Legal

Upstream Terms of Service

Version: 1.1

Effective date: 2026-07-11

Last updated: 2026-07-11

These Terms of Service ("Terms") are a binding agreement between ByteWorthy LLC, a Texas limited liability company offering the Upstream service ("Upstream," "we," "us," or "our"), and the organization that owns or controls the Upstream workspace associated with the acceptance record ("Customer," "you," or "your").

The person accepting these Terms for Customer represents that they are at least 18 years old and have authority to bind Customer. Upstream is a business-to-business service for healthcare organizations, revenue-cycle organizations, and their authorized workforce. It is not offered for personal, family, or household use.

1. Acceptance and Contract Record

Customer accepts these Terms by affirmatively selecting the dedicated acceptance control during signup or another contract flow. Upstream records the Customer account, accepting user, signer name and title when supplied, this document's version and SHA-256 hash, acceptance time, IP address, and user agent. Customer agrees that this electronic record constitutes its signature and evidence of the version accepted. A separately signed order form or master services agreement may supplement these Terms.

Do not access or use the Service if the accepting person lacks authority or Customer does not agree to these Terms.

2. The Service

"Service" means Upstream's websites, applications, APIs, integrations, workflow tools, prior authorization and payer-operations capabilities, intelligence features, and related support. Upstream may prepare evidence, requirements, and transaction payloads; route Customer-approved work through supported payer, EHR, clearinghouse, browser, voice, or human-service channels; track outcomes; and provide operational analysis.

The Service supports Customer's authorized personnel. It does not make clinical decisions, replace professional judgment, guarantee payer approval or payment, or establish medical necessity. Customer controls its clinical, coding, billing, and submission decisions.

3. Accounts and Customer Responsibilities

Customer must:

1. provide accurate account, organization, payer, provider, and billing information;
2. maintain current authorized-user roles and promptly remove access that is no longer needed;
3. protect credentials, API keys, and connected-system access;
4. use the Service only for lawful purposes and within Customer's authority;
5. obtain notices, authorizations, consents, and other rights needed for Customer Data; and
6. notify security@upstream.cx promptly of suspected unauthorized access.

Customer is responsible for its Authorized Users and for the accuracy and legality of Customer's instructions, approvals, submissions, and connected-system configuration.

4. Human Approval and Limited Agency

An automated workflow may prepare work, but it does not give Upstream authority to make Customer's clinical or billing decisions. Where Customer enables transmission of prior authorizations, claims, appeals, or related payer transactions, live transmission requires Customer's approval of the specific action and, where presented, acceptance of the Limited Agency Authorization version 1.1.

The Limited Agency Authorization is narrow: it authorizes transmission and status work for Customer-approved items through a supported channel. It does not authorize Upstream to negotiate contracts, receive Customer funds, independently change a submission, or bind Customer outside the approved transaction.

5. Fees, Payment, and Renewal

The selected plan, order form, or checkout page states the fees, billing cadence, included usage, and usage charges. Customer authorizes Stripe to charge the selected payment method for recurring and usage-based fees and applicable taxes through Stripe-hosted checkout, billing portal, or tokenized payment-method surfaces, as applicable. Upstream receives only Stripe customer and tokenized payment references, not full payment-card numbers.

Unless an order form states otherwise, paid subscriptions renew for successive periods matching the initial billing period until canceled. Customer may cancel through available account controls or by contacting billing@upstream.cx. Cancellation prevents future renewal charges but does not refund a period already provided, except where required by law or expressly stated in an order form.

Undisputed overdue amounts may accrue interest at the lesser of one percent per month or the maximum lawful rate. Upstream may suspend paid features after notice and a reasonable opportunity to cure.

6. Acceptable Use

Customer and its Authorized Users must not:

1. violate law, payer rules, or a third party's rights;
2. submit data Customer lacks authority to use or disclose;
3. submit Protected Health Information ("PHI") before the Business Associate Agreement is in force;
4. use a public demo or marketing form for PHI or confidential patient information;
5. access another customer's tenant or circumvent access controls;
6. introduce malware, disrupt the Service, or conduct unauthorized security testing;
7. scrape or automate access except through documented interfaces or written authorization;
8. reverse engineer the Service except to the extent a restriction is prohibited by law;
9. use the Service or its outputs to train a competing service; or
10. use generated content without the review appropriate to its healthcare and financial impact.

Upstream may suspend activity that reasonably appears to create a security, legal, patient-safety, or service-integrity risk while it investigates.

7. Customer Data, Privacy, and HIPAA

"Customer Data" means data Customer or its Authorized Users submit to the Service or direct the Service to obtain from Customer's connected systems. As between the parties, Customer retains its rights in Customer Data. Customer grants Upstream a nonexclusive right to host, process, transmit, and display Customer Data only as needed to provide, secure, support, and comply with law regarding the Service.

The Upstream Privacy Policy, version 1.0 effective July 10, 2026, explains Upstream's processing as a business and service provider. The Upstream Data Processing Addendum ("DPA"), version 1.0 effective July 10, 2026, is incorporated into these Terms when Upstream processes non-PHI personal data on Customer's behalf. PHI is governed by the Business Associate Agreement ("BAA"), version 1.1 effective July 10, 2026, which must be accepted before PHI enters the Service. If the BAA and these Terms conflict regarding PHI, the BAA controls.

Upstream may create information that has been de-identified in accordance with the BAA and applicable law, or aggregated so that it does not identify Customer or an individual. Upstream may use that information to operate, secure, evaluate, and improve the Service. Upstream will not attempt to re-identify it except to test de-identification safeguards or as otherwise permitted by law and the applicable agreement.

8. Security and Confidentiality

Each party may receive nonpublic information identified as confidential or that reasonably should be understood as confidential ("Confidential Information"). The receiving party will use Confidential Information only to perform or exercise rights under the agreement, protect it using reasonable care, and disclose it only to personnel and contractors who need it and are bound by confidentiality obligations. These duties do not apply to information the recipient can document was lawfully known without restriction, independently developed, received lawfully from a third party, or made public without breach.

If law requires disclosure, the recipient will provide advance notice when legally permitted and reasonable assistance at the disclosing party's expense. Upstream's security commitments are described in the BAA, DPA, and published security materials. No method of storage or transmission is completely secure.

9. Integrations and Subprocessors

Customer may direct the Service to interact with third-party systems. Customer is responsible for its relationship with those providers and for granting appropriate access. Upstream is not responsible for a third-party service's independent acts, availability, or terms.

Upstream uses subprocessors to provide the Service. The canonical Subprocessor List, version 1.0 effective July 10, 2026, identifies their functions and data scope. The DPA governs additions and objections. PHI may flow to a subcontractor only where the BAA permits it and the required written protections are in force.

10. Intellectual Property and Feedback

Upstream and its licensors own the Service, documentation, software, models, designs, and related intellectual property. Subject to these Terms and payment of applicable fees, Upstream grants Customer a limited, nonexclusive, nontransferable right during the subscription term to use the Service for Customer's internal business operations.

If Customer provides feedback, Customer grants Upstream a perpetual, worldwide, royalty-free right to use it without identifying Customer or disclosing Customer Confidential Information. Upstream will not use Customer's name or logo in marketing without Customer's prior written permission.

11. AI-Assisted Features

Some features use machine learning or generative AI to classify information, identify possible requirements, or draft work for review. Outputs may be incomplete, outdated, or incorrect. Customer must review consequential outputs and the exact payload and destination before approving an action. Upstream does not represent that an output is medical, legal, coding, reimbursement, or compliance advice.

Upstream will handle PHI in an AI-assisted feature only through a configuration permitted by the BAA and Upstream's PHI controls. PHI is not authorized for public demos or non-PHI model lanes.

12. Warranties and Disclaimers

Each party warrants that it has authority to enter the agreement. Upstream warrants that it will provide the Service in a professional and workmanlike manner and will not materially reduce the Service's security commitments during a paid term.

EXCEPT FOR THE EXPRESS WARRANTIES IN THE AGREEMENT, THE SERVICE IS PROVIDED "AS IS" AND "AS AVAILABLE." TO THE MAXIMUM EXTENT PERMITTED BY LAW, UPSTREAM DISCLAIMS IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, AND NON-INFRINGEMENT, AND WARRANTIES ARISING FROM COURSE OF DEALING OR USAGE. UPSTREAM DOES NOT WARRANT UNINTERRUPTED OPERATION, A PARTICULAR PAYER OR FINANCIAL OUTCOME, OR THAT AUTOMATED OUTPUT WILL BE ERROR-FREE.

13. Indemnification

Upstream will defend Customer against a third-party claim that Customer's authorized use of the unmodified Service infringes a United States patent, copyright, or trademark, and will pay resulting court-awarded damages or approved settlement amounts. Upstream has no obligation for claims caused by Customer Data, Customer instructions, unauthorized modifications, combinations not supplied by Upstream, or continued use after Upstream provides a reasonable replacement or notice to stop.

Customer will defend Upstream against third-party claims arising from Customer Data, Customer's instructions or submissions, Customer's violation of law or these Terms, or Customer's lack of authority to provide data or direct an action, and will pay resulting court-awarded damages or approved settlement amounts.

The indemnified party must promptly notify the indemnifying party, allow control of the defense and settlement, and provide reasonable cooperation. A settlement may not admit fault or impose a nonmonetary obligation on the indemnified party without its written consent.

14. Limitation of Liability

TO THE MAXIMUM EXTENT PERMITTED BY LAW, NEITHER PARTY WILL BE LIABLE FOR INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, OR PUNITIVE DAMAGES, OR FOR LOST PROFITS, REVENUE, GOODWILL, OR BUSINESS INTERRUPTION, EVEN IF ADVISED OF THE POSSIBILITY.

EXCEPT FOR THE EXCLUSIONS BELOW, EACH PARTY'S TOTAL AGGREGATE LIABILITY ARISING OUT OF THE AGREEMENT WILL NOT EXCEED THE FEES PAID OR PAYABLE BY CUSTOMER TO UPSTREAM FOR THE SERVICE DURING THE TWELVE MONTHS BEFORE THE EVENT GIVING RISE TO LIABILITY. THE CAP DOES NOT LIMIT CUSTOMER'S PAYMENT OBLIGATIONS, EITHER PARTY'S FRAUD OR WILLFUL MISCONDUCT, OR LIABILITY THAT CANNOT LAWFULLY BE LIMITED. Liability involving PHI remains subject to the BAA and this Section unless a signed order form expressly provides a different cap.

15. Term, Suspension, and Termination

These Terms begin when accepted and continue while Customer uses the Service. Either party may terminate a month-to-month Service at the end of the current billing period. A fixed-term order may be terminated only as stated in that order or for uncured material breach.

Either party may terminate for material breach if the breach is not cured within thirty days after written notice, or sooner when cure is not possible. Upstream may suspend access immediately to contain a security incident, protect PHI, comply with law, or prevent material harm, and will restore access when the condition is resolved where reasonably possible.

After termination, Customer may request an export of available Customer Data during the period stated in its order form or, if none is stated, within thirty days. Upstream will then delete or return Customer Data according to the BAA, DPA, legal holds, and documented backup lifecycle.

16. Changes

Upstream may update the Service and these Terms. For a material change to legal rights or obligations, Upstream will provide reasonable advance notice and require a new acceptance where the acceptance gate applies. Emergency security or legal changes may take effect sooner with notice as soon as reasonably practicable. The acceptance record, not a page's display date alone, determines which version Customer accepted.

17. Governing Law and Disputes

Texas law governs the agreement without regard to conflict-of-law rules. Before filing a claim, the parties will attempt in good faith for thirty days to resolve the dispute through executives after written notice.

Except for claims seeking injunctive relief to protect Confidential Information or intellectual property, claims within small-claims jurisdiction, or collection of undisputed fees, any dispute will be resolved by binding arbitration administered by the American Arbitration Association under its Commercial Arbitration Rules. The arbitration will be conducted by one arbitrator in Tarrant County, Texas, and judgment may be entered in any court with jurisdiction. Each party waives trial by jury and participation in a class or representative action to the maximum extent permitted by law.

18. General

The agreement consists of these Terms, applicable order forms, the BAA, the DPA, the Limited Agency Authorization, and documents expressly incorporated by reference. In a conflict, the following order applies only to the relevant subject: BAA for PHI; Limited Agency Authorization for the scope of payer-transmission authority; DPA for non-PHI personal data processed for Customer; signed order form; these Terms; Privacy Policy.

Neither party may assign the agreement without the other's consent, except to an affiliate or in connection with a merger, reorganization, or sale of substantially all relevant assets if the assignee assumes the agreement. The parties are independent contractors except for the narrow agency expressly granted by an accepted Limited Agency Authorization. Neither party is liable for delay caused by circumstances beyond its reasonable control, excluding payment obligations.

Failure to enforce a provision is not a waiver. If a provision is unenforceable, it will be limited to the minimum extent necessary and the rest remains effective. There are no third-party beneficiaries. Sections intended by their nature to survive termination do so.

19. Notices and Contact

Legal notices to Upstream must be sent to legal@upstream.cx and by mail to:

ByteWorthy LLC

220 Town Park Avenue

Princeton, TX 75407-9846

United States

Operational contacts:

• General support: support@upstream.cx
• Billing: billing@upstream.cx
• Privacy: privacy@upstream.cx
• Security: security@upstream.cx

Upstream may send notices to the account owner, signer, or billing email associated with Customer's workspace. Email notice is effective when sent unless the sender receives a delivery failure.

End of Terms of Service version 1.1.