Contents
⚠️ DRAFT TEMPLATE — pending legal review. This is a good-faith draft and not legal advice. Bracketed
[[PLACEHOLDERS]]must be completed and the whole document approved by counsel before use.
This Customer Agreement (the "Agreement") is between [[PHI-CLOUD LEGAL ENTITY, ADDRESS]] ("phi-cloud", "we", "us") and the individual or entity that creates an account or uses the Service ("Customer", "you"). By clicking "I agree", creating an account, or using the Service, you accept this Agreement. If you accept on behalf of an organization, you represent that you are authorized to bind it.
This Agreement incorporates by reference the Acceptable Use Policy, the Data Processing Addendum ("DPA"), the Business Associate Agreement ("BAA", applicable only as described therein), the Sub-processor list, and the Privacy Policy.
1. The Service
phi-cloud is a stateless, OpenAI-compatible inference gateway that routes your requests to third-party and self-hosted AI model providers ("Providers") on a region-resident basis. We transmit your request content to the selected Provider and return the response. We do not log or persist the content of your requests or responses. A list of Providers is maintained in the Sub-processor list.
2. Accounts and API keys
2.1 You must provide accurate registration information and keep your credentials and API keys secret. You are responsible for all activity under your account and keys.
2.2 You must be of legal age and not barred from receiving the Service under applicable law or sanctions/export-control regimes.
3. Customer responsibilities; data classification
3.1 You decide what data you send and how it is classified. You direct routing
via request controls including X-Region (jurisdiction) and X-PHI (health-data
flag). You are the controller (and, for U.S. health data, the covered
entity or its business associate) for the data you submit.
3.2 PHI / special-category data. You may submit protected health information
or special-category personal data only when you have correctly set X-PHI and
selected a region whose routing resolves to a Provider contractually cleared for
that data class (see the DPA and Sub-processor list). If a request is not eligible
for a cleared Provider, the Service will decline to route it (phi_blocked /
no_route) rather than send it to a non-cleared Provider. You are responsible
for setting these controls correctly. Submitting regulated data without the
correct flags, or to an ineligible region, is a breach of this Agreement and may
expose that data to a Provider not cleared for it.
3.3 You will comply with the Acceptable Use Policy and with all laws applicable to your use, including data-protection and health-information laws.
4. Provider terms and model outputs
4.1 Your use of a given model is also subject to that Provider's and model's applicable use terms. We pass through Provider availability and capabilities "as is" and do not control model behavior.
4.2 AI output is probabilistic and may be wrong. Outputs are not professional, medical, legal, or financial advice. You are responsible for evaluating outputs before relying on them, especially in clinical or other high-stakes contexts.
5. Fees, prepaid credits, and billing
5.1 The Service is prepaid. You purchase credits in advance; usage draws down your credit balance. Pricing, minimums, currencies, and the credit conversion rate are as published in-product and may change prospectively.
5.2 Auto-recharge. If you enable auto-recharge, you authorize us to charge your payment method to top up credits when your balance falls below your configured threshold, until you disable it.
5.3 Credits are not a deposit, are denominated for usage only, and are non-refundable except where required by law or as expressly stated at purchase. Card and invoice management is handled through our payment processor's customer portal.
5.4 Taxes are your responsibility except for taxes on our net income.
6. Term and termination
6.1 This Agreement runs while you have an account. Either party may terminate for convenience on notice; we may suspend or terminate immediately for breach, non-payment, legal risk, or security risk.
6.2 On termination your right to use the Service ends. Because the Service is stateless, we hold no request/response content to return or delete; account metadata is handled per the Privacy Policy and DPA.
7. Confidentiality
Each party will protect the other's non-public information disclosed under this Agreement and use it only to perform under this Agreement.
8. Warranties and disclaimers
8.1 Each party warrants it has authority to enter this Agreement.
8.2 EXCEPT AS EXPRESSLY STATED, THE SERVICE IS PROVIDED "AS IS" AND "AS AVAILABLE". WE DISCLAIM ALL IMPLIED WARRANTIES, INCLUDING MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT. We do not warrant that outputs are accurate or that the Service will be uninterrupted or error-free.
9. Indemnification
You will defend and indemnify phi-cloud against third-party claims arising from your data, your use of the Service in violation of this Agreement or law, or your misclassification of regulated data. [[Mutual / mirror IP indemnity from phi-cloud — TO BE SET BY COUNSEL.]]
10. Limitation of liability
10.1 NEITHER PARTY IS LIABLE FOR INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR EXEMPLARY DAMAGES, OR LOST PROFITS/DATA.
10.2 EACH PARTY'S TOTAL LIABILITY IS CAPPED AT THE AMOUNTS YOU PAID IN THE [[12]] MONTHS BEFORE THE CLAIM. [[Carve-outs for confidentiality, indemnity, data-protection breach — TO BE SET BY COUNSEL.]]
11. Changes to the Agreement
We may update this Agreement prospectively. Material changes will be notified
in-product and/or by email, and continued use after the effective date — or
re-acceptance where we require it — constitutes acceptance. The current version is
identified by the version above.
12. Governing law; disputes
This Agreement is governed by the laws of [[JURISDICTION]], excluding conflicts rules, and disputes are subject to [[VENUE / ARBITRATION]]. The DPA's and BAA's own governing-law terms control for their subject matter where they differ.
13. General
Entire agreement; no assignment without consent (except to an affiliate or in a merger); severability; no waiver; independent contractors; notices to the contact addresses on file. Where this Agreement conflicts with the DPA or BAA on the processing of personal data or PHI, the DPA/BAA controls.
Contact: [[legal@phi-cloud.com]] · Data protection: [[privacy@phi-cloud.com]]