Terms —
changelog

MSA v1.0 — effective 2026-06-28

Initial published Master Services Agreement (California law). Includes Exhibit A (SLA, 99.5% uptime) and Exhibit B (DPA). An Order Form may serve as the Statement of Work for Professional Services, governed by the Professional Services Terms. Permalink: /legal/msa/v1.0.

MSA v1.6 — effective 2026-10-01

Data Processing Addendum only; the MSA body is identical to v1.5. DPA §4.3 is split in two. Under §4.3(a), every new subprocessor gets the 30-day notice and objection right. That includes any company not on the Subprocessor List, even one that replaces a listed provider for the same purpose and location, and a listed provider that will process a new category of personal data or process it in a new location. The exception for changes that keep the same data categories and processing location is removed. If an objection is not resolved, the customer may terminate the affected Order Form or SOW, in whole or only for the services that cannot be provided without the new subprocessor. It then receives a refund of prepaid, unused fees for those services, including billing and revenue-cycle services, and owes no fees for them after termination (fees for work already done stay payable). Under §4.3(b), a customer whose Order Form or SOW includes billing and revenue-cycle services authorizes, by signing it, Mulholland’s use of individual revenue-cycle support contractors in the Philippines. The Subprocessor List shows that category and its location, not individual names, and engaging or replacing an individual within it is not a new subprocessor. Before an individual first processes the customer’s personal data, Mulholland sends the customer a notice of the engagement without names, by email or through the Trust Center. The customer agrees that this update is the notice of engagement the CCPA requires (Cal. Civ. Code §1798.140(j)(2), (ag)(2)). On request, Mulholland identifies the individuals within 10 business days. On a reasonable request made on documented data-protection grounds, it stops assigning a named individual to the customer’s work. A firm or agency would be a new subprocessor under §4.3(a). Annex C names the subprocessors used as of publication and describes the contractor category. This version binds only customers who sign an Order Form or written amendment that incorporates it (MSA §§11.10 and 11.13). It does not change earlier versions and is not an update under DPA §10.5. Permalink: /legal/msa/v1.6.

MSA v1.5 — effective 2026-10-01

Billing and revenue-cycle services. Professional Services now include billing and revenue-cycle services agreed to in an Order Form or SOW, such as eligibility and benefits verification, claims preparation and submission, payment posting, denial and appeal follow-up, and payer and patient balance follow-up (§12.18). New §1.6: Mulholland performs them on the customer’s behalf, at its direction, and in its name; the customer reviews and approves claims, appeals, and statements and remains responsible for their accuracy and completeness, its coding and clinical documentation, fee schedules, and patient financial policies, and its compliance with its payer contracts and the law; Mulholland gives no coding, legal, or compliance advice and does not guarantee reimbursement or collections; and, unless the Order Form or SOW says otherwise, Mulholland follows up only on patient balances that are not in default, does not buy or take assignment of accounts, and payments go to the customer. DPA Annex A names these services as a purpose of processing, Annex C adds revenue-cycle support contractors in the Philippines as a subprocessor category for customers whose Order Form or SOW includes billing services, each added to the Subprocessor List before it processes personal data, and §11.7 confirms that the DPA governs subprocessors’ processing in Professional Services as well as through the Platform. Export and deletion now run on one clock (§10.5). The Export Period is the 60 days that begin when no Order Form or SOW is in effect and no free service is being provided or, if earlier, when the Agreement terminates; if an Order Form, SOW, or free service starts after the period begins, a new period begins when it ends, and if it starts during the period or in the 30 days after it, the earlier period is cancelled. The customer may export Customer Data, Customer Ontology, and Output while an Order Form or SOW is in effect or a free service is being provided and, on written request, during the Export Period. Within 30 days after the Export Period ends, Mulholland deletes Customer Personal Data (or returns it and then deletes it, if the customer asks during the Export Period) and requires its subprocessors to delete it (§10.5; DPA §8.2, which replaces reasonable efforts after a request with a firm obligation). Copies required by law and routine backups stay protected until deleted and are used only for the purpose for which they are kept, and Protected Health Information follows BAA §5.3. A model trained only for the customer on identifiable data is deleted on the same date (§3.3(d)(vii)). Mulholland may create De-Identified Data only while an Order Form is in effect, and no longer during the Export Period (§3.3(a)), and may publish its public de-identification commitment in its privacy policy or a customer data privacy notice (§3.3(d)(iii)). This version binds only customers who sign an Order Form or written amendment that incorporates it (MSA §§11.10 and 11.13). It does not change earlier versions and is not an update under DPA §10.5. Permalink: /legal/msa/v1.5.

MSA v1.4 — effective 2026-10-01

§3.3 rewritten: De-Identified Data and Mulholland Models. For customers who sign an Order Form or written amendment that incorporates v1.4 or a later version, and only for data Mulholland first receives on or after that date (never data received under an Order Form on an earlier version), Mulholland may de-identify customer data and use the De-Identified Data, combined with other customers’, to develop and train its own models, which it owns. Protected Health Information is de-identified only under BAA v1.1 §3.4. Under v1.4, Mulholland agrees not to re-identify De-Identified Data, name a customer as a source, sell De-Identified Data as a dataset, or use identifiable data to train any model used for others, and agrees that outside model providers may not train on customer data. New §11.13 (Versions) and definitions §§12.24–12.28, and “Term” defined in §10.1; conforming edits to §§1.4, 3.1, 3.5, 7.3(e), 10.5, 12.7 and 12.23, and to DPA §§2.3(b), 6.2 and 9, new §2.5, and Annexes A, B and C. This version binds only customers who sign an Order Form or written amendment that incorporates it (MSA §§11.10 and 11.13). It does not change earlier versions and is not an update under DPA §10.5. Permalink: /legal/msa/v1.4.

MSA v1.3 — effective 2026-09-03

Data Processing Addendum only; the MSA body is identical to v1.2. DPA §9 (CCPA) adds the two service-provider terms California’s regulations require: Mulholland provides the same level of privacy protection the CCPA requires of Customer, and notifies Customer without undue delay if it can no longer meet those obligations. Because this update is required to comply with Data Protection Laws, it applies to customers on earlier versions under DPA §10.5 upon notice. Permalink: /legal/msa/v1.3.

MSA v1.2 — effective 2026-09-03

Ownership and portability rebalance: Customer now owns its Customer Ontology — the customer-specific schemas, tables, mappings, taxonomies, data dictionary, and customer-stated business rules (§3.1, §12.22) — alongside Customer Data and Output, and may export all three during the term and for 60 days after (§10.5; up from 45 days, data and output only). Output is defined as business results and expressly excludes software, agents, skills, workflows, prompts, and configurations produced to operate the Platform (§12.15). Mulholland retains the Platform, Mulholland Materials, generic and domain-level ontology templates, and Generalized Improvements (§3.2, §12.12, §12.23). Customer’s Data-Claim indemnity is now subject to the General Cap, except regulatory fines arising directly from Customer’s own violation of data laws (§7.3(d)), and excludes claims caused by Mulholland’s breach, gross negligence, or willful misconduct (§6.2). Invoice-dispute window extended to 30 days (§8.3). New §3.5 (license to Mulholland) and §3.6 (business-continuity addenda). Exhibit B (DPA) is corrected to describe the platform as actually operated: tenant isolation is logical, enforced by forced row-level security in a multi-tenant database (replacing an inaccurate per-Customer-database statement); the encryption-in-transit floor is stated as TLS 1.2; Annex C is restated by category with the Trust Center Subprocessor List as the authoritative, living list (naming Google Cloud Platform, OpenAI, Cloudflare, and Vanta as of this version); new DPA §4.3 gives thirty days’ notice and an objection right before any new subprocessor processes personal data; and the certifications paragraph states the SOC 2 Type II examination as underway rather than as a dated target. Permalink: /legal/msa/v1.2.

MSA v1.1 — effective 2026-07-02

Counsel-approved clarifications: Customer Data is not used to train foundation models (§3.3); restricted-data categories enumerated (§2.2(e)); Output may not be the sole basis for consequential decisions without human review (§2.2(g)). Permalink: /legal/msa/v1.1.

PST v1.5 — effective 2026-10-01

Billing errors found late. For billing and revenue-cycle services, the 45-day claim window under MSA §5.2 runs from when the customer discovers, or reasonably should have discovered, the problem. Notice is due no later than 12 months after the service or, for a missed payer filing deadline, 90 days after the later of that deadline and the payer’s late-filing denial. A problem counts as discoverable once Mulholland reports it, once a monthly report shows the claim’s denial, rejection, reduction or unsubmitted status, or once a payer response shows it (§4). §11 gains a second paragraph covering missed filing deadlines. If Mulholland misses a payer’s filing deadline for a claim, corrected claim, or first-level appeal through its own fault, and the customer gave complete information at least 10 business days before the deadline, Mulholland pays the reimbursement lost. That payment is net of later recoveries and of the fee Mulholland would have earned, and Mulholland also refunds its fees on the claim. Excluded are clinical, coding, eligibility, credentialing and enrollment denials, claims the customer holds or files itself, and payer errors where Mulholland can prove timely filing. Mulholland first seeks a late-filing exception. The payment is capped, for missed deadlines in any 12-month period, at three times the average monthly billing-service fee. It is direct damages despite MSA §7.1 and counts toward the General Cap and the Professional Services cap in MSA §7.2. For first-level appeals it is owed only if a timely appeal would more likely than not have been paid, and any later recovery is repaid to Mulholland. §8 adds the customer’s billing duties: complete information, answers and payer correspondence within 5 business days, and current enrollment and credentialing. It also adds monthly denial and A/R reports, Mulholland’s right to decline claims the documentation does not support, and notice of potential overpayments within 10 business days. §6 notes the new remedy. Binds only customers who sign an Order Form that incorporates it. Permalink: /legal/pst/v1.5.

PST v1.4 — effective 2026-10-01

Billing and revenue-cycle services are listed among Professional Services (§1), and the claims, appeals, statements, correspondence, and account and payment records Mulholland prepares or submits in the customer’s name, and the eligibility, remittance, and other payer and patient information it obtains for the customer, are the customer’s Customer Data (or Output), not Deliverables (§2). For billing and revenue-cycle services, the 45-day claim window under MSA §5.2 runs from each service or, for a claim or appeal, from the payer’s response (or 90 days after submission, if earlier), not from the end of the engagement (§4). Pilot remedies (§9): the refund election is the exclusive remedy only for a Pilot whose fee the Order Form makes refundable, and not for claims under the DPA or the BAA; any other paid Pilot keeps the re-performance and termination-and-refund remedies of Section 11 and the 45-day window in MSA §5.2, like other Professional Services, and §6 now notes the refundable-Pilot exception. The 90-day long-stop refund applies to every Pilot and extends day-for-day for delay caused by the customer’s failure to meet its Section 8 obligations. Binds only customers who sign an Order Form that incorporates it. Permalink: /legal/pst/v1.4.

PST v1.3 — effective 2026-10-01

July clarity cures: Free Services keep confidentiality and personal-data coverage (§1); Section 13 governs the DPA for data sources Customer directs Mulholland to access (§3); one exclusive remedy lane and a 90-day long-stop for Pilots (§9). Conforming changes for MSA v1.4: Customer’s ownership covers Customer Ontology as well as Customer Data and Output, and De-Identified Data and Mulholland Models are governed by MSA §3.3 (§2); Third-Party Materials and data sources Customer directs Mulholland to access are Source Data for MSA §3.3, subject to the exclusions in MSA §3.3(d)(x) (§3); and §16 now provides that nothing in these terms limits Mulholland’s rights or obligations under MSA §3.3, or the remedies the MSA provides for breach of those obligations. Binds only customers who sign an Order Form that incorporates it. Permalink: /legal/pst/v1.3.

PST v1.2 — effective 2026-07-02

§10 restructured to a pure placement-fee model (no hiring restraint; 25% conversion fee) for California B&P §16600 posture, per outside review. Permalink: /legal/pst/v1.2.

PST v1.1 — effective 2026-07-02

Counsel-approved hardening of the Professional Services Terms: exclusive re-performance and termination-and-refund remedy (§11), Deliverables non-infringement warranty (§12), Personal Data / BAA bridge for Professional Services (§13), injunctive relief (§14), residual knowledge (§15), precedence and survival (§16); strengthened cooperation, pilot-credit, and non-solicitation terms. Permalink: /legal/pst/v1.1.

PST v1.0 — effective 2026-06-28

Initial published Professional Services Terms. Permalink: /legal/pst/v1.0.

BAA v1.1 — effective 2026-10-01

§3.4 authorizes Mulholland to de-identify PHI under 45 C.F.R. §164.514(a)–(c), including for its own purposes under MSA v1.4 §3.3, only within the customer’s logically isolated environment and never from PHI first received before the BAA’s Effective Date: a written expert determination (safe harbor for structured fields only), minimum necessary, §164.514(c) record codes, not-PHI status, no use of PHI-derived De-Identified Data or Mulholland Models to market to the customer’s patients, no remuneration, the Cal. Civ. Code §1798.148(c) statements, and remediation of any failed de-identification (§3.4(g)). The BAA covers all PHI Mulholland handles in providing the Platform or performing the Services, including Professional Services and free services, and, from its Effective Date, PHI received earlier (preamble, Recitals, §§1, 5.1). Breaches are reported within 10 days of discovery or any shorter legal deadline (§2(c)); Mulholland may not use PHI under §3.4 where a required consent has not been obtained (§4.3); §6.4 adds §3.4 to survival; and the $1,000,000 PHI cap applies notwithstanding the MSA’s general and Free Services caps (§§6.6, 6.9). Binds only customers who sign an Order Form that incorporates it. Permalink: /legal/baa/v1.1.

BAA v1.0 — effective 2026-06-28

Initial published Business Associate Agreement for healthcare clients; §6.6 caps PHI liability at $1,000,000. Incorporated by reference into the healthcare Order Form. Permalink: /legal/baa/v1.0.