Developer & API Use Policy

1.1 Who This Applies To: This Policy applies to customers, integration partners, and developers who build applications or integrations that connect to the CoOrdio platform ("you").

1.2 Order of Precedence: This Policy supplements the Terms of Service. If you have a signed Customer Agreement or integration partner agreement, that agreement controls where it conflicts with this Policy. The Business Associate Agreement (BAA) controls with respect to Protected Health Information (PHI).

2.1 Requirements: To access CoOrdio APIs, you must:

• be at least 18 years old and have authority to bind the organization on whose behalf you use the APIs;
• have an active CoOrdio customer account or a signed integration partner agreement with OpenBots;
• be located in, and operate your integration from, the United States unless OpenBots approves otherwise in writing; and
• have a BAA in place with OpenBots, and with each covered entity whose data you access, before your integration accesses or processes PHI.

3.1 Authentication: Access to CoOrdio APIs is controlled through API keys and OAuth 2.0 tokens issued by OpenBots. Credentials are confidential and are issued to you, not to your users or third parties.

3.2 Your Responsibilities: You are responsible for all activity that occurs with your credentials. You must:

• store credentials in a secrets manager or equivalent secure store, never in source code, client-side applications, logs, or public repositories;
• use separate credentials for sandbox, staging, and production environments;
• request only the scopes your integration needs and restrict access to the personnel who need it;
• rotate credentials periodically and immediately revoke and replace any credential you suspect has been exposed; and
• notify security@coordio.com promptly of any suspected compromise.

3.3 Sandbox Data: Sandbox and test environments must use synthetic or de-identified data only. Never load real PHI or real payment card data into a sandbox environment.

4.1 Permitted Uses: You may use CoOrdio APIs only for lawful purposes in accordance with this Policy, including to:

• build integrations that extend or complement CoOrdio healthcare revenue cycle capabilities, such as eligibility, prior authorization, document capture, claims, and payment workflows;
• connect EHR, practice management, and other systems used by your organization or by customers who have authorized you;
• automate workflows on behalf of your organization or authorized customers; and
• develop and test integrations in sandbox environments.

5.1 Prohibited Conduct: You must not use CoOrdio APIs to:

• submit false, fraudulent, upcoded, or misleading claims or data, or otherwise violate the False Claims Act, the Anti-Kickback Statute, or payer rules;
• access, collect, or process data beyond what the customer has authorized and the minimum necessary for your integration;
• sell, rent, or broker data obtained through the APIs, or use PHI or patient data for advertising or marketing;
• reverse engineer, decompile, or attempt to extract source code, prompts, model weights, or training data;
• use API responses or AI Output to train, fine-tune, or benchmark a competing product or AI model;
• circumvent authentication, scopes, rate limits, or other security controls, or attempt prompt injection or other manipulation of CoOrdio AI agents;
• scrape, crawl, or bulk-export data except through documented API endpoints;
• resell, sublicense, or white-label access to CoOrdio APIs without written permission from OpenBots;
• conduct load testing, security testing, or benchmarking against production environments without prior written approval; or
• use the APIs in violation of HIPAA, the HITECH Act, 42 CFR Part 2, PCI DSS, the TCPA, or any other applicable law.

6.1 Protected Health Information: CoOrdio APIs may transmit or provide access to PHI. If your integration creates, receives, maintains, or transmits PHI, you must comply with HIPAA and the BAA, use and disclose PHI only as the customer has authorized, and apply the minimum necessary standard.

6.2 Security Requirements: Your integration must maintain administrative, technical, and physical safeguards at least as protective as those described in our Security Policy at coordio.health/security, including:

• encryption of data in transit using TLS 1.2 or higher and encryption of stored PHI using AES-256 or an equivalent standard;
• access controls, multi-factor authentication for administrative access, and audit logging of access to PHI;
• secure development practices, vulnerability management, and timely patching; and
• storing, processing, and transmitting PHI only within systems located in the United States that meet these requirements, unless the customer and OpenBots approve otherwise in writing.

6.3 Payment Card Data: If your integration handles payment card data, you must comply with PCI DSS, must not store sensitive authentication data after authorization, and should use the tokenized payment methods provided by OpenBots or its PCI DSS validated payment processors instead of handling full card numbers.

6.4 Incident Reporting: You must report any suspected security incident, unauthorized access, or breach involving CoOrdio APIs, credentials, PHI, or payment card data to security@coordio.com within twenty-four (24) hours of discovery, and cooperate with OpenBots and affected customers in investigating and responding to it.

6.5 Retention and Deletion: Retain data obtained through CoOrdio APIs only as long as needed for the customer-authorized purpose, and securely delete it when your integration is disabled, the customer revokes authorization, or your agreement ends.

6.6 Compliance Responsibility: OpenBots's HIPAA compliance, SOC 2 attestation, and PCI DSS compliance apply to the systems OpenBots operates. They do not extend to your applications or infrastructure, and you are solely responsible for the compliance and security of your integration.

7.1 AI Output: Some CoOrdio APIs return AI Output, such as document classifications, extracted data, eligibility and benefits interpretations, and recommendations. AI Output can be inaccurate. If your integration acts on AI Output automatically, you must implement appropriate validation and human review, and you are responsible for the results.

7.2 Untrusted Inputs: Treat content you send to CoOrdio AI features, and content returned from them, as untrusted. Do not use AI Output to execute code, change permissions, or move funds without validation.

8.1 Rate Limits: OpenBots enforces rate limits and usage quotas to protect platform stability. Limits vary by plan and integration tier. You must respect limits communicated in HTTP response headers (for example, X-RateLimit-Limit and X-RateLimit-Remaining), implement exponential backoff and retry logic, and contact partners@coordio.com before you expect to exceed your limits.

8.2 Versioning and Deprecation: OpenBots may modify, version, deprecate, or discontinue APIs. We will give reasonable advance notice of breaking changes to generally available APIs, except where a change is needed for security, legal, or payer requirements. Beta and preview APIs may change without notice.

8.3 Monitoring: OpenBots monitors API usage to operate, secure, and improve the platform and to verify compliance with this Policy.

9.1 Use of Our Marks: If you offer a publicly available application or integration that uses CoOrdio APIs, you must accurately disclose that it connects to CoOrdio. You may not use the CoOrdio or OpenBots names, logos, or brand assets in a way that suggests endorsement, certification, or partnership without written permission from OpenBots.

10.1 Suspension and Termination: OpenBots may suspend or revoke API access immediately if we reasonably believe your use violates this Policy, the Terms of Service, or law, or threatens the security of the platform, our customers, or patients. On termination you must stop using CoOrdio APIs, delete your credentials, and delete or return data obtained through them as required by Section 6.5 and the BAA.

11.1 As Is: CoOrdio APIs are provided subject to the warranty disclaimers, limitation of liability, indemnification, dispute resolution, and governing law (Delaware) provisions of the Terms of Service, which apply to your use of the APIs.

12.1 Updates: We may update this Policy from time to time. The version and "Last Updated" date at the top of this page show when it was last changed. Material changes will be communicated to registered developers by email.

13.1 Mailing Address: OpenBots Inc. Attn: Developer Relations - Coordio Healthcare Platform 440 Sawgrass Corporate Expressway, Suite 210 Sunrise, FL 33325 United States

13.2 Email: API access and quotas: partners@coordio.com Security incidents and vulnerabilities: security@coordio.com Compliance questions: compliance@coordio.com Legal notices: legal@openbots.ai