Susurrus

Terms of Service and Business Associate Addendum

Version 0.2 · Last updated 27 October 2026

Part 1. Terms of Service

1. Who we are and what this covers

These terms are between Susurrus AI, Inc., a Delaware corporation ("Susurrus", "we", "us"), and the person who creates an account ("you"). If you use the Service on behalf of a practice or other organization that you have authority to bind, "you" includes that organization. They cover your use of the Susurrus web application and related services (the "Service"). Part 2, the Business Associate Addendum, is part of these terms.

2. The Service

Susurrus helps radiologists turn their dictation into draft reports. The Service is offered today as a closed pilot to invited radiologists. Features may change, be added or be removed during the pilot. The Service is a drafting tool, not a medical-record archive: cases are deleted automatically after a short retention period (see our privacy notice), so you must copy every final report into your own reporting system.

3. Your account

  • You must be a licensed radiologist or otherwise invited by us, and you must give accurate information when you sign up.
  • Your account is for you alone. Don't share your sign-in, keep your password safe, and use two-step sign-in, which every account requires.
  • Tell us at once if you think someone else has used your account.
  • You are responsible for what is done through your account.

4. AI-drafted reports

  • The Service uses software, including artificial-intelligence models, to suggest draft report text from what you dictate or type.
  • Every draft is a suggestion for you to review. You review, edit and approve all report text before you sign or use it, and you are responsible for the content of any report you sign.
  • The Service does not provide medical advice or diagnoses and does not replace your professional judgment.
  • We work to make the Service accurate, but we do not promise that any draft will be complete or free of mistakes.

5. Acceptable use

You agree not to:

  • use the Service against the law or against your professional obligations;
  • try to reach another user's data, or test, probe or attack the Service's security without our written permission;
  • copy, resell or reverse-engineer the Service;
  • upload malicious code, or overload or disrupt the Service;
  • enter patient information unless you are allowed to (section 7).

6. Fees

Early access to the Service, before the official closed pilot begins, is free. During the official closed pilot, the Service will be charged at cost: the cost of your AI usage plus a share of hosting costs. Before any charge, we will tell you the amount and how billing works, and ask you to accept updated terms.

7. Patient information and your authority

  • What protects it. The Service is built so that patient information you enter is handled under HIPAA: every service we use to process it has signed a business associate agreement with us, and it is encrypted in transit and at rest. Part 2 sets out our obligations.
  • Your promise. Each time you sign in or enter patient information, you promise that one of these is true: (a) you are a covered entity or business associate under HIPAA, or are authorized to sign for one (for example, your own practice or reading group), and you have authority to bind it to these terms, including Part 2, which is then its business associate agreement with us; or (b) the hospital, practice or other organization whose patients you read for has given you permission to enter its patients' information into the Service and to have it handled as these terms describe. You also promise that your use does not break any contract, policy or law that applies to you. If neither (a) nor (b) is true, do not enter patient information.
  • We rely on your word. We rely only on your promise. We do not check, verify, monitor or audit your authority, your permission or your employment. Our not checking is not consent to any entry you are not allowed to make, and it does not make us a party to your arrangements with any organization.
  • If your permission ends or is questioned. If your authority or permission ends or changes, stop entering that organization's patient information at once. If an organization tells you that you did not have permission, or asks that its information be removed, tell us at once through the in-app reporting tools, without patient details, so we can secure or remove it.
  • If you can't bind an organization. If you cannot bind an organization, your acceptance binds only you. It does not make us that organization's business associate by agreement, and it gives that organization no rights under Part 2.

8. How we use case data

  • To run the Service. We use what you enter to provide the Service to you.
  • To test and improve Susurrus, de-identified only. We use only de-identified cases to test, benchmark and improve the Service, including its instructions and models. We never use identified case content for this.
  • De-identified first: any case used to improve the Service, and anything we share with others, is first de-identified under HIPAA (45 CFR 164.514).
  • Never: we do not sell your data or patient information, and we do not use it for marketing or advertising.
  • Outside vendors that process data for us may not train their own models on it, and where a vendor offers a training opt-out, we keep it turned on.

9. Privacy

Our privacy notice explains what we collect and how we keep it: https://susurrusai.com/privacy

10. Our responsibility and its limits

  • The Service is provided "as is". To the extent the law allows, we disclaim all warranties not stated in these terms, including fitness for a particular purpose.
  • To the extent the law allows, our total liability arising out of or relating to these terms or the Service (under any legal theory) is limited to the greater of $100 and the fees you paid us in the 12 months before the claim.
  • We are not liable for indirect, incidental, special, consequential or punitive damages, or for lost profits, to the extent the law allows.
  • Acting on a notice. We are not liable to you for suspending or closing your account, or for securing, keeping or deleting data, in good faith in response to a notice from a hospital, practice, employer or regulator (section 11).
  • These limits don't apply where the law does not allow them to be limited.
  • Claims caused by your use. To the extent the law allows, you will indemnify and defend Susurrus AI, Inc. and its officers and employees against third-party claims (including from your employer, a hospital, a practice, patients or regulators), and the losses, fines and reasonable legal fees that come from them, to the extent they arise from: (a) your entering patient information without the authority or permission you promised in section 7; (b) your breach of these terms; or (c) your use of the Service against the law, your professional obligations, or a contract or policy that applies to you.

11. Ending your use

  • You may stop using the Service and close your account at any time.
  • We may suspend or close an account that breaks these terms, or end the pilot, with reasonable notice where we can.
  • If an organization contacts us. If a hospital, practice, employer or regulator tells us that patient information in your account may have been entered without its permission, we may at once, without notice to you where the law allows: suspend your account; stop processing the affected cases, including any de-identified use; keep them secured and unused while the matter is reviewed or the law requires, pausing automatic deletion if needed; and, once we have confirmed who the organization is, delete or return its information as it directs, with backup copies ageing out as Part 2, section 9 describes. We may tell that organization when your account was active, how many cases were affected, how the information was protected and when it was deleted. Acting on a notice does not mean we agree the claim is correct.
  • When an account closes, any cases and account information we still hold are returned to you on request (if requested before deletion) or deleted, as set out in Part 2, section 9.
  • Sections 4, 7, 8, 10, 11 and 13 survive the ending of your account or these terms.

12. Changes to these terms

  • We may update these terms. A new version takes effect when you accept it.
  • We ask you to accept the new version at your next sign-in, and you can't keep using the Service without accepting it.
  • We keep a record of which version you accepted, and when.

13. Governing law

These terms are governed by the laws of the State of Delaware, without regard to its conflict-of-laws rules, except where federal law (including HIPAA) applies. These terms (including Part 2) are the entire agreement between you and us for the Service and replace any earlier terms for the Service. If any part of these terms is found unenforceable, the rest stays in effect.

14. Contact

Susurrus AI, Inc., security officer: support@susurrusai.com. Do not send patient information or case text by email; use the in-app reporting tools instead.

15. Trademarks

PowerMic is a trademark of Nuance Communications, Inc.; SpeechMike is a trademark of Speech Processing Solutions GmbH. Susurrus is not affiliated with, sponsored by or endorsed by either.

Part 2. Business Associate Addendum

This Addendum applies whenever Susurrus creates, receives, maintains or transmits protected health information ("PHI") through the Service. Where you, or the organization you are authorized to act for, are a covered entity or business associate under HIPAA, you or that organization are the "Covered Entity", and Susurrus is the "Business Associate" (or subcontractor business associate). Words not defined here have their meaning under HIPAA (45 CFR Parts 160 and 164). This Addendum is a business associate agreement only with a Covered Entity that has agreed to these terms through a person authorized to bind it. It creates no agreement or business associate relationship with an organization you cannot bind; Susurrus still protects that information as this Addendum describes, and its other duties for it are those the law imposes directly. If this Addendum and Part 1 conflict, this Addendum controls for PHI.

1. Uses and disclosures

Susurrus will use or disclose PHI only:

  • to provide the Service to the Covered Entity;
  • to de-identify PHI under 45 CFR 164.514, so that only de-identified data is used to test, benchmark and improve the Service. De-identified data is no longer PHI and may be used as Part 1, section 8 allows;
  • for Susurrus's proper management and administration and to carry out its legal responsibilities. Any disclosure for these purposes is either required by law, or made with reasonable assurances from the recipient that it will keep the information confidential, use or further disclose it only as required by law or for the purpose disclosed, and notify Susurrus of any breach of confidentiality;
  • as required by law.

Susurrus will not use or disclose PHI in any way that would break the Privacy Rule if the Covered Entity did it, except as this section allows. It will not sell PHI or use it for marketing. It will use, disclose and request only the minimum necessary.

2. Safeguards

Susurrus will use appropriate administrative, physical and technical safeguards, and comply with Subpart C of 45 CFR Part 164 (the Security Rule), to protect electronic PHI and prevent uses or disclosures this Addendum does not allow.

3. Subcontractors

Susurrus will ensure that each subcontractor that creates, receives, maintains or transmits PHI for it agrees in writing, in a business associate agreement, to the same restrictions, conditions and requirements that apply to Susurrus under this Addendum.

If Susurrus knows that a subcontractor is materially breaching its business associate agreement, Susurrus will take reasonable steps to cure the breach and, if those steps do not work, end the subcontract. If ending it is not feasible, Susurrus will report the breach to the Covered Entity.

4. Reporting

  • Uses or disclosures not allowed, including breaches of unsecured PHI: Susurrus will report to the Covered Entity any such use or disclosure it becomes aware of, and for any breach of unsecured PHI will notify the Covered Entity as 45 CFR 164.410 requires, without unreasonable delay and in no case later than 60 calendar days after discovery (except where law enforcement requests a delay under 45 CFR 164.412). For a breach of unsecured PHI, the report will give, as it becomes available:
    • the individuals affected;
    • the other information the Covered Entity needs for its own notices.
  • Security incidents: Susurrus will report any successful security incident it becomes aware of to the Covered Entity without unreasonable delay.
    • The parties agree that this Addendum is notice of attempted but unsuccessful security incidents that don't result in unauthorized access, use, disclosure, change or destruction of PHI, such as blocked sign-in attempts, pings and port scans. Susurrus does not need to report these individually.
  • Mitigation: Susurrus will mitigate, as far as practicable, any harmful effect it knows of from a use or disclosure that breaks this Addendum.

5. Individuals' rights

Susurrus will support the Covered Entity's obligations:

  • Access: within 15 business days of a request, to the extent Susurrus still maintains PHI in a designated record set, make it available to the Covered Entity under 45 CFR 164.524. This includes in electronic form where requested.
  • Amendment: to the extent Susurrus still maintains PHI in a designated record set, make it available for amendment and incorporate any amendments the Covered Entity directs, under 45 CFR 164.526.
  • Accounting of disclosures: keep, and provide on request, the information needed for an accounting of disclosures under 45 CFR 164.528.
  • Requests made directly to Susurrus: if an individual asks Susurrus directly, Susurrus will pass the request to the Covered Entity within 5 business days.

6. Covered Entity's obligations

Where it applies, Susurrus will comply with the Privacy Rule requirements that apply to the Covered Entity in performing any of the Covered Entity's obligations for it.

  • The Covered Entity will tell Susurrus about any limit in its notice of privacy practices, any change to or withdrawal of an individual's permission, and any restriction it has agreed to under 45 CFR 164.522, if any of these may affect how Susurrus uses or discloses PHI. The Covered Entity will not ask Susurrus to use or disclose PHI in a way HIPAA does not allow.

7. Books and records

Susurrus will make its internal practices, books and records about the use and disclosure of PHI available to the Secretary of Health and Human Services, to determine compliance with HIPAA.

8. Term and termination

  • Term: this Addendum lasts as long as Susurrus holds PHI for the Covered Entity.
  • Termination for breach: if Susurrus materially breaches this Addendum, the Covered Entity may end the Terms and this Addendum, if Susurrus doesn't cure the breach within 30 days of written notice, or at once if cure is not possible.

9. Return or destruction at the end

When the Terms end:

  • Susurrus will return or destroy the PHI it holds for the Covered Entity, including PHI held by its subcontractors. Records that contain no report text and must be kept by law or under our record schedule (for example the signed-report fingerprint and the record of who opened which case number, each kept for 400 days) are kept only for that period and then deleted. Records kept secured under Part 1, section 11 after an organization's notice are kept only for that purpose and period, are not used to provide or improve the Service, and are then deleted.
  • Copies in backups are destroyed as the backups age out, within 35 days for Azure database backups, 14 days for the encrypted nightly copy, and about 14 days for recovery copies of deleted files in Azure file storage.
  • Where return or destruction is not feasible, Susurrus will extend this Addendum's protections to that PHI, and limit further uses and disclosures to the purposes that make return or destruction infeasible, for as long as it holds it.

10. General

  • Interpretation: this Addendum is read to allow compliance with HIPAA.
  • Changes in the law: the parties will amend it as needed to keep up with changes in HIPAA. An updated version accepted under Part 1, section 12 by a person authorised to bind the Covered Entity amends this Addendum for that Covered Entity.
  • Survival: Susurrus's obligations under this Addendum continue for as long as Susurrus holds PHI, and sections 4, 5 (for accounting of disclosures), 7, 8, 9 and 10 survive termination.
  • No third parties: nothing in it gives rights to anyone other than the parties.