Project Skylar Application Terms

1. Scope and agreements

Project Skylar is provided by 912 Dynamics, Inc., a Delaware corporation, at 325 Martha Lane, Fort Worth, TX 76126 (912 Dynamics, we, us). These Application Terms apply to authorized use of the Project Skylar web application and supported mobile applications by a subscribing organization (Customer) and its authorized users.

These terms supplement the Customer’s applicable service agreement, order and Application License Agreement. They do not replace an executed agreement or change its fees, liability allocation, governing law, notice requirements or other negotiated provisions. The executed agreement controls a conflict; for protected health information (PHI), the applicable Business Associate Agreement (BAA) and law control. A website update does not amend an executed BAA or establish acceptance on behalf of a Customer.

Our general Website Terms of Use apply to the marketing website. Their public-content licenses, non-confidential submission provisions and discretionary deletion provisions do not apply to confidential Customer records or PHI in Project Skylar. The Project Skylar Privacy Policy explains the application’s data handling.

2. Authorized access and use

Subject to the applicable agreement, 912 Dynamics permits authorized users to access and use Project Skylar for the Customer’s lawful internal purposes within the enabled features and assigned department permissions. The Customer must have authority to provide its data and to direct its processing, designate authorized users, keep account information current, and promptly remove access when it is no longer appropriate.

Do not share credentials, bypass department or role restrictions, attempt unauthorized access, misuse another organization’s records, or upload material you have no right to use. Each user must follow the Customer’s policies and the service’s required authentication and device controls. Account access is not permission to process PHI in every available feature.

3. Healthcare data and HIPAA

PHI means protected health information under the Health Insurance Portability and Accountability Act and its implementing rules (HIPAA). When 912 Dynamics processes PHI on behalf of a Customer that is a covered entity or another business associate, the applicable BAA defines the parties’ roles, permitted uses and responsibilities.

Before introducing PHI, the Customer and 912 Dynamics must execute the required BAA and confirm the approved Production environment, features, data destinations and required safeguards. Only that confirmed scope may receive PHI. Development, test, demonstration and trial workflows are limited to synthetic or otherwise expressly permitted data. A login, disclaimer acknowledgment, subscription or MFA setting alone does not establish a BAA or approval for PHI use.

The Customer remains responsible for its lawful instructions, any required notices, consents or authorizations, and providing only information appropriate to the approved purpose, including minimum-necessary limits where applicable. Records subject to additional restrictions require specific review before use.

4. Customer records and permitted processing

The Customer retains its rights in its records, subject to the rights of individuals and applicable law. 912 Dynamics may process those records only to provide, secure and support the agreed service, follow authorized instructions, or as otherwise permitted or required by the applicable agreement and law. Customer PHI is confidential; it is not public website content.

General website, marketing, content-license or aggregate-information language does not authorize selling PHI, using it for advertising or general-purpose model training, or disclosing it outside the BAA. Any permitted de-identification or aggregation of PHI must satisfy the BAA and applicable law; merely removing a name or calling data anonymous does not establish that standard.

Service providers that handle PHI on our behalf must be within the approved service scope and subject to the required agreements and safeguards. General availability of a third-party feature does not establish its eligibility for the Customer’s PHI.

5. Security and incident reporting

912 Dynamics must apply the administrative, physical and technical safeguards required by applicable law and the BAA to the PHI it handles, limit access to authorized purposes, and address security incidents under those obligations. We report impermissible uses or disclosures and security incidents as required by the applicable BAA and law, including breach notification without unreasonable delay and within applicable deadlines.

The Customer and its users must use supported devices and software, protect credentials, follow required MFA and session controls, and promptly report suspected unauthorized access, a lost device or a security incident to their administrator and support@912dynamics.com. Send only a general description initially; do not email patient information, passwords, authenticator secrets or recovery codes. We will arrange an appropriate secure channel when needed.

6. Access, correction, export and deletion requests

The Customer directs requests concerning its records. An authorized representative may contact support@912dynamics.com to request access, an export, correction or deletion. We verify authority and scope, assess applicable holds and legal obligations, and coordinate secure handling. A request may be handled through a documented manual process; an in-app deletion button is not required to submit it.

We assist the Customer with applicable individual access, amendment and accounting-of-disclosures obligations as required by the BAA and law. Individuals should ordinarily contact the organization responsible for their care or records. Requests received directly by 912 Dynamics are routed to the responsible Customer for coordination. We do not require a password or MFA code by email to verify a request.

7. Retention, cancellation and disposition

Our default is to retain authoritative Customer records until an authorized explicit disposition request, subject to applicable law, legal holds and the Customer’s agreement. Age, inactivity or subscription cancellation alone does not trigger automatic deletion of those records. Any continued custody after cancellation remains subject to the applicable service arrangements, confidentiality and BAA protections.

Formal termination of a BAA is distinct from subscription cancellation. PHI is returned or destroyed where feasible as required by the BAA. If return or destruction is infeasible, the reason and remaining records must be documented, protections continue, and further uses and disclosures are limited to the purposes that make return or destruction infeasible. A preference to keep records indefinitely does not itself establish infeasibility.

Temporary files, session and device caches, security logs and backup versions have separate operational lifecycles. Authorized disposition is coordinated across affected systems and providers; the completion record identifies relevant backup expiry or restored-copy handling, holds and any lawfully retained copies. We do not promise instantaneous erasure of every backup. HIPAA does not impose a universal six-year retention minimum on every chat or CPR record; the Customer must identify applicable records laws and obligations.

8. Mobile, offline and location features

Supported browser and mobile clients can retain authentication state, caches and permitted offline reference documents. A mobile WebView wrapper does not mean that nothing is stored on the device. Use a supported, updated device with a screen lock, protect downloaded material and follow the Customer’s device, logout and loss-reporting procedures.

Use only approved features and destinations for patient-related information. Ordinary email, marketing forms, advertising analytics, push-notification bodies and unapproved support or third-party channels must not receive PHI. Location features may process precise coordinates; a patient or incident location must not be sent to a routing or mapping provider unless that workflow and destination are specifically approved for that data.

9. Professional judgment and service limits

Project Skylar provides reference, workflow and decision-support features. AI responses may be incomplete, inaccurate or inappropriate for a particular situation. Qualified users must verify sources and outputs, follow applicable protocols and medical direction, and exercise professional judgment. Project Skylar is not a substitute for emergency services or the Customer’s required clinical recordkeeping.

Professional-use cautions do not waive 912 Dynamics’ confidentiality, security or other obligations under applicable law or an executed agreement. No HIPAA certification, FedRAMP authorization or SOC 2 report is granted or represented by these terms.

10. Changes and contact

We identify the version and effective date of these terms and provide material changes through the applicable Customer notice and agreement process. New or expanded PHI uses require the appropriate contractual authority and service approval; they are not authorized solely by changing this page. Signed Customer agreements remain subject to their own amendment and acceptance requirements.

For application terms, privacy, security or records requests: support@912dynamics.com. Mail: 912 Dynamics, Inc., 325 Martha Lane, Fort Worth, TX 76126. Do not include PHI or credentials in an initial ordinary email.