Agreements and policies.

Which documents apply to you

Every customer is bound by the Terms of Service, the Acceptable Use Policy, the Privacy Policy and the Service description. Which addendum you sign depends on what kind of data you handle, and the SLA’s service credits depend on the plan. The table shows the usual set; your countersigned copies are under Console → Organization.

Document	Gateway	Hosted	Hosted Pro	Who signs it
Terms of Service, AUP, Privacy Policy, Service description	Yes	Yes	Yes	Accepted by the account owner at signup
SLA	Target only	Target only	Contractual, with service credits	Part of the Terms; no separate signature
Business Associate Agreement (with 42 CFR Part 2 QSOA)	Healthcare profile: practices, behavioral health, billing companies, and any customer that handles PHI			Signed electronically in signup by an officer of the covered entity or business associate
Data Processing & Safeguards Addendum	Accounting and tax, legal and title, wealth, insurance and other non-HIPAA profiles			Signed electronically in signup by the account owner
Books-and-records vendor letter	RIA profile, in addition to the addendum			Issued by PacinfraX at signup; kept with the compliance manual
Order Form	Annual plans over 25 seats paid by invoice; dedicated infrastructure at 250 seats and above			Both parties, electronically
Partner terms	MSPs and consultants reselling or referring			The partner, at partner signup
SMS terms, Cookie statement	Recipients of locked messages and website visitors; informational			Nobody; published notices

How signing works

1. During signup you choose a profile (healthcare, accounting and tax, legal and title, wealth). The profile decides which addendum appears at the agreement step.
2. You read the document on screen, enter the signer’s name and title, and sign electronically. The same document is published here, unchanged, so counsel can review it before you start.
3. We countersign and place the PDF under Console → Organization, with the version and date.
4. Order Forms for invoiced annual plans are sent for electronic signature separately and reference the Service description for plans, limits and included services.
5. If your profile changes later (for example, a CPA firm begins handling PHI for a medical practice client), you can sign the BAA from the console without re-signing anything else.

How changes are notified

We give at least 30 days’ notice of material changes to these documents by email to the account owner, with a console banner, and at least 60 days’ notice of price changes, which take effect at your next renewal. Changes to the subprocessor list follow the 30-day notice in the BAA and addendum, as described on the subprocessors page. Each document carries its effective date; earlier versions are available on request. A change required by law may take effect sooner, with notice as soon as practicable.

About the attorney-review note

Documents marked “Draft for attorney review” are published ahead of general availability so that your counsel, your carrier or your compliance consultant can read what you would sign. The substance (data handling, breach notice within 72 hours of determination, return and destruction within 30 days, subprocessor flow-down) is what we intend to sign. Final effective dates and any edits from our counsel will be posted here with notice before anyone is bound by them.

Example

Pacific Behavioral, a group therapy practice that also treats substance use disorder, signs up on the healthcare profile. The agreement step shows the BAA with the 42 CFR Part 2 qualified service organization agreement included, so the practice does not need a second document for Part 2 records. The practice director signs; the countersigned PDF appears in the console, and the practice adds PXCMail to its business associate list.

FAQ

Can we use our own BAA or DPA instead?

For plans at the standard price, no; the published documents are the ones we sign, which keeps them consistent for every customer. Customers on dedicated infrastructure under a separate agreement can negotiate terms.

Do we need both the BAA and the addendum?

Usually one or the other. A firm that handles PHI signs the BAA; everyone else signs the addendum. A firm with both kinds of data can sign both.

Who can sign for our organization?

Someone with authority to bind it: an owner, partner, officer or practice administrator with that authority. The signer’s name and title are recorded on the document.

Where is the governing law?

In the Terms of Service. The contracting entity is PacinfraX Corporation in Irvine, California.

Contact

Questions about any document: [email protected]. Notices by mail to PacinfraX Corporation, Attn: Legal, 19900 MacArthur Boulevard, Suite 915, Irvine, CA 92612.