Terms of Service

1. Acceptance of Terms

These Terms of Service ("Terms") govern access to and use of OnePath Connect (the "Service"), a business-to-business REST API operated by OnePath Health, Inc. ("OnePath," "we," or "us"). By executing an API Partner Agreement or accessing the Service, you ("Partner") agree to be bound by these Terms on behalf of your organization.

These Terms supplement and do not replace any Business Associate Agreement ("BAA") or separately executed agreement. In the event of a conflict, the separately executed agreement governs.

2. Description of Service

OnePath Connect is a HIPAA-compliant, FHIR R4-native API that allows credentialed Partner organizations to integrate AI-powered clinical intelligence into their own platforms. Capabilities include patient onboarding and consent management, structured health data submission and retrieval, lab document AI processing, AI-generated insights and conversational AI, health goal and fitness plan management, and health scoring. A complete description is at onepath.health/platform.

OnePath Connect is a B2B integration API. Partners are solely responsible for their end-user relationships, including any required disclosures, consent mechanisms, and privacy notices.

3. Partner Eligibility

To access OnePath Connect, Partners must:

• Be a Covered Entity or Business Associate under HIPAA, or otherwise eligible to receive PHI from OnePath under applicable law
• Execute a Business Associate Agreement with OnePath prior to production access
• Provide accurate information during the partner application process, including a valid RSA public key for consent assertion signing
• Have the legal authority to bind their organization to these Terms

4. Business Associate Agreement

A fully executed BAA is a condition precedent to production API access. Sandbox access may be provided without a BAA provided no real Protected Health Information is used. Partners are solely responsible for ensuring sandbox data is de-identified per 45 CFR §164.514.

5. API Access and License

5.1 License Grant

Subject to these Terms and applicable fees, OnePath grants Partner a limited, non-exclusive, non-transferable, revocable license to access and use OnePath Connect solely for Partner's internal business purposes in accordance with OnePath's documentation.

5.2 Permitted Use

Partner may use the Service to register and manage records for users of Partner's own platform, submit structured health data and clinical documents for AI processing, retrieve AI-generated insights, health summaries, and health scores, enable AI-powered conversational health Q&A within Partner's products, and manage user health goals and fitness plans.

5.3 Prohibited Use

Partner may not:

• Resell, sublicense, or make the Service available to third parties as a standalone API without prior written consent
• Submit data for individuals who have not provided valid consent under applicable law
• Attempt to circumvent rate limits, authentication mechanisms, or consent controls
• Use the Service in any manner that violates HIPAA or applicable state health privacy laws
• Log, store, or transmit raw PHI inconsistent with the minimum-necessary standard or the executed BAA
• Reverse engineer, decompile, or attempt to derive the source code of the OnePath platform

6. API Keys and Authentication

Partner is responsible for maintaining the confidentiality of its API keys and RSA private key. API keys must not be embedded in client-side code, logged, or transmitted in URLs. Notify OnePath immediately at security@onepath.health if credentials are suspected compromised.

7. Rate Limits and Quotas

The Service is subject to rate limits and monthly AI token quotas as specified in Partner's service tier. Rate limit information is provided in API response headers. AI token quotas reset on the first day of each calendar month. Overages may result in throttling or additional fees.

8. Intellectual Property

OnePath retains all intellectual property rights in the Service, the API, documentation, models, and underlying technology. Partner retains all rights to its own data submitted to the Service. By submitting data, Partner grants OnePath a limited license to process it solely for providing the Service as described in the BAA and these Terms.

9. Confidentiality

Each party agrees to maintain the confidentiality of the other party's Confidential Information and not disclose it to third parties without prior written consent, except as required by law.

10. Disclaimers

THE SERVICE IS PROVIDED "AS IS" WITHOUT WARRANTIES OF ANY KIND. ONEPATH DOES NOT WARRANT THAT THE SERVICE WILL BE UNINTERRUPTED, ERROR-FREE, OR THAT ANY AI-GENERATED OUTPUTS WILL BE ACCURATE, COMPLETE, OR SUITABLE FOR CLINICAL DECISION-MAKING. AI outputs do not constitute medical advice, diagnosis, or treatment recommendations. Partners are solely responsible for how AI outputs are used.

11. Limitation of Liability

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, ONEPATH'S AGGREGATE LIABILITY ARISING OUT OF THESE TERMS WILL NOT EXCEED THE FEES PAID BY PARTNER IN THE THREE MONTHS PRECEDING THE CLAIM. ONEPATH WILL NOT BE LIABLE FOR INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES.

12. Indemnification

Partner agrees to indemnify, defend, and hold harmless OnePath from and against any claims, liabilities, damages, losses, and expenses arising out of Partner's use of the Service in violation of these Terms, any breach of the BAA, or Partner's violation of applicable law.

13. Term and Termination

Either party may terminate these Terms with thirty (30) days' written notice. OnePath may suspend or immediately terminate access upon material breach of these Terms or the BAA, or upon reasonable belief that Partner's use poses a security risk.

14. Governing Law

These Terms are governed by the laws of the State of New York. Any disputes will be subject to the exclusive jurisdiction of courts in New York County, New York.

15. Changes to These Terms

OnePath may update these Terms with at least thirty (30) days' notice of material changes. Continued use of the Service after the effective date constitutes acceptance.

16. Contact

Questions: legal@onepath.health