@soleur/opencode 0.0.0-stage → 3.354.2

package/skills/legal-generate/references/templates/business-associate-agreement/template.md

@@ -0,0 +1,112 @@
+<!-- Adapted from General-Legal/legal-templates (CC0-1.0) — see NOTICE -->
+**Business Associate Addendum**
+This Business Associate Addendum ("BAA") is made and entered into between <mark>[LEGAL NAME OF COMPANY]</mark>, a <mark>[STATE OF INCORPORATION OF COMPANY]</mark> company ("Company") and the entity listed in the signature block ("Customer") as an addendum to the existing services agreement in place between Customer and Company (the "Services Agreement"). The Services Agreement governs Customer's use of the <mark>[cloud-based software services]</mark> made available by Company (the "Services") and prohibits Customer from utilizing the Services in a manner that would result in Company Processing any Protected Health Information without Company's prior written consent.
+Customer, as a Covered Entity or Business Associate under the Health Insurance Portability and Accountability Act (HIPAA), now desires to utilize certain HIPAA-Eligible Services that can be configured by Customer to Process Protected Health Information. Subject to Customer's purchase of HIPAA-Eligible Services under the Services Agreement and application of required security configurations, Company hereby consents to Customer's use of the HIPAA-Eligible Services for the Processing of Protected Health Information. Customer acknowledges that this BAA does not apply to any Services that are not designated as HIPAA-Eligible Services or to any accounts Customer, or its personnel, may create with Company, now or in the future, that are outside the scope of the Services Agreement.
+This BAA will take effect from the effective date of the first executed ordering document for HIPAA-Eligible Services between Company and Customer.
+
+# Definitions For the purposes of this BAA, capitalized terms shall have the meanings ascribed to them in Appendix A. Any capitalized terms used herein but not defined in Appendix A will have the meanings ascribed to them under HIPAA or the Services Agreement, respectively.
+
+# Application This BAA shall only apply to HIPAA-Eligible Services purchased under the Services Agreement in an ordering document that expressly references and applies this BAA, and only to the extent that Customer is a Covered Entity or Business Associate.
+
+# Required Uses and Disclosures Company may Process PHI: (a) for or on behalf of Customer to provide the HIPAA-Eligible Services as specified in the Services Agreement; and (b) as necessary for the proper management and administration of its business, provided that any disclosures of PHI by Company for this purpose are subject to reasonable assurances from the recipient that all such PHI will be held in confidence, only be used in accordance with Applicable Law and for the purpose for which it was disclosed to the recipient, and that recipient will notify Company of any instances in which the confidentiality of the PHI has been breached.
+
+# Obligations of Company
+
+Limitations on Use and Disclosure.
+
+Company, its agents and its subcontractors shall: (i) not use or disclose PHI other than as permitted or required by this BAA or Applicable Law; (ii) not use or disclose PHI in any manner that violates Applicable Law; and (iii) only use or disclose the minimum amount of PHI necessary to provide the HIPAA-Eligible Services or to carry out Company's legal responsibilities.
+
+Company is permitted, for Data Aggregation purposes to the extent permitted under HIPAA, to use, disclose, and combine PHI received from, or on behalf of, Customer by Company pursuant to this BAA with PHI, as defined by 45 C.F.R. 160.103, received by Company in its capacity as a Business Associate of other Covered Entities, to perform data analyses relating to the health care operations of the respective Covered Entities and/or Customer.
+
+Company may delete, de-identify PHI, or further Secure PHI rendering it unusable and not easily recoverable, when it is no longer useful or necessary to accomplish the purpose for which it was collected, or in accordance with the retention schedule agreed by the parties.
+
+Specific Use and Disclosures. Company may use PHI for the proper management and administration of Company's services or to carry out the legal responsibilities of Company. Company may use PHI to create de-identified health information in accordance with 45 C.F.R. 164.514(a)-(c) for the purpose of improving its AI services; Company shall ensure that its AI services do not store or retain PHI beyond what is necessary for the immediate interaction, unless explicitly authorized by the Covered Entity.
+Safeguards. Company shall employ appropriate administrative, technical, and physical safeguards designed to protect the confidentiality, integrity, and availability of PHI and prevent the use or disclosure of PHI in any manner inconsistent with the terms of this BAA or the Services Agreement. Company shall further comply with its obligations under the HIPAA Rules relating to the treatment of electronic PHI, including Subpart C of 45 C.F.R. Part 164.
+Secretary Audits. Company shall, in accordance with HIPAA, make available to Customer and the Secretary its documented internal practices and records relating to the Processing of PHI on behalf of Customer under this BAA to the extent necessary for Customer to satisfy its reporting and audit obligations to the Secretary.
+Reporting. Customer acknowledges that Company will not Process any directly identifying information about the identities of Individuals other than certain limited device identifiers like IP address and that it may not be possible for Company to provide this information after it has been deleted, de-identified, or further Secured in accordance with Section 4.1(c). As such, and in relation to all reporting obligations under this BAA, Company will only be obligated to provide the limited device identifiers it Processes in the course of providing the HIPAA-Eligible Services when reporting on the identities of any Individuals who may have been affected by a Security Incident or Breach.
+Designated Record Set. Notwithstanding anything to the contrary contained herein, Customer acknowledges that Company does not create or maintain a Designated Record Set on behalf of Customer in the course of providing the HIPAA-Eligible Services.
+Requests for Production or Amendment.
+
+If any Individual requests access to, or amendment of PHI or an accounting of disclosures directly from Company, Company will deny the request as invalid and redirect the Individual to submit its requests to Customer.
+
+Customer will be responsible for making all determinations regarding the grant or denial of an Individual's request for access to, or the amendment of PHI and Company will make no such determinations. Except as otherwise required by law, only Customer will be responsible for releasing PHI to an Individual pursuant to a request for access to PHI. Any denial of access to PHI determined by Customer pursuant to 45 CFR Section 164.524 or 45 CFR Section 164.526 (as applicable), and conveyed to Company by Customer, shall be the responsibility of Customer, including resolution or reporting of all appeals and/or complaints arising from such denial.
+
+Company will make available to Customer the information reasonably necessary for Customer to respond to a request for an accounting of disclosures in accordance with 45 CFR Section 164.528. The requested information may include: (1) the date of the disclosure; (2) the name of the entity or person who received the PHI, and if known, the address of such entity or person; (3) a brief description of the PHI disclosed; and (4) a brief statement of the purpose of such disclosure.
+
+Subcontractors. In accordance with 45 CFR § 164.502(e)(1)(ii) and 45 CFR § 164.308(b)(2), and to the extent that Company discloses PHI to a subcontractor, Company will obtain and maintain a written agreement with each such subcontractor that ensures the confidentiality and reasonable protection of PHI and passes through substantially similar restrictions and obligations as those that apply to Company under this BAA.
+
+Security Incidents & Breaches.
+
+If Company becomes aware of any use or disclosure of PHI not provided for by this BAA, then Company will report such use or disclosure to Customer without unreasonable delay and in no case later than 30 calendar days after discovery of a Breach. Company also agrees to report any successful Security Incident to Customer, within the meaning of 45 CFR 164.304, no later than 30 calendar days of becoming aware of the Security Incident if it is not otherwise reported to Customer pursuant to 4.9(b) below.
+Company agrees to report any Breach of Customer's Unsecured PHI in accordance with the requirements set forth in 45 CFR 164.400 et seq. as soon as is reasonably practicable, but in no event later than thirty (30) calendar days after it is discovered. A Breach report will include the following information: (i) a brief description of what happened, including the date of the Breach (if known) and the date of discovery; (ii) the identities or related identifiers of the individuals affected, if known; (iii) a brief description of the data elements involved in the Breach; and (iv) a brief description of the efforts Company is undertaking to investigate, mitigate, and resolve the Breach and any preventative measures being taken to prevent its recurrence. If the necessary information is not available to Company at the time of a Breach, then Company will continue to work diligently to investigate the Breach and will provide the information to Customer as it becomes available. Company shall maintain complete records regarding a Breach for the required period under 45 CFR 164.530(j) or such longer period as may be required under Applicable Law and will make such records available to Customer within a reasonable time upon Customer's written request.
+In the event of an Incident caused by, or arising from, an act or omission of Company, or any subcontractor of Company, Company shall, where requested by Customer, provide the required notifications under 45 CFR 164.404 and 45 CFR 164.406.
+The parties acknowledge that unsuccessful Security Incidents (e.g., pings and other broadcast attacks on a firewall, denial of service attacks, port scans, unsuccessful login attempts, or other security incidents that do not result in the unauthorized use, disclosure, modification, or destruction of Customer's PHI) occur within the normal course of business and the parties stipulate and agree that this paragraph constitutes notice by Company to Customer for such unsuccessful Security Incidents satisfying the notice requirement of the HIPAA Rules.
+
+# Customer Obligations
+
+Customer <mark>agrees that: (i) it shall comply with its obligations as a Covered Entity under Applicable Law(s) with respect to its use of the HIPAA-Eligible Services; (ii) it has provided notice and obtained (or shall obtain) all necessary consents (including without limitation, verifiable consent) and rights necessary under Applicable Law(s) for Company to Process any PHI transmitted to Company while providing the </mark>HIPAA-Eligible <mark>Services; (iii) it shall not transmit PHI to, or store PHI with, Company through any means other than through enabled HIPAA-Eligible Services to which this BAA applies; and (iv) it is solely responsible for configuring its HIPAA-Eligible Services in accordance with the HIPAA Rules.</mark>
+
+Customer shall limit its transmission and storage of PHI to Company through the HIPAA-Eligible Services to the minimum extent necessary in accordance with 45 C.F.R. §164.502(b).
+
+Customer shall notify Company of any limitations in its privacy practices under 45 C.F.R. §164.520, to the extent that such limitations may affect Company's ability to provide the HIPAA-Eligible Services or to use or disclose PHI.
+
+Customer shall notify Company of any changes in permissions granted by an Individual, or restrictions on the use or disclosure of their PHI under 45 C.F.R. §164.522, to the extent that such changes or restrictions affect Company's provision of the HIPAA-Eligible Services or use or disclosure of PHI.
+
+Customer shall not configure the HIPAA-Eligible Services in a manner that will cause Company to use or disclose PHI in any way that is impermissible under the HIPAA Rules.
+
+# Term and Termination
+
+Upon any termination or expiration, Company's consent to the storage and transmission of PHI as provided for herein shall be immediately revoked. The obligations of Company under this BAA shall survive termination or expiration to the extent that Company retains any PHI, and shall continue until Company has completed its obligations under Section 6.3 and all PHI has been returned or destroyed in accordance therewith. Sections of this BAA that by their nature should survive termination -- including without limitation those relating to confidentiality, breach notification for pre-termination incidents, record retention, and subcontractor obligations -- shall so survive.
+
+In the event Customer downgrades any of its HIPAA-Eligible Services to a service or product offering that is not HIPAA-Eligible, then Company's consent to the transmission and storage of PHI through the Services shall be immediately revoked and, subject to Company's completion of its obligations under Section 6.3, all obligations of Company under this BAA shall terminate; provided, however, that obligations of Company that by their nature should survive, including those relating to confidentiality, breach notification for pre-downgrade incidents, and record retention, shall so survive until Company has completed its obligations under Section 6.3.
+
+Upon the termination of the Services Agreement for any reason or downgrading of the Services to any non-HIPAA-Eligible Service offering, Company shall, upon receipt of a written request from Customer, either return or destroy all of Customer's PHI in its possession within sixty (60) days. Customer may request, and Company will provide, a written certification verifying that the return or destruction is complete.
+
+# General
+
+Amendment. If any of the regulations promulgated under HIPAA or the HITECH Act are amended or interpreted in a manner that renders this BAA inconsistent therewith, the parties shall cooperate in good faith to amend this BAA to the extent necessary to comply with such amendments or interpretations.
+Interpretation. Any ambiguity in this BAA shall be resolved to permit the parties to comply with HIPAA and the HITECH Act.
+Indemnification and Limitation of Liability. The parties agree and acknowledge that the indemnification obligations and limitation of liability provisions contained under the Services Agreement shall apply and govern each party's performance under this BAA.
+Conflicting Terms. In the event that any terms of this BAA conflict with any terms of the Services Agreement, the terms of this BAA shall govern and control over the conflicting term in the Services Agreement. All other non-conflicting terms of the Services Agreement shall remain valid and enforceable.
+**IN WITNESS WHEREOF,** the parties have caused this BAA to be signed by their authorized representatives.
+
+---
+**Signature Block**
+
+- [LEGAL NAME OF CUSTOMER]
+**Company**
+- By:   Printed Name:   Title:
+- Address for notices:  [CUSTOMER ADDRESS] With copy to: [CUSTOMER EMAIL]
+- Address for notices:  [COMPANY ADDRESS] With copy to: [COMPANY EMAIL]
+
+---
+
+**Appendix A (Definitions)**
+
+# "Applicable Law" means any national, state, or local laws, rules, regulations, and regulatory guidance applicable to either party's performance under the Services Agreement.
+
+# "Breach" shall have the meaning ascribed to it under the HIPAA Rules (45 CFR 164.402).
+
+# "HIPAA" means the Health Insurance Portability and Accountability Act of 1996, as amended by Subtitle D of the 2009 Health Information Technology for Economic and Clinical Health (HITECH) Act, and their implementing regulations.
+
+# "HIPAA Rules" means the Privacy, Security, and Breach Notification and Enforcement Rules at 45 CFR Part 160 and Part 164.
+
+# "HIPAA-Eligible Services" means the products and services listed in an ordering document that: (1) expressly references being governed by this BAA; and (2) expressly identifies the services as being "HIPAA-Eligible services" or "Advanced Compliance services", regardless of whether they are purchased individually or as a part of a service package.
+
+# "Incident" means any use or disclosure of PHI not provided for in this BAA, any Breach, or any successful Security Incident involving the PHI of Customer that Company, or any subcontractor of Company, becomes aware of.
+
+# "Individual" shall have the meaning ascribed to it under 45 CFR 160.103 and shall include a person who qualifies as a personal representative in accordance with 45 CFR 164.502(g) or other applicable federal or state law.
+
+# "Process" means any operation or set of operations that are performed on information or on sets of information, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
+
+# "Protected Health Information" or "PHI" shall have the meaning ascribed to it in 45 CFR 160.103, but is limited to information Processed for, or on behalf of, Customer while providing HIPAA-Eligible Services.
+
+# "Secure" means to render unusable, unreadable, or indecipherable to unauthorized individuals through the use of a technology or methodology specified by the Secretary in the guidance issued under section 13402(h)(2) of the Health Information Technology for Economic and Clinical Health Act (the "Guidance"), as updated from time to time, which, in the case of electronic information, requires that it be encrypted in accordance with certain standards specified in the Guidance.
+
+# "Security Incident" means any access, use, disclosure, modification, transmission, or destruction, of PHI that is not authorized under the Services Agreement, this BAA, or is otherwise permissible under the HIPAA Rules.
+
+# "Unsecured PHI" means PHI that is not rendered unusable, unreadable, or indecipherable to unauthorized persons through the use of a technology or methodology specified by the Secretary in the Guidance.
+
+--- 
+
+This template was prepared and made publicly available by General Legal, PC ("General Legal"). It is provided for general reference purposes only and does not constitute, and should not be construed as, legal advice, or an endorsement or review of any particular transaction in which it is used. Use of this template does not create an attorney-client relationship with General Legal. General Legal has not reviewed, and takes no position on, any modifications made to this document or the deal terms it is used to document.

package/skills/legal-generate/references/templates/cookie-notice/template.md

@@ -0,0 +1,82 @@
+<!-- Adapted from General-Legal/legal-templates (CC0-1.0) — see NOTICE -->
+**Cookie Notice**
+
+This Cookie Notice explains how [<mark>CompanyName</mark>] ("**[<mark>CompanyName</mark>]**", "**we**", "**us**" or "**our**") uses cookies and similar technologies in connection with the [<mark>website</mark>] website and any other website that we own or control and which posts or links to this Cookie Notice (collectively, the "**Sites**")[<mark>; and our mobile app (App)</mark>].
+
+**What are cookies?**
+
+Cookies are small data files that are placed on your computer or mobile device when you visit a website. Cookies serve different purposes, like helping us understand how a site is being used, letting you navigate between pages efficiently, remembering your preferences, and generally improving your browsing experience.
+
+Our Sites may use both session cookies (which expire once you close your web browser) and persistent cookies (which stay on your computer or mobile device until you delete them).
+
+We use two broad categories of cookies: (1) first party cookies, served directly by us to your computer or mobile device, which we use to recognize your computer or mobile device when it revisits our Sites; and (2) third-party cookies, which are served by service providers or business partners on our Sites, and can be used by these parties to recognize your computer or mobile device when it visits other websites. Third-party cookies can be used for a variety of purposes, including site analytics, advertising, and social media features.
+
+**What types of cookies and similar tracking technologies do we use on the Sites [**<mark>and App</mark>**]?**
+
+On the Sites, we use cookies and other tracking technologies in the following categories described in the table below.
+
+| Type | Description | Who serves the cookies (link to privacy policy/site) | How to control them |
+| --- | --- | --- | --- |
+| Advertising | These cookies are used by advertising companies to collect information about how you use our Sites and other websites over time. These companies use this information to show you ads they believe will be relevant to you within our services and elsewhere, and to measure how the ads perform. | [ADD] | [ADD] |
+| Analytics | These cookies help us understand how our services are performing and being used. These cookies may work with web beacons included in emails we send to track which emails are opened and which links are clicked by recipients. | [ADD] | [ADD] |
+| Essential | These cookies are necessary to allow the technical operation of our services (e.g., they enable you to move around on a website and to use its features). | [ADD] | [ADD] |
+| Functionality / performance | Enhance the performance and functionality of our services. | [ADD] | [ADD] |
+| Social | These cookies may allow you to log into the Sites or App through your social media account or share content in our sites that you find interesting through third-party social media providers. These cookies may also be used for advertising purposes. | [ADD] | [ADD] |
+
+**Other technologies**
+
+In addition to cookies, our Sites may use other technologies, such as Flash technology and pixel tags to collect information automatically.
+
+*Browser Web Storage*
+
+We may use browser web storage (including via HTML5), also known as locally stored objects ("LSOs"), for similar purposes as cookies. Browser web storage enables the storage of a larger amount of data than cookies. Your web browser may provide functionality to clear your browser web storage.
+
+*Flash Technology*
+
+We may use Flash cookies (which are also known as Flash Local Shared Object ("Flash LSOs")) on our Sites to collect and store information about your use of our Sites. Unlike other cookies, Flash cookies cannot be removed or rejected via your browser settings. If you do not want Flash LSOs stored on your computer or mobile device, you can adjust the settings of your Flash player to block Flash LSO storage using the tools contained in the Website Storage Settings Panel. You can also control Flash LSOs by going to the Global Storage Settings Panel and following the instructions. Please note that setting the Flash Player to restrict or limit acceptance of Flash LSOs may reduce or impede the functionality of some Flash applications, including, potentially, Flash applications used in connection with our Sites.
+
+*Web Beacons*
+
+We may also use web beacons (which are also known as pixel tags and clear GIFs) on our Sites and in our HTML formatted emails to track the actions of users on our Sites and interactions with our emails. Unlike cookies, which are stored on the hard drive of your computer or mobile device by a website, pixel tags are embedded invisibly on webpages or within HTML formatted emails. Pixel tags are used to demonstrate that a webpage was accessed or that certain content was viewed, typically to measure the success of our marketing campaigns or engagement with our emails and to compile statistics about usage of the Sites, so that we can manage our content more effectively.
+
+*Mobile Application Software Development Kits (SDKs)*
+
+We may use third-party software development kits ("SDKs") in our mobile applications. An SDK is third-party computer code that may be used for a variety of purposes, including providing us with analytics regarding the use of our mobile applications, to integrate with social media, add features or functionality to our app, or to facilitate online advertising. SDKs may enable third parties to collect information directly via our App.
+
+*Session-replay technologies*
+
+We may use products and services provided by [<mark>FullStory</mark>] that employ software code to record users' interactions with the Services in a manner that allows us to watch DVR-like replays of those user sessions. The replays include users' clicks, mobile app touches, mouse movements, scrolls [and keystrokes/key touches] during those sessions. These replays help us diagnose usability problems and identify areas for improvement. [<mark>You can learn more about FullStory and opt out of session recording by FullStory at .]</mark>
+
+# Your choices
+
+Your options for controlling what information cookies and similar technologies collect about you include:
+1. <mark>[Cookie Preference Dashboard. You can change the cookie settings when you visit our Sites via our Cookie Banner that is displayed to you when you first visit our Sites, or at any time by visiting the Cookie Dashboard [hyperlink]. Our Cookie Banner and Cookie Dashboard allow you to accept, refuse or manage the settings of all or some cookies:</mark>
+    1. <mark>Strictly necessary cookies do not require your consent. </mark>
+    2. <mark>When we deploy other cookies, you have the possibility to either accept or reject all cookies, or to allow the deployment of the categories of cookies you prefer, by clicking on the appropriate button (i.e. "accept all", "reject all" or "manage my settings").</mark>]
+2. **Blocking cookies in your browser.** Most browsers let you remove or reject cookies. To do this, follow the instructions in your browser settings. Many browsers accept cookies by default until you change your settings. Please note that if you set your browser to disable cookies, the Sites may not work properly. For more information about cookies, including how to see what cookies have been set on your device and how to manage and delete them, visit . If you do not accept our cookies, you may experience some inconvenience in your use of our Sites. For example, we may not be able to recognize your computer or mobile device and you may need to log in every time you visit our Sites.
+3. **Blocking images/clear gifs**: Most browsers and devices allow you to configure your device to prevent images from loading. To do this, follow the instructions in your particular browser or device settings.
+4. **Third-party opt-out option**. You can opt out of interest-based advertising through some of the third parties listed in the chart above by using the corresponding third-party opt-out tool provided in the chart.
+5. **Industry association opt-outs**. You may opt out of receiving interest-based advertising on websites through members of the Network Advertising Initiative by clicking or the Digital Advertising Alliance by clicking . You may opt out of receiving targeted advertising in mobile apps through participating members of the Digital Advertising Alliance by installing the AppChoices mobile app, available , and selecting the user's choices. Please note that we also may work with companies that offer their own opt-out mechanisms and may not participate in the opt-out mechanisms linked above.
+6. **Blocking advertising ID use in your mobile settings**. Your mobile device settings may provide functionality to limit use of the advertising ID associated with your mobile device for interest-based advertising purposes.
+
+For more information about cookies, including how to see what cookies have been set on your computer or mobile device and how to manage and delete them, visit . If you do not accept our cookies, you may experience some inconvenience in your use of our Sites. For example, we may not be able to recognize your computer or mobile device and you may need to log in every time you visit our Sites.
+
+If you choose to opt out of targeted advertisements, you will still see advertisements online, but they may not be relevant to you. Even if you do choose to opt out, not all companies that serve online behavioral advertising are included in this list, and so you may still receive some cookies and tailored advertisements from companies that are not listed.
+
+You will need to apply these opt-out settings on each device and browser from which you wish to limit the use of your information for interest-based advertising purposes
+
+For more information about how we collect, use and share your information, see our <mark>Privacy Policy.</mark>
+
+# Changes
+
+Information about the cookies we use may be updated from time to time, so please check back on a regular basis for any changes.
+
+# Questions
+
+If you have any questions about this Cookie Notice, please contact us by email at <mark>[EMAIL].</mark>
+
+Last modified <mark>[INSERT DATE]</mark>.
+
+---
+
+This template was prepared and made publicly available by General Legal, PC ("General Legal"). It is provided for general reference purposes only and does not constitute, and should not be construed as, legal advice, or an endorsement or review of any particular transaction in which it is used. Use of this template does not create an attorney-client relationship with General Legal. General Legal has not reviewed, and takes no position on, any modifications made to this document or the deal terms it is used to document.