# DoseTempo — Terms of Service (Clinic, Staff & Business Admin)
> **Scope:** These Terms govern the relationship between DoseTempo and the
> **healthcare practices** that use our platform, and the **staff and
> business administrators** those practices authorize to access it. They
> include HIPAA Business Associate provisions that must be read alongside a
> separately executed Business Associate Agreement (BAA).
>
> **Patients** are end users, not customers — their terms are in a separate
> document: `docs/TERMS-OF-SERVICE-PATIENT.md`. Patients do not execute a
> BAA, are not billed, and cannot export data.
>
> **Effective date:** October 23, 2026
> **Last updated:** October 24, 2026
> **Owner:** Legal / Security Officer — Aerron Retikis (aerron@domi-nation.online)
---
## Table of Contents
1. [Acceptance of Terms](#1-acceptance-of-terms)
2. [Eligibility & Permitted Use](#2-eligibility--permitted-use)
3. [Accounts & Access](#3-accounts--access)
4. [Your Obligations](#4-your-obligations)
5. [HIPAA & Business Associate Relationship](#5-hipaa--business-associate-relationship)
6. [Protected Health Information](#6-protected-health-information)
7. [Data Ownership & Export](#7-data-ownership--export)
8. [Data Retention & Deletion](#8-data-retention--deletion)
9. [Subscription & Billing](#9-subscription--billing)
10. [Acceptable Use Policy](#10-acceptable-use-policy)
11. [Service Availability](#11-service-availability)
12. [Intellectual Property](#12-intellectual-property)
13. [Disclaimers](#13-disclaimers)
14. [Limitation of Liability](#14-limitation-of-liability)
15. [Indemnification](#15-indemnification)
16. [Suspension & Termination](#16-suspension--termination)
17. [Confidentiality](#17-confidentiality)
18. [Changes to These Terms](#18-changes-to-these-terms)
19. [Governing Law & Dispute Resolution](#19-governing-law--dispute-resolution)
20. [Contact](#20-contact)
---
## 1. Acceptance of Terms
By creating an account, accessing, or using DoseTempo (the "Service"), you
(the "Customer" or "Practice") agree to be bound by these Terms of Service
("Terms"). If you are accepting these Terms on behalf of a practice, you
represent that you have the authority to bind that practice.
If you do not agree to these Terms, do not use the Service.
> These Terms govern the use of DoseTempo by prescribing practices and
> their authorized staff. They must be read alongside the DoseTempo
> Privacy Policy and a separately executed Business Associate Agreement
> (BAA).
---
## 2. Eligibility & Permitted Use
### 2.1 Who may use DoseTempo
DoseTempo is intended for licensed healthcare practices that prescribe
and/or dispense peptide therapies and wish to track patient-reported
adherence and anticipate replenishment needs.
By using the Service, you represent that:
- You are a licensed healthcare provider or practice authorized to
prescribe and dispense peptides in your jurisdiction.
- Your use of the Service complies with all applicable laws, including
HIPAA, state medical practice laws, and prescribing regulations.
- You will use the Service only for lawful purposes related to your
practice's patient care.
### 2.2 What DoseTempo is not
- DoseTempo is **not** a substitute for your EHR, practice management
software, or clinical judgment.
- DoseTempo does **not** verify whether a patient actually administered a
dose. It records patient-reported confirmations only.
- DoseTempo does **not** provide medical advice, diagnosis, or treatment
recommendations.
---
## 3. Accounts & Access
### 3.1 Account provisioning
- Accounts are provisioned by DoseTempo's administrator or by your
practice's business administrator.
- Each user receives a unique login. **Login sharing is prohibited.**
- New users receive a temporary password via email and should set a
permanent password on first sign-in. **Passwords must be at least 8
characters and include a capital letter, a number, and a symbol.**
### 3.2 Multi-factor authentication
- Every sign-in requires multi-factor authentication (a 6-digit code
emailed to the user's account). This cannot be disabled.
### 3.3 Session management
- Only one active session is permitted per user at a time.
- Sessions automatically expire after 15 minutes of inactivity.
- If you suspect unauthorized access, contact DoseTempo support
immediately.
### 3.4 Password responsibility
- You are responsible for maintaining the confidentiality of your
password and MFA codes.
- You are responsible for all activity that occurs under your account.
- Notify us immediately if you believe your account has been compromised.
### 3.5 Patient accounts
Patients are end users of the Service, not Customers. Patients are
governed by their own Terms of Service
(`docs/TERMS-OF-SERVICE-PATIENT.md`); the provisions below describe the
**Customer's** obligations regarding patient accounts. The following
applies to patient accounts:
- Patient accounts are created by the practice (Customer) when a
patient is enrolled in DoseTempo. Patients do not self-register.
- Patients receive a temporary password via email and are required to
set a permanent password on first sign-in (same policy: 8+ characters
with a capital letter, number, and symbol).
- Patients are subject to the same MFA, session management, and
brute-force protections as all other users (§3.2–3.3).
- **Patients cannot edit their own contact information** (name, date
of birth, email, phone). If a patient's information needs to change,
the patient messages their practice through the platform, and the
practice updates the record. **Location users can edit patient
contact information**, and every change is tracked in a change
history (what changed, who changed it, when). This ensures the
practice — as the covered entity — maintains an accurate medical
record.
- **Patients cannot export or download their own data.** Data export
is restricted to business administrators and super admins (§7.2).
Patients who want a copy of their records must request it through
their practice, which is the covered entity responsible for
fulfilling patient access requests under HIPAA.
- **Patients cannot delete their own account or data.** Only the
practice can deactivate a patient or direct data deletion.
- Patients are responsible for keeping their password and verification
code private and for reporting any suspected unauthorized access to
their practice or through the support ticket system.
- If a patient's account is compromised, the practice may suspend the
patient's access immediately. DoseTempo will investigate using audit
logs and complete a HIPAA 4-factor risk assessment.
- The Customer (practice) is responsible for ensuring patients have
consented to the use of DoseTempo for adherence tracking, in
accordance with applicable law and the Customer's own consent
practices.
- **Web push dose reminders.** Patients may enable push notifications
to receive a de-identified reminder ("Dose Reminder") when a dose is
scheduled. The notification body contains no PHI — no patient name,
no peptide, no dose details. Push notifications are delivered over TLS
via the browser's push service (FCM/APNs), which receives only the
anonymous notification body and no PHI. No Business Associate Agreement
is required for the push service because no PHI is transmitted to it.
Patients may disable notifications at any time from the app or their
device settings.
---
## 4. Your Obligations
As a Customer, you agree to:
- Use the Service only for patients under your active care.
- Enter accurate patient information (name, date of birth, email, phone,
peptide, schedule, supply) as prescribed.
- Ensure your patients have consented to the use of DoseTempo for
adherence tracking, in accordance with applicable law and your own
consent practices.
- Maintain the security of your login credentials and ensure your staff
do so.
- Comply with all applicable laws, including HIPAA, in your use of the
Service.
- Use the Service in accordance with the Acceptable Use Policy (Section 10).
- Promptly notify us of any suspected security incident or unauthorized
access.
---
## 5. HIPAA & Business Associate Relationship
### 5.1 Business Associate status
DoseTempo is a **business associate** to your practice (the covered
entity) under HIPAA. We create, receive, maintain, and transmit protected
health information (PHI) on your behalf to provide the Service.
### 5.2 Business Associate Agreement
- A separately executed **Business Associate Agreement (BAA)** governs the
handling of PHI and is incorporated into these Terms by reference.
- In the event of a conflict between these Terms and the BAA regarding PHI,
the BAA controls.
- You must execute a BAA with DoseTempo before using the Service with PHI.
### 5.3 Our commitments under HIPAA
We will:
- Use and disclose PHI only as permitted by the BAA or as required by law.
- Implement appropriate administrative, physical, and technical safeguards.
- **Notify you (the covered entity) of specified incidents within 3
business days** of discovery, and provide a complete breach report for
confirmed reportable breaches within **30 calendar days** of discovery.
These deadlines are shorter than HIPAA's outer regulatory limit
(§164.410(b): without unreasonable delay and no later than 60 calendar
days) so you have time to meet your own statutory notification
deadlines to affected individuals, HHS, and the media.
- Make PHI available to you for your patients' rights requests (access,
amendment, accounting of disclosures).
- Return or destroy PHI at termination of the BAA, if feasible, or extend
protections if retention is required by law.
- Ensure our subcontractors are bound by equivalent obligations.
### 5.4 Your responsibilities under HIPAA
You are the **covered entity**. You are responsible for:
- Obtaining patient consent for the use of DoseTempo, as required by law.
- **Notifying affected individuals, HHS, and (for breaches affecting 500+
individuals in a jurisdiction) the media** in the event of a reportable
breach, in accordance with the HIPAA Breach Notification Rule
(§164.404–406). DoseTempo (the business associate) notifies you; you
notify your patients.
- Maintaining your own HIPAA compliance, including risk analysis, workforce
training, and sanction policies.
- Ensuring your staff with access to DoseTempo are trained on HIPAA and
these Terms.
---
## 6. Protected Health Information
### 6.1 What we process
We process the PHI you enter into the Service: patient identifiers (name,
date of birth, email, phone), peptide prescriptions, dosing schedules,
dose confirmation logs, injection site selections, refill status, patient
diary entries (mood, symptoms, injection responses, and items flagged for
the care team), and messages between your staff and patients. Web push
dose reminder notifications are de-identified and contain no PHI — no PHI
is transmitted to the browser push service.
### 6.2 How we process it
- We process PHI only to provide, maintain, and improve the Service.
- We do **not** use PHI for marketing, advertising, or sale to third
parties.
- We do **not** use PHI to train AI models or sell derived analytics.
- We do **not** combine PHI across customers for any purpose.
### 6.3 Subcontractors
We use the following subcontractors, each bound by a Business Associate
Agreement and required to safeguard PHI under HIPAA:
- **Cloud (managed backend)** — hosts the database, authentication, and
storage.
We do not share PHI with any other third party for processing. Web push
dose reminders are delivered through the browser's push service (FCM/APNs),
which receives only a de-identified notification body — no PHI is
transmitted to the push service, so no BAA is required for it.
---
## 7. Data Ownership & Export
### 7.1 You own your data
You retain all rights to the patient data you enter into DoseTempo. We
process it on your behalf as your business associate. We claim no
ownership of your PHI.
### 7.2 Export rights
- **Business administrators** may export their own business's data as CSV
at any time.
- **Location users** (clinicians) cannot export data — export is
restricted to prevent bulk PHI from leaving the platform through a
single compromised credential.
- **Super admins** may export data for any business or location for
administrative purposes.
### 7.3 Export format
Exports are provided as CSV files containing patient-level data (name,
date of birth, email, phone, peptide, schedule, dose history, injection
sites) scoped to the requesting business or location.
---
## 8. Data Retention & Deletion
### 8.1 During your subscription
We retain your PHI for the duration of your subscription and as long as
you maintain active patients in the Service.
### 8.2 On termination
- You may request a full data export before termination.
- We will return or destroy your PHI as directed by you and as required by
the BAA, unless retention is required by law (e.g., audit logs).
- Audit logs are retained for a minimum of six years.
### 8.3 Scheduled deletion
- You may schedule a business or location for deletion through the admin
interface. Deletion is scheduled (not instant) and logged for compliance.
- A confirmation is required before any deletion is executed.
---
## 9. Subscription & Billing
### 9.1 Subscription model
DoseTempo is offered as a subscription service billed per practice
(business), with pricing based on the number of locations and active
seats (users).
### 9.2 Billing terms
- Subscription fees, billing cycle (monthly or annual), and seat counts
are configured at onboarding and may be adjusted by mutual agreement.
- Invoices are due per the terms stated on the invoice.
- Annual subscriptions may be offered at a discount; refunds for
mid-cycle cancellation of annual plans are subject to the terms agreed
at signing.
### 9.3 Billing records
Billing history, billing amount, and payment status are visible to the
business administrator in the admin dashboard.
> Specific pricing, payment processing, and refund terms will be set forth
> in a separate order form or subscription agreement executed between the
> parties.
---
## 10. Acceptable Use Policy
You agree not to:
- Use the Service to store, process, or transmit data other than PHI
related to your own patients.
- Enter information for patients who are not under your active care.
- Share, sell, or otherwise disclose PHI obtained through the Service to
any party not authorized under HIPAA and your BAA.
- Attempt to access data belonging to another practice, location, or
patient without authorization.
- Attempt to bypass security controls, including authentication,
encryption, or access restrictions.
- Use the Service in any manner that could damage, disable, or impair it.
- Introduce malware, viruses, or unauthorized software.
- Use another person's credentials or allow another person to use yours.
- Export PHI except through the authorized export features, and only if
your role permits it.
- Use the Service in violation of any applicable law.
Violation of this policy may result in immediate suspension of access and
termination of your account.
---
## 11. Service Availability
### 11.1 No guaranteed uptime
While we strive to maintain high availability, we do not guarantee that
the Service will be uninterrupted, error-free, or available at all times.
The Service depends on third-party infrastructure (edge runtime, managed
database, email delivery) that may experience outages outside our
control.
### 11.2 Emergency mode
If the Service is unavailable, your practice should maintain a paper-based
dose logging fallback so patients can continue tracking their medication.
See the DoseTempo Disaster Recovery Plan for the emergency mode procedure.
### 11.3 Maintenance
We may perform scheduled maintenance with reasonable notice. We are not
liable for downtime during scheduled maintenance.
---
## 12. Intellectual Property
### 12.1 DoseTempo
The Service, including its software, design, branding, and documentation,
is owned by DoseTempo and protected by intellectual property laws. These
Terms grant you a limited, non-exclusive, non-transferable license to use
the Service for the duration of your subscription.
### 12.2 Your data
You retain all rights to the patient data you enter. We retain all rights
to the Service, including aggregated, de-identified, non-PHI analytics
that do not identify any individual patient.
### 12.3 Restrictions
You may not:
- Copy, modify, or reverse-engineer the Service.
- Resell or redistribute access to the Service.
- Remove or alter any proprietary notices.
---
## 13. Disclaimers
### 13.1 As-is service
The Service is provided "as is" and "as available," without warranties of
any kind, express or implied, including but not limited to warranties of
merchantability, fitness for a particular purpose, or non-infringement.
### 13.2 No clinical warranty
DoseTempo does not provide medical advice and does not verify dose
administration. Adherence data reflects patient-reported information only.
We are not responsible for clinical decisions made based on the Service's
data, and the Service is not a substitute for professional medical
judgment.
### 13.3 No warranty on third-party services
We rely on third-party infrastructure and email delivery. We do not
warrant the availability or performance of those services.
---
## 14. Limitation of Liability
### 14.1 General limitation
To the maximum extent permitted by law, DoseTempo's total liability for
any claim arising out of or relating to these Terms or the Service shall
not exceed the amount you paid for the Service in the twelve (12) months
preceding the claim.
### 14.2 Excluded damages
In no event shall DoseTempo be liable for indirect, incidental, special,
consequential, or punitive damages, or for loss of profits, data, or
business interruption, except to the extent such exclusion is prohibited
by law.
### 14.3 HIPAA liability
Nothing in this section limits liability that cannot be limited under
applicable law, including liability for breaches of the HIPAA Privacy,
Security, or Breach Notification Rules to the extent such liability is
imposed by law or by the BAA.
---
## 15. Indemnification
You agree to indemnify and hold harmless DoseTempo from any claims,
damages, or expenses (including reasonable attorneys' fees) arising from:
- Your breach of these Terms or the BAA.
- Your violation of applicable law, including HIPAA.
- Your misuse of the Service or PHI.
- Claims by your patients arising from your clinical decisions or your
use of the Service.
This indemnification does not apply to the extent a claim arises from
DoseTempo's breach of the BAA or gross negligence or willful misconduct.
---
## 16. Suspension & Termination
### 16.1 Suspension
We may suspend access to the Service if:
- You breach these Terms or the BAA.
- We suspect unauthorized access or a security incident involving your
account.
- Required by law or by a security incident response.
- You fail to pay subscription fees when due.
Suspension requires confirmation and will be logged. We will notify you
of the reason for suspension unless doing so would compromise an
investigation.
### 16.2 Termination by you
You may terminate your subscription by providing written notice. On
termination, you may export your data, and we will return or destroy PHI
per the BAA.
### 16.3 Termination by us
We may terminate your account for material breach of these Terms or the
BAA that is not cured within 30 days of notice, or immediately for
non-payment, security violations, or illegal use.
### 16.4 Effect of termination
On termination:
- Your access to the Service ceases.
- We will return or destroy PHI per the BAA, subject to legal retention
requirements.
- Provisions that by nature should survive termination (including HIPAA
obligations, confidentiality, indemnification, and limitation of
liability) survive.
---
## 17. Confidentiality
Each party agrees to keep confidential any non-public information
received from the other, including PHI, business information, and the
terms of these Terms. PHI is governed by the BAA. This obligation survives
termination.
---
## 18. Changes to These Terms
We may update these Terms from time to time. Material changes will be
communicated to your business administrator with reasonable notice.
Continued use of the Service after changes take effect constitutes
acceptance of the revised Terms.
---
## 19. Governing Law & Dispute Resolution
### 19.1 Governing law
These Terms are governed by the laws of the jurisdiction in which
DoseTempo is organized, without regard to conflict-of-laws principles.
> The specific jurisdiction should be confirmed with legal counsel and
> inserted here.
### 19.2 Dispute resolution
- The parties will attempt to resolve disputes informally first.
- Unresolved disputes may be submitted to binding arbitration or the
courts of the governing jurisdiction, as agreed by the parties.
- Class actions are waived to the extent permitted by law.
> The specific dispute resolution mechanism (arbitration vs. litigation,
> venue, and arbitrator selection) should be confirmed with legal counsel.
---
## 20. Contact
For questions about these Terms, your subscription, or to report a
security concern:
- Submit a support ticket through the DoseTempo platform.
- Mark urgent security concerns as "URGENT — SECURITY."
For legal notices, contact the DoseTempo Legal/Security Officer — Aerron
Retikis — at aerron@domi-nation.online or through the platform's support
ticket system.
---
## Appendix A: HIPAA Cross-Reference
| HIPAA Requirement | Addressed In |
|---|---|
| Business Associate Agreement | §5 |
| Permitted uses & disclosures | §5, §6 |
| Safeguards (administrative, physical, technical) | §5, Privacy Policy §8 |
| Breach notification | §5.3, Privacy Policy §10 |
| Patient rights (access, amendment, accounting) | Privacy Policy §6 |
| Data return/destruction at termination | §8, §16.4 |
| Audit log retention (6 years) | §8.3 |
| Minimum necessary / role-based access | Privacy Policy §8.3 |
---
*These Terms are the official Terms of Service of DoseTempo, effective as of
the last-updated date above.*