AiFax.net Terms of Service and Business Associate Agreement

Healthcare Utilization Consultants LLC, d/b/a AiFax.net ("AiFax," "we," "us")
Version 1.1. Effective date: September 10, 2026.

Part I. Terms of Service

1. The Service

AiFax provides HIPAA-compliant electronic fax service, including sending and receiving of fax documents, online document access, number porting, and optional document-processing features. Service plans include a monthly page allowance; pages sent beyond the plan allowance are billed at the per-page overage rate shown on our pricing page. Faxing is never interrupted when an allowance is exceeded.

2. Accounts and Acceptable Use

1. You are responsible for maintaining the confidentiality of your login credentials and for all activity under your account.
2. You may not use the service for unlawful purposes, for unsolicited broadcast faxing in violation of the Telephone Consumer Protection Act (TCPA) or the Junk Fax Prevention Act, or to transmit malicious content.
3. You represent that information you provide at signup, including number-porting authorizations, is accurate and that you are authorized to act for the organization you register.

3. Billing

1. Subscriptions bill monthly in advance; page overages bill in arrears on the next invoice.
2. Number porting into AiFax is included. If you leave the service, we will cooperate with porting your number to your new provider.
3. Fees are non-refundable except where required by law or expressly stated otherwise.

4. Service Levels and Support

We target continuous availability but do not guarantee uninterrupted service; fax delivery also depends on carriers and the receiving party's equipment. Support is available at info@aifax.net.

5. Termination

You may cancel at any time from your billing portal. We may suspend or terminate accounts for material breach of these terms, non-payment, or unlawful use, with notice where practicable. Sections of these terms that by their nature should survive termination survive, including the PHI return-and-destruction obligations of the BAA.

6. Liability

To the maximum extent permitted by law, AiFax's aggregate liability arising out of the service is limited to the amounts you paid to AiFax in the twelve months preceding the claim. Neither party is liable for indirect, incidental, or consequential damages. Nothing in this section limits either party's obligations under HIPAA or liability for gross negligence or willful misconduct.

7. General

These terms are governed by the laws of the State of Florida, without regard to conflicts of law. If any provision is held unenforceable, the remainder stays in effect. We may update these terms with notice; continued use after the effective date of an update constitutes acceptance. The version number and effective date at the top of this page identify the terms you accepted.

Part II. Business Associate Agreement (BAA)

This Business Associate Agreement ("BAA") is entered into between the customer accepting these terms ("Customer," acting as a Covered Entity or as a Business Associate of a Covered Entity, as applicable) and Healthcare Utilization Consultants LLC d/b/a AiFax.net ("Business Associate"), and applies whenever Customer creates, receives, maintains, or transmits Protected Health Information ("PHI") through the AiFax service. It is intended to satisfy 45 CFR 164.504(e) and 164.314(a) of the HIPAA Rules.

1. Definitions

Terms used but not otherwise defined here, including "Breach," "Electronic Protected Health Information (ePHI)," "Protected Health Information," "Required by Law," "Secretary," "Security Incident," and "Subcontractor," have the meanings given in the HIPAA Rules (45 CFR Parts 160, 162, and 164, as amended, including by the HITECH Act and subsequent rulemaking).

2. Permitted Uses and Disclosures

1. Business Associate may use and disclose PHI only as necessary to provide the fax and document services described in Part I, as permitted by this BAA, or as Required by Law.
2. Business Associate may use PHI for its proper management and administration and to carry out its legal responsibilities, and may disclose PHI for those purposes where the disclosure is Required by Law or where reasonable assurances of confidentiality and breach notification are obtained from the recipient.
3. Business Associate may de-identify PHI in accordance with 45 CFR 164.514(b) only as needed to provide and improve the service.
4. Business Associate will not sell PHI, and will not use or disclose PHI for marketing or fundraising purposes.
5. Business Associate will request, use, and disclose only the minimum necessary PHI to accomplish the intended purpose.
6. Business Associate will not use PHI, or data de-identified from PHI, to train, fine-tune, or improve any artificial-intelligence or machine-learning model, whether its own or a third party's. AI document-processing features operate only on the individual document being processed for Customer, and Business Associate contractually prohibits its AI vendors from retaining Customer content for training.
7. Business Associate will store and process PHI only in data centers located in the United States, and will not transfer PHI outside the United States without Customer's prior written consent.
8. To the extent Business Associate carries out any of Customer's obligations under Subpart E of 45 CFR Part 164, Business Associate will comply with the requirements of Subpart E that apply to Customer in the performance of those obligations.

3. Safeguards

1. Business Associate will implement administrative, physical, and technical safeguards that comply with the HIPAA Security Rule (45 CFR Part 164, Subpart C) for all ePHI it creates, receives, maintains, or transmits, including: encryption of ePHI in transit (TLS 1.2 or higher) and at rest (AES-256), role-based access controls, multi-factor authentication for administrative access, centralized audit logging, workforce security training, and a documented risk analysis and risk management program reviewed at least annually.
2. Business Associate maintains written policies and procedures and an inventory of systems that store or process ePHI, consistent with current HHS Security Rule guidance.
3. At least once every twelve (12) months, and at any time on Customer's reasonable request, Business Associate will provide Customer a written verification, signed by a person with responsibility for Business Associate's security program, that the technical safeguards described in this Section are in place and operating. This verification is intended to satisfy the business associate verification requirements of the HIPAA Security Rule as amended from time to time.
4. Business Associate maintains a contingency plan, including data backup, disaster recovery, and emergency-mode operation procedures, designed to restore the service and access to ePHI within seventy-two (72) hours of a loss.

4. Reporting

1. Business Associate will report to Customer any use or disclosure of PHI not permitted by this BAA, any Security Incident (excluding unsuccessful routine attempts such as pings and port scans, which are hereby reported generally), and any Breach of Unsecured PHI.
2. Business Associate will give Customer preliminary notice of any Breach of Unsecured PHI, and of any Security Incident that Business Associate reasonably believes may have compromised PHI, within seventy-two (72) hours of discovery, and will deliver a complete report without unreasonable delay and in no case later than ten (10) business days after discovery. The report will include, to the extent known, the identification of affected individuals and the information required by 45 CFR 164.410, and will be supplemented as further information becomes available.
3. Business Associate will notify Customer within twenty-four (24) hours of activating its contingency plan in response to an event that affects Customer's ePHI or Customer's access to the service.
4. Business Associate will mitigate, to the extent practicable, any harmful effect known to it of a use or disclosure of PHI in violation of this BAA, and will cooperate with Customer's investigation and with any notifications Customer is required to make.

5. Subcontractors

Business Associate will ensure that any Subcontractor that creates, receives, maintains, or transmits PHI on its behalf (including telecommunications carriers, hosting providers, and any artificial-intelligence or document-processing vendors) agrees in writing to restrictions and security obligations at least as protective as those in this BAA, in accordance with 45 CFR 164.502(e)(1)(ii) and 164.308(b)(2).

6. Individual Rights

1. Business Associate will make PHI in a Designated Record Set available to Customer as needed for Customer to meet its obligations under 45 CFR 164.524 (access) and will incorporate amendments as directed by Customer under 45 CFR 164.526.
2. Business Associate will document and make available to Customer the information required for an accounting of disclosures under 45 CFR 164.528.
3. If an individual requests access directly from Business Associate, Business Associate will forward the request to Customer within five (5) business days.

7. Customer Obligations

1. Customer will notify Business Associate of any limitation in Customer's notice of privacy practices, any change in or revocation of an individual's permission to use or disclose PHI, and any restriction on the use or disclosure of PHI that Customer has agreed to under 45 CFR 164.522, to the extent any of these affect Business Associate's use or disclosure of PHI.
2. Customer will not request Business Associate to use or disclose PHI in any manner that would not be permissible under the HIPAA Rules if done by Customer, except as permitted for Business Associate's proper management and administration under Section 2.
3. Customer is responsible for obtaining any consents or authorizations required for the PHI it transmits through the service, for the accuracy of the fax numbers and email addresses it directs documents to, and for the confidentiality of its own login credentials.

8. Books and Records

Business Associate will make its internal practices, books, and records relating to the use and disclosure of PHI available to the Secretary of HHS for purposes of determining compliance with the HIPAA Rules.

9. Term and Termination

1. This BAA is effective upon acceptance and continues until the customer relationship ends or the BAA is terminated as provided here.
2. Either party may terminate this BAA and the underlying service if the other party materially breaches this BAA and fails to cure within thirty (30) days of written notice.
3. Upon termination, Business Associate will return or destroy all PHI in its possession within thirty (30) days, and will retain no copies. If return or destruction is infeasible (for example, where retention is required by law or held on archival backup media pending scheduled destruction), the protections of this BAA extend to that PHI for as long as it is retained, and uses and disclosures are limited to the purposes that make return or destruction infeasible. Written confirmation of destruction is available on request.

10. Miscellaneous

1. Nothing in this BAA creates any rights in third parties.
2. Any ambiguity in this BAA shall be interpreted to permit compliance with the HIPAA Rules. This BAA shall be amended automatically to the extent necessary to comply with changes to the HIPAA Rules; AiFax will post updated versions at this URL with a new version number and effective date.
3. If Customer requires a countersigned copy of this BAA, or wishes to execute Customer's own form of BAA instead, contact info@aifax.net. In the event of a conflict between this BAA and the Terms of Service concerning PHI, this BAA controls.

11. Acceptance

By checking the acceptance box presented at signup (which records the date, time, account, and version of this agreement) or by using the service to transmit PHI, Customer and Business Associate agree to be bound by this BAA. Both parties intend electronic acceptance to constitute execution of this agreement.