Plain Language Guide

Terms of Service: Explained

The Mammologix Terms of Service is a legal document. This page explains what it actually says, in plain language, section by section, starting from the assumption that you know nothing about it yet. This is not legal advice; it is a plain-language companion to help you read the real document with confidence.

Read the Full TermsAsk a Question

Section 1

The Basics: What This Document Is

Before anything else: what are you looking at, and why does it exist?

It is the legal agreement between Mammologix, LLC (doing business as I/O Trak, Incorporated) and any client facility that uses Mammologix services. The current version is v31.1, effective January 5, 2026. It describes what Mammologix will do, what the client is responsible for, how billing works, how data is handled, and what happens if either party ends the relationship.

The Service Provider is Mammologix, LLC, a Florida limited liability company doing business as I/O Trak, Incorporated, located at 830 Sunshine Lane, Altamonte Springs, FL 32714. The Client is any healthcare provider or facility that accesses or uses Mammologix services. Each physical imaging location the Client operates is treated as a separate, independent Site for billing purposes.

No. By accessing or using Mammologix services, the Client acknowledges they have read, understood, and agreed to be bound by these terms. The person accepting on behalf of a facility must have the legal authority to bind the organization.

A Site is a unique, physical imaging location where services are rendered under the Client's supervision. Each Site is tracked and billed independently. If your organization has three imaging locations, that is three Sites.

An Encounter is a single patient visit involving one or more breast imaging procedures performed on the same day. This includes screening, diagnostic, mobile, and contrast-enhanced mammograms; breast or axillary ultrasound; breast MRI; Molecular Breast Imaging (MBI); Breast-Specific Gamma Imaging (BSGI); Positron Emission Mammography (PEM); and interventional procedures such as biopsy, localization, placement, or aspiration, all performed on that same day.

Section 2

Services & Scope: What Is and Isn't Included

What Mammologix does, how it's structured, and what falls outside the standard agreement.

Mammologix provides modular breast imaging support across four service areas: Tracking (MammoTrack: end-to-end monitoring of breast imaging events, overdue cases, and outcomes), Communicating (MammoCommunicate: patient lay letters, MQSA-compliant notifications, and reminders), Complying (MammoComply: MQSA, ACR, NAPBC, NQMBC compliance tools and reporting), and Navigating (MammoNavigate: follow-up coordination, the Novissimus Navigator, and overdue inquiry management).

It is fully modular: à la carte. Clients select services individually and only pay for what they use. You can add or remove services at any time by submitting a written request.

Included at no additional charge with standard service: unlimited user access for your entire site, white-glove onboarding (database setup, data migration, lay letter templates, user training), ongoing training resources (webinars, documentation, knowledge base), priority support by phone, email, and in-app messaging, full client data ownership, MQSA/FDA compliance support, ACR/NAPBC/NQMBC reporting tools, the Overdue Inquiry Tracking System, and the Novissimus Follow-Up Navigator.

A Clarification is a structured exception-handling process Mammologix initiates when a patient report contains incomplete, contradictory, or incongruent information that prevents accurate follow-up. Mammologix flags the issue, contacts your designated healthcare team to get the missing information, and updates the record. The fee is $2.28 per clarification, the same rate as a standard encounter.

Services outside the fee schedule are considered out-of-scope and require a separate written agreement. These include custom programming and configuration ($95/hr), custom printed inserts ($0.30 to $2.00/piece), hand matching services ($1.00/piece), LDCT patient tracking ($15/month per site), variable printing ($0.35/page), custom patient navigation services (priced by proposal), and international postage. Estimates are always provided free of charge; no work begins without written approval.

Mammologix uses HL7, sFTP, and fax for secure patient information exchange. All transmissions are encrypted. Mammologix facilitates the exchange but is not responsible for transmission delays, failures, or data discrepancies caused by third-party systems.

Section 3

Billing & Fees: How Invoicing Works

Every number, deadline, and policy governing what you pay and when.

Mammologix bills monthly based on actual service utilization during the preceding billing period. You are only charged for what you use. Each invoice reflects the number of encounters processed, patient communications produced, and any applicable add-ons. The invoice is sent electronically to your designated billing contact.

The current fees (Appendix A, effective January 5, 2026): Start-Up fee $500 per site (one-time); Tracking & Clarification $2.28 per encounter or clarification; Lay Letter: Self-Service (digital, you print and mail) $0.65 per digital impression; Lay Letter: Premier (Mammologix prints and mails) $1.12 per printed impression plus postage at current USPS rates; Compliance/MQSA reporting is included at no additional charge; Overdue Inquiry Tracking and Novissimus Navigator are included at no additional charge.

Payment is due within 30 days of the invoice date.

Check, Electronic Funds Transfer (EFT), and credit card. If you pay by credit card, a processing fee of up to 3% may be applied where permitted by applicable state law and card network rules. This fee will be disclosed on your invoice and itemized separately on your payment receipt. It does not apply to debit cards, prepaid cards, ACH, or EFT payments.

A deferred payment surcharge of 1.5% per month (18% annually) begins accruing on any balance not paid within 30 days. The surcharge continues until the balance is paid in full and is itemized separately on future invoices. If the balance remains unpaid for 60 or more days, Mammologix may suspend services after issuing written notice.

During suspension, all data processing and system access are temporarily disabled. No lay letters are generated, no tracking events are processed, and no compliance reporting runs. Support is paused. Services are reinstated after full payment of the outstanding balance. A $250 reinstatement fee may apply if the suspension exceeds 30 days.

You must notify Mammologix in writing within 15 calendar days of receiving the invoice. Mammologix will review and investigate in good faith and respond in a timely manner. If the dispute is resolved in your favor, a credit or adjustment will be applied to a subsequent invoice. You are still responsible for paying all undisputed portions of the invoice by the original due date.

The agreement requires you to contact Mammologix first and allow a 15-day resolution period before initiating a chargeback. If you bypass this process, Mammologix may suspend services, pursue recovery through collections or legal action, and charge a $250 administrative fee per chargeback.

The Terms of Service state that fees are not refundable. The one exception is the 90-Day Service Promise, available to new client sites through a signed rider. If you walk away under the Promise, we refund Mammologix service fees for the 90-day evaluation period. Third-party pass-through costs such as postage are not refunded. Read the Promise

Yes, with a minimum of 45 days written notice for standard service fee changes. Most fee changes happen no more than once per calendar year. Third-party passthrough costs (such as USPS postage rates) can change at any time without advance notice, reflecting the most current published rates. If you do not accept a price change, you may terminate the affected service or the entire agreement by providing written notice before the change takes effect. Continued use after the effective date constitutes acceptance.

Section 4

Data Ownership: Who Owns What

Your data is yours. Here is exactly what that means in practice.

The Client retains full ownership of all data submitted to, stored within, or processed through the services, including patient health information, imaging records, and operational data. Mammologix does not acquire any ownership rights in Client data. Access by Mammologix is strictly limited to what is necessary to deliver the services.

Mammologix retains full ownership of all software, algorithms, user interfaces, trade secrets, trademarks, documentation, and proprietary materials. The Client receives a limited, non-exclusive, non-transferable, non-sublicensable license to use the services for internal operations during the active service relationship. The agreement does not transfer any ownership rights.

If you provide feedback or enhancement requests, Mammologix may use that feedback to improve or modify the services without any obligation or compensation to you. Mammologix will not publicly attribute your feedback to your organization without your prior written consent.

Yes. Upon termination, Mammologix provides one no-cost data export in a standard, machine-readable format (CSV, XML, JSON, or PDF) within 45 days of the effective termination date. A secure portal also remains available for 90 days post-termination so you can access and download your data on your own schedule. After that 90-day window, data is securely deleted.

Yes. You may submit a written request for deletion of specific data that is not subject to regulatory or contractual retention requirements. Mammologix will review in good faith and, if approved, process the deletion within 30 days, provided it does not conflict with any applicable law, regulation, or audit requirement.

Yes. Upon written request, Mammologix will provide a written certification confirming that Client data has been securely deleted using commercially reasonable data destruction protocols and applicable industry standards.

Section 5

HIPAA & the BAA: Patient Data Protections

How protected health information is handled, and what the Business Associate Agreement means for your facility.

Yes. The agreement explicitly acknowledges that Mammologix qualifies as a Business Associate of the Client under HIPAA. A Business Associate Agreement (BAA) is executed concurrently with the Terms of Service as Appendix B and is incorporated by reference. If there is any inconsistency between the TOS and the BAA regarding PHI, the BAA controls.

A Business Associate Agreement is a HIPAA-required contract that governs how a vendor may use protected health information (PHI) on your behalf. It ensures Mammologix is legally bound to the same privacy and security obligations as your facility. The BAA attached to this TOS is based on official HHS sample provisions and complies with the HIPAA Privacy Rule, Security Rule, Breach Notification Rule, and HITECH Act.

Yes. You may substitute your own approved BAA, provided it meets minimum HIPAA requirements. Alternatively, you may request modifications to the Mammologix BAA to meet your internal policies or state-specific obligations, and Mammologix will review and incorporate mutually agreeable changes. If no alternative is submitted, the Mammologix BAA is deemed accepted as of the Effective Date.

Mammologix may only use or disclose PHI as necessary to perform the services described in the agreement, or as required by law. PHI is never used for secondary, commercial, or non-operational purposes. Uses and disclosures are limited to the minimum necessary. De-identified data (prepared under HIPAA standards) may be used for service improvement and internal research, but will never be sold or licensed to third parties.

Where third-party vendors are engaged, Mammologix requires those vendors to agree to privacy and security obligations consistent with HIPAA and the terms of this agreement. Subcontractors are held accountable for their compliance.

Both parties agree to comply with: HIPAA and the HITECH Act, MQSA (Mammography Quality Standards Act), Medicare and Medicaid CMS billing regulations, and applicable state health data privacy laws (including the California CMIA and similar statutes). The Client remains solely responsible for ensuring compliance within its own operations and jurisdiction.

Section 6

Data Security: How Your Data Is Protected

The technical safeguards in place, and what happens if something goes wrong.

Mammologix implements: encryption of all data in transit and at rest using industry-standard protocols; role-based access controls (RBAC) limiting access to authorized personnel only; multi-factor authentication (MFA) required for all system access; logging of all access attempts with monitoring for unauthorized activity; industry-standard network perimeter defenses and threat monitoring; and systematic vulnerability management.

Cloud-based systems are hosted exclusively in SOC 2 Type II certified data centers. These facilities include multi-layered physical access controls (biometric authentication, continuous video surveillance), environmental protection systems (temperature control, fire suppression, power redundancy), and geographically distributed disaster recovery with documented Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs).

Yes. All Mammologix personnel receive initial and ongoing training on data security, privacy best practices, and HIPAA compliance.

Mammologix will provide written notice to the affected client within five business days of discovering a breach involving unauthorized access, disclosure, or compromise of PHI or other sensitive data. The notification will include: the nature of the breach, the types of data involved, the date of discovery and (if known) the date of occurrence, steps Mammologix is taking to mitigate harm and prevent recurrence, and any actions the client may need to take.

Mammologix will secure affected systems, conduct a root cause analysis, implement measures to prevent recurrence, and (where required by HIPAA or other applicable regulations) coordinate with the Client to fulfill breach notification obligations to affected individuals, regulatory authorities, and other required parties.

Section 7

Ending the Relationship: Termination

What it takes to end services, what you owe, and how long your data stays available.

That is what the 90-Day Service Promise is for. Tell us in writing what is not working, give us 15 days to address it, and if you are still not satisfied, send walk-away notice no later than 15 days after day 90. Read the Promise

You may terminate at any time, for any reason, by providing written notice to Mammologix. Termination is effective 30 days from the date of written notice, unless both parties agree in writing to an earlier or later date.

Yes. Mammologix may terminate with at least 30 days written notice, or immediately (termination for cause) if: you materially breach the agreement and fail to cure within 15 days of written notice; you have an invoice more than 60 days overdue after written notice of delinquency; you become insolvent or file for bankruptcy; you violate healthcare laws in a way that exposes Mammologix to legal or reputational harm; or you engage in data misuse, unauthorized access, PHI tampering, or fraud.

Yes. You remain responsible for all service charges incurred through the effective termination date, including outstanding invoices and charges for services rendered during the notice period. No amounts paid or payable under the agreement are refundable. This applies regardless of whether you continue using the services or elect to terminate.

Mammologix will: (1) provide one complimentary data export in a standard, machine-readable format (CSV, XML, JSON, or PDF) within 45 days of termination; (2) maintain a secure online portal for 90 days post-termination through which you can access and download your data independently. After the 90-day window, all remaining Client data is securely deleted. Extended storage beyond 90 days may be arranged under a separate written agreement for an additional fee.

The 90-day Access Window begins on the earliest of: the date Mammologix receives your written termination notice; the date services are suspended for non-payment; or the date you stop submitting data or using the services for 90 consecutive days. Missing this window results in permanent data deletion. Mammologix is not liable for data lost because a client failed to retrieve it within the access period. If you need more time, you must arrange extended access in writing before the window closes.

The following provisions survive termination: any payment obligations incurred before termination, confidentiality and data handling obligations, intellectual property rights, indemnification obligations, limitations of liability, dispute resolution terms, and any other provisions that by their nature are intended to survive.

Section 8

Limits & Responsibilities: Legal Guardrails

Liability caps, indemnification, dispute resolution, and what each party is responsible for.

No. Mammologix is a workflow and operational support service. The Client remains solely responsible for ensuring clinical accuracy, regulatory compliance within their operations, and the correctness of all billing practices and clinical decisions. Mammologix does not provide legal, clinical, or regulatory compliance guarantees. The Client is also solely responsible for the accuracy, completeness, and timeliness of all patient information submitted to Mammologix.

Yes. Mammologix's total cumulative liability for all claims arising from the agreement cannot exceed the total fees paid by the Client in the 12 months immediately preceding the event giving rise to the claim. Neither party is liable for indirect, incidental, consequential, special, exemplary, or punitive damages (including lost profits, lost revenue, or lost data) regardless of the theory of liability.

Yes. The liability cap does not apply to: either party's indemnification obligations, liability for gross negligence, willful misconduct, or fraud, obligations under the BAA, or any liability that cannot be excluded or limited by applicable law.

Indemnification means one party agrees to defend and compensate the other against third-party claims. The Client indemnifies Mammologix against claims arising from: Client breaches of the agreement, violations of applicable law by the Client or its staff, Client data that infringes third-party rights, and the Client's clinical decisions or billing practices. Mammologix indemnifies the Client against claims that the services infringe U.S. intellectual property rights, and against data breaches caused by Mammologix's failure to maintain required security safeguards.

Florida law governs. Disputes must first go through non-binding mediation in Seminole County, Florida, with a mutually agreed mediator (costs split equally). If mediation does not resolve the dispute within 60 days, the parties may proceed. Financial disputes under $100,000 go to binding arbitration under American Arbitration Association (AAA) Commercial Rules, before a single arbitrator in Seminole County. Disputes of $100,000 or more, intellectual property disputes, and claims for injunctive relief are litigated in Seminole County state courts or the Middle District of Florida federal courts.

No. Both parties waive the right to bring or participate in class actions, collective arbitration, or similar proceedings, to the fullest extent permitted by law. Each party may still pursue individual claims.

Neither party is liable for failure or delay caused by events beyond their reasonable control, including natural disasters, war, government actions, telecommunications failures, or cyberattacks. Mammologix will make commercially reasonable efforts to restore service. If a force majeure event prevents Mammologix from performing material services for more than 30 consecutive days, the Client may terminate under the standard termination clause. During a partial disruption, invoicing reflects only unaffected service portions.

Yes. Material changes will be communicated at least 30 days before the effective date. Continued use of services after the effective date constitutes acceptance of the modified agreement. No other amendment is valid unless in writing and signed by both parties.

Still Have Questions?

Ask Directly. We Will Answer Plainly.

Every question in this guide came from real client conversations. If yours is not answered here, reach out. We will give you a straight answer, not a legal runaround.

Contact UsView Full Terms of Service

Didn't find what you were looking for?

Our team has supported breast imaging centers since 1995. If it's not here, we probably know the answer.

Ask a Question →