Terms of Service

Effective Date: December 28, 2025

Welcome to Pendulum ("Pendulum," "we," "us," or "our"). These Terms of Service ("Terms") govern access to and use of the Pendulum software platform (the "Service").

By accessing or using the Service, you agree to these Terms. If you do not agree, do not use the Service.

1. The Service

Pendulum is a clinical system of record designed to support mental health practices with documentation, scheduling, records management, policy controls, audit logging, and disclosures.

Pendulum is:

• a tool for licensed professionals and their practices
• built to enforce minimum-necessary and relationship-based access
• scoped to a single practice (no cross-practice access)

Pendulum is not:

• a healthcare provider
• a medical device
• a diagnostic, treatment, or decision-making system
• an insurance or billing platform

All clinical decisions, care delivery, documentation accuracy, and legal compliance remain the responsibility of the practice and its professionals.

2. Plans, Subscriptions, and Feature Gating

The Service is offered in plans with feature entitlements and policy gates. Plan names and feature sets include:

• Core (EHR): clients, scheduling, progress notes, treatment plans, intake summaries, psychotherapy notes (segregated), measures, scoped exports, and audit viewing for Owner/Admin.
• Studio: Core features plus advanced policy controls and governance tooling.
• Add-on: AI Drafts (opt-in) for draft note generation and summaries.
• Add-on: Audio-to-Draft (opt-in) for recording, transcription, and draft generation with explicit consent controls.

Some features are disabled by default and require explicit enablement by plan and practice policy, including AI features, audio/transcription, and client portal access. Exports may be enabled by plan and policy.

3. Eligibility

You may use the Service only if:

• you are at least 18 years old
• you are authorized to act on behalf of a practice or yourself as a professional user
• your use complies with applicable laws and professional standards

Clients (patients) may access limited portions of the Service only when explicitly invited by a practice and only to content explicitly shared.

4. Accounts and Access

You are responsible for:

• maintaining the confidentiality of your login credentials
• ensuring that access is granted only to authorized users
• promptly revoking access when a user no longer requires it

You agree not to:

• share accounts
• bypass access controls
• attempt unauthorized access to data or systems

Pendulum reserves the right to suspend or terminate access for violations of these Terms or to protect the Service.

5. Authorization, Minimum Necessary, and Practice Responsibilities

Access within Pendulum is governed by role eligibility, relationship entitlement (for assigned clients), sensitivity gates, and practice policy. Role alone is never sufficient for clinical access.

You are responsible for:

• assigning roles appropriately and maintaining assignments
• ensuring access is limited to the minimum necessary
• ensuring users comply with professional and legal obligations

Admin and Staff roles do not have clinical text access. Psychotherapy notes are author-only by default and excluded from client portal views.

6. Data and Content

6.1 Practice Data

You retain ownership of all data you submit to the Service, including clinical records, psychotherapy notes, transcripts (if enabled), and client information ("Practice Data").

You grant Pendulum a limited, non-exclusive license to host, process, and transmit Practice Data solely to provide the Service.

6.2 Accuracy and Responsibility

You are solely responsible for:

• the accuracy of clinical documentation
• compliance with record-keeping laws
• determining what data is appropriate to store or share
• obtaining required consents for recordings and disclosures

Pendulum does not review, verify, or endorse clinical content.

6.3 Communications and Logs

Email communications from Pendulum do not include PHI. Pendulum does not log PHI in analytics, errors, or request/response bodies and uses structured logging with redaction by default.

6.4 De-identified and Aggregated Data

We may create de-identified or aggregated data from Practice Data in accordance with applicable law and use it to operate, improve, secure, and analyze the Service. We do not attempt to re-identify de-identified data, and de-identified or aggregated data is not treated as PHI.

7. HIPAA and Business Associate Relationship

Pendulum acts as a Business Associate under the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") when handling Protected Health Information ("PHI") on behalf of covered entities.

Use of the Service constitutes agreement to Pendulum's Business Associate obligations as described in a separate Business Associate Agreement ("BAA"), where applicable. If these Terms conflict with the BAA, the BAA controls.

8. Psychotherapy Notes

Psychotherapy notes are segregated from other clinical records and are excluded from exports and client portal views by default. Access is limited to the author clinician unless practice policy explicitly allows otherwise.

9. Exports and Disclosures

Pendulum does not email PHI. All disclosures happen through explicit, authenticated export flows. There is no ambient sharing; each disclosure is explicitly initiated and logged.

Exports require:

• explicit scope selection
• a preview of counts and date range
• confirmation before generation
• time-limited downloads for export artifacts
• auditing of initiation, preview, confirmation, and download

Psychotherapy notes are excluded by default. Practices are responsible for ensuring disclosures comply with law and professional obligations.

Export artifacts are encrypted at rest and disclosed only within authenticated flows.

10. AI-Assisted Features

Pendulum may offer optional AI-assisted features, such as drafting or summarization.

You acknowledge that:

• AI outputs are drafts only
• AI does not provide clinical judgment, diagnosis, treatment advice, or risk scoring
• you are solely responsible for reviewing, editing, and approving any AI-assisted content
• AI can only access clinician-selected data for assigned clients and is excluded from psychotherapy notes by default

AI features require practice-level enablement and clinician opt-in. If an AI provider is not BAA-approved with no-retention and no-training terms, PHI is not sent and the feature remains disabled for PHI.

AI actions are audited with metadata only.

11. Audio Recording and Transcription

Audio recording and transcription are off by default. If enabled:

• recording must be manually started and stopped
• a visible recording indicator is required
• explicit client consent is required for recording and transcription
• draft-only mode deletes audio by default after draft creation

Retained transcripts require additional explicit consent, are excluded from exports by default, and are restricted to the author clinician.

Audio and transcription actions are audited.

12. Security and Audit

Pendulum implements administrative, technical, and physical safeguards including encryption, access controls, and audit logging. Audit logs contain metadata only and do not include PHI.

You are responsible for maintaining appropriate safeguards on your systems and promptly notifying Pendulum of any suspected unauthorized access or security incident involving the Service.

However, no system is completely secure. You accept this risk.

13. Fees and Billing

Some features of the Service require payment.

Billing is handled via third-party payment processors. Pendulum does not store full payment card information and does not include PHI in billing communications.

Failure to pay applicable fees may result in suspension or termination of access.

14. Acceptable Use

You agree not to use the Service to:

• violate laws or regulations
• infringe privacy rights
• store or transmit malicious code
• attempt to reverse engineer the Service
• bypass authorization or audit controls
• send PHI via email or unsecured channels

15. Third-Party Services and Links

The Service may include integrations or links to third-party services. Those services are governed by their own terms and privacy practices. Pendulum does not control or endorse third-party services.

16. Termination

You may stop using the Service at any time.

Pendulum may suspend or terminate access:

• for violations of these Terms
• to comply with law
• to protect the security or integrity of the Service

17. Disclaimers

THE SERVICE IS PROVIDED "AS IS" AND "AS AVAILABLE."

TO THE MAXIMUM EXTENT PERMITTED BY LAW, PENDULUM DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT.

18. Limitation of Liability

TO THE MAXIMUM EXTENT PERMITTED BY LAW, PENDULUM SHALL NOT BE LIABLE FOR INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES.

NOTHING IN THESE TERMS LIMITS LIABILITY THAT CANNOT BE LIMITED BY LAW, INCLUDING OBLIGATIONS UNDER HIPAA OR THE BAA.

19. Indemnification

You agree to indemnify and hold Pendulum harmless from claims arising out of your use of the Service, your Practice Data, or your violation of these Terms, to the extent permitted by law.

20. Dispute Resolution and Binding Arbitration

Except where prohibited by law, any dispute, claim, or controversy arising out of or relating to these Terms or the Service will be resolved by binding arbitration on an individual basis. The arbitration will be conducted under the Federal Arbitration Act by a recognized arbitration provider. The arbitrator may award the same damages and relief as a court. Either party may seek injunctive relief in court to prevent unauthorized access, misuse, or infringement of intellectual property rights.

BY AGREEING TO ARBITRATION, YOU ARE WAIVING THE RIGHT TO A JURY TRIAL OR TO PARTICIPATE IN A CLASS ACTION. NOTHING IN THIS SECTION LIMITS OBLIGATIONS UNDER HIPAA OR THE BAA.

21. Class Action Waiver

You and Pendulum agree that any dispute will be brought only in an individual capacity and not as a plaintiff or class member in any purported class or representative proceeding. The arbitrator may not consolidate more than one person's claims or preside over any form of representative proceeding.

22. Time Limit on Claims

To the maximum extent permitted by law, any claim arising out of or related to the Service must be filed within one year of the event giving rise to the claim, or it is permanently barred.

23. Governing Law and Venue

These Terms are governed by the laws of the United States and the State of Texas, without regard to conflict-of-law principles. Subject to the arbitration requirements above, any permitted court proceedings shall be brought in state or federal courts located in Texas, and you consent to their jurisdiction.

24. Changes

We may update these Terms from time to time. Continued use of the Service constitutes acceptance of the updated Terms.

25. Contact

For questions about these Terms, contact: legal@pendulum.clinic