Version 1.0 · Effective October 12, 2026
This page is the FlowEHR Master Subscription Agreement ("MSA"). It is a short wrapper. Most of the legal text is the Common Paper Cloud Service Agreement Standard Terms, a free standard contract that FlowEHR did not write. This page adds FlowEHR's standard Key Terms and lists every change we make to the Standard Terms. We publish this page so that customers can read exactly what they are signing before any negotiation starts.
You accept this MSA by signing a FlowEHR Order Form that references it. The Order Form names the version of this page that applies. Later versions of this page do not change an Order Form already signed. They apply only if both parties sign a new Order Form or renewal that references them (see Section 5).
1. What the agreement is made of
Your agreement with Flow EHR, Inc., doing business as FlowEHR ("FlowEHR", the "Provider") is made up of these documents:
| # | Document | Where it lives | What it covers |
|---|---|---|---|
| 1 | Order Form | Signed by both parties | Who the customer is, what you bought, price, AI setting. The only deal-specific document. |
| 2 | Business Associate Agreement (BAA), version 2.1 | flow-ehr.com/baa | How FlowEHR protects protected health information. |
| 3 | Data Handling and AI Schedule, version 1.1 | flow-ehr.com/ai-terms | How FlowEHR handles customer data: ambient documentation, retention, human review, recording consent, subprocessors, and the Model Development Setting. |
| 4 | Key Terms | This page, Section 3 | FlowEHR's standard legal terms: governing law, liability caps, security. |
| 5 | Modifications | This page, Section 4 | Every change FlowEHR makes to the Common Paper Standard Terms. |
| 6 | Common Paper Cloud Service Agreement Standard Terms, Version 2.1 | commonpaper.com/standards/cloud-service-agreement/2.1 | Everything else: access, payment, termination, warranties, indemnities, confidentiality. |
Items 2 to 6 together are the "Framework Terms" under the Common Paper Standard Terms. Each Order Form together with the Framework Terms is an "Agreement". Implementation and data migration are "professional services" under an Order Form, provided under FlowEHR's Implementation Terms.
2. Order of precedence
If documents conflict, they control in this order:
- The BAA, as to PHI and the parties' HIPAA obligations, and as to Patient Data where BAA Section 16.7 applies (Modification 4.1).
- The Order Form, for that Order Form only. An Order Form can change the BAA or the Data Handling and AI Schedule only if it names the specific section it changes.
- The Data Handling and AI Schedule, as to data handling and AI operational details.
- The Key Terms and Modifications on this page.
- The Common Paper Cloud Service Agreement Standard Terms v2.1.
3. FlowEHR standard Key Terms
These complete the Variables in the Common Paper Cloud Service Agreement Key Terms.
| Key Term | FlowEHR standard |
|---|---|
| Provider | Flow EHR, Inc., a Delaware corporation |
| Provider Notice Address | legal@flow-ehr.com, with a copy by mail to the postal address stated on the Order Form |
| Effective Date | The date of last signature on the first Order Form that references this MSA |
| Governing Law | The laws of the State of Delaware |
| Chosen Courts | The state or federal courts located in New Castle County, Delaware |
| Provider Covered Claims | Any action, proceeding, or claim that the Cloud Service, when used by Customer according to the terms of the Agreement, violates, misappropriates, or otherwise infringes upon anyone else's intellectual property or other proprietary rights. |
| Customer Covered Claims | Any action, proceeding, or claim that (1) the Customer Content (other than Generated Output), when used according to the terms of the Agreement, violates, misappropriates, or otherwise infringes upon anyone else's intellectual property or other proprietary rights; (2) results from Customer's breach or alleged breach of Section 2.1 (Restrictions on Customer); (3) results from Customer's failure to give any notice to, or obtain any consent from, a patient or other person that Applicable Laws require before an encounter is recorded or transcribed; or (4) results from Customer's use of Generated Output without the Human Review required by the Data Handling and AI Schedule. |
| General Cap Amount | 1x the Fees paid or payable by Customer to Provider in the 12 month period immediately before the claim |
| Increased Claims | (a) Breach of Section 3 (Privacy & Security); (b) breach of the BAA, including amounts owed under BAA Section 5.4 (Costs and Liability); (c) breach of Section 10 (Confidentiality), excluding any data or security breaches; and (d) an Indemnifying Party's indemnification obligation |
| Increased Cap Amount | The greater of $50,000 or 3x the Fees paid or payable by Customer to Provider in the 12 month period immediately before the claim |
| Unlimited Claims | None |
| Additional Warranties | By Provider: None. By Customer: Customer represents and warrants that (a) each User who prescribes, orders, or provides care through the Product holds, and will maintain, every license, registration (including DEA registration where required), and certification that Applicable Laws require for the care they provide and in each state where their patients are located; (b) Customer will obtain every patient consent that Applicable Laws require for Customer's use of the Product, including for telehealth and e-prescribing; and (c) Customer's use of telehealth and e-prescribing through the Product complies with Applicable Laws, including laws on establishing a provider–patient relationship and on prescribing controlled substances. |
| DPA | Not applicable. The Cloud Service is offered only in the United States and is not designed to process personal data governed by the GDPR. |
| BAA | The FlowEHR Business Associate Agreement, version 2.1, incorporated by Modification 4.1. The limitations of liability in Section 8 of the Standard Terms, as completed by these Key Terms, apply to claims under the BAA (BAA Section 16.1). |
| Security Policy | Provider will use commercially reasonable efforts to secure the Cloud Service from unauthorized access, alteration, or use and other unlawful tampering, and will maintain the safeguards required of it by the BAA and the HIPAA Security Rule. The description at flow-ehr.com/security is informational and is not incorporated. |
Standard Order Terms
Every Order Form includes these terms unless the Order Form expressly says otherwise. They complete the Order Form Variables in the Standard Terms, so an Order Form only needs to state who the customer is, what it bought, the Fees, and its AI setting.
| Term | FlowEHR standard |
|---|---|
| Order Date | The date of last signature on the Order Form. |
| Go-Live Date | The earlier of (a) the date Customer first uses the Cloud Service to schedule, see, document, message or bill a real patient (loading migrated data, configuration, testing and training do not count), or (b) 30 days after the Order Date, extended by any delay Provider causes in completing its implementation tasks. |
| Subscription Period | From the Order Date until 12 months after the Go-Live Date. Fees accrue from the Go-Live Date, and monthly billing periods begin on the Go-Live Date. |
| Non-Renewal Notice Date | At least 30 days before the end of the current Subscription Period. Under Section 5.1 of the Standard Terms, each Order Form renews for successive 12-month Subscription Periods unless a party gives notice of non-renewal before that date. |
| Renewal pricing | Provider may change the Fees for a renewal Subscription Period by notice to Customer at least 120 days before the end of the current Subscription Period. Without that notice, the renewal continues at the Fees on the Order Form. |
| Payment Process | Automatic payment. Customer authorizes Provider to charge its card or bank account on file monthly: subscription Fees in advance, and usage-based Fees (such as Encounter fees) in arrears. |
| Billable Provider | A licensed clinician who has their own schedule in the Cloud Service, or a User who prescribes. Staff users are free and unlimited. Billable Providers added during a Subscription Period are charged at the Order Form's unit price, prorated, and are co-terminous with the Order Form. |
| Encounter | Where an Order Form prices by Encounter: a patient visit, in person or by telehealth, that takes place on or after the Go-Live Date and for which a User signs a visit note in the Cloud Service. Each visit counts once, however many notes or addenda it has. Cancelled visits, no-shows, and records imported through data migration are not Encounters. |
| Use Limitations | Use for Customer's own patients and practice operations in the United States, by Users and (as permitted by Modification 4.11) Customer's patients, within the number of Billable Providers on the Order Form. |
| Technical Support | Email support@flow-ehr.com and in-app support, Monday–Friday 9 a.m.–6 p.m. Pacific, excluding U.S. federal holidays. Target first response: within 4 business hours when Customer cannot see patients or access records; within 1 business day for everything else. Scheduled maintenance is announced at least 48 hours in advance and, where practical, scheduled outside 7 a.m.–8 p.m. in Customer's time zone. |
| SLA | Provider will use commercially reasonable efforts to provide and maintain the Cloud Service without excessive errors and interruptions. If Provider does not meet this SLA in two consecutive months, or in more than three months in any 12-month period, Customer may, as its only remedy, terminate the Order Form on notice and receive a prorated refund of prepaid Fees for the remainder of the Subscription Period. |
| Professional services | Implementation, onboarding and data migration are provided under FlowEHR's Implementation Terms (Exhibit D to the Order Form), for the fees stated on the Order Form. |
| AI settings | Ambient Documentation is on unless the Order Form says off; Customer may turn it off at any time by notice to Provider, and clinicians control its use in each encounter through the consent step. Telehealth recording is not enabled. Transcripts are kept with the record, and Customer may request their deletion after the note is signed. The Model Development Setting is the one checked on the Order Form (Standard if none is checked). |
| Patient payments | Card payments are processed through Customer's own Stripe account, which Customer opens through the Cloud Service and which is governed by Customer's own agreement with Stripe. Stripe is a Third-Party Service that Customer engages directly; it is not a Provider subprocessor. Stripe charges its processing fees to that account. Provider charges no payment-processing fee, does not hold Customer's funds, and sends Stripe no clinical information. |
4. Modifications to the Standard Terms
These are FlowEHR's "Other Changes to Standard Terms" for the Key Terms. Section numbers refer to the Common Paper Cloud Service Agreement Standard Terms Version 2.1. In each Modification, only the quoted text and the "Conforming changes" sentences change the Standard Terms. Other text explains them and has no contractual effect.
4.1 Protected health information is permitted (modifies Section 3.2)
The Standard Terms list protected health information as "Prohibited Data" (Section 13.27) and bar Customer from submitting it unless the Order Form or Key Terms allow it (Section 3.2). An EHR exists to hold that data. So FlowEHR adopts Common Paper's published "Incorporate BAA" language, with the BAA date filled in:
The parties have entered into a Business Associate Agreement dated as of the BAA Effective Date stated on the Order Form ("BAA"). Despite Section 3.2, Customer may submit Protected Health Information or PHI. The terms of the BAA will control each party's rights and obligations as to PHI, and the terms of the BAA will control in the event of any conflict with this Agreement as to PHI and the parties' HIPAA obligations.
The Common Paper language covers only HIPAA-regulated PHI. Some FlowEHR customers are cash-pay practices that are not HIPAA covered entities. Their patient data is not "PHI" under HIPAA, but it is still sensitive health data under state law, which Section 13.27(e) would also prohibit. So FlowEHR adds:
Despite Section 3.2, Customer may also submit Patient Data. "Patient Data" means information about Customer's patients or prospective patients that is submitted to the Product in connection with their care, payment for their care, or Customer's health care operations. It includes identification numbers, insurance information and health information described in clauses (c) and (e) of "Prohibited Data", whether or not it is PHI. Provider will protect all Patient Data as if it were PHI under the BAA, even if Customer is not a Covered Entity. Customer will not enter payment card or financial account numbers into the Product except through the payment interface Provider designates for that purpose.
4.2 No model training under the CSA (deletes Section 1.6)
FlowEHR adopts Common Paper's published "Remove AI training" change:
Delete Section 1.6.
Conforming changes: the references to Section 1.6 in Section 5.6(a) (Survival) and Section 11.1 (Reservation of Rights) are also deleted, and model development, product improvement through AI, and the use of de-identified data are governed only by the Data Handling and AI Schedule (including the Model Development Setting selected on the Order Form) and by the BAA.
Why: Section 1.6 would let FlowEHR train models on Customer Content under rules that differ from the Schedule. Deleting it leaves one set of rules, in one place, that the customer chooses on the Order Form.
4.3 Usage Data excludes patient information (modifies Sections 1.4 and 13.32)
"Usage Data" does not include PHI or Patient Data. If data about the provision, use, or performance of the Product contains PHI or Patient Data, Provider may use it only as the BAA permits, and may use it under Section 1.4 only after it is de-identified in accordance with 45 C.F.R. § 164.514(a)–(b).
4.4 Clinical use is not a High Risk Activity (clarifies Sections 2.1(a)(viii) and 13.20)
Use of the Product by Customer and its licensed health care professionals for clinical documentation, e-prescribing, scheduling, patient communication, billing, and practice operations, where a licensed professional exercises independent clinical judgment, is not a High Risk Activity. The Product is not designed or authorized for emergency response, life support, real-time patient monitoring, or any use in which a delay or failure of the Product would itself be expected to cause death or bodily injury, and those uses remain High Risk Activities.
4.5 Access to records is preserved during suspension (modifies Section 2.2)
Before suspending Customer's access under Section 2.2(a) for non-payment, Provider will give Customer at least 10 days' notice. During any suspension, Provider will keep Customer's ability to view and export Customer Content, unless continued access would create a security risk to the Product or to others. In that case Provider will provide an export of Customer Content on request.
Why: a practice needs continuous access to its own records, including to meet its own record-access obligations to patients.
4.6 Export window before deletion (replaces Section 5.5(b))
Despite Section 5.5(a), for 60 days after expiration or termination (the "Transition Period"), Provider will keep Customer Content available to Customer and, on Customer's request, will provide an export of Customer Content as FHIR R4 resources (with documents in their original formats). Within 30 days after the Transition Period, Provider will return PHI and Patient Data to Customer or, at Customer's election, destroy it, subject only to the retention permitted by BAA Section 15.3, and will confirm deletion on request. Customer is responsible for retaining its own medical records for as long as Applicable Laws require.
4.7 Name and logo use requires consent (modifies Section 12.8)
Provider may identify Customer and use Customer's name and logo in marketing only if the Order Form says so, or with Customer's prior written consent (email is sufficient). Provider will never disclose PHI or Patient Data in marketing.
4.8 Subprocessors: adding vendors, notice and the right to object
Provider lists the third parties that process PHI or Patient Data for it at flow-ehr.com/subprocessors. The list attached to an Order Form is the list as of its Order Date, and Provider may add, replace or remove subprocessors at any time under this Modification without amending the Agreement. Before a new subprocessor begins processing PHI or Patient Data, Provider will (a) have the written business associate agreement the BAA requires, and (b) update the list and email Customer's notice contact at least 15 days in advance. If a faster change is needed to keep the Product running, to address a security risk, or to meet a legal requirement, Provider will give notice as soon as practicable. Vendors and tools that do not receive PHI or Patient Data (for example, tools Provider uses to build, test, operate, support or sell the Product without access to PHI) are not subprocessors under this Modification, and Provider may use them without notice. Customer may object within the notice period on reasonable, documented privacy or security grounds. Before Customer terminates, Provider may offer a commercially reasonable alternative. If the parties cannot resolve the objection, Customer may terminate the affected Order Form on notice and receive a prorated refund of prepaid Fees for the remainder of the Subscription Period. This Modification is the notice and objection process referred to in BAA Section 7.2 and Schedule Section 7.3, and it applies to every new subprocessor of PHI or Patient Data, whether or not material.
Why: FlowEHR adds AI models and other vendors as the product grows. This lets it do so without re-signing anything, while customers always know who handles their patients' data.
4.9 Beta Products and PHI (clarifies Section 12.7)
Beta Products are provided "AS IS" under Section 12.7, but any Beta Product that processes PHI or Patient Data does so under the BAA. Beta status never reduces Provider's obligations under the BAA.
4.10 Terms used in the BAA and the Schedule
The BAA and the Data Handling and AI Schedule use the following terms, which mean: "Customer Data" — Customer Content, including Generated Output and Patient Data; "Authorized User" — a User; "Subscription Term" — a Subscription Period; "Services" — the Product and any professional services under an Order Form; "Third-Party Services" — products or services that are not provided by Provider and that Customer chooses to connect to the Product; "Customer Systems" — systems that Customer or its other vendors operate; and the "post-termination export period" — the Transition Period in Modification 4.6. The Subprocessor objection process referred to in those documents is Modification 4.8.
4.11 Patients may use patient-facing features (clarifies Sections 1.1 and 2.1(a)(ii))
Customer's patients may use the patient-facing features of the Product (such as the patient portal, online scheduling, intake forms, telehealth, messaging and payments) as the Documentation describes. That use is permitted under Sections 1.1 and 2.1(a)(ii). Patients are not Users.
5. Changes to this MSA
FlowEHR may publish new versions of this page. Each version has its own version number and effective date, and FlowEHR keeps every prior version and provides it on request at legal@flow-ehr.com. An Order Form is governed by the version it references. A new version applies to a customer only through a newly signed Order Form or renewal Order Form that references it. A renewal under Section 5.1 of the Standard Terms, without a new Order Form, keeps the version already in effect. The Data Handling and AI Schedule is the one exception: FlowEHR may update it during a Subscription Period as provided in its Section 11.3.
6. Attribution
This agreement incorporates the Common Paper Cloud Service Agreement Standard Terms Version 2.1, which are free to use under CC BY 4.0. Common Paper hosts the unmodified terms at commonpaper.com/standards/cloud-service-agreement/2.1. FlowEHR modified the Standard Terms only as described on this page. FlowEHR's Business Associate Agreement and Data Handling and AI Schedule are FlowEHR's own documents. Common Paper is not a party to, and does not endorse, this agreement.
Questions about this agreement: legal@flow-ehr.com.