as these Terms allow;
11. circumvent or interfere with any security measure, access control, plan limit, usage limit or technical restriction of the Service; or
12. apply for or obtain any patent, copyright, trademark or other right covering any part of the Service or InjuryTrack Materials, or anything derived from them.

13.4 No Competing Products. In addition to section 13.3, during the term of these Terms and for 24 months after the later of (i) their end or (ii) the last date any of Customer's Authorized Users accessed the Service, Customer will not, and will ensure its Authorized Users acting for Customer will not, directly or indirectly, independently or with or through others, develop, commission, fund, acquire an interest in, or offer to others a Competing Product, or assist anyone else in doing so, to the fullest extent permitted by applicable law. This section does not stop Customer from purchasing and using another vendor's product for its own practice, provided Customer does not disclose InjuryTrack Materials or our Confidential Information to that vendor or otherwise breach section 13.3. Customer agrees these restrictions are reasonable and necessary to protect our trade secrets, confidential information and goodwill, which Customer receives access to only under these Terms.

13.5 Trade secrets and confidential information. The non-public aspects of the Service and InjuryTrack Materials — including their design, logic, rules, workflows, data models, templates, roadmap, pricing not published on our website, and anything marked or reasonably understood as confidential — are our trade secrets and "Confidential Information." Customer and its Authorized Users will keep them confidential, use them only to use the Service under these Terms, and protect them with at least reasonable care. These obligations last for as long as the information remains a trade secret under applicable law and, for other Confidential Information, for five years after these Terms end. Information that is or becomes public through no fault of Customer or its Authorized Users is not Confidential Information, but a combination of features is not public merely because individual features are. Notice under 18 U.S.C. § 1833(b): an individual is not liable under any trade-secret law for disclosing a trade secret in confidence to a government official or an attorney solely to report or investigate a suspected violation of law, or in a sealed court filing.

13.6 No residuals. No right is granted to use any Confidential Information or InjuryTrack Materials retained in the memory of any person ("residual knowledge"), and any use of it to build or assist a Competing Product is a breach of these Terms.

13.7 Feedback. Suggestions, feature requests, ideas and other feedback about the Service from Customer or its Authorized Users ("Feedback") are given voluntarily. Customer hereby assigns, and will cause its Authorized Users to assign, to us all right, title and interest in Feedback, waives any moral rights in it, and agrees we may use it for any purpose without compensation or attribution. Feedback does not include Customer Data.

13.8 Customer Data is Customer's. Nothing in this section 13 gives us any right in Customer Data beyond section 6 and the Business Associate Agreement, or limits Customer's right to export its own Customer Data.

13.9 Monitoring and verification. We may monitor use of the Service, including through audit logs and automated detection of copying, scraping and unusual access, to protect the Service and enforce these Terms. If we reasonably believe this section 13 may have been breached, Customer will, within ten business days of our written request, certify in writing whether it and its Authorized Users have complied, identify any breach, and reasonably cooperate in our investigation, including by preserving relevant records.

13.10 Remedies. A breach or threatened breach of this section 13 or of the User Agreement would cause us irreparable harm for which money damages would not be adequate. We are entitled to temporary, preliminary and permanent injunctive relief and specific performance in any court of competent jurisdiction, without posting a bond or proving actual damages, in addition to all other remedies, including damages, disgorgement of profits and other benefits obtained through the breach, and immediate suspension or termination of access without refund. Customer will reimburse our reasonable attorneys' fees, expert fees and costs of enforcing this section 13 if we prevail. Each restricted period in section 13.4 is extended by any period during which the restriction was breached. [Attorney to consider whether to add a liquidated-damages amount for breach of section 13.3(d) or 13.4.]

13.11 Severability and reformation. If any part of this section 13 is found unenforceable as written — for example, because of its length, scope or geography under the law that applies — the court should modify it to the minimum extent needed to make it enforceable and enforce it as modified, and the rest of this section remains in effect. The restrictions apply in every jurisdiction where Customer or its Authorized Users are located or where a Competing Product is offered.

13.12 Our independent development. Nothing in these Terms limits our right to develop, use or offer any product, feature or service, including ones similar to any Feedback.

14. Confidentiality and security

Each party will protect the other's non-public business information with reasonable care and use it only for this agreement. We maintain administrative, physical and technical safeguards appropriate to PHI, as described in the Business Associate Agreement and on our security page, including encryption, two-factor sign-in for every user, access controls, audit logging and encrypted backups.

15. Warranties and disclaimers

We will provide the Service with reasonable skill and care and in material accordance with its documentation. EXCEPT AS EXPRESSLY STATED IN THESE TERMS, THE SERVICE IS PROVIDED "AS IS" AND "AS AVAILABLE," AND WE DISCLAIM ALL OTHER WARRANTIES, EXPRESS OR IMPLIED, INCLUDING MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT. We do not warrant that the Service will be uninterrupted or error-free, that deadlines, rules or estimates it shows are complete or current for every claim, or any outcome of any case or claim.

16. Limitation of liability

TO THE EXTENT PERMITTED BY LAW, NEITHER PARTY WILL BE LIABLE FOR INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL OR PUNITIVE DAMAGES, OR LOST PROFITS, REVENUE OR SETTLEMENTS, EVEN IF ADVISED OF THE POSSIBILITY. EACH PARTY'S TOTAL LIABILITY ARISING OUT OF THESE TERMS WILL NOT EXCEED THE FEES CUSTOMER PAID FOR THE SERVICE IN THE 12 MONTHS BEFORE THE EVENT GIVING RISE TO THE CLAIM. These limits do not apply to Customer's payment obligations, either party's indemnity obligations, a breach of section 13 or of the User Agreement by Customer or its Authorized Users, infringement or misappropriation of the other party's intellectual property, or liability that cannot be limited by law. [Attorney to confirm the cap and whether breach-of-BAA obligations carry a separate cap.]

17. Indemnification

We will defend Customer against third-party claims that the Service infringes their intellectual property and pay resulting damages awarded. Customer will defend us against third-party claims arising from Customer Data, Customer's clinical, billing or legal decisions, messages sent at Customer's direction, or Customer's or its Authorized Users' violation of these Terms (including section 13), the User Agreement or law, and pay resulting damages awarded. The indemnified party must give prompt notice and reasonable cooperation.

18. Term and termination

These Terms apply from acceptance until Customer's account is closed and its data deleted. Either party may terminate for the other's material breach that is not cured within 30 days of written notice. Sections 2 (responsibility for Authorized Users), 6–8, 13–17 and 19–20 survive termination, as do the Authorized Users' obligations under the User Agreement.

19. Changes to these Terms

We may update these Terms. For material changes we will give at least 30 days' notice by email or in the Service, and the account owner will be asked to accept the new version in the Service. Changes do not apply retroactively.

20. Governing law, disputes and general terms

These Terms are governed by the laws of the State of Florida, without regard to conflict-of-laws rules. The parties will first try in good faith to resolve any dispute by contacting each other, except that we may seek injunctive or other equitable relief to protect the Service, InjuryTrack Materials or our Confidential Information at any time, in any court of competent jurisdiction. Any lawsuit will be brought in the state or federal courts located in [COUNTY] County, Florida, and the parties consent to that jurisdiction. [Attorney to decide whether to use arbitration instead.] Customer may not assign these Terms without our consent, except to a successor of its practice; we may assign them to a successor of our business that agrees to the Business Associate Agreement. Neither party is liable for delays caused by events beyond its reasonable control. These Terms, with the documents they reference, are the entire agreement on their subject. Notices to us go to support@injurytrack.app and [MAILING ADDRESS]; notices to Customer go to the account owner's email.

User Agreement

This User Agreement is between [COMPANY LEGAL NAME], doing business as InjuryTrack ("InjuryTrack," "we," "us"), and each individual who signs in to or otherwise uses the Service through a practice's account ("you") — including the account owner, administrators, providers, staff, billing staff, contractors and every other user the practice invites. You must accept it before using the Service, and again when it changes. It applies to you personally, in addition to the Terms of Service between InjuryTrack and the practice ("Customer"), and it continues to bind you after you stop working with that practice. Capitalized terms not defined here have the meaning given in the Terms.

1. Authorized use

You may use the Service only as an Authorized User of Customer, only for Customer's internal management of its own patients' cases, and only within the role and access Customer gives you. You will use only your own account and two-factor device, never share them, and follow the Acceptable Use Policy and the law, including HIPAA.

2. What you agree not to do

You will not, directly or indirectly — whether on your own, together with others, through others, or by assisting, advising, enabling, funding or encouraging anyone else — do or attempt to do anything prohibited by sections 13.3 and 13.4 of the Terms. In particular, you will not:

1. copy, reproduce, reverse engineer, or create derivative works of the Service or any InjuryTrack Materials, in whole or in part;
2. use the Service, InjuryTrack Materials or anything you learned from them to design, build, train, improve, market or support a Competing Product, or help anyone else do so — including by describing features, workflows, rules, checklists, timelines, templates or screens, sharing screenshots, recordings or exports, writing specifications or requirements, testing, or giving feedback to anyone developing one;
3. capture, scrape or extract the Service or InjuryTrack Materials by any manual or automated means, or use them to train or evaluate any artificial-intelligence system;
4. give access to, or share InjuryTrack Materials with, anyone who is not an Authorized User of Customer, or with anyone developing or planning a Competing Product; or
5. take, keep or send to yourself or others any copies, screenshots, recordings, notes or exports of InjuryTrack Materials (as opposed to Customer's own patient records, which you may handle only as Customer and the law allow).

Competing Products. While you are an Authorized User and for 24 months after your last access to the Service, you will not, directly or indirectly, independently or with or through others, develop, or assist anyone in developing, a Competing Product, to the fullest extent permitted by the law that applies to you. This does not prevent you from using another vendor's product in a later job, as long as you do not use or disclose InjuryTrack Materials or our Confidential Information. Your confidentiality obligations last as long as the information remains a trade secret.

3. Confidentiality

The non-public aspects of the Service are our trade secrets and Confidential Information, as described in section 13.5 of the Terms. You will keep them confidential and use them only to do your work for Customer in the Service. Notice under 18 U.S.C. § 1833(b): you are not liable under any trade-secret law for disclosing a trade secret in confidence to a government official or an attorney solely to report or investigate a suspected violation of law, or in a sealed court filing.

4. When you leave the practice

When your access ends, you will stop using the Service, not try to access it, and delete or return any InjuryTrack Materials in your possession. Your obligations under sections 2, 3, 5 and 7 continue.

5. Feedback

If you send suggestions, ideas or feature requests about the Service, you assign to us all rights in them, waive any moral rights, and agree we may use them for any purpose without compensation.

6. Monitoring and records

You understand that your activity in the Service is logged (for example, sign-ins and which records are viewed, changed or exported) for security, HIPAA compliance and enforcement of these terms, and that Customer and we may review those logs. We keep a record of your acceptance of this User Agreement, including your name, the date and time, the version and your IP address.

7. Enforcement

A breach or threatened breach of this User Agreement would cause us irreparable harm. We may enforce it against you directly, and are entitled to injunctive relief and specific performance in any court of competent jurisdiction without posting a bond, in addition to damages, disgorgement of any benefit you or others obtained, and our reasonable attorneys' fees and costs if we prevail. We may also suspend or end your access. Each restricted period is extended by any period during which you were in breach.

8. General

This User Agreement is governed by Florida law and the venue provisions of section 20 of the Terms, except that we may seek equitable relief in any court of competent jurisdiction. If any part is found unenforceable as written, it will be modified to the minimum extent needed to make it enforceable and the rest remains in effect. Your electronic acceptance has the same effect as a signature. We may update this User Agreement; you will be asked to accept the new version before continuing to use the Service. It does not create any employment relationship between you and InjuryTrack, and it does not limit any obligations you have to Customer.

Acceptable Use Policy

Customer and its users may use the Service only for managing Customer's own patients' cases and related business. They will not:

• share accounts or credentials, bypass two-factor authentication, or let anyone who is not Customer's workforce or authorized agent use the Service;
• enter or upload information they are not permitted to hold, or use the Service to disclose PHI without a legal basis;
• upload malware, or probe, scan or test the Service's security without our written permission (we welcome responsible reports at support@injurytrack.app);
• interfere with the Service's operation, exceed reasonable usage, or scrape it by automated means;
• use messages sent through the Service to harass, mislead, or contact anyone without a legitimate purpose related to a patient's care or claim;
• copy, reverse engineer, capture, scrape, resell or share the Service or its materials, use it to build or help anyone build a similar or competing product (alone, with others, or by assisting others), or give access to anyone developing one — see Terms section 13 and the User Agreement; or
• misrepresent the InjuryTrack Certified badge or use InjuryTrack's name to suggest an endorsement of clinical care.

Privacy Policy

This Privacy Policy explains how [COMPANY LEGAL NAME] ("InjuryTrack") handles personal information through our website and the Service. It does not replace the Business Associate Agreement, which governs the protected health information practices store in the Service.

1. Patient information (PHI)

Practices enter and control their patients' information. We process it only as their business associate: to provide, secure and support the Service for that practice, under the Business Associate Agreement and HIPAA. We never sell it, use it for advertising, or use it to train artificial-intelligence models. Patients with questions about their information should contact their healthcare provider, who controls their records.

2. Information we collect about our customers and users

• Account information: practice name, address, phone and state; users' names, work emails and roles; promotional codes used.
• Security and usage information: sign-in events, IP addresses, browser type, and an audit log of actions taken in the Service (used for security, HIPAA audit controls and support).
• Billing information: plan, billing period and payment status. Card details are collected and stored by Stripe, not by us.
• Communications: support requests and feature suggestions you send us.

3. Attorneys and case managers who reply to status requests

When a practice asks an attorney or case manager for a case status update, we send them an email on the practice's behalf (a practice using white label may show its own name and logo instead of ours; we still operate the reply page and handle the reply as described here). If they use the secure reply page, we record their reply, the name and email they enter, and the date, time and IP address of the visit, and add the reply to the practice's case records. We use this information only to deliver it to that practice and keep the audit trail, and we don't use it for marketing. Questions about a particular request should go to the practice that sent it.

4. Practices we contact about InjuryTrack

To introduce InjuryTrack to healthcare practices, we use business information that is publicly available: practice names, addresses and phone numbers from the federal NPI Registry, and contact details and services that practices publish on their own websites. We use AI services (Google Gemini and OpenAI) to find a practice's website, check whether it treats auto-accident patients, and identify the published business email to write to; no patient information is ever involved. Our emails are sent through SendGrid and record whether a link was clicked. Every email includes a one-click unsubscribe; once you unsubscribe (or reply asking us to stop) we never email that address again, and we keep the address only on our do-not-email list so that it stays that way. To ask what we hold about your practice or have it deleted, email support@injurytrack.app.

4a. Website visitors

Our marketing website does not use advertising or analytics trackers or third-party scripts. Our servers keep standard technical logs (such as IP address and pages requested) for security and reliability.

5. Cookies

We use only cookies that are strictly necessary: a session cookie that keeps you signed in and protects forms against cross-site requests. It is deleted when you sign out or after inactivity. We do not use advertising, tracking or analytics cookies, so there is nothing to opt out of.

6. How we use information

To provide, secure and support the Service; to bill for subscriptions; to send account and service emails (such as trial reminders, security notices and the alerts you turn on); to respond to requests; to improve the Service using aggregated, de-identified usage information; and to comply with law.

7. How we share information

We share information only with the subprocessors listed below that help us run the Service (hosting, payments, email), under contracts that protect it; when required by law or to protect rights and safety; or with a successor in a merger or sale that agrees to this policy and the Business Associate Agreement. We do not sell or "share" personal information for cross-context behavioral advertising.

8. Retention

Account and practice records are kept while the account is open and as described in section 7 of the Terms (12 months of read-only access after a subscription ends, then deletion after notice). Audit and security logs are kept as long as the practice's records, for HIPAA audit purposes. Backups age out within 35 days. Billing records are kept as required for tax and accounting.

9. Security

We protect information with encryption in transit (TLS) and at rest (including field-level encryption of sensitive patient fields; uploaded files such as EHR ledgers, appointment lists and insurance EOBs are read to extract the data you confirm and are not retained; a signed patient authorization attached to a records-release request is kept encrypted only until the practice downloads it to its own records and confirms deletion, and is deleted automatically 30 days after upload in any case), two-factor sign-in for every user, role-based access, automatic sign-out, audit logging, daily encrypted backups and monitored hosting on HIPAA-eligible infrastructure. No system is perfectly secure; we will notify affected customers of security incidents as the law and the Business Associate Agreement require.

10. Your choices and rights

Users can update their name and notification choices in the Service, and practice admins can correct practice details and deactivate users. Depending on where you live, you may have rights to access, correct, delete or obtain a copy of personal information we hold about you as a customer or user; contact us at support@injurytrack.app and we will respond as the law requires. Requests about patient information are handled by the patient's healthcare provider.

11. Children

The Service is for healthcare businesses and is not directed to children. Practices may store information about minor patients as their business associate, under the Business Associate Agreement.

12. Location of data

Information is stored and processed in the United States.

13. Changes and contact

We will post updates here and notify customers of material changes by email. Contact: support@injurytrack.app, [MAILING ADDRESS].

Business Associate Agreement

This Business Associate Agreement ("BAA") is between the practice that accepts it in the Service ("Covered Entity") and [COMPANY LEGAL NAME] d/b/a InjuryTrack ("Business Associate"). It is effective when Covered Entity accepts it and is part of the Terms of Service. Version 2026-10-22.

1. Definitions

Capitalized terms not defined here (including Breach, Data Aggregation, Designated Record Set, Electronic Protected Health Information, Individual, Protected Health Information ("PHI"), Required by Law, Secretary, Security Incident, Subcontractor and Unsecured PHI) have the meanings given in the HIPAA Rules at 45 CFR Parts 160 and 164. "HIPAA Rules" means the Privacy, Security, Breach Notification and Enforcement Rules, as amended by the HITECH Act.

2. Permitted uses and disclosures

Business Associate may use and disclose PHI only: (a) to provide the Service to Covered Entity as described in the Terms, including sending communications Covered Entity directs through the Service; (b) as Required by Law; and (c) for its proper management and administration or to carry out its legal responsibilities, as permitted by 45 CFR §164.504(e)(4), provided any disclosure is Required by Law or made with reasonable written assurances of confidentiality from the recipient. Business Associate will not use or disclose PHI in a way that would violate Subpart E of 45 CFR Part 164 if done by Covered Entity, will not sell PHI, and will not use PHI for marketing. Business Associate will not de-identify PHI or perform Data Aggregation for others without Covered Entity's written permission.

3. Minimum necessary

Business Associate will limit its uses, disclosures and requests of PHI to the minimum necessary. Its personnel do not access PHI except as necessary to provide support Covered Entity requests or to keep the Service secure and running; platform operator accounts are technically prevented from viewing patient records.

4. Safeguards

Business Associate will use appropriate administrative, physical and technical safeguards and comply with Subpart C of 45 CFR Part 164 (the Security Rule) with respect to Electronic PHI, to prevent use or disclosure of PHI other than as provided by this BAA.

5. Reporting

Business Associate will report to Covered Entity: (a) any use or disclosure of PHI not provided for by this BAA of which it becomes aware; (b) any Security Incident of which it becomes aware; and (c) any Breach of Unsecured PHI, as required by 45 CFR §164.410. Reports will be made without unreasonable delay and in no case later than [10] business days after discovery, and will include, to the extent available, the identity of each Individual affected and the other information Covered Entity needs to give notice under 45 CFR §164.404. The parties agree that this section is notice of the ongoing existence of unsuccessful Security Incidents (such as pings, port scans and blocked sign-in attempts) that do not result in unauthorized access to PHI, for which no further report is required. Business Associate will cooperate with Covered Entity's investigation and mitigation, and will mitigate, to the extent practicable, harmful effects known to it.

6. Subcontractors

Business Associate will ensure, in accordance with 45 CFR §§164.502(e)(1)(ii) and 164.308(b)(2), that any Subcontractor that creates, receives, maintains or transmits PHI on its behalf (including its hosting provider) agrees in writing to the same restrictions, conditions and requirements that apply to Business Associate. Current subcontractors are listed under Subprocessors.

7. Individual rights

Within 15 business days of Covered Entity's request, Business Associate will make PHI in a Designated Record Set available to Covered Entity so it can meet its obligations for access (§164.524), amendment (§164.526) and an accounting of disclosures (§164.528). Most of this can be done by Covered Entity directly in the Service (records, exports and the audit log). If an Individual asks Business Associate directly, Business Associate will forward the request to Covered Entity.

8. Covered Entity's obligations

Covered Entity will: notify Business Associate of limitations in its Notice of Privacy Practices, changes in an Individual's permission, or restrictions it agrees to, to the extent they affect Business Associate's use or disclosure of PHI; not ask Business Associate to use or disclose PHI in a way not permitted for Covered Entity; and obtain any authorization needed before directing disclosures through the Service (for example, to an attorney).

9. Books and records

Business Associate will make its internal practices, books and records relating to PHI available to the Secretary for purposes of determining compliance with the HIPAA Rules.

10. Term and termination

This BAA starts on its effective date and lasts as long as Business Associate maintains PHI for Covered Entity. If either party knows of a pattern of activity or practice of the other that is a material breach of this BAA, it will give notice and an opportunity to cure within 30 days; if the breach is not cured, the non-breaching party may terminate the Terms and this BAA.

11. Return or destruction of PHI

When the Terms end, Covered Entity may export its PHI from the Service during the read-only period described in the Terms (12 months). Business Associate will then destroy all PHI it maintains, after at least 30 days' notice, and will confirm destruction in writing on request; Covered Entity may ask for earlier destruction. PHI in encrypted backups is destroyed as the backups expire, within 35 days. If return or destruction is infeasible for any PHI, Business Associate will extend the protections of this BAA to it and limit further uses and disclosures to the purposes that make return or destruction infeasible.

12. Miscellaneous

References to the HIPAA Rules mean them as in effect or amended. The parties will amend this BAA as needed to comply with changes in the law. Any ambiguity will be resolved to permit compliance with the HIPAA Rules. Nothing in this BAA gives rights to any third party. Business Associate's obligations under sections 6 and 11 survive termination.

Subprocessors

These third parties help us run the Service. Those that may store or process PHI have signed business associate agreements with us.

We will update this list and notify customers by email at least 30 days before adding a subprocessor that will process PHI. [Confirm the list matches your production setup before launch.]

"InjuryTrack Certified" badge terms

While Customer has an active paid subscription and has accepted the current Business Associate Agreement, Customer may display the InjuryTrack Certified badge on its website, marketing and printed materials. Online, Customer should use the embed code from Practice settings, which links to a live verification page. The badge states only that Customer manages its case records on InjuryTrack; Customer will not present it as an endorsement of its clinical care, licensure or results, and will not alter the artwork. The badge shows as not verified automatically when these conditions stop being met, and Customer will remove downloaded copies within 30 days after its subscription ends. We may revoke the right to display the badge for misuse.

Clinical disclaimer — educational tool

InjuryTrack is intended solely as an educational and organizational tool. Its care guide, timelines, next steps, suggestions, alerts, playbook, cost estimates and state-rule summaries are general information drawn from common practice and published sources. They are not medical advice, do not establish a standard of care, and are not a substitute for the independent professional judgment of a licensed provider.

Every clinical decision — including examination, diagnosis, treatment plans and frequency, imaging, referrals, maximum medical improvement and discharge — must be made by the treating provider in the exercise of their own clinical judgment and discretion, based on each patient's individual presentation and the applicable scope of practice. A prompt or suggestion in the Service is never a reason to provide, order, withhold or continue care.

Deadlines, insurance and no-fault rules, lien steps, outside-provider cost estimates and other state information may be incomplete, out of date or not applicable to a particular claim, and are not legal or billing advice. Customer remains solely responsible for its clinical, billing, coding and legal decisions and should confirm legal requirements with qualified counsel in the relevant state.