Terms of Service

01About these Terms

This website and the OptimNav platform are provided by OptimNav (“OptimNav,” “we,” “us” or “our”). The platform is an artificial intelligence agent and robotic process automation platform that helps 340B covered entities, hospitals, health systems and their authorized representatives find, document and review referral prescriptions and the contract pharmacy claims tied to them (the “Services”).

These Terms of Service (“Terms”) apply to this website and any related pages we operate (the “Site”) and to the Services. By accessing the Site or using the Services, you agree to these Terms. If you use the Services on behalf of an organization, you confirm that you are authorized to accept these Terms for that organization, and “you” includes that organization.

Many customers sign a separate agreement with OptimNav. If documents conflict, they apply in this order:

• The Business Associate Agreement, for anything involving protected health information.
• The Customer Agreement, meaning any master services agreement, order form or statement of work signed by you and OptimNav.
• These Terms.
• Our documentation for the Services.

If you do not agree to these Terms, do not use the Site or the Services.

02Definitions

Customer

The organization that has entered into a Customer Agreement with OptimNav, such as a 340B covered entity, hospital or health system.

Authorized User

An employee, contractor or agent of a Customer whom the Customer permits to use the Services, including a 340B consultant or third-party administrator acting under a written agreement with the Customer.

Customer Systems

Electronic health records, practice management, document management, fax, referral, pharmacy, third-party administrator, split-billing, claims and other systems that a Customer connects to the Services or authorizes the Services to access.

Customer Data

All data submitted to the Services by or for a Customer, or accessed by the Services from Customer Systems, including protected health information.

Outputs

Referral findings, claim matches, policy checks, confidence scores, recommendations, reasoning summaries, evidence packets, reports and other material the Services generate.

PHI

Protected health information, as defined at 45 C.F.R. § 160.103.

HIPAA

The Health Insurance Portability and Accountability Act of 1996, the Health Information Technology for Economic and Clinical Health (HITECH) Act, and their implementing regulations at 45 C.F.R. Parts 160 and 164, each as amended.

340B Program

The drug pricing program established by Section 340B of the Public Health Service Act, 42 U.S.C. § 256b, together with the regulations and guidance of the Health Resources and Services Administration (“HRSA”).

03Eligibility and accounts

The Services are offered only to organizations and their Authorized Users for business purposes in the United States. They are not offered to consumers or to patients. You must be at least 18 years old to use the Services.

• Credentials. Each Authorized User must have unique login credentials and may not share them. Where we offer or require multi-factor authentication, it must stay enabled.
• Provisioning. The Customer is responsible for granting, reviewing and promptly removing access, and for limiting each Authorized User’s role to the minimum necessary for that person’s job.
• Responsibility. The Customer is responsible for everything done through its accounts and for its Authorized Users’ compliance with these Terms.
• Unauthorized access. Notify us right away at security@optimnav.com if you suspect an account or credential has been compromised.

04Access to your systems

The Services work by reading records in Customer Systems. The Customer authorizes OptimNav to access, retrieve and process Customer Data from Customer Systems through the integrations, application programming interfaces, file transfers, service accounts, credentials and automation methods the Customer approves, solely to provide the Services.

The agent acts only within the permissions you grant

The Services operate within the access the Customer configures. Where the Customer enables the Services to take an action in a Customer System, such as updating a claim status in a third-party administrator platform, the Customer authorizes that action and is responsible for reviewing the configuration before enabling it. The Services are not designed to create, change or delete clinical documentation in a medical record, and the Customer will not configure them to do so.

Your commitments

• You have the rights, licenses and authority needed to give OptimNav access to each Customer System and to the Customer Data in it.
• Our access, as you configure it, is permitted by your agreements with the vendors of those systems. You are responsible for any fees those vendors charge.
• You have obtained any consents, authorizations or approvals required for that access under applicable law and your own policies.

Credentials you give us

We store system credentials encrypted, restrict them to the personnel and processes that need them, and use them only to provide the Services. You may revoke our access at any time. Revoking access may interrupt the Services. We are not responsible for outages, changes or errors in Customer Systems, and changes to those systems may require changes to your configuration.

05Your 340B program remains yours

OptimNav supports your team’s work. It does not take over your obligations. The Customer remains solely responsible for its participation in the 340B Program, including:

• Registration, recertification and the accuracy of information on file with HRSA.
• Determining patient eligibility and whether each prescription and claim qualifies.
• Writing, maintaining and following its 340B policies and procedures.
• Preventing diversion and duplicate discounts, including through the Medicaid Exclusion File and state Medicaid requirements.
• Its contract pharmacy arrangements and any data it submits to manufacturers, rebate programs or claims data platforms.
• Maintaining auditable records for as long as HRSA guidance, manufacturer agreements and applicable law require.
• Responding to HRSA audits, manufacturer audits, self-disclosures and any repayment obligations.

The Services apply the rules the Customer configures based on its written policies. OptimNav does not decide what those policies should be and does not guarantee that any claim qualifies or that HRSA, a manufacturer, an auditor or a court will accept a determination. Nothing on the Site or in the Services is legal, regulatory, compliance, financial or clinical advice. Customers should rely on their own counsel and 340B advisors.

Unless the Customer Agreement says otherwise, the Services are not the Customer’s system of record for 340B recordkeeping. Customers should export and keep the evidence packets and other records they need.

06AI outputs and human review

Outputs are generated with machine learning models, large language models and automation. They can be incomplete, inaccurate or inconsistent, even when presented with a high confidence score. A confidence score is a statistical estimate, not a guarantee.

• People make the decisions. The Customer will keep qualified personnel reviewing Outputs before relying on them for any qualification, financial, reporting or compliance decision. The Customer sets its own review thresholds and is responsible for them, and for every decision made using Outputs.
• No clinical use. The Services are not a medical device and do not provide clinical decision support. Outputs must not be used to diagnose, treat or make care decisions for any patient, or to communicate with patients.
• Sources stay visible. The Services are designed to link each conclusion to the records it relied on so reviewers can check the underlying evidence. Reviewers should do so.
• Report errors. Tell us about material errors in Outputs. We will make reasonable efforts to investigate and correct them.
• Corrections. Approvals, rejections and corrections your Authorized Users make may be used to tune how the Services work for your organization, subject to Section 8.

07HIPAA and protected health information

When OptimNav creates, receives, maintains or transmits PHI on behalf of a Customer that is a covered entity, or a business associate of one, OptimNav does so as a business associate or subcontractor under HIPAA. The parties’ Business Associate Agreement (“BAA”) governs that PHI. OptimNav will not process PHI for a Customer unless a BAA is in effect. Under the BAA and HIPAA, OptimNav will:

• Use and disclose PHI only as the BAA permits or as required by law, and limit uses and disclosures to the minimum necessary.
• Maintain administrative, physical and technical safeguards that comply with the HIPAA Security Rule, 45 C.F.R. Part 164, Subpart C.
• Report security incidents and breaches of unsecured PHI to the Customer as required by the BAA and 45 C.F.R. § 164.410.
• Require any subcontractor that handles PHI to agree in writing to the same restrictions and conditions.
• Support the Customer in meeting individuals’ rights of access, amendment and accounting of disclosures.
• Make its internal practices, books and records relating to PHI available to the Secretary of Health and Human Services as required.
• Return or destroy PHI when the relationship ends, where feasible, and extend the BAA’s protections to any PHI that cannot feasibly be returned or destroyed.

Records with heightened protection

If Customer Data includes substance use disorder records protected by 42 C.F.R. Part 2, or information that receives heightened protection under other federal or state law, the Customer will identify it and tell us of any restrictions on its use or disclosure. The parties will handle that information as those laws require.

Do not send PHI through the Site

The Site, its contact links and our general email addresses are not designed to receive PHI. Do not send PHI through them. Use only the secure channels OptimNav designates for your organization.

08Customer Data

You own your data

As between the parties, the Customer owns all Customer Data. Outputs generated from Customer Data are Customer Data, except for the Services themselves and OptimNav’s underlying software, models, prompts, templates, methods and know-how.

How we may use it

The Customer grants OptimNav a limited, non-exclusive license to host, copy, process, transmit and display Customer Data only as needed to provide, secure, support and maintain the Services for that Customer, to prevent or address technical and security problems, and as required by law, in each case consistent with the BAA.

What we will not do

• We do not sell Customer Data.
• We do not use PHI for marketing or advertising.
• We do not use a Customer’s PHI to train or fine-tune artificial intelligence models made available to other customers unless that Customer authorizes it in writing and HIPAA permits it.
• We do not allow third-party AI model providers to use Customer Data to train their models.

De-identified and aggregate data

OptimNav may de-identify PHI in accordance with 45 C.F.R. § 164.514 only where the BAA expressly permits it. OptimNav may compile aggregate operational metrics about use and performance of the Services that do not identify any Customer or individual, and may use them to operate and improve the Services.

Subprocessors and location

OptimNav uses subprocessors, including cloud infrastructure and hosted AI model providers, to deliver the Services. Every subprocessor that handles PHI is bound by a written business associate agreement. Customer Data is stored and processed in the United States unless the Customer agrees otherwise in writing. A current list of subprocessors is available to Customers on request.

Export and deletion

During the term, Customers may export their Customer Data, including evidence packets, using the export tools in the Services. After the Customer Agreement ends, the Customer has 30 days to request an export, unless the Customer Agreement says otherwise. OptimNav will then delete or return Customer Data as the Customer Agreement and BAA require, except where law requires us to keep it, in which case its protections continue for as long as we hold it.

09Security

OptimNav maintains a security program designed to protect Customer Data that is consistent with the HIPAA Security Rule. It includes:

• Encryption of Customer Data in transit and at rest.
• Role-based access controls and least-privilege access for our personnel.
• Multi-factor authentication for workforce access to production systems.
• Logging and monitoring, including an audit trail of the agent’s activity and the sources behind each Output.
• Vulnerability management, secure development practices and change control.
• Security and privacy training and confidentiality obligations for our workforce.
• Risk review of vendors that handle Customer Data.
• Backups, business continuity planning and documented incident response.

The Customer is responsible for securing its own systems, devices and credentials and for configuring user access appropriately. We will notify affected Customers of security incidents without unreasonable delay and within the timelines set by the BAA and applicable law.

Do not run penetration tests, vulnerability scans or load tests against the Services without our written approval. Please report suspected vulnerabilities to security@optimnav.com. We appreciate good-faith reports and will work with you to address them.

10Acceptable use

You will not, and will not allow anyone else to:

• Use the Site or Services in violation of any law, including HIPAA, the 340B statute, the federal Anti-Kickback Statute (42 U.S.C. § 1320a-7b(b)), the False Claims Act (31 U.S.C. §§ 3729–3733) and state health information and privacy laws.
• Use the Services to access any system or data you are not authorized to access, or to exceed your authorized access.
• Use Outputs to make clinical decisions, to deny, delay or change patient care, or for any purpose unrelated to the Customer’s own operations, such as marketing to patients.
• Alter evidence packets or other Outputs to misrepresent their content or source, or submit false or misleading information to HRSA, a manufacturer or any other party.
• Copy, modify, reverse engineer, decompile or attempt to extract the source code, models, model weights, prompts or system instructions of the Services, except to the extent the law expressly permits.
• Bypass or disable security, authentication or usage limits, introduce malicious code, or interfere with the Services or the systems they run on.
• Scrape or crawl the Site or the Services, or access them by automated means other than interfaces we provide.
• Resell, sublicense or provide the Services to anyone who is not an Authorized User, or use them to build a competing product.
• Publish benchmark or performance tests of the Services without our written consent.

11Third-party systems and services

The Services work with products and services that OptimNav does not control, including electronic health record systems, third-party administrators, contract pharmacies and cloud providers. Your use of those products is governed by your agreements with their providers. OptimNav is not responsible for them, for their availability or for changes to them. Third-party names and trademarks belong to their owners, and their mention does not imply endorsement.

12Fees

Fees, invoicing and payment terms for the Services are set out in the Customer Agreement. Fees are exclusive of taxes, which the Customer pays except for taxes on OptimNav’s income. If undisputed fees remain unpaid after written notice and the cure period in the Customer Agreement, OptimNav may suspend the Services until payment is made.

13Intellectual property

OptimNav and its licensors own the Site, the Services and all related software, models, prompts, workflows, designs, documentation and improvements, along with all intellectual property rights in them. Customers receive only the limited right to use the Services set out in the Customer Agreement during its term. All other rights are reserved.

If you send us suggestions or feedback, we may use them without obligation to you, provided we do not disclose your Confidential Information or any PHI in doing so. OptimNav and its logo are trademarks of OptimNav and may not be used without our prior written permission.

14Confidentiality

“Confidential Information” means non-public information one party discloses to the other that is marked confidential or that a reasonable person would understand to be confidential. It includes Customer Data, the non-public features of the Services and the terms of the Customer Agreement. Each party will protect the other’s Confidential Information with at least reasonable care, use it only to perform under these Terms and the Customer Agreement, and share it only with personnel and advisors who need to know it and are bound by similar obligations.

These obligations do not apply to information that is or becomes public through no fault of the receiving party, was already known to it, was independently developed, or was lawfully received from a third party without restriction. A party may disclose Confidential Information when required by law, after giving prompt notice where lawful so the other party can seek protection. PHI is always governed by the BAA, regardless of these exceptions.

15Healthcare compliance

• Exclusion. Each party represents that neither it nor any of its personnel performing under the Customer Agreement is excluded, debarred, suspended or otherwise ineligible to participate in any federal health care program or federal procurement program, including as listed by the HHS Office of Inspector General or on SAM.gov. Each party will tell the other promptly if that changes.
• Audit support. At the Customer’s request, OptimNav will reasonably cooperate with HRSA audits, manufacturer audits and government inquiries about the Customer’s use of the Services, including by providing available records of agent activity and evidence packets for the relevant period, on the terms set out in the Customer Agreement.
• No inducement. Nothing in these Terms or the Customer Agreement requires or is intended to induce any party to refer patients, or to purchase, order or arrange for any item or service paid for by a federal health care program.
• Public entities. If the Customer is a governmental entity, any provision of these Terms that the Customer is prohibited by law from accepting, such as certain indemnification, governing law or confidentiality provisions, applies only to the extent the law permits. OptimNav will cooperate with the Customer’s obligations under applicable public records laws.

16Suspension and termination

OptimNav may suspend access to the Services, in whole or in part, if it reasonably believes suspension is needed to prevent a security threat or harm to the Services, other customers or individuals, or to stop use that violates the law or these Terms. Where practicable, we will give advance notice, limit the suspension to what is necessary, and restore access promptly once the issue is resolved.

The term and termination rights for the Services are set out in the Customer Agreement. We may suspend or end access to the Site at any time. When access ends, you must stop using the Services. Section 8 governs the export and deletion of Customer Data. Sections that by their nature should survive will survive, including those on Customer Data, confidentiality, disclaimers, limitation of liability, indemnification and general terms.

17Disclaimers

Except as expressly stated in the Customer Agreement, the Site and the Services are provided “as is” and “as available.” To the fullest extent permitted by law, OptimNav disclaims all warranties, express, implied or statutory, including implied warranties of merchantability, fitness for a particular purpose, title, non-infringement and accuracy.

OptimNav does not warrant that Outputs will be accurate, complete or error-free; that the Services will be uninterrupted; that any prescription or claim will qualify under the 340B Program; that any level of savings or revenue will be achieved; or that any determination will be accepted by HRSA, a manufacturer, an auditor or a court.

Content on the Site is provided for general information only.

18Limitation of liability

Except as otherwise provided in the Customer Agreement or the BAA, and to the fullest extent permitted by law, neither party will be liable for any indirect, incidental, special, consequential, exemplary or punitive damages, or for any loss of profits, revenue, savings, data or goodwill, however caused and even if advised of their possibility.

Except as otherwise provided in the Customer Agreement or the BAA, each party’s total liability arising out of or relating to these Terms or the Services will not exceed the fees the Customer paid to OptimNav for the Services in the 12 months before the event giving rise to the claim. If you have no Customer Agreement, OptimNav’s total liability to you will not exceed one hundred U.S. dollars ($100).

Some jurisdictions do not allow certain exclusions or limitations of liability, so some of the above may not apply to you.

19Indemnification

By the Customer. Except as otherwise provided in the Customer Agreement, the Customer will defend OptimNav and its personnel against third-party claims, and pay resulting losses, to the extent they arise from Customer Data, the Customer’s 340B Program decisions and submissions, the access to Customer Systems the Customer authorized, or use of the Services in violation of these Terms or the law.

By OptimNav. Except as otherwise provided in the Customer Agreement, OptimNav will defend the Customer against third-party claims alleging that the Services, as provided by OptimNav, infringe a United States patent, copyright or trademark or misappropriate a trade secret, and pay resulting losses. This obligation does not apply to claims arising from Customer Data, from combinations with items not provided by OptimNav, or from modifications or uses not authorized by OptimNav.

Process. The party seeking defense must give prompt written notice of the claim, allow the defending party to control the defense and settlement, and provide reasonable cooperation. No settlement may impose an obligation or admission on the defended party without its consent, which may not be unreasonably withheld.

20Changes to these Terms

We may update these Terms from time to time. We will post the updated Terms on this page and change the “Last updated” date. For material changes, we will notify Customers by email or in the Services at least 30 days before the changes take effect, unless a change is required sooner by law. Changes to these Terms do not modify a signed Customer Agreement or BAA. Continued use of the Site or Services after changes take effect means you accept them.

21General terms

• Governing law and venue. Unless the Customer Agreement says otherwise, these Terms are governed by the laws of the state in which OptimNav has its principal place of business, without regard to conflict of laws rules, and the parties submit to the exclusive jurisdiction of the state and federal courts located in that state. Either party may seek injunctive relief in any court of competent jurisdiction to protect its Confidential Information, PHI or intellectual property.
• Assignment. Neither party may assign these Terms without the other’s consent, except to a successor in a merger, acquisition or sale of substantially all of its relevant assets that agrees to be bound by them, and, for PHI, by the BAA.
• Force majeure. Neither party is liable for delays caused by events beyond its reasonable control. This does not excuse payment obligations or OptimNav’s obligation to safeguard PHI.
• Independent parties. The parties are independent contractors. Nothing in these Terms creates a partnership, joint venture, agency or employment relationship.
• No third-party beneficiaries. These Terms create no rights for anyone other than the parties, including patients, prescribers, pharmacies and manufacturers.
• Notices. Notices to OptimNav must be sent to legal@optimnav.com. We may send notices to the email address associated with your account or Customer Agreement. You agree to receive communications from us electronically.
• Export and sanctions. You will comply with U.S. export control and sanctions laws in using the Site and the Services.
• Severability and waiver. If a provision is found unenforceable, it will be enforced to the maximum extent permitted and the rest of these Terms will remain in effect. A failure to enforce a provision is not a waiver.
• Entire agreement. These Terms, together with any Customer Agreement and BAA, are the entire agreement between the parties on their subject matter and replace any prior understandings about it.

22Contact

Questions about these Terms can be sent to OptimNav at:

• Legal and noticeslegal@optimnav.com
• Security and vulnerability reportssecurity@optimnav.com
• Privacyprivacy@optimnav.com