Terms of Service

Last updated: March 21, 2026

These Terms apply to individual healthcare practices, solo providers, and small group practices signing up directly at kestrel.to. If you are a revenue cycle management company, billing company, or organization managing prior authorization on behalf of multiple practices, contact legal@caisystems.dev for a Master Services Agreement before using the Service.

IMPORTANT — PLEASE READ CAREFULLY BEFORE USING KESTREL. BY CREATING AN ACCOUNT, CLICKING "I AGREE," OR OTHERWISE ACCESSING OR USING THE SERVICE, YOU: (1) CONFIRM YOU HAVE READ AND UNDERSTOOD THESE TERMS IN FULL; (2) AGREE TO BE BOUND BY THESE TERMS ON BEHALF OF YOURSELF AND YOUR PRACTICE OR ORGANIZATION; AND (3) SPECIFICALLY AGREE TO THE BINDING INDIVIDUAL ARBITRATION CLAUSE AND CLASS ACTION WAIVER IN SECTION 14. IF YOU DO NOT AGREE TO ALL OF THESE TERMS, DO NOT CREATE AN ACCOUNT OR USE THE SERVICE. These Terms constitute a legally binding agreement. If signing up on behalf of a practice or organization, you represent that you have authority to bind that entity.

1. Definitions

"Service" means the Kestrel web application, APIs, dashboards, and related tools operated by Cai Systems LLC at kestrel.to, including all features, updates, and future versions.

"Company," "we," "us," "our" means Cai Systems LLC, a Rhode Island limited liability company.

"You," "Your" means the healthcare Practice, organization, or individual accepting these Terms, and any employees, contractors, staff members, or agents who access or use the Service through your account.

"Practice" means a single healthcare facility or location operating under a single National Provider Identifier (NPI) or group NPI and a single federal tax identification number. Multiple locations, clinics, or facilities — even under common ownership, a shared employer identification number, or a single corporate entity — each constitute a separate Practice and each require a separate subscription.

"AI Output" means any and all content, data, analysis, score, classification, recommendation, document, or information of any kind generated by the Service's artificial intelligence systems in response to any input, including but not limited to: documentation gap analysis results, approval probability scores, traffic light classifications, missing requirement identifications, fix recommendations, appeal letters, Letters of Medical Necessity, peer-to-peer preparation documents, call scripts, denial pattern reports, payer intelligence summaries, and any structured or unstructured data returned by any endpoint of the Service.

"Model Distillation" means using AI Output — in original form, modified form, summarized form, or as a reference or benchmark — as training data, fine-tuning data, reinforcement learning signal, reward model input, preference data, evaluation data, synthetic data generation seed, or any other input used to train, improve, calibrate, benchmark, or evaluate any artificial intelligence or machine learning model or system, regardless of model size, architecture, or intended use, whether proprietary, open-source, or operated by you or any third party.

"Competitive System" means any product, service, platform, tool, or technology offered to third parties that provides prior authorization analysis, documentation gap identification, payer requirement matching, clinical documentation scoring, or PA approval prediction functionality substantially similar to any core feature of the Service. "Competitive System" does not include: (i) internal workflow tools built and used solely within your own organization that are not offered or sold to third parties and that do not incorporate AI Output as any input; or (ii) general-purpose EHR, practice management, or billing software that includes incidental PA workflow features.

"PHI" means Protected Health Information as defined under HIPAA (45 CFR 160.103).

"Effective Date" means the earlier of: (i) the date you create an account; or (ii) the date you first access or use the Service.

2. Service Description and Disclaimers

2a. What Kestrel Does. Kestrel is a prior authorization documentation analysis tool. It analyzes clinical documentation against payer-specific prior authorization requirements and produces gap analysis reports identifying potential documentation deficiencies before PA submission. It is an administrative tool for healthcare professionals, PA coordinators, billing specialists, and revenue cycle staff.

2b. Not Medical Advice. The Service provides documentation analysis and administrative decision support only. It does not provide medical advice, clinical recommendations, diagnosis, treatment suggestions, or clinical decision support as defined under applicable law. Nothing in AI Output should be understood as a recommendation to modify, withhold, or alter patient care. All clinical decisions — including decisions about what documentation to include in a PA submission — remain the sole responsibility of licensed healthcare providers exercising independent professional judgment.

2c. No Guarantee of Authorization or Clinical Outcomes. The Service does not guarantee that any prior authorization request will be approved, denied, or processed within any particular timeframe. The Company does not represent or warrant that use of the Service will increase your PA approval rates, reduce your denial rates, or produce any specific clinical, administrative, or financial outcome for your practice. Gap analysis results are advisory and based on the Company's interpretation of payer-published requirements, which may be incomplete, outdated, or subject to payer discretion not reflected in published criteria. An approval probability score is a statistical estimate, not a prediction, promise, or guarantee of outcome. Any results, statistics, or case studies referenced in the Company's marketing materials represent historical outcomes and are not guarantees of future performance. Payers retain sole authority over all authorization decisions.

2d. AI Limitations. The Service uses artificial intelligence, including large language models, to analyze clinical documentation. AI analysis may contain errors, omit relevant clinical context, misidentify requirements, or produce results that do not reflect current payer standards. The Company does not warrant that AI Output will be accurate, complete, current, or suitable for any particular PA submission. You must apply independent professional judgment when reviewing AI Output. You must not rely solely on AI Output when making PA submission decisions.

2e. Payer Rule Coverage. Gap analysis depends on a database of payer-specific PA requirements maintained by the Company through automated scraping and manual curation. Coverage varies significantly by payer and CPT/HCPCS code. For procedure codes or payers where payer-specific rules are unavailable, the Service relies on AI-based general clinical analysis, which may be substantially less specific or accurate than payer-published criteria. A "green" or "high probability" result based on AI general analysis is less reliable than one based on verified payer-specific rules. The absence of a gap finding does not indicate that PA is not required, nor does it guarantee approval. Information about current payer rule coverage is available upon request by contacting support@kestrel.to.

2f. Payer Requirements Currency. Payer PA requirements change frequently and without advance notice. The Company makes reasonable efforts to monitor and update its payer rules database, but there may be significant delays between payer policy changes and database updates. You are responsible for independently verifying critical PA requirements against current payer publications, provider portals, and official payer communications before submitting any PA request.

2g. Billing Compliance. The Service is not designed to ensure compliance with the No Surprises Act, surprise billing regulations, or any federal or state billing transparency or notification requirements. You are solely responsible for all billing, notification, coding accuracy, and transparency obligations applicable to your practice, regardless of AI Output.

2h. AI Transparency — Texas. For healthcare practitioners in Texas subject to the Texas Responsible Artificial Intelligence Governance Act (TRAIGA, effective January 1, 2026) and Texas SB 1188: You acknowledge that the Service uses AI to analyze clinical documentation. You represent that you will personally review all AI Output before making any clinical or administrative decision based on it, and that you will provide any required patient disclosures regarding AI use as required by applicable Texas law. The Company's AI systems are not designed for direct patient interaction and do not diagnose, treat, or communicate with patients.

2i. No Liability for Payer Decisions. The Company has no control over payer policies, systems, or decisions. Payer denial, delay, or modification of a PA request — regardless of AI Output — is not a failure of the Service and does not entitle you to any refund or remedy against the Company.

3. Account Registration and Security

3a. Accuracy and Authority. You must provide accurate, complete, and current information when creating your account and keep it updated. You represent that you are at least 18 years old and have legal authority to bind your Practice to these Terms. If you authenticate via third-party single sign-on (Google or Microsoft), you are responsible for the security of that third-party account and all Service access through it. The Company is not responsible for unauthorized access resulting from compromise of third-party authentication credentials.

3b. Account Responsibility. You are responsible for all activity under your account and credentials, including activity by employees, contractors, staff, and any person you permit to access the Service. Protect your credentials. Do not share login credentials or API keys outside your Practice.

3c. Workforce Access Management. Maintain a current inventory of active users and API keys under your account. Revoke access credentials for departing or role-changing workforce members within twenty-four (24) hours of their departure or role change. Contact legal@caisystems.dev immediately if you suspect unauthorized access to your account, credentials, or API keys.

3d. Suspension and Termination Rights. We may suspend or terminate your account: (i) for violation of these Terms, with notice where practicable; (ii) for non-payment after reasonable notice; (iii) immediately without advance notice if we have reasonable basis to believe PHI is being submitted without an executed BAA, or if usage patterns indicate potential HIPAA violation, security threat, or Section 4c violation; or (iv) for any other cause with reasonable prior notice where circumstances permit.

4. Acceptable Use

4a. Permitted Uses. You may use the Service and AI Output for internal prior authorization workflows for patients of your Practice; staff training within your single Practice; quality improvement within your single Practice; and related healthcare administrative functions within the scope of your single Practice.

4b. Single Practice Limitation. These Terms authorize use for one Practice as defined in Section 1. Using a single subscription across multiple Practices, locations, or affiliated facilities is a material breach. Contact legal@caisystems.dev if you manage multiple locations.

4c. Prohibited Uses. You shall not, and shall not permit any employee, contractor, agent, or third party to, directly or indirectly:

(i) Model Distillation. Use AI Output for Model Distillation, or as any input to the training, fine-tuning, evaluation, benchmarking, or improvement of any artificial intelligence or machine learning model or system, whether operated by you or any third party. This prohibition applies regardless of whether the AI Output is used directly or after modification, summarization, or transformation.

(ii) Competitive Development. Use AI Output as any input to the design, architecture, feature specification, requirement gathering, or development of any Competitive System, whether for your own use, for a client, or for any third party.

(iii) Systematic Extraction. Submit more than one hundred (100) API requests per calendar day, or more than one thousand (1,000) requests in any rolling thirty (30) day period, where such requests use clinical notes that are substantially identical, follow a repetitive or template-based structure, contain clearly synthetic or fabricated patient scenarios, or are not associated with actual patient prior authorization workflows of your Practice. This limit does not apply to requests made in connection with your Practice's actual patient PA workflows, even if those workflows are structured and systematic, provided the requests correspond to identifiable patient cases in your Kestrel account.

(iv) Unauthorized Distribution. Share, resell, sublicense, redistribute, or make available access to the Service, your account credentials, or AI Output to any person or entity outside your Practice without the Company's prior written consent.

(v) Reverse Engineering. Attempt to reverse-engineer, reconstruct, or derive the Service's payer rules database, scoring methodology, prompt structures, or AI architectures through systematic output analysis, repeated querying, comparative testing, or any other means.

(vi) Account or Rate Limit Circumvention. Create multiple accounts, obtain multiple API keys, or take any other action to circumvent subscription limits, rate limits, usage restrictions, or access controls.

(vii) False Submissions. Submit false, fabricated, or misleading clinical documentation, or documentation that does not correspond to an actual patient encounter at your Practice. This prohibition does not apply to sample submissions made during the Company's guided onboarding process using Company-provided sample clinical note templates.

(viii) Security Circumvention. Attempt to bypass, disable, probe, or exploit any access control, authentication system, rate limiter, security measure, or technical protection of the Service or any system it interacts with.

(ix) Unlawful Use. Use the Service for any purpose that violates applicable law or regulation, including submitting fraudulent PA requests, using AI Output to support insurance fraud, or using the Service in any way that violates HIPAA.

4d. API Key Security. API keys issued by the Company (format: kst_live_*) are credentials personal to your account. You shall: (i) not share API keys outside your Practice; (ii) not commit or expose keys in public repositories, client-side code, or unencrypted communications; (iii) revoke keys for departing employees within 24 hours; and (iv) notify legal@caisystems.dev immediately upon suspecting unauthorized key use or exposure. We may revoke API keys without advance notice upon detecting policy violations.

4e. Audit Rights. Upon five (5) business days' written notice, the Company may audit your use of the Service and API to verify compliance, including Section 4c. Audits may include review of API access logs, request volumes, usage timestamps, and — excluding PHI — request content. You shall cooperate reasonably, including providing documentation of AI Output use within ten (10) business days of request. The Company may conduct up to two (2) audits per calendar year without specific cause, and additional audits upon reasonable written notice stating grounds for suspicion of a violation.

5. PHI and HIPAA Compliance

5a. BAA Required Before PHI Submission. Submission of any PHI through the Service requires a separately executed Business Associate Agreement (BAA). You must not submit any PHI until a BAA is fully executed. Submission of PHI without an executed BAA is a material breach and may result in immediate account suspension. For purposes of this Section, any submission of clinical notes through the Service — whether via the web application, PDF upload, or API — constitutes PHI submission, regardless of whether the notes were intended to contain patient identifiers or whether such identifiers are present in a non-standard location.

5b. PHI Processing Architecture. Clinical notes are de-identified before transmission to AI processing. Patient identifiers are encrypted at rest. See the BAA and Privacy Policy for complete detail.

5c. Your HIPAA Obligations. You are solely responsible for: (i) obtaining all required patient authorizations and consents before submitting clinical documentation; (ii) ensuring your Practice's use complies with all applicable federal and state privacy laws, including HIPAA, HITECH, and applicable state health privacy laws; (iii) the clinical accuracy and completeness of documentation submitted; and (iv) training your workforce on appropriate use of the Service.

6. Payment Terms

6a. Fees. Fees are as published on the Kestrel pricing page at time of subscription. All fees are in USD. Except as provided in Section 13b or required by applicable law, all fees are non-refundable.

6b. Billing. You will be charged according to the billing cycle selected at signup. Annual subscriptions are billed in advance and non-refundable except as provided in Section 13b.

6c. Price Changes. We may change fees for month-to-month subscriptions with thirty (30) days' prior written notice by email. Continued use after the effective date of a price change constitutes acceptance. Price changes do not apply during any active annual subscription period.

6d. Non-Payment. If fees are overdue after reasonable notice, we may suspend access. Suspension does not relieve your obligation to pay.

6e. Billing Disputes. If you believe you have been incorrectly charged, you must notify the Company at legal@caisystems.dev within sixty (60) days of the charge date, describing the disputed amount and the basis for the dispute. The Company will investigate and respond within fifteen (15) business days. Failure to dispute a charge within sixty (60) days constitutes acceptance of that charge. Disputed amounts do not excuse payment of undisputed fees.

6f. Taxes. You are responsible for all applicable taxes on your subscription, excluding taxes on the Company's net income.

7. Intellectual Property

7a. Company Ownership. The Service — including its software, algorithms, payer rules database, AI systems, user interface, and documentation — is owned by or licensed to Cai Systems LLC and protected by applicable intellectual property laws. These Terms grant a limited, non-exclusive, non-transferable access right only. No ownership interest is transferred.

7b. Your Clinical Content. You retain ownership of clinical documentation you submit. The Company claims no ownership of your clinical notes or patient data. By submitting content, you grant the Company a limited license to process it solely to deliver the Service.

7c. Network Intelligence License. The Company collects and uses de-identified, aggregated analysis metadata generated through use of the Service — including payer name, procedure code, gap result categories, completeness scores, approval probability ranges, outcome classifications, and timestamps. This metadata never includes PHI, patient names, provider names, or individually identifiable information, and is not subject to the BAA. The Company uses this data to improve AI accuracy, develop payer intelligence, generate network benchmarks, and train internal models.

By using the Service and accepting these Terms, you grant the Company a perpetual, irrevocable, worldwide, royalty-free license to collect, retain, and use such de-identified aggregated metadata for these purposes. You may opt out of contributing to network intelligence at any time by updating your preference in account Settings under Privacy Preferences. You will also be asked to set this preference during initial account setup. Opting out does not affect your access to any feature of the Service. Once de-identified metadata has been aggregated into network-level models, it cannot be individually removed because it is no longer traceable to your account.

7d. No IP Transfer via AI Output. AI Output does not transfer any ownership of or rights in the intellectual property embodied in the Service's AI systems, payer rules, or scoring algorithms.

7e. Feedback. If you provide feedback or feature suggestions, you grant the Company a perpetual, irrevocable, royalty-free license to use that feedback for any purpose without compensation.

8. Warranties and Limitation of Liability

8a. Disclaimer of Warranties. THE SERVICE IS PROVIDED "AS IS" AND "AS AVAILABLE" WITHOUT WARRANTIES OF ANY KIND, EITHER EXPRESS OR IMPLIED. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, THE COMPANY EXPRESSLY DISCLAIMS ALL WARRANTIES, INCLUDING: THE IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, AND NON-INFRINGEMENT; ANY WARRANTY THAT THE SERVICE WILL BE UNINTERRUPTED, ERROR-FREE, OR SECURE; ANY WARRANTY THAT AI OUTPUT WILL BE ACCURATE, COMPLETE, CURRENT, OR SUITABLE FOR ANY PARTICULAR PA SUBMISSION; AND ANY WARRANTY REGARDING THE COMPLETENESS OR CURRENCY OF PAYER RULES IN THE DATABASE.

8b. Exclusion of Consequential Damages. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, THE COMPANY SHALL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, OR PUNITIVE DAMAGES, INCLUDING: LOST PROFITS; LOST REVENUE; LOSS OF DATA; COST OF SUBSTITUTE SERVICES; DENIAL OR DELAY OF PA REQUESTS; DELAYED, DENIED, OR MODIFIED PATIENT CARE; CLAIM UNDERPAYMENT; OR ANY OTHER COMMERCIAL OR ECONOMIC LOSS — REGARDLESS OF THE THEORY OF LIABILITY AND REGARDLESS OF WHETHER THE COMPANY WAS ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

8c. Aggregate Liability Cap. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, THE COMPANY'S TOTAL CUMULATIVE LIABILITY FROM ALL CAUSES OF ACTION AND THEORIES OF LIABILITY COMBINED SHALL NOT EXCEED THE TOTAL FEES ACTUALLY PAID BY YOU DURING THE TWELVE (12) CALENDAR MONTHS IMMEDIATELY PRECEDING THE EVENT GIVING RISE TO THE CLAIM.

8d. Carve-Outs. The cap in Section 8c does not limit: (i) the Company's right to enforce Section 9 against you; (ii) your indemnification obligations under Section 10; (iii) the Company's remedies for your willful misconduct or fraud; or (iv) your obligations under the BAA for unauthorized PHI disclosure. The Company's own liability to you remains subject to Section 8c.

8e. Essential Basis. The limitations in this Section reflect a reasonable allocation of risk that is an essential element of the basis of the bargain.

9. Liquidated Damages — AI Output Misuse

9a. Harm Acknowledgment. You acknowledge that a violation of Section 4c(i) (Model Distillation) or Section 4c(ii) (Competitive Development) would cause the Company harm that is genuinely difficult to calculate, because the primary assets harmed are intangible. Foreseeable harm includes: (1) the cost of building and maintaining the payer rules database through continuous scraping, AI extraction, and verification; (2) competitive harm from a model trained on AI Output replicating capabilities the Company spent significant resources to develop; (3) unjust enrichment from obtaining substantial commercial value without compensation; and (4) difficulty of detection, because distillation may be undetectable until a competing product launches, making actual damages impossible to prove with specificity.

9b. Notice and Cure Before Damages Attach. Before any liquidated damages obligation attaches, the Company shall send you written notice specifying the alleged violation with reasonable detail, including the relevant API log data or usage pattern evidence. You shall have fifteen (15) business days to respond in writing with a credible non-distillation explanation for the usage pattern or to demonstrate that the use falls within a permitted exception. If you provide a credible explanation, the Company shall investigate in good faith before declaring a verified violation. Failure to respond within fifteen (15) business days is deemed acceptance of the violation finding.

9c. Liquidated Damages Amount. Following the notice and cure process in Section 9b, in the event of a verified violation, you agree to pay FIFTY THOUSAND DOLLARS ($50,000 USD) per violation event. A "violation event" means: each calendar month or partial calendar month during which prohibited use occurred; or each discrete model training, fine-tuning, or evaluation run incorporating AI Output — whichever calculation produces the higher aggregate amount. "Verified violation" means a violation supported by API log data, usage pattern analysis, or other reasonably available evidence after the Section 9b process is complete. The Parties agree this represents a reasonable pre-estimate of the harm described in Section 9a.

9d. Third-Party Contractor Reduction. Where a violation of Section 4c(i) or 4c(ii) is caused solely by the independent actions of a third-party contractor, consultant, or vendor who accessed the Service through your account without your knowledge, authorization, or instruction, and you: (i) promptly report the violation to legal@caisystems.dev upon discovery; (ii) cooperate fully with the Company's investigation; and (iii) terminate the third party's access immediately — the liquidated damages obligation may be reduced or waived at the Company's sole discretion. This provision does not apply if you knew or reasonably should have known of the third party's activities.

9e. Election of Remedies. The Company may elect either: (i) the liquidated damages in Section 9c; or (ii) provable actual damages, disgorgement of profits, and reasonable attorneys' fees — whichever is greater. This provision does not limit the Company's right to seek injunctive or other equitable relief.

9f. Injunctive Relief. You acknowledge that a violation of Section 4c would cause irreparable harm for which monetary damages alone are inadequate. The Company may seek emergency injunctive relief from any court of competent jurisdiction without posting bond and without prejudice to other remedies.

10. Indemnification

You agree to indemnify, defend, and hold harmless Cai Systems LLC and its members, managers, officers, employees, contractors, and agents from and against third-party claims, liabilities, damages, judgments, losses, costs, and expenses (including reasonable attorneys' fees) arising from: (a) your negligent or wrongful use of the Service or AI Output; (b) your violation of any provision of these Terms; (c) your submission of false, fabricated, or misleading clinical documentation to the Service or to any payer; (d) your violation of any applicable law or regulation, including HIPAA; or (e) any claim by a patient, family member, or other third party arising from your Practice's prior authorization decisions or clinical care.

The Company may assume exclusive control of any defense at its own expense; you agree to cooperate and not settle any claim without the Company's prior written consent.

11. Termination

11a. By You. You may terminate at any time by written notice to legal@caisystems.dev. Month-to-month subscriptions: termination takes effect at end of current billing period; no refund for partial period. Annual subscriptions: termination is immediate; no refund for unused portion except as provided in Section 13b.

11b. By Company. We may terminate immediately and without advance notice for verified violation of Section 4c, PHI submission without a BAA, or any conduct posing immediate security, legal, or compliance risk. In other cases we provide reasonable notice.

11c. Effect of Termination. Your right to access and use the Service ceases immediately upon termination. You remain liable for all obligations that accrued before termination, including any liquidated damages under Section 9. PHI handling is governed by the BAA.

11d. Practice Transfer or Acquisition. If your Practice is acquired, merged, or transferred, notify the Company within thirty (30) days. A successor entity does not automatically inherit rights under these Terms; continued use by a successor constitutes that successor's acceptance of these Terms.

11e. Survival. The following Sections survive termination for any reason: 1 (Definitions), 4c (Prohibited Uses), 5 (PHI and HIPAA Obligations), 7 (Intellectual Property), 8 (Limitation of Liability), 9 (Liquidated Damages), 10 (Indemnification), 11e (Survival), 12 (Force Majeure), 13c (Version Archive), 14 (Governing Law and Dispute Resolution), and 15 (General Provisions).

12. Force Majeure

Neither Party shall be liable for delay or failure in performance caused by circumstances beyond its reasonable control, including acts of God, natural disasters, pandemic, government orders, war, terrorism, civil unrest, cyberattacks on third-party infrastructure, or failure of third-party cloud, AI, payment, or communications providers. The affected Party shall provide prompt written notice and use commercially reasonable efforts to resume performance. Payment obligations are not excused.

13. Modifications

13a. Non-Material Changes. We may modify for non-material purposes (corrections, clarifications that do not adversely affect your rights) by posting updated Terms at kestrel.to/terms with an updated date. Continued use constitutes acceptance.

13b. Material Changes. A material change means any change to: how PHI is handled; the limitation of liability or aggregate cap amount; the liquidated damages amount or scope; the dispute resolution mechanism; or subscription pricing. For material changes: (i) at least thirty (30) days' advance written email notice; and (ii) affirmative in-app reacceptance required before your next login after the effective date. If you reject a material change, you may terminate before the effective date and receive a pro-rata refund of prepaid annual fees for the unused post-effective-date period. This is the only circumstance under which prepaid fees are refundable.

13c. Version Archive. Prior versions are available at kestrel.to/terms/history upon request. The version in effect when a dispute arises governs that dispute.

14. Governing Law and Dispute Resolution

14a. Governing Law. These Terms are governed by the laws of the State of Rhode Island, without regard to conflict of law provisions. The UN Convention on Contracts for the International Sale of Goods does not apply.

14b. Informal Resolution First. Before any formal dispute process, contact legal@caisystems.dev describing your dispute in reasonable detail. The Parties will attempt informal resolution within thirty (30) days. This is a condition precedent to arbitration or court action, except for claims seeking emergency injunctive relief under Section 14f.

14c. Small Claims / District Court. Either Party may bring a claim in the Rhode Island District Court (Providence County) for disputes of $15,000 or less, provided the claim falls within that court's jurisdiction and procedural rules. Rhode Island small claims court (jurisdiction up to $2,500) remains available for claims within its jurisdictional limit.

14d. Binding Arbitration. Except for Section 14c (small claims) and Section 14f (injunctive relief), all unresolved disputes shall be resolved by final and binding individual arbitration administered by the AAA under its Commercial Arbitration Rules. Arbitration shall be conducted in Providence, Rhode Island, or remotely if both Parties agree. The arbitrator shall apply Rhode Island law. The award shall be final and binding and may be confirmed in any court of competent jurisdiction.

AAA filing fees: If you are an individual practitioner or practice with fewer than ten (10) full-time employees and your claim does not exceed $75,000, and if the applicable AAA filing fee exceeds what you would pay to file in small claims court, the Company will pay the excess, provided your claim is filed in good faith. This subsidy does not apply to claims brought by the Company against you.

14e. CLASS ACTION WAIVER. YOU AND THE COMPANY EACH EXPRESSLY WAIVE ANY RIGHT TO BRING OR PARTICIPATE IN ANY CLASS ACTION, COLLECTIVE ACTION, CONSOLIDATED ACTION, OR REPRESENTATIVE ACTION ARISING OUT OF OR RELATING TO THESE TERMS OR THE SERVICE. ALL DISPUTES SHALL BE RESOLVED ON AN INDIVIDUAL BASIS ONLY.

YOU AND THE COMPANY EACH WAIVE ANY RIGHT TO A JURY TRIAL IN ANY PROCEEDING ARISING OUT OF OR RELATING TO THESE TERMS OR THE SERVICE.

OPT-OUT RIGHT: IF YOU DO NOT WANT TO BE BOUND BY THE CLASS ACTION WAIVER IN THIS SECTION 14e, YOU MAY OPT OUT OF THE CLASS ACTION WAIVER ONLY (NOT THE ARBITRATION AGREEMENT) BY SENDING WRITTEN NOTICE FROM THE EMAIL ADDRESS REGISTERED TO YOUR KESTREL ACCOUNT TO legal@caisystems.dev WITHIN THIRTY (30) DAYS OF FIRST ACCEPTING THESE TERMS. THE SUBJECT LINE MUST READ: "CLASS ACTION WAIVER OPT-OUT." OPTING OUT DOES NOT AFFECT THE ARBITRATION AGREEMENT IN SECTION 14d OR ANY OTHER PROVISION OF THESE TERMS. IF YOU OPT OUT, ANY DISPUTE NOT SUBJECT TO ARBITRATION SHALL BE RESOLVED IN COURTS OF COMPETENT JURISDICTION, WITH VENUE AT THE COMPANY'S ELECTION IN THE COUNTY WHERE YOUR PRACTICE IS LOCATED OR IN PROVIDENCE COUNTY, RHODE ISLAND.

For disputes that arise during the thirty (30) day opt-out window: if a valid opt-out notice was sent before the dispute arose, the class action waiver does not apply to that dispute. If no opt-out was sent before the dispute arose, the class action waiver applies.

14f. Injunctive Relief Carve-Out. Either Party may seek emergency injunctive, temporary restraining, or other equitable relief from any court of competent jurisdiction to prevent irreparable harm — including unauthorized use of intellectual property, AI Output, or PHI — without first satisfying the informal resolution requirement and without posting bond. Seeking equitable relief is not a waiver of the right to arbitrate the underlying dispute.

15. General Provisions

15a. Entire Agreement. These Terms, together with the executed BAA and the Privacy Policy, constitute the entire agreement between the Parties regarding the Service. De-identified, aggregated data that no longer meets the HIPAA definition of PHI (45 CFR 164.514) is governed by these Terms and the Privacy Policy, not the BAA. No prior drafts, marketing materials, or verbal representations are incorporated.

15b. No Waiver. Failure to enforce any provision on any occasion does not waive the right to enforce it in the future.

15c. Severability. If any provision is held invalid, it shall be modified minimally to become enforceable, or severed if it cannot be modified. Remaining provisions remain in effect. If the class action waiver in Section 14e is held unenforceable, the arbitration agreement in Section 14d is also unenforceable, and disputes shall be resolved in courts located in Rhode Island.

15d. Assignment. You may not assign these Terms without prior written consent. Any purported assignment without consent is void. The Company may assign without consent in connection with merger, acquisition, or sale of substantially all assets, provided the assignee assumes all obligations under these Terms.

15e. Notices. All legal, compliance, HIPAA, and dispute-related notices to the Company shall be sent to legal@caisystems.dev. Product support inquiries: support@kestrel.to. Email is the Company's designated primary and sufficient notice channel for all purposes under these Terms. Notices to you will be sent to the email address on your account. You are responsible for keeping your email current. Email notice is effective upon transmission for routine matters; for material changes under Section 13b, effective upon confirmed delivery or thirty days after transmission, whichever is earlier.

15f. No Third-Party Beneficiaries. These Terms do not create rights for any third party, including patients, payers, or other healthcare entities.

15g. Relationship. The Parties are independent contracting parties. These Terms do not create partnership, joint venture, agency, employment, or fiduciary relationship.

15h. Headings. Section headings are for reference only.

15i. Language. These Terms are written in English. Any translation is for convenience only. In case of conflict, the English version controls.

16. Contact

Cai Systems LLC Legal, compliance, HIPAA, and all formal notices: legal@caisystems.dev Product support: support@kestrel.to

Email is the Company's designated primary notice channel for all purposes under these Terms. The Company does not maintain a public physical mailing address for notice purposes. If physical delivery is required by law or court order, contact legal@caisystems.dev to obtain current mailing information.

Version 2.0 — effective March 21, 2026