Terms of Service
Last updated:
These terms govern your use of CompyMax at hipaacompliancesoftware.org. By creating an account or using the service you agree to them. If you are agreeing on behalf of an organization, you confirm you have authority to bind it, and “you” refers to that organization.
1. What the service is — and what it is not
We provide software for documenting and managing a HIPAA compliance program, together with published research about third-party vendors.
We are not a law firm and we do not provide legal advice. Nothing in the platform, the vendor checker, our templates or our communications is a substitute for advice from qualified counsel about your specific situation.
No product can make an organization “HIPAA certified”. No such designation exists under the HIPAA rules and no government body issues one. Using this service does not establish that you comply with HIPAA or any other law. Whether you meet your obligations depends on how you configure and operate your own systems and how you conduct your business.
Our vendor checker publishes researched information based on public sources available at the date shown on each entry. It is not certification of any vendor, vendors do not pay for inclusion or placement, and vendor practices change — verify anything material directly with the vendor before relying on it.
2. Accounts
You must provide accurate information, keep credentials confidential and are responsible for activity under your account. Tell us promptly at support@hipaacompliancesoftware.org if you suspect unauthorized access. You must be at least 18 and using the service for business purposes.
3. Plans, trials and ending your plan
Trials run for 14 days without a credit card. Paid plans are prepaid for a fixed period — each payment buys one month or one year, charged in advance and stated exclusive of tax. Nothing renews automatically and no card is stored or charged again without you choosing to pay. We email the billing contact before a period ends so a lapse is never a surprise.
Because nothing auto-renews, there is no cancellation to perform: if you do not renew, the plan simply ends when the period you paid for expires. There are no notice periods and no requirement to contact support. Except where required by law, fees already paid are not refunded. You keep access through the period you paid for, your compliance records remain readable in the application afterwards, and your data remains exportable for 30 days after the period ends.
Payments are processed by our payment partner. We do not receive or store complete payment card numbers. We may change prices with at least 30 days’ notice before your next renewal.
4. Acceptable use
You agree not to:
- Upload protected health information or other patient data.
- Upload unlawful, infringing or malicious content, or attempt to compromise the service or other customers’ data.
- Present our exports as certification, as an audit opinion, or as legal advice to a third party.
- Resell or provide access to the service outside the scope of your plan. Managed service providers may administer client organizations under the MSP plan; that is expressly permitted.
- Republish our vendor checker content in bulk or use automated means to scrape it.
5. Your data
You own the content you put into the service. You grant us the limited licence needed to host, process and display it in order to provide the service. We handle it as described in our Privacy Policy. You are responsible for the accuracy of what you record, including assessment answers you attest to.
Where you connect a third-party system such as Microsoft 365 or Google Workspace, you confirm you are authorized to grant that access, and you remain bound by that provider’s own terms.
6. Our intellectual property
The software, templates, course material and checker content are ours or our licensors’. You may use policy templates and training material within your own organization and its client organizations, including adapting them; you may not redistribute or sell them as a standalone product.
7. Availability
We aim for continuous availability but do not promise uninterrupted or error-free service. We may modify or discontinue features, and will give reasonable notice before removing functionality you materially rely on. Planned maintenance is announced in advance where practical.
8. Disclaimers
To the fullest extent permitted by law, the service is provided “as is” and “as available”, without warranties of any kind, express or implied, including implied warranties of merchantability, fitness for a particular purpose, accuracy and non-infringement.
We do not warrant that use of the service will result in compliance with HIPAA or any other law, that you will pass any audit, investigation, security review or insurance assessment, or that automated checks will detect every misconfiguration. Automated checks report what a provider’s interface reports at the time they run and are one input among many, not a security audit.
9. Limitation of liability
To the fullest extent permitted by law, neither party is liable for indirect, incidental, special, consequential, exemplary or punitive damages, or for lost profits, lost revenue, lost data or business interruption, even if advised such damages were possible.
Our total aggregate liability arising out of or relating to these terms or the service, on any theory of liability, will not exceed the total fees you paid us in the twelve months immediately before the event giving rise to the claim. If you have paid nothing, our aggregate liability is limited to one hundred US dollars.
Nothing here limits liability that cannot lawfully be limited, including for fraud, or for death or personal injury caused by negligence. Some jurisdictions do not allow certain exclusions, so parts of this section may not apply to you.
Regulatory penalties, enforcement actions, breach notification costs and contractual losses arising from your own compliance posture or operations remain your responsibility.
10. Indemnity
You will defend and indemnify us against third-party claims arising from your content, your use of the service in breach of these terms, your violation of law, or your presentation of our outputs as certification, audit opinion or legal advice.
11. Suspension and termination
You may stop using the service at any time. We may suspend or terminate access for material breach of these terms, non-payment, or activity that threatens the security of the service — with notice and an opportunity to cure where the circumstances reasonably allow. On termination you may export your data for 30 days.
12. Changes to these terms
We may update these terms. For material changes we will notify account administrators by email at least 30 days before they take effect. Continuing to use the service after that constitutes acceptance; if you do not agree, cancel before the effective date.
13. General
These terms and the Privacy Policy are the entire agreement between us regarding the service. If a provision is held unenforceable, the rest remains in force. Our failure to enforce a provision is not a waiver of it. You may not assign these terms without our consent; we may assign them in connection with a merger, acquisition or sale of assets.
These terms are governed by the laws of the State of Delaware, excluding its conflict of law rules, and the parties submit to the exclusive jurisdiction of the state and federal courts located there.