ChartVoyant API Use Agreement

This Agreement governs the issuance and use of a production ChartVoyant API key. It is entered into between Geach Technologies, LLC, doing business as ChartVoyant ("ChartVoyant", "we"), and the organization identified below (the "Integrator", "you"). A key is issued only after a signed copy is on file. Sandbox keys are covered by the separate Sandbox Terms and do not require this Agreement.

Terms

1. Definitions

   API means the ChartVoyant application programming interface, including the MCP endpoint. MCP endpoint means the Model Context Protocol server ChartVoyant operates as part of the API, together with its tools and their descriptions. Key means a credential issued by ChartVoyant in the form cvk_…. Practice means the medical office the Key is bound to. PHI means protected health information as defined by HIPAA. Data means information reached through the API using the Key, including every result the MCP endpoint returns. AI Agent means any software that uses a large language model or other artificial intelligence to read, interpret, or act on Data, including any MCP client. Model Provider means any person that operates a model used by an AI Agent or that otherwise receives Data from one.

2. Grant of access

   ChartVoyant grants you a limited, non-exclusive, non-transferable, revocable right to access the API using the Key, solely to operate the integration described above, solely for the Practice named above, and solely for the term of the Key. No other right is granted. The Key is bound to one Practice and confers no access to any other office's data.

3. One key, one integration

   The Key identifies a single system. You will not share it with, or use it on behalf of, any other organization, product, subcontractor, or practice. A second integration requires a second Key. You will request a separate Key for each environment you operate.

4. Credential security

   You will:

   • store the Key in a secrets manager or equivalent encrypted store, protected at least as well as a production database credential;
   • use the Key only from servers you control or, on the conditions in §10, from an MCP client on a computer you manage — never in browser JavaScript, in a mobile or desktop application you distribute, or in any other client that a person outside your authorized personnel can inspect;
   • keep the Key out of source control, container images, build and CI logs, screenshots, support tickets, chat messages, and AI assistant transcripts;
   • limit access to the Key to personnel who need it, and revoke that access on their departure;
   • transmit all API requests over TLS.

5. Permitted use and minimum necessary

   You will request and use the minimum data necessary for the integration's stated purpose, and you will request the lowest access level that accomplishes it. You will not use the Key to enumerate, bulk-extract, or systematically harvest records beyond what the integration requires.

6. Prohibited uses

   You will not, without the Practice's prior written authorization:

   • create or maintain a persistent parallel copy of the Practice's clinical record;
   • use Data to train, fine-tune, evaluate, or ground any machine learning or artificial intelligence model;
   • use Data for research, benchmarking, product development, or any purpose other than delivering the described integration;
   • sell, license, broker, or otherwise disclose Data to any third party;
   • re-identify, combine, or enrich Data with outside data sets.

   You will not attempt to circumvent access controls, rate limits, tenant scoping, or authentication, and you will not use the Key to probe endpoints outside the integration's stated purpose.

7. Rate limits and availability

   You will respect published rate limits and honor 429 responses with exponential backoff. You will notify ChartVoyant in advance of any bulk migration or backfill. The API is provided on a commercially reasonable basis; no uptime commitment is made in this Agreement.

8. Commercial use and profit share

   If the API is used in or in connection with a product or service that you sell, license, offer by subscription, or otherwise commercialize, you will pay Geach Technologies, LLC thirty-five percent (35%) of all profits derived from that product or service. Within thirty (30) days after the end of each calendar quarter you will remit the amount due together with a statement showing how it was calculated, and you will keep records sufficient to verify it, which ChartVoyant may review on reasonable notice. ChartVoyant may change this section, including the percentage, at any time by written notice to the technical contact on file; continued use of the Key after notice constitutes acceptance of the change. The Practice's use of the API for its own operations is not commercial use under this section.

9. HIPAA and business associate obligations

   You acknowledge that Data includes PHI, that the Practice is a covered entity, and that your handling of PHI makes you a business associate of the Practice. You represent that a business associate agreement between you and the Practice is or will be in effect before you access PHI, and that you will comply with it and with the HIPAA Privacy, Security, and Breach Notification Rules. This Agreement does not itself constitute a business associate agreement and does not modify any BAA between ChartVoyant and the Practice. From the moment the API delivers Data to you, you are solely responsible for safeguarding it, including when you pass it to an AI Agent, a Model Provider, or any other subcontractor, each of which must first be bound by a business associate agreement as HIPAA requires.

10. AI agents and the MCP server

    The MCP endpoint lets an AI Agent call the API with the Key. It works by handing Data to that AI Agent and, through it, to one or more Model Providers. You may use the MCP endpoint, or give Data obtained with the Key to any AI Agent, only while all of the following are true:

    • before any Data reaches a Model Provider, that Model Provider is bound by a business associate agreement with you or with the Practice that expressly covers the specific product, plan, deployment, and features your AI Agent uses — including MCP, connector, tool-use, logging, and telemetry traffic — and that prohibits any use of Data to train or improve a model. Some providers' business associate agreements exclude MCP servers, connectors, or tool traffic even on plans offered for healthcare use; confirming in writing that your use is covered is solely your responsibility. A consumer, personal, or free account never meets this condition;
    • the Practice has approved in writing the AI Agent, its Model Providers, and its purpose, and you have identified them in the Integration details above;
    • each Key used with an AI Agent is issued for one named individual or one unattended agent, is never shared between people, and carries the lowest access level that accomplishes the purpose; you are responsible for every request made with it, and on request you will identify the individual who directed any request;
    • an MCP client that holds the Key runs only on a computer your organization owns or manages, with full-disk encryption, an automatic screen lock, and current security updates, and is used only by the individual the Key was issued to; the Key is kept in an environment variable or the operating system's credential store, never in a file that is shared, synced, or committed to source control;
    • transcripts, logs, caches, traces, and telemetry that the AI Agent or its client keeps are protected as PHI or turned off, and any that leave your systems go only to a recipient bound as described in the first item;
    • a person you designate supervises each AI Agent, and you are responsible for every action it takes and every output it produces, whether or not a person reviewed it first;
    • no AI Agent is used to make or communicate a diagnosis, a treatment decision, or any other clinical judgment, and nothing an AI Agent produces is presented as medical advice.

    You understand that AI Agents can misread or misstate Data, act on the wrong patient or appointment, follow instructions planted in content they read — including faxes, messages, and documents in the chart — and disclose Data through their own outputs, logs, and providers. You assume all of these risks. ChartVoyant does not operate, select, review, or control any AI Agent or Model Provider, makes no representation about any of them or about whether any agreement covers your use of them, and is not responsible for anything they do or for Data once the MCP endpoint has returned it. This section adds to, and does not reduce, your obligations under §9.

11. Security incidents

    You will notify ChartVoyant at info@chartvoyant.com without unreasonable delay, and in any event within twenty-four (24) hours, of any actual or suspected exposure, compromise, loss, or unauthorized use of the Key, and of any security incident affecting Data, including one at an AI Agent or Model Provider. Your notice will include the Key prefix and the facts known at the time. ChartVoyant may revoke the Key immediately on such notice. Prompt reporting is expected and will not by itself disqualify you from a replacement Key.

12. Monitoring and audit

    ChartVoyant records each Key-authenticated request — method, route, response status, source IP, correlation identifier, and duration — and retains that record. Requests against the Practice's records are additionally written to the Practice's own audit trail, which the Practice may review. For the MCP endpoint the record also names the method and tool called and the names, but not the values, of its arguments, and each tool call is written to the Practice's audit trail. You consent to this monitoring. On reasonable request you will describe to ChartVoyant or the Practice how Data is stored, secured, and retained by your systems.

13. Suspension and revocation

    API access is not an entitlement. ChartVoyant may suspend or revoke the Key at any time, with or without cause and without prior notice — including, without limitation, where the Key is implicated in a security incident, is used in breach of this Agreement, or threatens the stability of the platform, or where the Practice requests it. The Practice may likewise direct revocation of any Key bound to it at any time and for any reason. Revocation takes effect on the next request, and no revocation gives rise to any liability of ChartVoyant or the Practice to you.

14. Term, expiry, and termination

    This Agreement begins on signature and continues while any Key issued under it is active. Each Key carries its own expiry and stops authenticating on that date; a replacement requires a request from the technical contact on file. Either party may terminate this Agreement on thirty (30) days' written notice, or immediately for material breach.

    On termination or revocation you will stop accessing the API, and you will delete or return Data in your possession as directed by the Practice, except where retention is required by law. You will confirm completion in writing on request.

    Sections 8 (as to amounts accrued), 9, 10, 11, 15, and 17 through 22 survive any termination, revocation, or expiry.

15. Confidentiality

    Each party will protect the other's non-public information disclosed in connection with this Agreement, using at least reasonable care, and will use it only to perform under this Agreement. Data is the Practice's confidential information. These obligations survive termination.

16. Changes to the API

    ChartVoyant may change, deprecate, or withdraw API endpoints, MCP tools and their descriptions, and supported protocol versions. We will give the technical contact on file reasonable advance notice of a breaking change except where a shorter timeline is required for security. You are responsible for keeping that contact current.

17. No warranty

    The API, including the MCP endpoint, and the sandbox are provided "as is" and "as available", without warranty of any kind, express or implied, including merchantability, fitness for a particular purpose, accuracy, completeness, non-infringement, and any warranty that they will be uninterrupted, error-free, or secure. ChartVoyant does not warrant that any AI Agent will interpret or act on Data correctly, and makes no representation about any AI Agent, Model Provider, or other third-party product, including whether its terms or business associate agreement cover your use. Nothing returned by the API is medical advice, and you will not present it as such.

18. Limitation of liability

    To the maximum extent permitted by law:

    • ChartVoyant is not liable to you, or to anyone claiming through you, for any indirect, incidental, special, consequential, exemplary, or punitive damages, or for any loss of profits, revenue, business, goodwill, or data, arising out of or relating to this Agreement, the API, a Key, or Data, under any theory of liability, even if advised of their possibility;
    • ChartVoyant's total liability arising out of or relating to this Agreement, the API, a Key, or Data, under any theory of liability, will not exceed the amounts you paid ChartVoyant for API access in the twelve (12) months before the event giving rise to the claim, or one hundred dollars ($100) if no amounts were paid; and
    • ChartVoyant has no liability for any act or omission of you, your personnel or subcontractors, or any AI Agent or Model Provider, or for any access to, use, disclosure, alteration, or loss of Data after the API has delivered it at your request.

    These limits apply even if a limited remedy fails of its essential purpose. They do not limit ChartVoyant's liability for its own fraud, gross negligence, or willful misconduct where applicable law does not allow that liability to be limited. No limit or exclusion in this Agreement applies to your obligations under §6, §9, §10, §11, or §15, to your indemnity under §19, or to amounts you owe under §8.

19. Indemnity

    You will defend, indemnify, and hold harmless ChartVoyant and its members, managers, officers, employees, and contractors, and the Practice, from and against any claim, demand, investigation, proceeding, judgment, settlement, loss, damage, cost, or expense — including reasonable attorneys' fees, the costs of forensic investigation, breach notification, call centers, and credit monitoring, and, to the extent permitted by law, fines and penalties — arising out of or relating to:

    • your breach of this Agreement or of any business associate agreement with the Practice;
    • your use or misuse of a Key, or use of a Key by anyone who obtained it from you or from your systems;
    • your integration, AI Agents, or Model Providers, including any action an AI Agent takes and any output it produces;
    • any transmission of Data to an AI Agent, a Model Provider, or any other third party;
    • any security incident or breach involving Data in the possession or control of you, your personnel or subcontractors, or any AI Agent or Model Provider; or
    • your violation of law.

    ChartVoyant may take part in the defense with counsel of its choice at its own expense. You will not settle a claim in a way that imposes any obligation on, or admits fault by, ChartVoyant or the Practice without its prior written consent.

20. Insurance

    While any Key issued under this Agreement is active, and for two (2) years afterwards, you will maintain at your own expense cyber liability insurance, covering network security and privacy liability and breach response costs, and technology errors and omissions insurance, each with limits of at least one million dollars ($1,000,000) per claim. You will provide a certificate of insurance on request and will notify ChartVoyant within thirty (30) days of any cancellation or reduction of that coverage. Your insurance does not limit your obligations under this Agreement.

21. Assignment

    You may not assign this Agreement or transfer a Key, including by merger or change of control, without ChartVoyant's prior written consent. A Key is not an asset that survives a sale of your business.

22. Governing law

    This Agreement is governed by the laws of the State of Tennessee, without regard to its conflict-of-laws rules. The parties consent to the exclusive jurisdiction of the state and federal courts located in Hamilton County, Tennessee.

23. Entire agreement

    This Agreement, together with the usage policy published at chartvoyant.com/developers, is the entire agreement between the parties on this subject and supersedes prior discussions. Where the two conflict, this Agreement controls. Amendments must be in writing and signed by both parties. If any provision is held unenforceable, the rest remains in effect.

← Back to ChartVoyant for developers