Terms of Service

These Terms of Service (the “Terms”) govern access to and use of the DODD Agency Pro platform, websites, and related services (collectively, the “Service”). By creating an account, accessing, or using the Service, the customer organization (the “Customer”) and each individual user agree to these Terms. If you do not agree, do not use the Service.

The Service is intended solely for authorized use by Ohio DODD provider agencies and their authorized workforce members in the course of their compliance and operational duties. Access is licensed, not sold, and is limited to the scope described in these Terms and any applicable order or subscription.

Each user is responsible for safeguarding their login credentials and for all activity that occurs under their account. Users must use strong, unique passwords and enable any additional authentication controls the Service makes available.

Credentials must not be shared. Each individual accessing the Service must have their own distinct account. Sharing logins, using another person's credentials, or allowing an unauthorized person to use the Service under your account is prohibited. Customers must promptly deactivate accounts for workforce members who no longer require access.

The Customer is solely responsible for:

• Access and permissions. Determining who within its organization may access the Service, assigning appropriate roles, and reviewing those permissions on a regular basis. The Customer is responsible for the actions of its authorized users.
• Lawful use. Using the Service in compliance with all applicable federal and state laws and regulations, including the HIPAA Privacy, Security, and Breach Notification Rules and current guidance from the U.S. Department of Health and Human Services Office for Civil Rights, as well as applicable Ohio DODD requirements.
• Minimum necessary. Limiting the information it enters and accesses to the minimum necessary to accomplish the intended purpose, consistent with the HIPAA minimum necessary standard and the data-entry limitations in Section 4.

Client-related features expose defined fields for specific operational workflows. Client Compliance Tracking encrypts client names at rest; its other bounded fields and other enabled client modules may rely on tenant and role-based access controls. Customers must not attempt to enter information a feature is not designed to hold.

This limitation applies to every field of the Service. Do not place prohibited information in name fields, notes, attachments, or any other input. Entering prohibited information violates these Terms and may constitute an impermissible use or disclosure for which the Customer is responsible.

Supporting documents may be added only to the employee, client, or agency certification and insurance requirement card for which they are relevant. Agency file uploads require Company Admin acceptance of the File Upload Agreement in Account Settings. That agreement supplements these Terms and does not expand the permitted use of protected health information under an applicable business associate agreement.

Where DODD Agency Pro and a Customer execute a Business Associate Agreement (“BAA”), that agreement governs the permitted uses and disclosures of that information and the safeguards each party must maintain.

To the extent any term of these Terms conflicts with the executed BAA between the Customer and DODD Agency Pro regarding the handling of protected health information, the terms of the BAA control. All other terms of these Terms remain in full force and effect.

Security is a shared responsibility. DODD Agency Pro maintains administrative, physical, and technical safeguards for the portions of the Service it operates, including encryption of the stored client name. The Customer remains responsible for the security of everything within its own control, including but not limited to:

• Device and endpoint security for computers and mobile devices used to access the Service.
• Network security, screen-lock, and physical safeguards at Customer locations.
• Workforce training on privacy, security, and appropriate use of the Service.
• Account provisioning, role assignment, and timely deactivation of access.

The Customer's designated security and privacy personnel are responsible for the Customer's risk analysis, policies, and safeguard decisions.

Customers must promptly report any suspected or actual security incident, unauthorized access, lost or stolen device, or improper use or disclosure involving the Service to DODD Agency Pro at support@doddagencypro.com with “Security” in the subject line. Reporting timelines and obligations related to protected health information are further governed by the BAA.

Customers must not use the reporting channel to transmit prohibited information described in Section 4; describe incidents without including protected health information.

Customers and users must not:

• Enter information prohibited under Section 4 or use the Service for any unlawful purpose.
• Attempt to access data, accounts, or organizations other than their own, or circumvent access controls.
• Probe, scan, or test the vulnerability of the Service, or interfere with or disrupt its integrity or performance, except under a written authorization from DODD Agency Pro.
• Reverse engineer, copy, resell, or create derivative works from the Service except as permitted by law.
• Upload malicious code or use the Service to transmit unlawful, infringing, or harmful content.

DODD Agency Pro may suspend or restrict access, in whole or in part, without prior notice where it reasonably believes doing so is necessary to protect the security, integrity, or availability of the Service or the data of other customers — for example, in response to a suspected compromise, active attack, or entry of prohibited information. We will endeavor to limit the scope and duration of any suspension to what is reasonably necessary and to notify the affected Customer.

As between the parties, the Customer owns the data it enters into the Service. DODD Agency Pro claims no ownership of Customer data and processes it only to provide the Service, as permitted by these Terms and the BAA, and as required by law.

During an active subscription, the Customer may export its data through the export functionality the Service provides. Customers are responsible for handling exported data securely and in accordance with their own obligations, including the HIPAA minimum necessary standard.

A Customer may cancel automatic renewal through the subscription controls made available in the Service or through the Stripe-hosted billing portal. A cancellation takes effect at the end of the Customer's then-current paid billing period. Stripe is instructed not to renew the subscription, and the Customer retains access through the displayed paid-through date.

Cancellation does not reverse a charge for a billing period that has already begun and does not create a prorated refund, except where a refund is required by law or expressly approved in writing. The Customer remains responsible for any amount already due. The Service will provide confirmation of the scheduled cancellation and the date on which paid access ends.

When the paid period ends, access to the Service ends and the post-termination retention period in Section 13 begins. Cancelling renewal is not the same as immediately deleting Customer data. Customers should export needed records before paid access ends.

The Service retains active and archived operational records to provide the product and preserve review history. After paid access ends, Customer data is retained for 90 days to permit an authorized recovery or reactivation request. At the end of that period, DODD Agency Pro will begin deletion from active systems, subject to the applicable BAA, legal preservation duties, security requirements, and any different written agreement with the Customer.

Residual copies in encrypted backups may remain until those backups expire under the ordinary backup-retention schedule and will not be restored for ordinary business use. A Customer should export records it is required to retain before access ends. Where the BAA or applicable law requires a different return, destruction, or documentation process, that requirement controls.

Either party may terminate a subscription in accordance with the applicable order or subscription terms. DODD Agency Pro may suspend or terminate access for a material breach of these Terms, including entry of prohibited information or unlawful use, subject to the security suspension provisions in Section 9.

Upon termination, the Customer's right to access the Service ends. Data handling after termination is governed by Sections 11 and 13 and the BAA.

DODD Agency Pro uses third-party providers for hosting, communications, AI-assisted features, and payment processing. The current providers and their application-supported data paths are described on the Subprocessors page. Applicable written agreements govern additional obligations.

DODD Agency Pro is a compliance organization, tracking, and checklist tool designed to support the Customer's compliance efforts. It does not provide legal advice, guarantee compliance, replace an official audit or regulatory review, or relieve the Customer of responsibility for understanding and following all applicable laws, rules, regulations, payer requirements, and DODD guidance. The Customer is solely responsible for its compliance decisions, records, actions, and omissions, and must verify requirements using current official sources. To the fullest extent permitted by law, the Customer agrees not to hold DODD Agency Pro, its owners, affiliates, officers, employees, contractors, or service providers responsible for penalties, citations, repayment obligations, losses, or other consequences resulting from the Customer's failure to comply, misuse of the Service, inaccurate or incomplete information entered into the Service, or reliance on the Service without appropriate independent review.

To the fullest extent permitted by applicable law, DODD Agency Pro is not responsible for a Customer's failure to satisfy a legal, regulatory, payer, certification, documentation, billing, employment, or contractual obligation, or for a Customer's decision to rely on the Service without independently reviewing the official authority and facts relevant to that decision.

Nothing in these Terms excludes or limits liability that cannot lawfully be excluded or limited, changes obligations expressly assumed in an executed BAA, or excuses DODD Agency Pro from performing the Service in accordance with its express written commitments. Any broader limitation of damages, liability cap, indemnification obligation, or exclusive remedy must be stated in an applicable order or other written agreement.

Supporting documents and external links are optional agency features. A Company Admin must accept the File Upload Agreement and explicitly activate the feature in Account Settings. The accepted agreement supplements these Terms. Checking an acceptance box alone does not activate or save the feature.

The Customer remains responsible for its authority to upload or share each document, the accuracy and relevance of its contents, workforce access, and compliance with applicable confidentiality, intellectual-property, employment, records-retention, and other obligations. Upload only evidence relevant to the employee or client requirement card. Do not upload protected health information unless an applicable executed business associate agreement is in effect and the Service has been authorized for that use. External links remain subject to the external provider's access controls and availability; the Service does not copy or back up the linked document.

Accepted file types are PDF, JPEG and PNG, with a limit of 5 MB per file and 25 MB of active files per card; 1 MB means 1,000,000 bytes. External links do not consume file quota. Security checks may reject a document and cannot guarantee detection of every threat. Adding evidence does not verify its accuracy, certify compliance, or mark a requirement complete.

Active uploaded files remain until replaced or deleted. Replaced or deleted files leave the active card and are recoverable for 30 days, subject to authorized access. After that window, stored file bodies become eligible for permanent removal unless held for applicable obligations. Historical backups have separate retention and may contain earlier copies; the 30-day window is not a promise of complete erasure or a statement of the Customer's legal record-retention period. Disabling the feature stops new uploads, links and replacements while preserving authorized access to existing items. The Customer must retain authoritative source records and its own recovery arrangements.

To the extent permitted by law, DODD Agency Pro is not responsible for loss, interruption, unauthorized disclosure, or other harm caused by the Customer's access decisions, external providers, failure to retain source records, or use contrary to these Terms or the accepted File Upload Agreement. The Service does not guarantee uninterrupted access or freedom from every security incident. The third-party claim, defense and indemnification provisions in the accepted File Upload Agreement apply according to their terms, including their exceptions for DODD Agency Pro's own breach, negligence or willful misconduct. Nothing in this section excludes non-waivable liability, reduces obligations in an applicable business associate agreement, or changes an express written commitment. An applicable business associate agreement controls a conflict concerning protected health information.