API and Integration Terms

These API and Integration Terms (the "Integration Terms") are between GetClinic Inc., a Delaware corporation, 74 E Glenwood Ave, Unit STE 5895, Smyrna, DE 19977, United States ("GetClinic"), and the Customer. They form part of the Customer's Terms of Service or Cloud Services Agreement (the "Agreement"). Capitalised terms used but not defined in these Integration Terms have the meanings given in the Agreement.

1. Application

1.1 These Integration Terms apply to the Customer's use of the API, API Keys, Webhooks and Connectors:

(a) under the Cloud Services Agreement, where the Order Form includes them or the Customer accepts them in the Service (section 1.1(g) of the Cloud Services Agreement); and

(b) under the Terms of Service, from the time the Customer accepts them in the Service (section 9 of the Terms of Service). Until the Customer has accepted them, its use of the API, Webhooks and Connectors is governed by section 9.3 of the Terms of Service.

1.2 The API, Webhooks and Connectors are available only where the Customer's plan or Order Form includes them and GetClinic has enabled them for the Organisation. A Connector is available only when the Service shows it as enabled.

1.3 If these Integration Terms conflict with the Agreement, the Agreement prevails, except that these Integration Terms prevail on the matters in sections 6 and 9. The Data Processing Terms and the Business Associate Agreement prevail over both for personal data and PHI.

2. Definitions

2.1 "API" means the programming interface of the Service published under the /v1 path and described in the Documentation.

2.2 "API Key" means a credential the Service issues to the Customer to call the API without a User's sign-in.

2.3 "Scope" means a permission attached to an API Key. The Scopes, and the operations each Scope allows, are listed in the Documentation.

2.4 "Webhook" means a signed message the Service sends to an Endpoint when an event occurs, and "Endpoint" means an address the Customer registers to receive Webhooks.

2.5 "Connector" means a feature of the Service that exchanges data with a system outside the Service, such as file import from a storage location the Customer controls and the laboratory drop by which the Customer's systems push files to the Service.

2.6 "Customer System" means any system, application, storage location or Endpoint that the Customer, or a third party acting for the Customer, connects to the Service through the API, a Webhook or a Connector, including a system built by the Customer and a product of a third-party vendor (a "Third-Party Integration").

2.7 "API Output" means data returned by the API, Webhooks or Connectors, including Customer Data and Outputs.

3. API Keys

3.1 Issue. An administrator of the Customer who holds the permission to manage the Organisation creates API Keys in the Service, after confirming a second factor. An API Key cannot be used to create, change or revoke an API Key.

3.2 Scope and reach. Each API Key:

(a) carries the Scopes chosen when it is created, and allows only the operations those Scopes allow;

(b) is bound to one organisational unit and reaches only that unit and the units below it in the same legal entity;

(c) never has more access than the administrator who created it holds at the time of each request, and stops working if that administrator is deactivated, leaves the unit, or loses the permission needed; and

(d) has an expiry date chosen at creation, no later than 365 days after it.

3.3 Actions reserved to Users. Some actions can only be taken by a User who has confirmed a second factor, and are not available to an API Key. They include bulk and workspace exports and FHIR export. The Documentation lists the operations available to API Keys. GetClinic may add an operation to a Scope only if it reaches no data and allows no action beyond what that Scope already allows, and gives notice of the addition under section 10.4.

3.4 Secret shown once. The Service shows the secret of an API Key once, when it is created. GetClinic keeps only a keyed hash of it and cannot recover it. A lost secret is replaced by creating a new API Key and revoking the old one.

3.5 Revocation. The Customer can revoke an API Key at any time in the Service. Revocation takes effect at once and cannot be undone.

3.6 Responsibility for calls. The Customer is responsible for every call made with its API Keys, including by a Third-Party Integration, as if made by a User.

3.7 Records. The Service records the creation and revocation of API Keys, the time each was last used, hourly counts of its requests, refusals and throttled requests, and failed authentications. The Customer's administrators can see the creation, revocation, last use and failed authentications of their API Keys in the Service, and GetClinic provides the hourly counts on request.

4. Rate limits

4.1 The Service limits the number of requests per API Key and per Organisation, and the number of active API Keys, as stated in the Documentation. A request over a limit is refused with a status that states when the request may be retried. Requests are not queued.

4.2 Repeated failed authentications from one source cause the Service to refuse requests from that source for a period.

4.3 GetClinic may change the limits on notice in the Service. It will not reduce a limit stated in the Order Form during the Subscription Term.

4.4 The Customer will design its Customer Systems to respect the limits and the retry time, and will not use several API Keys or sources to get around a limit.

5. Webhooks

5.1 Endpoints. An administrator who holds the permission to manage the Organisation registers Endpoints in the Service, after confirming a second factor. An Endpoint must use HTTPS on port 443 with a domain name, must be on the Organisation's list of allowed hosts, and must not redirect. The Service does not follow redirects.

5.2 Content. A Webhook carries the identifiers of the event, the Organisation, the organisational unit, the case and the report version concerned, and an address from which a User can retrieve the content. It carries no clinical, genetic or identity data. The case and report identifiers it carries are pseudonymous identifiers that the Customer can link to a patient. The events available are listed in the Documentation.

5.3 Signature. Each Webhook is signed with the Endpoint's secret. The Customer will verify the signature and the timestamp of each Webhook before acting on it, as the Documentation describes, and will reject Webhooks that fail verification. When the Customer rotates the secret, the Service signs with both secrets for 24 hours.

5.4 Delivery. The Service retries a failed delivery several times over about 21 hours, as the Documentation describes, and then stops. It suspends an Endpoint after repeated consecutive failures, as the Documentation describes. A Webhook may be delivered more than once, and the Customer will deduplicate on the event identifier. GetClinic does not commit to a delivery time, and a Webhook is a notice, not the record: the Customer will rely on the content it retrieves from the Service.

5.5 Records. The Service keeps delivery records for at least 90 days.

6. Customer Systems and data leaving the Service

6.1 The Customer's responsibility. The Customer chooses, configures and operates its Customer Systems and is responsible for them, including their security, their availability, the people who can access them and what they do with API Output. GetClinic does not review, test, certify or support Customer Systems, except as the Order Form provides for professional services.

6.2 Disclosure by the Customer. Data that leaves the Service through the API, a Webhook or a Connector to a Customer System is disclosed by the Customer, on its instruction:

(a) under section 3.2 of the Data Processing Terms, the Customer's enabling and configuration of an API Key, a Webhook or a Connector are its instructions, and GetClinic's processing ends when the data is delivered to the Customer System;

(b) under section 3.5 of the Business Associate Agreement, the disclosure is one that Covered Entity initiates through the Service; and

(c) as section 9.3 of the Terms of Service provides, GetClinic is not responsible for data after it has been delivered to an Endpoint or system that the Customer has selected.

6.3 Data Location. API Output is delivered to the Customer System wherever the Customer has placed it. Delivery to a Customer System outside the Data Location is the Customer's transfer and not a copy by GetClinic under section 6.6 of the Cloud Services Agreement or section 7.6 of the Terms of Service. The Customer is responsible for any transfer mechanism that the law requires for it.

6.4 Third-Party Integrations. A vendor or integrator that operates a Third-Party Integration acts for the Customer, and is the Customer's processor, business associate or service provider, not GetClinic's Sub-processor. Before giving it an API Key, credentials or access to API Output, the Customer will put in place the agreement that the law requires with it, and will give it only the Scopes it needs. GetClinic is not a party to that agreement and is not responsible for the third party.

6.5 Data coming in. The Customer is responsible for the data its Customer Systems send to the Service, which is Customer Data. Files received through a Connector are scanned and held in quarantine like any other upload. The Customer will send only data it is entitled to process and will not send Patient Data until the Data Processing Terms, and where it applies the Business Associate Agreement, are signed.

6.6 Credentials the Customer provides. Where a Connector needs a credential to a Customer System, such as access to a storage location, the Customer will provide a credential limited to what the Connector needs. GetClinic uses it only to operate that Connector and protects it under the technical and organisational measures in Annex II of the Data Processing Terms. The Customer can change or withdraw it at any time.

6.7 FHIR export. FHIR export contains an approved report version, its variant observations and its provenance, and never contains secondary findings. The subject of the exported resources is an identifier of the case, not a patient record.

7. Permitted use and restrictions

7.1 The Customer may use the API, Webhooks and Connectors only to connect its own Customer Systems to the Service for the purposes the Agreement allows.

7.2 The Customer will not, and will ensure that its Users and any third party acting for it do not:

(a) share an API Key between Customer Systems or third parties, or embed it in software or pages that run on users' devices or that others can read;

(b) access the Service by automated means other than the API, including by scraping the user interface (section 5.2 of the Acceptable Use Policy);

(c) get around a Scope, a rate limit, an IP allow-list or another security control;

(d) carry out load, penetration or security testing without GetClinic's written permission;

(e) resell, sublicense or provide access to the API to anyone other than the Customer's own Customer Systems;

(f) use Outputs received through the API, Webhooks or Connectors, or allow a third party to use them, to train, fine-tune or evaluate a machine-learning model or to build a data set, other than a model or data set used only by the Customer for its own clinical, laboratory or research work and not provided to others; this does not limit the Customer's use of the data it submitted to the Service; or

(g) use the API or API Output to build a product or service that competes with the Service.

7.3 Section 7.2(f) and (g) do not restrict the publication and sharing that section 14.4 of the Cloud Services Agreement or section 15.5 of the Terms of Service allows.

8. Security duties

8.1 The Customer will:

(a) keep API Key secrets and Webhook secrets in a secret store, and not in source code, URLs, logs, tickets or email;

(b) give each Customer System its own API Key with the fewest Scopes and the lowest organisational unit it needs;

(c) replace each API Key before it expires, by creating a new one and revoking the old one;

(d) revoke an API Key at once if it suspects that the secret has been exposed, and report the suspicion to [email protected] without undue delay (section 4.3 of the Acceptable Use Policy);

(e) verify Webhook signatures under section 5.3; and

(f) where the Customer has set an IP allow-list for API Keys, keep it current.

8.2 The Customer will track the expiry dates of its API Keys shown in the Service.

9. Suspension and revocation by GetClinic

9.1 GetClinic may suspend or revoke an API Key, suspend an Endpoint or pause a Connector where it reasonably believes that:

(a) the API Key or a secret has been exposed or is being used by someone not authorised by the Customer;

(b) its use breaches these Integration Terms or the Acceptable Use Policy;

(c) its use threatens the security or the stability of the Service or other customers; or

(d) the law requires it.

9.2 GetClinic will limit the action to what is needed and will notify the Customer's administrators by email when it acts. Where practicable it will notify the Customer before it acts. GetClinic will tell the Customer the reason on request, unless the law or the security of the Service forbids it.

9.3 A revocation by GetClinic cannot be undone. The Customer may create a new API Key once the cause is resolved. A suspended Endpoint or paused Connector is restored when the cause is resolved.

9.4 Section 11 of the Agreement continues to apply.

10. Changes and deprecation

10.1 Compatible changes. GetClinic may add operations, fields, events and values to the API and Webhooks at any time. The Customer will design its Customer Systems to ignore fields and values they do not recognise.

10.2 Breaking changes. GetClinic will make a change that is not compatible under section 10.1 only in a new version of the API published under a new path, and will keep the existing version available alongside it for at least 6 months after notice under section 10.4, or, under the Cloud Services Agreement, for the longer period in the Order Form.

10.3 Removal. GetClinic may withdraw an operation, a Scope, an event or a Connector on at least 6 months' notice under section 10.4. It may do so on shorter notice, or without notice, where needed to address a security risk, to comply with law, or because a third party that a Connector depends on withdraws its service, and it will then give as much notice as it can.

10.4 Notice. GetClinic gives notice under this section 10 in the Service and by email to the Customer's administrators, and records the change in the release notes.

10.5 Preview. Operations and Connectors marked as preview are excluded from sections 10.2 and 10.3 and may change or be withdrawn without notice (section 9.5 of the Terms of Service, section 15.4 of the Cloud Services Agreement).

11. Fees, availability and liability

11.1 Fees for the API, Webhooks and Connectors are those of the Customer's plan or Order Form.

11.2 The API is part of the Service for the purposes of the Service Level Agreement only where that agreement says so. Webhook delivery and the availability of Customer Systems and third-party systems are outside any service level.

11.3 GetClinic's liability under these Integration Terms is subject to the limits of the Agreement. GetClinic is not liable for a Customer System, a Third-Party Integration, or loss caused by the use of an API Key that the Customer did not keep secret.

12. Term

12.1 These Integration Terms apply for as long as the Customer uses the API, Webhooks or Connectors under the Agreement.

12.2 When the Agreement ends, API Keys, Endpoints and Connectors stop working, without affecting the export period under the Agreement. Sections 6, 7.2(f) and (g), and 11.3 survive.