Request a Private Demonstration
Client Login

Merlin Law Terms of Service: Business Associate Agreement (HIPAA & State Health Privacy) & Non-Disclosure Agreement

Last Updated:

October 13, 2026

By clicking “I Agree,” checking the agreement box, or accessing and using the Merlin Law software platform (the “Software”), you (“User” or “Covered Entity”) agree to be bound by this Business Associate Agreement and Non-Disclosure Agreement (the “Agreement”) with Merlin Law, Inc. (“Company” or “Business Associate”).

If you are entering into this Agreement on behalf of a company, law firm, medical practice, or other legal entity, you represent that you have the authority to bind such entity to these terms.

PART I: BUSINESS ASSOCIATE AGREEMENT (HIPAA & STATE HEALTH PRIVACY)

  1. Purpose and Scope

This Part I applies solely to the extent that User is a “Covered Entity” or “Business Associate” under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and transmits, receives, or stores Protected Health Information (PHI) or Electronic Protected Health Information (ePHI) within the Software.

  1. Permitted Uses and Disclosures
  • Services: Company may use or disclose PHI only as permitted or required by this Agreement, the primary Merlin Law Terms of Service, or as Required by Law.
  • Management & Administration: Company may use or disclose PHI for the proper management and administration of the Company, or to carry out its legal responsibilities, provided that any disclosures are Required by Law or Company obtains reasonable written assurances from the recipient regarding confidentiality and breach notification.
  • Data Aggregation: Company may provide data aggregation services relating to the health care operations of the User if explicitly authorized by the underlying services.
  1. Obligations of Business Associate (Merlin Law)
  • Safeguards: Company will implement appropriate and reasonable administrative, physical, and technical safeguards to prevent the unauthorized use or disclosure of PHI, and to protect the confidentiality, integrity, and availability of ePHI in compliance with the HIPAA Security Rule.
  • Subcontractors: Company will ensure that any agents or subcontractors that create, receive, maintain, or transmit PHI on behalf of Company agree to the same restrictions and conditions that apply to Company under this Agreement.
  • Breach Notification: Company will report to User any use or disclosure of PHI not provided for by this Agreement, including any Security Incident or Breach of Unsecured PHI, within seventy-two (72) hours of discovery. Company will mitigate, to the extent practicable, any harmful effects of such breach.
  • Access and Amendment: To the extent Company maintains PHI in a Designated Record Set, Company will make such PHI available to User to satisfy User’s obligations under 45 C.F.R. § 164.524 (Access) and § 164.526 (Amendment).
  • Accounting of Disclosures: Company will document and make available to User the information required to provide an accounting of disclosures of PHI in accordance with 45 C.F.R. § 164.528.
  1. California and Multi-State Compliance Addendum
  • California CMIA: In accordance with the California Confidentiality of Medical Information Act (CMIA) (Cal. Civ. Code § 56 et seq.), Company acknowledges that any medical information received from or created on behalf of User is highly confidential and shall not be disclosed to any third party except as authorized by the patient, the User, or permitted by the CMIA.

State Law Preemption: Where state laws regarding the privacy or security of health records, sensitive data, or breach notification timeframes (such as the Texas Medical Records Privacy Act, New York SHIELD Act, or Florida Information Protection Act) are more stringent than federal HIPAA provisions, Company agrees to comply with the stricter standard.

PART II: MUTUAL NON-DISCLOSURE AGREEMENT (ALL U.S. STATES)

  1. Definition of Confidential Information

“Confidential Information” means all information, data, or software code disclosed by one party (“Disclosing Party”) to the other party (“Receiving Party”), whether orally or in writing, that is designated as confidential or that reasonably should be understood to be confidential given the nature of the information and the circumstances of disclosure.

  • User Confidential Information includes, without limitation, client files, legal case files, litigation strategies, proprietary business workflows, and trade secrets entered into Merlin Law.
  • Company Confidential Information includes the Software architecture, proprietary algorithms, source code, user interface designs, and product roadmaps.
  1. Obligations of Non-Disclosure and Non-Use

The Receiving Party shall:

  • Hold the Disclosing Party’s Confidential Information in strict confidence.
  • Use at least the same degree of care to protect the Confidential Information as it uses to protect its own confidential information of like kind, but in no event less than a reasonable standard of care.
  • Not use any Confidential Information of the Disclosing Party for any purpose outside the scope of utilizing or providing the Merlin Law Software.
  • Limit access to Confidential Information to those of its employees, contractors, and advisors who need such access for purposes consistent with this Agreement and who are bound by confidentiality obligations no less restrictive than those herein.
  1. Exceptions

Confidential Information does not include information that: (a) is or becomes generally known to the public without breach of any obligation owed to the Disclosing Party; (b) was known to the Receiving Party prior to its disclosure by the Disclosing Party; (c) is received from a third party without breach of any obligation owed to the Disclosing Party; or (d) was independently developed by the Receiving Party.

  1. Compelled Disclosure

If the Receiving Party is compelled by law, court order, or government subpoena to disclose Confidential Information, it shall provide the Disclosing Party with prompt prior written notice (to the extent legally permitted) so the Disclosing Party may seek a protective order or contest the disclosure.

  1. California Consumer Privacy Act (CCPA/CPRA) Compliance

To the extent California consumer personal information is processed:

  • Company acts as a Service Provider (as defined under the CCPA/CPRA).
  • Company shall not sell, share, retain, use, or disclose User’s personal data or client personal data for any purpose other than for the specific business purpose of providing the Software services specified in this Agreement.
  • Company certifies that it understands and will comply with the restrictions and prohibitions set forth in Cal. Civ. Code § 1798.140.

PART III: GENERAL PROVISIONS

  1. Term and Termination
  • Term: This Agreement shall remain in effect for as long as User maintains an active account or retains access to the Software.
  • Return or Destruction of Data: Upon termination of User’s account, Company shall, at User’s option, return or destroy all PHI and Confidential Information in its possession. If return or destruction is infeasible, Company shall extend the protections of this Agreement to such information and limit further uses and disclosures to those purposes that make the return or destruction infeasible.
  1. Governing Law and Jurisdiction

This Agreement shall be governed by, interpreted, and construed in accordance with the laws of the State of California, without regard to its conflict of law principles. Any legal action, suit, or proceeding arising out of or relating to this Agreement must be instituted exclusively in the state or federal courts located in the State of California.

  1. Severability and Integration

If any provision of this Agreement is found to be invalid or unenforceable by a court of competent jurisdiction, the remaining provisions shall continue in full force and effect. This Agreement constitutes the entire agreement between the parties regarding its subject matter and supersedes all prior or contemporaneous agreements.

Electronic Acceptance

BY CLICKING “I AGREE” OR BY ACCESSING MERLIN LAW, YOU ACKNOWLEDGE THAT YOU HAVE READ, UNDERSTOOD, AND AGREE TO BE BOUND BY BOTH THE BUSINESS ASSOCIATE AGREEMENT (PART I) AND THE NON-DISCLOSURE AGREEMENT (PART II) CONTAINED HEREIN UNDER THE LAWS OF THE STATE OF CALIFORNIA.

Scroll to Top