Privacy Policy

Industry-leading security for physicians

We adhere to the following principles to protect your privacy

We do not rent or sell your information to third parties for marketing purposes. Any information that you provide will be secured with industry standard protocols and technology.

Whitepaper: HIPAA & Doximity (PDF)
Summary of Changes: 03-06-14 (PDF)
Whitepaper: Amion Messaging (PDF)


1. Personal Information Collected

Doximity collects publicly available information about physicians in a database to provide a directory and referral service to other healthcare professionals. This information includes your name, office address, office phone and fax numbers, specialty, and the medical school and training institutions you attended. Almost all doctors, and many other healthcare professionals, are included in our database. If you choose to register and become a User, you will verify that the information that we have collected about you is accurate.

The purpose of the Doximity service is to permit Users to add to the publicly available information about themselves in order to develop, maintain and enhance a network of professional contacts. Users may provide us certain personal information, such as your affiliations and work history, which we collect and publish in order to allow you to enhance your network of contacts.

If you have any hesitation about providing such information to us and/or having such information displayed on the Doximity website or otherwise used in any manner permitted in this Privacy Policy and the User Agreement, you may refrain from providing this information. The only information that you are required to provide in order to become a member of Doximity is your email address. By default, your email address is not published in your Doximity profile, and we will use it only to send you product updates and information. You can, of course, opt not to receive these updates.

If an authorized third party, such as an administrator in your office, completes the registration form on your behalf, both you and that third party will be deemed to have accepted all of the terms of this Privacy Policy.

We collect personal information from you at the following times:

When You Register

The following fields are required during registration to guarantee the Doximity network is a useful directory for its members: name, address, specialty, office phone, occupation, email address and password. Physicians are required to additionally enter or confirm medical school, year of graduation and birthday. Most of this information, other than your email address, will already be included in your profile, but we ask that you verify that the information is correct, and update it where necessary. We use your medical school year of graduation and birthday in order to verify that you are a physician.

We also give you the option to provide the following information: subspecialty, title/practice, clinical areas of interest, maiden name, languages spoken at your office, and profile photo. Providing such information is completely optional and choosing not to provide this information will not affect your ability to browse the Doximity directory or use the Doximity service.

All of the information that is publicly available or you voluntarily provide will be included in your profile, which is accessible to anyone browsing the Doximity directory, except your birth year, year you graduated from medical school, and your email address.

When You Add a Public Profile

Once you have completed the registration process, you may at any time provide additional information to your profile. Such information includes: medical group, IPA and hospital affiliations, internship, residency program, fellowships, work history, presentations, publications, education, professional interests, memberships, and board certifications. Providing additional information is entirely optional, but enables you to better identify yourself and find new opportunities in the Doximity system to build and leverage your professional network.

All of the information that is publicly available or you voluntarily provide will be published in your profile, which is accessible to anyone browsing the Doximity directory, except the year(s) you graduated from your internship, residency and/or fellowship programs. Any information you provide to us, whether during the registration process or as an update to your Profile, may be used in the same manner and extent to which other information is permitted to be used hereunder, including for the purpose of serving advertisements through the service.

When You Add a Private Profile

If you choose, you may fill out a private profile on Doximity. The private profile can consist of back line, mobile phone, home phone, other phone, pager, inpatient/admit number, email address or other private note.

Your private profile is visible only to those confirmed colleagues with whom you select to share it.

When You Invite Others to Join Doximity

If you wish to invite your colleagues to join Doximity, you can use our service to fax invitations to their offices. In this case, no additional information about you or your colleagues is collected.

Alternatively, you may enter their names and email addresses, which Doximity will use to send your invitation including a message that you write. The names and email addresses of people that you invite will be used only to send your invitation and reminders.

When You Contact Customer Support

Doximity may collect information through our website or through Customer Support in order to, among other things, accurately categorize and respond to your inquiry and deliver appropriate service levels.

Cookies

Like most websites, Doximity uses cookies and web log files to track site usage. A cookie is a tiny data file which resides on your computer which allows Doximity to recognize you as a User when you return to the Doximity website using the same computer and web browser. Like the information you enter at registration or when you update your Profile, cookie and log file data is used to customize your experience on our website. One type of cookie, known as a “persistent” cookie, is set once you’ve logged in to your Doximity account. The next time you visit the Doximity website, the persistent cookie will allow us to recognize you as an existing User so you will not need to log in before using the service. However, if you log out of the Doximity website you will need to re-enter your password the next time you visit in order to log in to your account. We use cookies to improve the quality of our service by storing User preferences and tracking User trends. Most browsers are initially set up to accept cookies, but you can reset your browser to refuse all cookies or to indicate when a cookie is being sent.

Log files, IP addresses and information about your computer and mobile device

Due to the communications standards on the internet, when you visit the Doximity website we automatically receive the URL of the site from which you came and the site to which you are going when you leave Doximity. Doximity also receives the internet protocol (“IP”) address of your computer (or the proxy server you use to access the World Wide Web), your computer operating system and type of web browser you are using, email patterns, mobile device operating system (if you are accessing Doximity using a mobile device), as well as the name of your ISP or your mobile carrier. We use this information to analyze overall trends to help improve the service. The linkage between your IP address and your personally identifiable information is not shared with third parties without your permission, except as described in Section 2 (“Legal Disclaimer” and “Disclosures to Others”), below.

Consent to Doximity Processing Information About You

Certain information you provide to Doximity may reveal, or allow others to identify, your nationality, ethnic origin, religion or other aspects of your private life, and more generally about you. Please be aware that in providing information to Doximity for the purposes of opening your user account, you are expressly and voluntarily accepting the terms and conditions of this Privacy Policy and Doximity’s User Agreement. The supplying of all such information by you to Doximity, including all information deemed "personal" or “sensitive” by applicable law, is entirely voluntary on your part. You have the right to withdraw your consent at any time, in accordance with the terms of this Privacy Policy and the User Agreement, but please note that your withdrawal of consent will not be retroactive.

Rights to Access, Correct and Eliminate Information About You

You have a right to access, modify, correct and eliminate the data about you, which has been collected pursuant to your decision to become a User. If you update any of your information, we may keep a copy of the information which you originally provided to us in our archives for uses documented herein. We take your rights seriously and encourage you to use them if you deem this to be appropriate. You may exercise these rights by emailing us at support@doximity.com or by contacting us at:

Doximity
ATTN: Privacy Policy Issues
500 3rd St. Suite 510
San Francisco, CA 94107

Return to top

2. Uses of Personal Information

Doximity is an online service dedicated to helping medical professionals more effectively connect with one another. The information you choose to provide about yourself on our service is used to help you describe yourself to other Users. If you close your Doximity account, we will remove all of the personal information that you have provided to Doximity from our publicly viewable database, as well as any private profile information that you have stored with us. We will retain the publicly available data in the database, including all of the information about you that was available on our database prior to your joining the Doximity network. Other information, that does not personally identify you as an individual, is collected by Doximity from Users (such as, for example, patterns of utilization) and is exclusively owned by Doximity. This information can be utilized by Doximity in such manner as Doximity, in its sole discretion, deems appropriate.

Doximity's Communications to You

Doximity will communicate with you through email, fax and notices posted on the Doximity website or through other means available through the service, including text and other forms of messaging. If we send any communications to you via the carrier service with which you have a mobile communications subscription or otherwise have access, you understand you will pay any service fees associated with any such access (including text messaging charges for messages to your mobile device). Our communications to you include emails which help inform Users about various features of the service. Doximity may send you promotional information unless you have opted out of receiving such information. You can change your email and contact preferences at any time by sending a request to support@doximity.com or by updating your profile information.

Customized Content

Information provided to Doximity (or to third parties with whom it offers combined services) is also used to customize your experience on our website. For example, you can store “favorite” phone numbers for easy reference.

Sharing Information with Third Parties

Doximity takes the privacy of Users very seriously. We do not sell, rent, or otherwise provide your private information to third parties for marketing or other purposes. We may provide data about the usage of our services with third party service providers with whom we contract to help us provide our Services. For example, we may work with vendors, consultants or other third parties to host and maintain our data and website properties, analyze our data, or provide marketing assistance. All contracted third parties must agree not to use your personal information and communications other than to fulfill their responsibilities to us and are bound by confidentiality agreements with regard to their use of such information. We may provide aggregated anonymous data about the usage of our services to third parties for such purposes as we deem, in our sole discretion, to be appropriate, including to prospective investors in Doximity. We may segment our Users by specialty, education, alumni groups, training, research, grants, trials, geographic location or other similar information and provide information from your public profile as part of our Services and product offerings. If you would like to be excluded from the aggregated research or products based upon aggregated or segmented data and Users’ activities on the site, please email support@doximity.com.

As part of our Services, we may share personal information with accredited Continuing Medical Education (CME) and Continuing Education (CE) providers who certify CME and CE activities, to process CME or CE activities you may choose to take through our Service.

As part of our Services, we may also share public profile information with medical leading publications and ranking bodies, such as U.S. News and World Reports to increase the visibility of our Users.

When you use the Doximity Service through a Doximity website, newsletter, mobile app or other medium, you may be presented with advertisements or opportunities to engage in informational programs consisting of sponsor-selected content. Examples of these programs include sponsored news alerts or branded or unbranded discussion groups. All sponsored programs will be labeled clearly as sponsored.

When you choose to engage with a sponsored program, such as engaging with a commercial client’s sponsored news alert, we may provide our commercial clients with your identifiable information and information about the type of engagement (e.g., whether you viewed, interacted with or requested information about such promotional content). We will only share your identifiable information with clients who have agreed to use such information solely for authorized purposes.

To confirm, we will not provide your personal contact information such as email, phone, fax, or postal address as part of our Services.

You may revoke your authorization to participate in these features of our Services at anytime. If you would like to be excluded from the accredited bodies, leading publications or commercial features of our Services, please email support@doximity.com.

Finding Colleagues

We use your information, including the addresses you import through our contact importers, to make suggestions to you and other users on Doximity. For example, if another user imports the same email address as you do, we may suggest that you add each other as colleagues.

To help your friends find you, we allow other users to use contact information they have about you, such as your email address, to find you, including through contact importers and search.

Search

We offer search services to help you find information and learn more about other Users (for example, you can search for Users with particular expertise, or that you may know from your medical school). We use information from User profiles and other contributions to Doximity to inform and refine our search service.

Surveys and Polls

As a User, you may receive requests to participate in market research including polls and surveys submitted by other Doximity members. If you participate in surveys and polls offered through our website, the information you provide may be visible to others using the Doximity website. You may opt-out of participating by emailing support@doximity.com to stop receiving these inquiries and requests.

Communications to other Users

Communications you initiate through Doximity, such as a colleague invitation sent to a non-User, will list your name in the message, along with your current office address and phone/fax numbers. No other contact information will be included in the message.

Doximity members may communicate with one another using the Doximity DocMail feature. DocMail messages may only be initiated between two users who have confirmed a colleague relationship within the Doximity network. In the case where a User has initiated a group message to two or more of his or her colleagues, recipients of this group message may “reply all” to the recipients of this group message, even though they are not all colleagues. This is the only instance where a User may receive a DocMail from a non-colleague. DocMail messages may be sent Secure or non-Secure. Secure messages require recipients to confirm their identity by entering their PIN code prior to viewing. Non-Secure messages may be read by anyone with access to a User’s mobile device.

You can disable DocMail at any time in Settings. You can disable “push” notifications of new DocMail messages at any time through the settings on your mobile device.

Legal Disclaimer

It is possible that we may need to disclose personal information when required by law, such as responses to civil or criminal subpoenas, or other requests by law enforcement personnel. We will disclose such information when we have a good-faith belief that it is necessary to comply with a court order, ongoing judicial proceeding, subpoena, or other legal process or request to Doximity brought in any country throughout the world, or to exercise our legal rights or defend against legal claims.

Disclosures to others

We may also disclose your personal and other information you provide, to another third party as part of a reorganization or a sale of substantially all of the business of Doximity. Any third party to which we transfer or sell Doximity’s assets will have the right to continue to use the personal and other information that you provide to us.

Return to top

3. Your Information Choices

Accessing and Changing Your Account Information

You can review the personal information you provided us and make any desired changes to the information you publish, or to the settings for your Doximity account, including your email and contact preferences, at any time by emailing support@doximity.com You can also make these changes on the Doximity website by updating your Profile. Please be aware that even after your request for a change is processed, Doximity may, for a time, retain residual information about you in its backup and/or archival copies of its database.

Closing Your Account

You can also close your account at any time by emailing support@doximity.com If you close your Doximity account, we will remove all of the information that you have provided to Doximity from our publicly viewable database, as well as any private profile information that you have stored with us. We will retain the publicly available data in the database, including all of the information about you that was available on our database prior to your joining the Doximity network. We may also retain certain data contributed by you if we believe it may be necessary to prevent fraud or future abuse, or for legitimate business purposes, such as analysis of aggregated, non-personally identifiable data, account recovery, or if required by law.

Doximity may also retain and use your information if necessary to provide the Services to other Users. For example, just as an email you may send to another person through an email service provider resides in that person's inbox even after you delete it from your sent files or close your account, communications to other Users, as well as your contributions to iRounds and DocNews or other communications, may remain visible to others after you have closed your account. Similarly, other information you have shared with others, or that other Users have copied, may also remain visible. This includes personal health information that you communicate through the Doximity Services. Doximity disclaims any liability in relation to the deletion or retention (subject to the terms herein) of information or any obligation not to delete the information. Doximity does not control when search engines update their cache, which may contain certain public profile information that has since been removed from Doximity's publicly viewable database.

To request that we close your account and remove your information from the Doximity website, please send your request to support@doximity.com Please send your request using an email account that you have registered with Doximity under your name. You will receive a response within five business days of its receipt.

Memorializing Accounts

If we learn that a User is deceased, we may memorialize the User's account. In these cases we may restrict profile access, remove messaging functionality, and close an account if we receive a formal request from the User's next of kin or other proper legal request to do so.

Return to top

4. Your Obligations

As a User, you have certain obligations toward the other Users with whom you will be communicating. Certain of these obligations are imposed by applicable law and regulations, and others have become commonplace in user-friendly communities of like-minded members, such as Doximity:

  1. You must, at all times, respect the terms and conditions of the then-current Privacy Policy and the User Agreement. This includes respecting all intellectual property rights which may belong to third parties (such as photographs).
  2. You must not download or otherwise disseminate any information which may be deemed to be injurious, defamatory, violent, offensive, racist, sexist or xenophobic, or which may otherwise violate the purpose and spirit of Doximity and its community of Users.
  3. You must not provide information to Doximity and /or other Users which you believe might be injurious or detrimental to your person, professional or social status.
  4. You must use our free peer-to-peer invite and secure message system for clinical, not commercial use. While we do allow selected client outreach for partner information, market research, expert witness, and career opportunities, these messages have a distinct format and channel-level opt-outs to protect our members. Those found soliciting, scamming, or spamming other members will be removed or suspended from the network at our sole discretion.

Any violation of these guidelines may lead to the restriction, suspension or termination of your account by Doximity, as we take these principles seriously and consider them to be the basis on which our Users adhere to the Doximity website and the services which it offers.

Return to top

5. Important Information

If Users have questions or concerns regarding this statement, you may contact Doximity by email at support@doximity.com

Insurance Data

Insurance data on Doximity is offered for informational purposes only, should not be relied upon, and users agree to hold harmless Doximity and its data suppliers for use of the data.

Changes to this Privacy Policy

We reserve the right to modify this privacy statement at any time, so please review it frequently. If we make material changes to this policy, we will notify you here, by email, or by means of a notice on our home page. We generally post updates to this policy once per year or as applicable. By continuing to use the Doximity service after notice of changes have been sent to you or published on the Doximity website, you are consenting to the changes.

If you use the Doximity service after notice of these changes have been posted, you are providing your consent to the changed practices.

Insurance and other data is provided to Doximity by docspot.com

Return to top

6. Security

In order to secure your personal information, access to your data on Doximity is password-protected. It is your responsibility to protect the security of your login information.

Return to top

7. End User License Agreement

NOTE: YOU ARE CONCLUDING A LEGALLY BINDING AGREEMENT

1. INTRODUCTION

A. Purpose

Doximity's mission is to connect the world's medical professionals to enable you to be more productive and successful.

B. Scope and Intent

You agree that by registering on Doximity, or by using the website, including our directory search, productivity features, mobile applications, premium services, or other information provided as part of the Doximity services (collectively "Doximity" or the "Services"), you are entering into a legally binding agreement with Doximity, 500 3rd St., Suite 510, San Francisco, CA 94107 ("we," "us," "our," and "Doximity") based on the terms of this Doximity User Agreement and the Doximity Privacy Policy, which is hereby incorporated by reference (collectively referred to as the "Agreement") and become a Doximity user ("you", "your", and "User").

If you are using Doximity on behalf of a company, medical practice or other legal entity, you are nevertheless individually bound by this Agreement even if your company has a separate agreement with us. If you do not want to register an account and become a Doximity User, do not conclude the Agreement, do NOT click join Doximity and do not access, view, download or otherwise use any Doximity webpage, information or services. By joining Doximity you acknowledge that you have read and understood the terms and conditions of this Agreement and that you agree to be bound by all of its provisions. By joining Doximity you also consent to use electronic signatures and acknowledge your registration as one. Please note that the Doximity User Agreement and Privacy Policy are also collectively referred to as Doximity's "Terms of Service."

2. YOUR OBLIGATIONS

A. Applicable laws and this Agreement
  • DOs and DON'Ts;
  • Complaints Regarding Content Posted on the Doximity Website; and
  • Doximity's Privacy Policy.
B. License and warranty for your submissions to Doximity

You must comply with all applicable laws, the Agreement, as may be amended from time to time with or without advance notice, and the policies and processes explained in the following sections:

You have control over the information you provide Doximity under this Agreement, and may request its deletion at any time, unless you have shared information or content with others and they have not deleted it, or it was copied or stored by other users. Additionally, you grant Doximity and its registered users a nonexclusive, irrevocable, worldwide, perpetual, unlimited, assignable, sublicenseable, fully paid up and royalty-free right to copy, prepare derivative works of, improve, distribute, publish, remove, retain, add, process, analyze, use and commercialize, in any way now known or in the future discovered, any information you provide, directly or indirectly to Doximity, including, but not limited to, any registration data, user generated content, ideas, concepts, techniques or data to the services, you submit to Doximity, without any further consent, notice and/or compensation to you or to any third parties. Any information you submit to us is at your own risk of loss as noted in Sections 2 and 3 of this Agreement.

By providing information to us, you represent and warrant that you are entitled to and have the requisite rights to submit the information and that the information is accurate, not confidential, and not in violation of any contractual restrictions or other third party rights. Note messages containing electronic protected health information between users should be submitted through DocMail, which is encrypted. Except as otherwise provided in this Agreement, Doximity will have no obligations with respect to the information you submit to us. Doximity hereby grants you a non-exclusive, non-transferable license to re-use or republish your own contributions made to the Doximity site in its original or derivative form for republication elsewhere, such as in journals or other professional publications. This license is restricted to your own contributions and does not grant you rights to republish the contributions or postings of other Doximity members. Doximity shall be free to use any ideas, concepts, know-how or techniques contained in such information for any purpose whatsoever including, but not limited to, developing, manufacturing, and marketing products and services incorporating such information. It is your responsibility to keep your Doximity profile information accurate and updated.

C. Service Eligibility

To be eligible to use the Service, you must meet the following criteria and represent and warrant that you: (1) are 18 years of age or older; (2) a certified U.S. physician, medical student, or other health care professional (3) are not currently restricted from the Services, or not otherwise prohibited from having a Doximity account, (4) are not a competitor of Doximity or are not using the Services for reasons that are in competition with Doximity; (5) will only maintain one Doximity account at any given time; (6) have full power and authority to enter into this Agreement and doing so will not violate any other agreement to which you are a party; (7) will not violate any rights of Doximity, including intellectual property rights such as copyright or trademark rights; and (8) agree to provide at your cost all equipment, software, and internet access necessary to use the Services.

D. Sign-In Credentials

You agree to: (1) Keep your password secure and confidential; (2) not permit others to use your login credentials to access your account; (3) refrain from using other Users' accounts; (4) refrain from selling, trading, or otherwise transferring your Doximity account or any information and content of another Doximity user to another party; and (5) refrain from charging anyone for access to any portion of Doximity, or any information therein. Further, you are responsible for anything that happens through your account until you close down your account or prove that your account security was compromised due to no fault of your own. To close your account, please contact support@doximity.com.

E. Indemnification

You indemnify us and hold us harmless for all damages, losses and costs (including, but not limited to, reasonable attorneys' fees and costs) related to all third party claims, charges, and investigations, caused by (1) your failure to comply with this Agreement, including, without limitation, your submission of content that violates third party rights or applicable laws, (2) any content you submit to the Services, and (3) any activity in which you engage on or through Doximity.

F. Payment

If you purchase any services that we offer for a fee, either on a one-time or subscription basis ("Premium Services"), you agree to Doximity storing your payment card information. You also agree to pay the applicable fees for the Premium Services (including, without limitation, periodic fees for premium accounts) as they become due plus all related taxes, and to reimburse us for all collection costs and interest for any overdue amounts. Your obligation to pay fees continues through the end of the subscription period during which you cancel your subscription. You may cancel your Premium Services by contacting support@doximity.com. You also acknowledge that Doximity's Premium Services are subject to this Agreement and any additional terms related to the provision of the Premium Service. All fees and charges are nonrefundable and there are no refunds or credits for partially used periods. All Premium Services, including upgrades and additional messages acquired as part of your Premium account, expire immediately upon cancellation or termination of your Premium account.

G. Notify Us of Acts Contrary to the Agreement

If you believe that you are entitled or obligated to act contrary to this Agreement under any mandatory law, you agree to provide us with detailed and substantiated explanation of your reasons in writing at least 30 days before you act contrary to this Agreement, to allow us to assess whether we may, at our sole discretion, provide an alternative remedy for the situation, though we are under no obligation to do so.

H. Notifications and Service Messages

For purposes of service messages and notices about the Services to you, Doximity may place a banner notice across its pages to alert you to certain changes such as modifications to this Agreement. Alternatively, notice may consist of an email from Doximity to an email address associated with your account, even if we have other contact information. You also agree that Doximity may communicate with you through your Doximity account or through other means including email, mobile number, telephone, or delivery services including the postal service about your Doximity account or services associated with Doximity. You acknowledge and agree that we shall have no liability associated with or arising from your failure to maintain accurate contact or other information, including, but not limited to, your failure to receive critical information about the Service.

I. User-To-User Communication and Sharing

Doximity offers various forums such as DocMail and iRounds, where you can communicate with individuals and groups. Any electronic personal health information communicated will be subject to the Business Associate Agreement attached as Exhibit A.

Doximity members can create iRounds groups, phone lists for free, however, Doximity may close or transfer iRounds groups or phone lists in its discretion, or remove content from them if the content violates this Agreement or others' intellectual property rights.

Please note that ideas you post and information you share may be seen and used by other Users, and Doximity cannot guarantee that other Users will not use the ideas and information that you share on Doximity. Therefore, if you have an idea or information that you would like to keep confidential and/or don't want others to use, or that is subject to third party rights that may be infringed by your sharing it, do not share it on Doximity. DOXIMITY IS NOT RESPONSIBLE FOR A USER'S MISUSE OR MISAPPROPRIATION OF ANY CONTENT OR INFORMATION YOU POST, UPLOAD, OR TRANSMIT WITHIN DOXIMITY.

J. Privacy

You should carefully read our full Privacy Policy and Business Associate Agreement before deciding to become a User as it is hereby incorporated into this Agreement by reference, and governs our treatment of any information, including personally identifiable information and electronic personal health information you submit to us. Please note that certain information, statements, data, and content (such as photographs) which you may submit to Doximity, or groups you choose to join might, or are likely to, reveal your gender, ethnic origin, nationality, age, and/or other personal information about you. You acknowledge that your submission of any information, statements, data, and content to us is voluntary on your part.

K. Contributions to Doximity

By submitting ideas, suggestions, documents, and/or proposals ("Contributions") to Doximity through its suggestion or feedback webpages, you acknowledge and agree that: (a) your Contributions do not contain confidential proprietary or protected health information; (b) Doximity is not under any obligation of confidentiality, express or implied, with respect to the Contributions; Doximity shall be entitled to use or disclose (or choose not to use or disclose) such Contributions for any purpose, in any way, in any media worldwide; (d) Doximity may have something similar to the Contributions already under consideration or in development; (e) you irrevocably assign to Doximity all rights to your Contributions; and (f) you are not entitled to any compensation or reimbursement of any kind from Doximity under any circumstances.

L. Posted Data

The information and content posted on Doximity is gathered from publicly available data or submitted by Users, and Doximity cannot guarantee the accuracy of such information. Use of Doximity by you is conditioned upon your agreement that all of the information and content, including profile and insurance data, is for informational purposes only and should not be relied upon, and that as User, you agree to hold harmless Doximity and other Users and data suppliers for your use or reliance on such data.

3. YOUR RIGHTS

On the condition that you comply with all your obligations under this Agreement, including, but not limited to, the Do's and Don'ts listed in Section 12, we grant you a limited, revocable, nonexclusive, nonassignable, nonsublicenseable license and right to access the Services, through a generally available web browser, mobile device or application (but not through scraping, spidering, crawling or other technology or software used to access data without the express written consent of Doximity or its Users), view information and use the Services that we provide on Doximity webpages and in accordance with this Agreement. Any other use of Doximity contrary to our mission and purpose (such as seeking to connect to someone you do not know or to use information gathered from Doximity commercially in each case unless expressly authorized by Doximity) is strictly prohibited and a violation of this Agreement. We reserve all rights not expressly granted in this Agreement, including, without limitation, title, ownership, intellectual property rights, and all other rights and interest in Doximity and all related items, including any and all copies made of the Doximity website.

4. OUR RIGHTS AND OBLIGATIONS

A. Services Availability

For as long as Doximity continues to offer the Services, Doximity shall provide and seek to update, improve and expand the Services. As a result, we allow you to access Doximity as it may exist and be available on any given day and have no other obligations, except as expressly stated in this Agreement. We may modify, replace, refuse access to, suspend or discontinue Doximity, partially or entirely, or change and modify prices for all or part of the Services for you or for all our users in our sole discretion. All of these changes shall be effective upon their posting on our site or by direct communication to you unless otherwise noted. Doximity further reserves the right to withhold, remove and or discard any content available as part of your account, with or without notice if deemed by Doximity to be contrary to this Agreement. For avoidance of doubt, Doximity has no obligation to store, maintain or provide you a copy of any content that you or other Users provide when using the Services.

B. Third Party Sites

Doximity may include links to third party web sites ("Third Party Sites") on www.doximity.com and elsewhere. You are responsible for evaluating whether you want to access or use a Third Party Site. You should review any applicable terms and/or privacy policy of a Third Party Site before using it.

Doximity is not responsible for and does not endorse any features, content, advertising, products or other materials on or available from Third Party Sites. Accordingly, if you decide to access Third Party Sites, you do so at your own risk.

C. Disclosure of User Information

You acknowledge, consent and agree that we may access, preserve, and disclose your registration and any other information you provide if required to do so by law or in a good faith belief that such access preservation or disclosure is reasonably necessary in our opinion to: (1) comply with legal process, including, but not limited to, civil and criminal subpoenas, court orders or other compulsory disclosures; (2) enforce this Agreement; (3) respond to claims of a violation of the rights of third parties, whether or not the third party is a User, individual, or government agency; (4) respond to customer service inquiries; or (5) protect the rights, property, or personal safety of Doximity, our Users or the public.

Disclosures of User information to third parties other than those required to provide customer support, administer this agreement, or comply with legal requirements are addressed in the privacy policy.

D. Connections and Interactions With Other Users

You are solely responsible for your interactions with other Users. Doximity may limit the number of colleague connections you may have to other Users and may, in certain circumstances, prohibit you from contacting other Users through use of the Services or otherwise limit your use of the Services. Doximity reserves the right, but has no obligation, to monitor disputes between you and other members and to restrict, suspend, or close your account if Doximity determines, in our sole discretion, that doing so is necessary to enforce this Agreement.

You agree that from time to time Doximity may invite or otherwise make you aware of certain educational, promotional or financial opportunities relating to Your Communications and profile.

5. SERVICE DISCLAIMER

Do not rely on Doximity, any information therein, or its continuation. We provide the platform for Doximity and all information and services on an "as is" and "as available" basis. Doximity does not control or vet User generated content for accuracy. We do not provide any express warranties or representations.

To the fullest extent permissible under applicable law, we disclaim any and all implied warranties and representations, including, without limitation, any warranties of merchantability, fitness for a particular purpose, title, accuracy of data, and noninfringement. If you are dissatisfied or harmed by Doximity or anything related to Doximity, you may close your Doximity account and terminate this agreement in accordance with section 7 ("termination") and such termination shall be your sole and exclusive remedy.

Doximity is not responsible, and makes no representations or warranties for the delivery of any messages (such as DocMail, posting on iRounds or transmission of any other user generated content) sent through Doximity to anyone. In addition, we neither warrant nor represent that your use of the service will not infringe the rights of third parties. Any material, service, or technology described or used on the website may be subject to intellectual property rights owned by third parties who have licensed such material, service, or technology to us.

Doximity does not guarantee that the services it provides will function without interruption or errors in functioning. In particular, the operation of the services may be interrupted due to maintenance, updates, or system or network failures. Doximity disclaims all liability for damages caused by any such interruption or errors in functioning. Furthermore, Doximity disclaims all liability for any malfunctioning, impossibility of access, or poor use conditions of the Doximity site due to inappropriate equipment, disturbances related to internet service providers, to the saturation of the internet network, and for any other reason.

6. MEDICAL DISCLAIMER

The contents of Doximity, such as text, graphics, images, information obtained from Doximity's licensors, users, employees and other material contained in Doximity ("Content") is for informational and educational purposes only and are not a substitute for the professional judgment of a health care professional in diagnosing and treating patients. Doximity or you are not permitted to advise, diagnose, or otherwise treat users through the services. Neither the content nor any other service offered by or through this site is intended to be for medical diagnosis or treatment. Persons accessing this information assume full responsibility for the use of the information and agree that Doximity is not responsible or liable for any claim, loss, or damage arising from the use of the information. Doximity does not recommend or endorse any specific drugs, tests, physicians, products, procedures, opinions, “off-label” drug uses or other information that may be mentioned on Doximity and Doximity members are required by the "Do's" of these Terms of Use to disclose any such conflicts of interest. Your reliance upon the Content obtained or used by you is solely at your own risk.

Doximity reminds you that the Service is not meant to serve as a substitute for your own professional medical judgment. You should always exercise your professional judgment in evaluating your patients, and should carefully consider any treatment plan. Doximity encourages you to confirm the information made available or otherwise obtained through the Service with other reliable sources before undertaking any treatment. We also encourage you to review from time to time the American Medical Association's Policy for Professionalism in the Use of Social Media at http://www.ama-assn.org/ama/pub/meeting/professionalism-social-media.shtml.

BUSINESS ASSOCIATE AGREEMENT

The Health Insurance Portability and Accountability Act of 1996 generally requires that covered entities and business associates enter into contracts to ensure that the business associates will appropriately safeguard protected health information. A business associate contract serves to clarify and limit, as appropriate, the permissible uses and disclosures of protected health information by the business associate, based on the relationship between the parties and the activities or services being performed by the business associate. You and Doximity agree to the terms of the business associates agreement provided in Exhibit A relating to any communications of electronic protected health information.

8. LIMITATION OF LIABILITY

Neither Doximity nor any employees, shareholders, representatives or directors ("Doximity Affiliates") shall be cumulatively liable for (a) any damages in excess of U.S. $10, or (b) any special, incidental, indirect, punitive or consequential damages or loss of use, profit, revenue or data to you or any third person arising from your use of the Service, any platform applications or any of the content or other materials on, accessed through or downloaded from Doximity. This limitation of liability is part of the basis of the bargain between the parties and without it the terms and prices charged would be different. This limitation of liability shall:

Apply regardless of whether (1) you base your claim on contract, tort, statute or any other legal theory, (2) we knew or should have known about the possibility of such damages, or (3) the limited remedies provided in this section fail of their essential purpose; and

Not apply to any damage that Doximity may cause you intentionally or knowingly in violation of this Agreement or applicable law, or as otherwise mandated by applicable law that cannot be disclaimed from in this Agreement.

Not apply if you have entered into a separate agreement to purchase Premium Services with a separate Limitation of Liability provision that supersedes this section in relation to those Premium Services.

9. TERMINATION

A. Mutual Rights of Termination

You may terminate this Agreement, for any or no reason, at any time, with notice to Doximity pursuant to Section 11.B. This notice will be effective upon Doximity processing your notice. Doximity may terminate the Agreement and your account for any reason or no reason, at any time, with or without notice. This cancellation shall be effective immediately or as may be specified in the notice. Termination of your Doximity account includes disabling your access to Doximity and may also bar you from any future use of Doximity.

B. Misuse of the Services

Doximity may restrict, suspend or terminate the account of any User who abuses or misuses the Services or offers competitive services. Misuse of the Services includes inviting to connect other Users whom you do not know or with whom you do not have a medical referral, informational, recruiting or consulting objective authorized by Doximity; abusing the Doximity messaging services; using the Services commercially without Doximity's authorization, infringing any intellectual property rights, violating any of the Do's and Don'ts listed in Section 12, or any other behavior that Doximity, in its sole discretion, deems contrary to its purpose. In addition, and without limiting the foregoing, Doximity has adopted a policy of terminating accounts of Users who, in Doximity's sole discretion, are deemed to be repeat infringers under the United States Copyright Act.

C. Effect of Termination

Upon the termination of your Doximity account, you lose access to the Services. The terms of this Agreement shall survive any termination, except Sections 3 ("Your Rights") and 4.a-b, and d ("Our Rights and Obligations") hereof.

10. DISPUTE RESOLUTION

A. Law and Forum for Legal Disputes

This Agreement or any claim, cause of action or dispute ("claim") arising out of or related to this Agreement shall be governed by the laws of the state of California regardless of your country of origin or where you access Doximity, and notwithstanding of any conflicts of law principles and the United Nations Convention for the International Sale of Goods. You and Doximity agree that all claims arising out of or related to this Agreement must be resolved exclusively by a state or federal court located in Santa Clara County, California, except as otherwise agreed by the parties or as described in the Arbitration Option paragraph below. You and Doximity agree to submit to the personal jurisdiction of the courts located within Santa Clara County, California for the purpose of litigating all such claims. Notwithstanding the above, you agree that Doximity shall still be allowed to apply for injunctive remedies (or an equivalent type of urgent legal relief) in any jurisdiction.

B. Arbitration Option

For any claim (excluding claims for injunctive or other equitable relief) where the total amount of the award sought is less than $10,000, the party requesting relief may elect to resolve the dispute in a cost effective manner through binding non-appearance-based arbitration. In the event a party elects arbitration, they shall initiate such arbitration through an established alternative dispute resolution ("ADR") provider mutually agreed upon by the parties. The ADR provider and the parties must comply with the following rules: (a) the arbitration shall be conducted by telephone, online and/or be solely based on written submissions, the specific manner shall be chosen by the party initiating the arbitration; (b) the arbitration shall not involve any personal appearance by the parties or witnesses unless otherwise mutually agreed by the parties; and any judgment on the award rendered by the arbitrator shall be final and may be entered in any court of competent jurisdiction.

11. GENERAL TERMS

A. Severability

If any provision of this Agreement is found by a court of competent jurisdiction or arbitrator to be illegal, void, or unenforceable, the unenforceable provision will be modified so as to render it enforceable and effective to the maximum extent possible in order to effect the intention of the provision; and if a court or arbitrator finds the modified provision invalid, illegal, void or unenforceable, the validity, legality and enforceability of the remaining provisions of this Agreement will not be affected in any way.

B. Notices and Service of Process

In addition to Section 2.h. ("Notifications and Service Messages"), we may notify you via postings on www.doximity.com. You may contact us at support@doximity.com or via mail or courier at:

Doximity

ATTN: Legal Department
500 3rd St.
Suite 510
San Francisco, CA 94107

Additionally, Doximity accepts service of process at this address. Any notices that you provide without compliance with this section on Notices shall have no legal effect.

C. Entire Agreement

You agree that this Agreement constitutes the entire, complete and exclusive agreement between you and us regarding the Services and supersedes all prior agreements and understandings, whether written or oral, or whether established by custom, practice, policy or precedent, with respect to the subject matter of this Agreement. You also may be subject to additional terms and conditions that may apply when you use or purchase certain other Doximity services, third-party content or third party software.

D. Initial Posting and Amendments to This Agreement

This Agreement will be posted on the www.doximity.com website. We reserve the right to modify, supplement or replace the terms of the Agreement, effective upon posting at www.doximity.com or notifying you otherwise. For example, Doximity may present a banner on the site when we have amended this Agreement or the Privacy Policy so that you may access and review the changes prior to your continued use of the site. If you do not want to agree to changes to the Agreement, you can terminate this Agreement at any time per Section 9 (Termination).

E. No Informal Waivers, Agreements or Representations

Our failure to act with respect to a breach of this Agreement by you or others does not waive our right to act with respect to that breach or subsequent similar or other breaches. Except as expressly and specifically contemplated by the Agreement, no representations, statements, consents, waivers or other acts or omissions by any Doximity Affiliate shall be deemed legally binding on any Doximity Affiliate, unless documented in a physical writing hand signed by a duly appointed officer of Doximity.

F. No Injunctive Relief

In no event shall you seek or be entitled to rescission, injunctive or other equitable relief, or to enjoin or restrain the operation of the Service, exploitation of any advertising or other materials issued in connection therewith, or exploitation of the Services or any content or other material used or displayed through the Services.

G. Assignment and Delegation

You may not assign or delegate any rights or obligations under the Agreement. Any purported assignment and delegation shall be ineffective. We may freely assign or delegate all rights and obligations under the Agreement, fully or partially without notice to you. We may also substitute, by way of unilateral novation, effective upon notice to you, Doximity for any third party that assumes our rights and obligations under this Agreement.

H. Potential Other Rights and Obligations

You may have rights or obligations under local law other than those enumerated here if you are located outside the United States.

12. DOXIMITY USER "DOS" and "DON'TS"

As a condition to access Doximity, you agree to this User Agreement and to strictly observe the following DOs and DON'Ts:

A. Do Undertake the Following:
  1. Comply with all applicable laws, including, without limitation, state and federal patient privacy laws, intellectual property laws, export control laws, tax laws, and regulatory requirements;
  2. Provide accurate information to us and update it as necessary;
  3. Review and comply with our Privacy Policy;
  4. Review and comply with notices sent by Doximity concerning the Services; and
  5. Disclose any potential conflicts-of-interest, such as consultant fees (e.g. promoting "off-label" use) as appropriate; and
  6. Use the Services in a professional manner.
B. Don't Undertake the Following:
  1. Act dishonestly or unprofessionally by engaging in unprofessional behavior by posting inappropriate, inaccurate, or objectionable content to Doximity;
  2. Publish inaccurate information in the designated fields on the profile form (e.g., do not include a link or an email address in the specialty field). Please also protect sensitive personal information such as your email address, phone number, street address, or other information that is confidential in nature;
  3. Harass, abuse or harm another person, including sending unwelcomed or unauthorized communications to others using Doximity;
  4. Upload a profile image that is not your likeness or a head-shot photo;
  5. Use or attempt to use another's account without authorization from the user, or create a false identity on Doximity;

Upload, post, email, DocMail, fax, transmit or otherwise make available or initiate any content that:

  1. Falsely states, impersonates or otherwise misrepresents your identity, including but not limited to misrepresenting your current or previous positions and qualifications, or your affiliations with a person or entity, past or present;
  2. Is unlawful, libelous, abusive, obscene, discriminatory or otherwise objectionable;
  3. Adds to a content field content that is not intended for such field (i.e. submitting a telephone number in the specialty field);
  4. Includes information that you do not have the right to disclose or make available under any law or under contractual or fiduciary relationships (such as private patient information, insider information, or proprietary and confidential information learned or disclosed as part of employment relationships or under nondisclosure agreements);
  5. Infringes upon patents, trademarks, trade secrets, copyrights or other proprietary rights;
  6. Includes any unauthorized advertising, promotional materials, "junk mail," "spam," "chain letters," "pyramid schemes," or any other form of unauthorized communication. This prohibition includes but is not limited to (a) using Doximity invitations to send messages to people who don't know you or who are unlikely to recognize you as a known contact; (b) using Doximity to connect to people who don't know you and then sending unsolicited promotional messages to those direct connections without their permission; and (c) sending messages to distribution lists, newsgroup aliases, or group aliases;
  7. Contains software viruses, worms, or any other computer code, files or programs that interrupt, destroy or limit the functionality of any computer software or hardware or telecommunications equipment of Doximity or any User of Doximity;
  8. Forges headers or otherwise manipulate identifiers in order to disguise the origin of any communication transmitted through the Services; and/or
  9. Duplicate, license, sublicense, publish, broadcast, transmit, distribute, perform, display, sell, rebrand, or otherwise transfer information found on Doximity (excluding content posted by you) except as permitted in this Agreement or as expressly authorized by Doximity;
  10. Reverse engineer, decompile, disassemble, decipher or otherwise attempt to derive the source code for any underlying intellectual property used to provide the Services, or any part thereof
  11. Utilize or copy information, content or any data you view on and/or obtain from Doximity to provide any service that is competitive, in Doximity's sole discretion, with Doximity;
  12. Imply or state, directly or indirectly, that you are affiliated with or endorsed by Doximity unless you have entered into a written agreement with Doximity;
  13. Adapt, modify or create derivative works based on Doximity or technology underlying the Services, or other Users' content, in whole or part;
  14. Rent, lease, loan, trade, sell/re-sell access to Doximity or any information therein, or the equivalent, in whole or part;
  15. Sell, sponsor, or otherwise monetize iRounds content, phone lists, or any other service or functionality of Doximity, without the express written permission of Doximity;
  16. Deep-link to the Site for any purpose, (i.e. including a link to a Doximity web page other than Doximity's home page) unless expressly authorized in writing by Doximity or for the purpose of promoting your profile or a Group on Doximity;
  17. Remove any copyright, trademark or other proprietary rights notices contained in or on Doximity, including those of both Doximity and any of its licensors;
  18. Collect, use, copy, or transfer any information, including, but not limited to, personally identifiable information obtained from Doximity except as expressly permitted in this Agreement or as the owner of such information may expressly permit;
  19. Share information of non-Users without their express consent;
  20. Infringe or use Doximity's brand, logos and/or trademarks, including, without limitation, using the word "Doximity" in any business name, email, or URL or including Doximity's trademarks and logos or as expressly permitted by Doximity;
  21. Use manual or automated software, devices, scripts robots, other means or processes to access, "scrape," "crawl" or "spider" any web pages or other services contained in the site, unless explicitly permitted by Doximity;
  22. Use bots or other automated methods to access Doximity, add or download contacts, send or redirect messages, or perform other activities through Doximity, unless explicitly permitted by Doximity;
  23. Access, via automated or manual means or processes, Doximity for purposes of monitoring Doximity's availability, performance or functionality for any competitive purpose;
  24. Engage in "framing," "mirroring," or otherwise simulating the appearance or function of Doximity's website;
  25. Attempt to or actually access Doximity by any means other than through the interfaces provided by Doximity such as its mobile application or by navigating to http://www.doximity.com using a web browser. This prohibition includes accessing or attempting to access Doximity using any third-party service, including software-as-a-service platforms that aggregate access to multiple services, including Doximity;
  26. Attempt to or actually override any security component included in or underlying Doximity;
  27. Engage in any action that directly or indirectly interferes with the proper working of or places an unreasonable load on Doximity's infrastructure, including, but not limited to, sending unsolicited communications to other Users or Doximity personnel, attempting to gain unauthorized access to Doximity, or transmitting or activating computer viruses through or on Doximity;
  28. Interfere with or disrupt or game Doximity or the Services, including, but not limited to, any servers or networks connected to Doximity, in particular Doximity's search algorithms.
  29. Any attempt to obtain unauthorized access, interfere with or to exceed authorized access to Doximity shall be considered a trespass and computer fraud and abuse, punishable under state and federal laws. Doximity hereby notifies you that any or all communications with this website can and will be monitored, captured, recorded, and transmitted to the authorities as deemed necessary by Doximity in its sole discretion and without further notice.

13. COMPLAINTS REGARDING CONTENT POSTED ON THE DOXIMITY WEBSITE

We built Doximity to help you be a more successful physician or other healthcare professional. To achieve this purpose, we encourage our Users to share truthful and accurate information. We also respect the intellectual property rights of others. Accordingly, this Agreement requires that information posted by Users be accurate and not in violation of the intellectual property rights or other rights of third parties. To promote these objectives, Doximity provides a process for submission of complaints concerning content posted by our Users. Our policy and procedures can be found in the Doximity Privacy Policy.

If you believe any materials accessible on or from the Services infringe your copyright, you may request removal of those materials (or access thereto) from the Services by contacting Doximity at the following physical or email address:

Doximity

ATTN: Legal Department
500 3rd St.
Suite 510
San Francisco, CA 94107
support@doximity.com

and providing the following information:

  1. Identification of the copyrighted work that you believe to be infringed. Please describe the work, and where possible include a copy or the location (e.g., URL) of an authorized version of the work.
  2. Identification of the material that you believe to be infringing and its location. Please describe the material, and provide us with its URL or any other pertinent information that will allow us to locate the material.
  3. Your name, address, telephone number and (if available) e-mail address.
  4. A statement that you have a good faith belief that the complained of use of the materials is not authorized by the copyright owner, its agent, or the law.
  5. A statement that the information that you have supplied is accurate, and indicating that "under penalty of perjury," you are the copyright owner or are authorized to act on the copyright owner's behalf.
  6. A signature or the electronic equivalent from the copyright holder or authorized representative.

In an effort to protect the rights of copyright owners, we maintain a policy for the termination, in appropriate circumstances, of subscribers and account holders who are repeat infringers.

EXHIBIT A: HIPAA BUSINESS ASSOCIATE AGREEMENT BETWEEN DOXIMITY AND PROVIDER

THIS HIPAA BUSINESS ASSOCIATE AGREEMENT (the "BA Agreement") is entered into as of the date that the Doximity User (referred to in this BA Agreement as “Provider” electronically agrees to the Online Terms and Conditions of Use governing the Doximity service. This BA Agreement is entered into between the Provider ("Covered Entity") and Doximity, Inc. ("Business Associate").

Doximity is a “Business Associate” and Users are “Providers” under the BA Agreement in instances when Users upload protected health information to Doximity. Subcontractors that register as Users, or agree to the terms of Doximity’s Privacy Policy and Terms, and receive, maintain, or transmit protected health information on behalf of Doximity are “Business Associates” of Doximity and also subject to terms of this Agreement.

WITNESSETH

WHEREAS, Congress enacted the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), which protects the confidentiality of health information;

WHEREAS, pursuant to HIPAA, the United States Department of Health and Human Services ("HHS") promulgated Privacy Standards and Security Standards, each as defined below, governing confidential health information;

WHEREAS, Business Associate performs services through its provision of the Doximity Services (the "Service") on behalf of Covered Entity;

WHEREAS, Business Associate's provision of the Service requires Covered Entity to provide Business Associate with access to confidential health information; and

WHEREAS, in order to comply with the business associate requirements of HIPAA and its implementing regulations, Business Associate and Covered Entity must enter into an agreement that governs the uses and disclosures of such confidential health information by the Business Associate.

NOW, THEREFORE, in consideration of the foregoing recitals, the mutual promises and covenants set forth herein, and other good and valuable consideration, the receipt and sufficiency of which are hereby acknowledged, the parties agree as follows:

1. Definitions.

The following terms used in this BA Agreement shall have the same meaning as those terms in the HIPAA Rules: Data Aggregation, Designated Record Set, Disclosure, Health Care Operations, Minimum Necessary, Notice of Privacy Practices, Security Incident, Subcontractor, and Use.

For purposes of this BA Agreement, the following terms shall have the following meanings:

"Breach" when capitalized, "Breach" shall have the meaning set forth in 45 C.F.R. 164.402 (including all of its subsections); with respect to all other uses of the word "breach" in this BA Agreement, the word shall have its ordinary contract meaning.

“Business Associate” shall generally have the same meaning as the term “business associate” at 45 C.F.R. § 160.103.

“Covered Entity” shall generally have the same meaning as the term “covered entity” at 45 C.F.R. § 160.103.

"Electronic Media" shall have the meaning set forth in 45 C.F.R. 160.103, which is defined as electronic storage media (including memory devices in computers, hard drives, any removable or transportable digital memory medium, such as magnetic tape or disk, optical disk or digital memory card) or transmission media used to exchange information already in electronic storage media (including the Internet, extranet (using Internet technology to link a business with information only accessible to collaborating parties), leased lines, dial-up lines, private networks, and those transmissions that are physically moved from one location to another using magnetic tape, disk, or compact disk media). Certain transmissions, including of paper, via facsimile, and of voice, via telephone, are not considered to be transmissions via electronic media, because the information being exchanged does not exist in electronic form before the transmission.

"Electronic Protected Health Information" or "EPHI" shall mean Individually Identifiable Health Information that is (i) transmitted by Electronic Media or (ii) maintained in any medium constituting Electronic Media. For instance, EPHI includes information contained in a patient's electronic medical records and billing records. "EPHI" shall not include (i) education records covered by the Family Educational Right and Privacy Act, as amended, 20 U.S.C. 1232g; (ii) records described in 20 U.S.C. 1232g(a)(4)(B)(iv); and (iii) employment records held by a Covered Entity in its role as employer.

“HIPAA Rules” shall mean the Privacy, Security, Breach Notification, and Enforcement Rules at 45 C.F.R. Part 160 and Part 164.

"HITECH Act" shall mean the Health Information Technology for Economic and Clinical Health Act, found in Title XIII of the American Recovery and Reinvestment Act of 2009, effective February 17, 2009.

"Individual" shall have the same meaning as set forth in 45 C.F.R. 160.103, defined as the person who is the subject of PHI, and shall include a personal representative in accordance with 45 C.F.R. 164.502(g).

"Individually Identifiable Health Information" shall mean information that is a subset of health information, including demographic information collected from an individual, and

(i) is created or received by a health care provider, health plan, employer, or health care clearinghouse; and

(ii) relates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present or future payment for the provision of health care to an individual; and (a) identifies the individual, or (b) with respect to which there is a reasonable basis to believe the information can be used to identify the individual.

"Privacy Standards" shall mean the Standards for Privacy of Individually Identifiable Health Information, 45 C.F.R. Parts 160 and 164, Subparts A, D, and E, as currently in effect.

"Protected Health Information" or "PHI" shall mean Individually Identifiable Health Information that is (i) transmitted by Electronic Media, (ii) maintained in any medium constituting Electronic Media; or (iii) transmitted or maintained in any other form or medium. For instance, PHI includes information contained in a patient's medical records and billing records. "Protected Health Information" shall not include (i) education records covered by the Family Educational Right and Privacy Act, as amended, 20 U.S.C. 1232g; (ii) records described in 20 U.S.C. 1232g(a)(4)(B)(iv); and (iii) employment records held by a Covered Entity in its role as employer.

"Required by Law" shall have the same meaning as the term "Required by law" in 45 C.F.R. 164.103.

"Secretary" shall mean the Secretary of the U.S. Department of Health and Human Services or any office or person within the U.S. Department of Health and Human Services to which/whom the Secretary has delegated his or her authority to administer the Privacy Standards and the Security Standards, such as the Director of the Office for Civil Rights.

"Security Standards" shall mean Security Standards for the Protection of Electronic Protected Health Information, 45 C.F.R. Part 160 and Part 164, Subparts A and C.

"Subsequent Business Associate" shall mean any agent, including subcontractors, of Business Associate to whom Business Associate discloses Protected Health Information or Electronic Protected Health Information.

"Unsecured Protected Health Information" shall have the same meaning as the term "unsecured protected health information" in 45 C.F.R. 164.402, limited to the information created or received by Business Associate from or on behalf of Covered Entity.

All references to "days" in this BA Agreement shall mean calendar days. Capitalized terms used not defined herein shall have the meanings ascribed to them in the Privacy Standards or the Security Standards.

2. Business Associate Obligations. Business Associate acknowledges and agrees that it is considered a "business associate" as defined by HIPAA and by regulations promulgated thereunder. As a business associate of Covered Entity, Business Associate shall comply with the following terms of this BA Agreement, as required pursuant to 45 C.F.R. § 164.504.

2.1 Permitted Uses and Disclosures. Business Associate agrees that it shall use and disclose Protected Health Information received from Covered Entity for the purposes of providing the Service services, as otherwise permitted under this BA Agreement, or as Required by Law. Business Associate is authorized to use Protected Health Information to deidentify the information in accordance with 45 C.F.R. § 164.514(a)-(c). Business Associate agrees to follow guidance issued by the Secretary regarding what constitutes "minimum necessary" with respect to the use or disclosure of PHI and EPHI. Until such time that such guidance is issued, Business Associate shall limit its use or disclosure of PHI and EPHI, to the extent practicable, to the limited data set (as defined in 45 C.F.R. 164.514(e)(2)), or to the minimum necessary to accomplish the intended purpose of such use, disclosure or request, respectively.

2.2 Disclosures to Subsequent Business Associates. Business Associate shall not disclose any PHI to any Subsequent Business Associate, unless and until Business Associate and the Subsequent Business Associate have entered into an agreement containing the same terms and conditions as set forth in this BA Agreement.

2.2.1 Business Associate, in accordance with 45 C.F.R. § 164.502(e)(1)(ii) and § 164.308(b)(2), if applicable, shall ensure that any subcontractors that create, receive, maintain, or transmit Protected Health Information on behalf of Business Associate agree to the same restrictions, conditions, and requirements that apply to Business Associate with respect to such information.

2.3 Reporting Violations of Law. Consistent with the requirements of 45 C.F.R. 164.502(j)(1), Business Associate may disclose Protected Health Information to report violations of law to appropriate Federal and State authorities.

2.4 Appropriate Safeguards. Business Associate shall implement appropriate administrative, technical, and physical safeguards to prevent any use or disclosure of Protected Health Information not authorized by this BA Agreement. Specifically, Business Associate agrees to comply with the requirements of 45 C.F.R. 164.308, 164.310,164.312 and 164.316 to the same extent such requirements apply to Covered Entity.

2.5 Reporting of Illegal, Unauthorized or Improper Uses or Disclosures and Remedial Actions. Business Associate shall report to Covered Entity any illegal, unauthorized, or improper use or disclosure of Protected Health Information, Security Incident or any Breach (collectively, "Known Misuse") by it or a Subsequent Business Associate without unreasonable delay and within ten (10) business days of obtaining knowledge of such Known Misuse. Additionally, if the Known Misuse is a Breach of Unsecured Protected Health Information, Business Associate shall comply with the requirements of 45 C.F.R. 164.410. Business Associate shall take, or, in the event that the acts or omissions of a Subsequent Business Associate gave rise to the Known Misuse, shall require a Subsequent Business Associate to take, commercially reasonable actions to mitigate the negative impact of any Known Misuse and adopt additional or improve existing safeguards to prevent recurrence.

2.6 Internal Practices, Books and Records. Business Associate shall make its internal practices, books and records relating to the use and disclosure of Protected Health Information received from, or created or received by Business Associate on behalf of Covered Entity available to the Secretary, or their designees, for purposes of determining and facilitating Business Associate's and Covered Entity's compliance with the Privacy Standards and Security Standards.

2.7 Access to Protected Health Information.

2.7.1 Within ten (10) days of a request by Covered Entity, Business Associate shall provide Protected Health Information in its possession or in the possession of a Subsequent Business Associate to Covered Entity in order for Covered Entity to comply with its obligations under 45 C.F.R. 164.524 to provide Individuals with access to their Protected Health Information.

2.7.2 Business Associate shall notify Covered Entity within five (5) days of receiving a request from an Individual to access Protected Health Information. Following receipt of such notice from Business Associate, Covered Entity shall handle such request from the Individual.

2.8 Amendments to Protected Health Information.

2.8.1 Within ten (10) days of a request by Covered Entity, Business Associate shall provide Protected Health Information in its possession or in the possession of a Subsequent Business Associate to Covered Entity in order for Covered Entity to comply with its obligations under 45 C.F.R. 164.526 to provide Individuals the right to amend their Protected Health Information.

2.8.2 Business Associate shall notify Covered Entity within five (5) days of receiving a request from an Individual to amend Protected Health Information. Following receipt of such notice from Business Associate, Covered Entity shall handle such request from the Individual.

2.9 Accounting of Disclosures.

2.9.1 Within twenty (20) days of a request by Covered Entity, Business Associate shall provide Covered Entity with an accounting of all disclosures of Protected Health Information, other than disclosures excepted from the Privacy Standards accounting requirement under 45 C.F.R. 164.528(a)(1)(i)-(ix), made by Business Associate or by a Subsequent Business Associate in the previous six (6) years (but in no event prior to April 14, 2003) in order for Covered Entity to comply with its obligations under 45 C.F.R. 164.528 to provide Individuals with an accounting of disclosures of their Protected Health Information.

2.9.2 Such accounting shall include, with respect to each disclosure: the date of the disclosure; the name (and address, if known) of the entity or person receiving the Protected Health Information; a description of the Protected Health Information disclosed; a statement of the purpose of the disclosure; and any other information the Secretary may require under 45 C.F.R. 164.528 (collectively, "Disclosure Information").

2.9.3 Notwithstanding Section 2.11.2, for repetitive disclosures of Protected Health Information that Business Associate makes for a single purpose to the same person or entity, Business Associate may record: (a) the Disclosure Information for the first of these repetitive disclosures; (b) the frequency, periodicity or number of these repetitive disclosures made during the accounting period; and the date of the last of these repetitive disclosures.

2.9.4 Business Associate shall notify Covered Entity within ten (10) days of receiving a request from an Individual for an accounting of disclosures of Protected Health Information. Following receipt of such notice from Business Associate, Covered Entity shall handle such request from the Individual.

2.9.5 In accordance with the HITECH Act, the parties acknowledge that the Secretary shall promulgate regulations regarding the right of Individuals to receive an accounting of disclosures made for treatment, payment and healthcare operations during the previous three (3) years if such disclosures are made through the use of an electronic health record. The parties agree to comply with such regulations promulgated by the Secretary as of the effective date of those regulations.

2.10 Subpoenas, Court Orders, and Governmental Requests. If Business Associate receives a court order, subpoena, or governmental request for documents or other information containing Protected Health Information, Business Associate will use reasonable efforts to notify Covered Entity of the receipt of the request within ten (10) business days to provide Covered Entity an opportunity to respond. Business Associate may comply with such order, subpoena, or request as Required by Law or permitted by law.

2.11 Remuneration in Exchange for PHI. Except as permitted by the HITECH Act or regulations promulgated by the Secretary in accordance with the HITECH Act, and as of the effective date of such regulations, Business Associate shall not directly or indirectly receive remuneration in exchange for PHI unless Covered Entity notifies Business Associate that it obtained a valid authorization from the Individual specifying that the Individual's PHI may be exchanged for remuneration by the entity receiving such Individual's PHI.

3. Covered Entity Obligations.

3.1 Notice of Privacy Practices. Covered Entity shall notify Business Associate of limitation(s) in its notice of privacy practices, to the extent such limitation affects Business Associate's permitted Uses or Disclosures.

3.2 Individual Permission. Covered Entity shall notify Business Associate of changes in, revocation of, permission by an Individual to use or disclose PHI, to the extent such changes affect Business Associate's permitted Uses or Disclosures.

3.3 Restrictions. Covered Entity shall notify Business Associate of restriction(s) in the Use or Disclosure of PHI that Covered Entity has agreed to, to the extent such restriction affects Business Associate's permitted Uses or Disclosures.

3.4 Consents and Authorizations. Covered Entity represents and warrants that any and all consents, authorizations, or other permissions necessary under the Privacy Standards or other applicable law (including state law) to transmit information through the Service and/or under this BA Agreement have been properly secured.

3.5 Marketing. Covered Entity represents and warrants that it has obtained any and all authorizations from Individual for any use or disclosure of PHI for marketing, unless the marketing communication is made without any form of remuneration (i) to describe medical services or products provided by either party; (ii) for treatment of the Individual; or (iii) for case management or care coordination for the Individual or to direct or recommend alternate treatments, therapies, providers or settings.

3.6 Permissible Requests by Covered Entity. Covered Entity shall not request Business Associate to use or disclose Protected Health Information in any manner that would not be permissible under Subpart E of 45 C.F.R. Part 164.

4. Term and Termination.

4.1 Term. The Term of this BA Agreement shall commence on and this BA Agreement shall be effective as of the date on which Covered Entity electronically registers for the Service, and shall continue in effect for as long as Covered Entity is registered for the Service.

4.2 Termination for Cause. In the event either party determines that the other has engaged in a pattern of activity or practice that constitutes a material breach of a term of this BA Agreement and such violation continues for thirty (30) days after written notice of such breach has been provided, the party claiming a breach shall have the right to terminate Covered Entity's participation on the Service or, if termination is not feasible, to report the breach to the Secretary.

4.3 Effect of Termination.

4.3.1 Return or Destruction of Protected Health Information; Disposition When Return or Destruction Not Feasible. Upon termination of this Agreement, the parties hereby acknowledge that the return or destruction of PHI received by the Business Associate from Covered Entity is not feasible, and that, therefore, Business Associate may retain a copy of such Protected Health Information provided that: (i) the provisions of this Agreement shall continue to apply to any such information retained following cancellation, termination, expiration, or other conclusion of Covered Entity's participation on the Service; and (ii) Business Associate shall limit Uses and Disclosures of such PHI to those purposes that make the return or destruction thereof not feasible, for as long as Business Associate maintains such PHI.

4.3.2 Reasonable Fees. All reasonable fees incurred to cause the return, destruction, or storage of Protected Health Information under this Section 4.3 shall be borne by the Covered Entity.

5. Miscellaneous.

5.1 Regulatory References. A reference in this BA Agreement to a section in HIPAA, the HITECH Act, the Privacy Standards, or the Security Standards means the section as in effect or as amended at the time.

5.2 Survival. The respective rights and obligations of the parties under Section 4.3 of this BA Agreement shall survive the termination of this BA Agreement.

5.3 Interpretation. Any ambiguity in this BA Agreement shall be resolved in favor of a meaning that permits the parties to comply with the Privacy Standards and Security Standards. Except to the extent specified by this BA Agreement, all of the terms and conditions governing Covered Entity's participation on the Service shall be and remain in full force and effect. In the event of any inconsistency or conflict between this BA Agreement and the terms and conditions governing Covered Entity's participation on the Service, the terms and provisions and conditions of this BA Agreement shall govern and control.

5.4 Amendment. The parties shall work together through reasonable negotiations to amend this BA Agreement as necessary to comply with any changes in law, including, but not limited to, the promulgation of amendments to the Privacy Standards or Security Standards required by the HITECH Act or any other future laws, applicable to or affecting the rights, duties, and obligations of the parties under this BA Agreement or the terms and conditions governing Covered Entity's participation on the Service.

5.5 Independent Relationship. None of the provisions of this BA Agreement are intended to create, nor will they be deemed to create, any relationship between the parties other than that of independent parties contracting with each other as independent contractors solely for the purposes of effecting the provisions of this BA Agreement and the terms and conditions governing Covered Entity's participation on the Service.

5.6 Notices. In addition to Section 2.h. ("Notifications and Service Messages") and 11.b (“Notices and Service of Process”), we may notify you via postings on www.doximity.com. You may contact us at support@doximity.com or via mail or courier at the address below.

All notices and notifications under this BA Agreement shall be sent in writing by traceable carrier to the listed persons on behalf of Business Associate and Covered Entity at the addresses indicated at the address below, or as set forth in the online registration process or such other address as a party may indicate by at least ten (10) days' prior written notice to the other party. Notices will be effective upon receipt. Any notices provided without compliance with this section on Notices shall have no legal effect.

5.7 Construction and Jurisdiction. This Agreement shall be governed by and construed in accordance with the laws of the State of California (excepting any conflict of laws provisions which would serve to defeat application of California law). Each of the parties hereto submits to the exclusive jurisdiction of the state and/or federal courts located within the State of California for any suit, hearing or other legal proceeding of every nature, kind and description whatsoever in the event of any dispute or controversy arising hereunder or relating hereto, or in the event any ruling, finding or other legal determination is required or desired hereunder.

5.8 Effectiveness. This Agreement is effective upon the User’s acceptance of the Privacy Policy and Terms of Use during the online registration process.

ADDRESSES FOR NOTICES
FOR DOXIMITY, INC:
Doximity

ATTN: Legal Department
500 3rd St.
Suite 510
San Francisco, CA 94107
FOR COVERED ENTITY:

The notice address for Covered Entity will be the address provided by that entity on the online registration page for the Doximity service.

Return to top