Welcome to Mpilo OU ("Mpilo," "we," "us," or "our"). Mpilo is an Estonian company that provides an AI-powered scribing service (the "Service") using Microsoft Azure, Deepgram, and other technologies. By accessing or using our Service, you agree to be bound by these Terms of Service (the "Terms") and our Privacy Policy. If you do not agree to these Terms, please do not use our Service.
Mpilo's Service uses AI technology to transcribe and summarize live or recorded audio into notes. We utilize self-hosted and third-party technologies, including Microsoft Azure and Deepgram, to provide our Service. Mpilo has Business Associate Agreements (BAAs) in place with Microsoft Azure and Deepgram to ensure data privacy compliance.
You must be at least 18 years old to use our Service. By agreeing to these Terms, you represent and warrant that you are at least 18 years old, have not been previously suspended or removed from our Service, and that your use of our Service complies with all applicable laws and regulations.
As a user of our Service, you are responsible for: a. b. c. d.
Mpilo is committed to protecting the privacy and security of your data. We have implemented appropriate technical and organizational measures to safeguard your data, including encryption of data at rest and in transit. Mpilo does not have access to any data submitted to or from the AI models, which is encrypted and only accessible to you. We only store encrypted keys that allow us to synchronize your notes across devices.
All intellectual property rights in our Service and its content, features, and functionality are and shall remain the exclusive property of Mpilo and its licensors. Your use of our Service does not grant you any rights to such intellectual property, except as expressly set forth in these Terms or as otherwise granted by Mpilo in writing.
To the fullest extent permitted by law, Mpilo, its affiliates, and their respective officers, directors, employees, and agents shall not be liable for any indirect, incidental, special, consequential, or punitive damages, or any loss of profits or revenues, whether incurred directly or indirectly, or any loss of data, use, goodwill, or other intangible losses, resulting from your access to or use of our Service or any content or data submitted to our Service.
Mpilo provides its Service on an "as is" and "as available" basis, without any warranties or representations, express or implied. Mpilo does not warrant that its Service will be uninterrupted, error-free, or secure, or that any defects will be corrected. To the fullest extent permitted by law, Mpilo disclaims all warranties, including but not limited to implied warranties of merchantability, fitness for a particular purpose, and noninfringement.
You agree to indemnify, defend, and hold harmless Mpilo, its affiliates, and their respective officers, directors, employees, and agents from and against any claims, disputes, demands, liabilities, damages, losses, costs, and expenses, including, without limitation, reasonable legal and accounting fees, arising out of or in any way connected with your access to or use of our Service or your violation of these Terms.
Mpilo reserves the right to suspend or terminate your access to its Service at any time, with or without cause, and with or without notice. Upon termination, your right to use our Service will immediately cease. Sections 5, 6, 7, 8, 9, 10, 12, 13, 14, and 15 shall survive termination of these Terms.
Mpilo may revise these Terms from time to time. The most current version of the Terms will always be available on our website. By continuing to access or use our Service after any revisions become effective, you agree to be bound by the revised Terms.
These Terms shall be governed by and construed in accordance with the laws of Estonia, without giving effect to any principles of conflicts of law. You agree that any action at law or in equity arising out of or relating to these Terms or your use of our Service shall be filed only in the state or federal courts located in Estonia, and you hereby consent and submit to the personal jurisdiction of such courts for the purposes of litigating any such action.
If any provision of these Terms is found to be invalid, illegal, or unenforceable, the remaining provisions shall continue in full force and effect. If any provision is deemed unlawful, void, or unenforceable, that provision shall be deemed severable from these Terms and shall not affect the validity and enforceability of any remaining provisions.
These Terms, together with our Privacy Policy, constitute the entire agreement between you and Mpilo regarding your use of our Service and supersede all prior or contemporaneous understandings and agreements, whether written or oral, regarding such subject matter.
If you have any questions about these Terms or our Service, please contact us at [email protected].
This Business Associate Agreement ("BAA") is by and between Mpilo OÜ ("Business Associate"), and Customer ("Covered Entity"), and is effective as Effective Date.
WHEREAS, the pursuant to these Terms of Use Business Associate will provide certain services to, for, or on behalf of Covered Entity involving the use or disclosure of Protected Health Information ("PHI"), and pursuant to such Terms of Use, Business Associate may be considered a "business associate" of Covered Entity; and
WHEREAS, Covered Entity and Business Associate intend to protect the privacy and provide for the security of PHI disclosed to Business Associate pursuant to the Provider Agreement in compliance with the Health Insurance Portability and Accountability Act of 1996, Public Law 104-191 ("HIPAA") and the Standards for Privacy of Individually Identifiable Health Information promulgated thereunder by the U.S. Department of Health and Human Services at 45 CFR § 160 and § 164 (the "HIPAA Rules"), and the Health Information Technology for Economic and Clinical Health Act of 2009 (the "HITECH Act"), in each case as amended from time to time; and
WHEREAS, the purpose of this BAA is to satisfy certain standards and requirements of the HIPAA Rules and the HITECH Act, as the same may be amended from time to time.
NOW, THEREFORE, in consideration of the mutual agreement and covenants stated herein, the parties agree as follows:
Terms used in this agreement but not otherwise defined in this BAA shall have the same meaning as set forth in privacy Standards and Security Standards 45 CFR Parts 160, 162 and 164, or the HITECH Act as the case may be.
Business Associate agrees to use best measures to ensure that the usage or Disclosure of PHI is as necessary in order to perform the services set forth in the Substantive Agreement, as permitted under this BAA, or as Required by governing Laws. Business Associate may Use or Disclose such De-identified Data to third parties at its discretion, as such De-identified Data does not constitute PHI and is not subject to the terms of this BAA. Business Associate shall own all right, title and interest in and to such De-identified Data.
Business Associate shall not unless as permitted under law or this BAA Disclose any PHI.
Business Associate shall have the right to use all necessary measure including but not limited to technical, physical and administrative techniques to protect the PHI as well as de-identify any and all PHI, provided that Business Associate implements a de-identification process that conforms to the requirements of 45 C.F.R. 164.514(a)-(c) ("De-identified Data").
Business Associate shall promptly report to Covered Entity in writing any use or disclosure of PHI not provided for by this BAA of which Business Associate becomes aware. Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a use or disclosure of PHI by Business Associate in violation of the requirements of this BAA. This Report should be sent within 4 business days of the BAA being aware of the event.
Business Associate shall ensure that any Assigns or subcontractors, to whom it provides PHI received from (or created or received by Business Associate on behalf of) Covered Entity agree to the same restrictions and conditions that apply to Business Associate with respect to such PHI. It is the Responsibility of the BAA to ensure that the Assigns adhere and are bound by the terms herein. Business Associate shall notify Covered Entity, of all subcontracts and agreements relating to the Agreement, where the subcontractor or agent receives PHI as described in this BAA. Such notification shall occur within 30 (thirty) calendar days of the execution of the subcontract by placement of such notice on the Business Associate’s primary website or via email at the email of the BAA.
Business Associate shall make available to Covered Entity (or, as directed by Covered Entity, to an Individual) such information as Covered Entity may request, and in the time and manner designated by Covered Entity, to fulfill Covered Entity’s obligations (if any) to provide access to, provide a copy of, and account for disclosures with respect to PHI pursuant to HIPAA and the HIPAA Rules, including, but not limited to, 45 CFR §§ 164.524 and 164.528. Requests for information must be submitted at least 14 days in advance of the due date.
Business Associate shall make any amendments to PHI in a
Designated Record Set as directed by the Covered Entity, and
in the time and manner designated by Covered Entity, to
fulfill Covered Entity’s obligations (if any) to amend PHI
pursuant to HIPAA and the HIPAA Rules, including, but not
limited to, 45 CFR § 164.526, and Business Associate shall, as
directed by Covered Entity, incorporate any amendments to PHI
into copies of such PHI maintained by Business Associate.
In the event that any Individual requests that Business
Associate amend such Individual’s PHI or record in a
Designated Record Set, Business Associate within ten business
days will forward this request to Covered Entity. Any
amendment of, or decision not to amend, the PHI or record as
requested by an Individual and compliance with the
requirements applicable to an Individual’s right to request an
amendment of PHI will be the sole responsibility of Covered
Entity
Business Associate shall make its internal practices, books and records relating to the use and disclosure of PHI received from Covered Entity (or created or received by Business Associate on behalf of Covered Entity) available to the Secretary, for purposes of the Secretary determining Covered Entity’s compliance with HIPAA, this BAA and the HIPAA Rules. The books and records shall be in compliance with the laid down method advanced by the covered entity and the HHS.
Business Associate shall document such disclosures of PHI and
information related to such disclosures as would be required
for Covered Entity to respond to a request by an Individual
for an accounting of disclosures of PHI in accordance with 45
CFR § 164.528. This will also extend to if and to the extent
that such accounting is required under the HITECH Act or under
HHS regulations adopted in connection with the HITECH Act.
Business Associate must furnish Covered Entity the following
with respect to any covered disclosures by Business Associate:
(i) the date of disclosure of PHI;
(ii) the name of the
entity or person who received PHI, and, if known, the address
of such entity or person;
(iii) a brief description of
the PHI disclosed; and
(iv) a brief statement of the
purpose of the disclosure which includes the basis for such
disclosure.
Business Associate agrees to provide to Covered Entity or an Individual, in a time and manner designated by Covered Entity, information documented in accordance with Section 2(i) of this BAA in a time and manner as to permit Covered Entity to respond to a request by an Individual for an accounting of disclosures of PHI in accordance with 45 CFR § 164.528.
During the Term of this BAA, Business Associate shall notify Covered Entity within ten (10) days of Discovery of any Breach of Unsecured PHI. Business Associate further agrees, consistent with Section 13402 of the HITECH Act, to provide Covered Entity with information necessary for Covered Entity to meet the requirements of said section, and in a manner and format to be specified by Covered Entity.
a. Covered Entity shall be responsible for using appropriate safeguards to maintain and ensure the confidentiality, privacy and security of PHI transmitted to Business Associate pursuant to the BAA and this BAA, in accordance with the standards and requirements of HIPAA and the HIPAA Rules, until such PHI is received by Business Associate.
b. Upon request, Covered Entity shall provide Business Associate with the notice of privacy practices that Covered Entity produces in accordance with 45 CFR § 164.520, as well as any changes to such notice.
c. Covered Entity shall provide Business Associate with any changes in, or revocation of, permission by an Individual to use or disclose PHI, if such changes affect Business Associate’s permitted or required uses or disclosures.
d. Covered Entity shall notify Business Associate of any restriction to the use or disclosure of PHI that Covered Entity has agreed to in accordance with 45 CFR § 164.522, if such restriction affects Business Associate’s permitted or required uses or disclosures.
a. Term. The Term of this BAA shall become effective as of the Effective Date and shall terminate when all of the PHI provided by Covered Entity to Business Associate, or created or received by Business Associate on behalf of Covered Entity, is destroyed or returned to Covered Entity, or, if it is infeasible to return or destroy PHI, protections are extended to such information, in accordance with the termination provisions of this Section. The provisions of this BAA shall survive termination of the BAA to the extent necessary for compliance with HIPAA and the HIPAA Rules.
b. Material Breach. A material breach by either party of any provision of this BAA shall constitute a material breach of the BAA, if such breach is not cured by the breaching party within thirty (30) days of receipt of notice describing the material breach.
c. Reasonable Steps to Cure Breach. If either party learns of an activity or practice of the other party that constitutes a material breach or violation of the other party’s obligations under the provisions of this BAA, then the non-breaching party shall notify the breaching party of the breach and the breaching party shall take reasonable steps to cure such breach or violation, as applicable, within a period of time which shall in no event exceed thirty (30) days. If the breaching party’s efforts to cure such breach or violation are unsuccessful, the non-breaching party shall either terminate the BAA, if feasible, or if termination of the BAA is not feasible and the breaching party has violated the HIPAA Rules, the non-breaching party may report the breaching party’s breach or violation to the Secretary.
d. Judicial or Administrative Proceedings. Either party may terminate the BAA, effective immediately, if the other party is named as a defendant in a criminal proceeding for an alleged violation of HIPAA, or a finding or stipulation that the other party has violated any standard or requirement of HIPAA or other security or privacy laws is made in any administrative or civil proceeding in which the party has been joined.
e.
Effect of Termination.
1. Except as provided in paragraph (e)(2) of this Section or if
required by law or regulation to be maintained by Business
Associate, upon termination of the BAA for any reason, Business
Associate shall return at Covered Entity’s expense, or destroy all
PHI received from Covered Entity (or created or received by Business
Associate on behalf of Covered Entity) that Business Associate still
maintains in any form, and shall retain no copies of such PHI. This
provision shall apply to PHI that is in the possession of
subcontractors or agents of Business Associate.
2. In the event that Business Associate determines that
returning or destroying the PHI is infeasible, Business Associate
shall provide to Covered Entity notification of the conditions that
make return or destruction infeasible. Upon mutual agreement of the
parties that return or destruction of PHI is infeasible, Business
Associate shall extend the protections of this BAA to such PHI and
limit further uses and disclosures of such PHI to those purposes
that make the return or destruction infeasible, for so long as
Business Associate maintains such PHI. The obligations of Business
Associate under this Section shall survive the termination of the
BAA.
3. Amendment to Comply with Law. The parties acknowledge that
state and federal laws relating to electronic data security and
privacy are rapidly evolving and that amendment of the BAA may be
required to provide for procedures to ensure compliance with such
developments. The parties specifically agree to take such action as
is necessary to implement the standards and requirements of HIPAA,
the HIPAA Rules, the HITECH Act, and other applicable laws relating
to the security or confidentiality of PHI. Upon the request of
either party, the parties shall promptly enter into negotiations
concerning the terms of an amendment to the BAA embodying written
assurances consistent with the standards and requirements of HIPAA,
the HIPAA Rules, the HITECH Act, or other applicable laws relating
to security and privacy of PHI. Either party may terminate the BAA
upon thirty (30) days’ written notice in the event the other party
does not promptly enter into negotiations to amend the BAA when
requested pursuant to this Section, or does not enter into an
amendment to the BAA providing assurances regarding the safeguarding
of PHI that satisfy the standards and requirements of HIPAA, the
HIPAA Rules, the HITECH Act, or any other applicable laws relating
to security and privacy of PHI.
4. No Third Party Beneficiaries. Nothing in this BAA is
intended to confer, nor shall anything herein confer, upon any
person other than Covered Entity, Business Associate and their
respective successors and assigns, any rights, remedies, obligations
or liabilities whatsoever and no other person or entity shall be a
third party beneficiary of this BAA.
5. Effect on BAA. Except as specifically required to implement
the purposes of this BAA, or to the extent inconsistent with this
BAA, all other terms of the BAA shall remain in full force and
effect.
6. Interpretation. This BAA shall be interpreted as broadly as
necessary to implement and comply with HIPAA, the HIPAA Rules and
any other applicable law relating to security and privacy of PHI.
Any ambiguity in this BAA shall be resolved in favor of a meaning
that permits Covered Entity to comply with the HIPAA Rules.
7. Regulatory References. A reference in this BAA to a section
in the HIPAA Rules or the HITECH Act means the section as in effect
or as amended, and for which compliance is required.
