Legal

Terms of Service

Effective date: July 5, 2026

These Terms of Service (“Terms”) govern your use of Clinic Tabletop, the website at clinictabletop.com, and the exercises, reports, and related services we provide (together, the “Service”). By creating an account or using the Service, you agree to these Terms on behalf of yourself and, if you are using the Service for a clinic or other organization, on behalf of that organization.

1. What the Service is

Clinic Tabletop provides facilitated cybersecurity tabletop exercises designed for small healthcare organizations, along with after-action reports documenting each exercise. The Service is a training and preparedness tool.

2. What the Service is not

The Service does not provide legal, regulatory, compliance, insurance, or professional security advice, and nothing in the Service — including scenario content, coaching notes, scoring, citations, and after-action reports — is a substitute for advice from a qualified attorney, compliance professional, or security practitioner engaged for your specific situation. Completing exercises does not make your organization compliant with HIPAA or any other law, does not guarantee any audit, assessment, enforcement, or insurance outcome, and does not establish that your organization meets any particular standard of care. References to laws and frameworks (such as HIPAA or NIST CSF 2.0) are educational framing, not legal interpretation.

3. No patient data

The Service is not designed or intended to receive protected health information (PHI) or any patient data. Exercises are simulations: you must not enter real patient names, records, or other identifying patient information anywhere in the Service. Clinic Tabletop is not your business associate under HIPAA, and no business associate agreement is formed by use of the Service. If you include patient information in free-text fields against this instruction, you do so at your own risk and in violation of these Terms.

4. Accounts

You must provide accurate account information and keep control of your sign-in method (email or Google account). You are responsible for activity under your account. You must be at least 18 years old and using the Service for business purposes.

5. Subscriptions and billing

The Service is offered on a flat per-organization subscription covering all of your organization’s locations, billed monthly or annually through Stripe, our payment processor. Subscriptions renew automatically until canceled. You can switch plans, update payment details, or cancel at any time through the billing portal in your account; cancellation takes effect at the end of the current billing period, and except where required by law, payments are non-refundable. Prices may change with notice; changes apply at your next renewal. Promotional codes are subject to the terms stated when offered. We may provide complimentary access to some accounts at our discretion.

6. Acceptable use and fair use

You agree not to misuse the Service, including by attempting to access other customers’ data, probing or disrupting the Service, accessing the Service through scripts or other automated means, reselling or sublicensing access, scraping or bulk-extracting scenario content, using the Service to develop a competing product, or using it for any unlawful purpose.

Subscriptions include unlimited ordinary use, subject to fair-use limits designed to prevent automated abuse. These limits are set far above any clinic’s genuine exercise activity, and we will not enforce them against real use without talking to you first — if your clinic ever hits one legitimately, contact support and we will raise it at no charge.

7. Your content and ours

You own the information you enter (your clinic profile, participants, and exercise responses) and your exercise records and after-action reports are yours to keep, print, and share. We own the Service itself, including the scenario library, exercise engine, software, and design. We use the information you enter to operate the Service, as described in our Privacy Policy.

8. Availability and changes

We work to keep the Service available and improve it over time, and we may add, change, or remove features (including scenarios). We do not guarantee uninterrupted availability. We may suspend or terminate accounts that violate these Terms.

9. Disclaimer of warranties

The Service is provided “as is” and “as available,” without warranties of any kind, express or implied, including fitness for a particular purpose, non-infringement, and accuracy of content. Exercise narration and evaluation are generated in part by artificial intelligence and may contain errors.

10. Limitation of liability

To the maximum extent permitted by law, Clinic Tabletop will not be liable for indirect, incidental, special, consequential, or punitive damages, or for lost profits, revenues, data, or business opportunities, arising from or related to the Service. Our total liability for all claims relating to the Service is limited to the amount you paid us in the twelve months before the event giving rise to the claim.

11. Indemnity

You will indemnify and hold Clinic Tabletop harmless from claims arising out of your violation of these Terms, including the entry of patient data into the Service contrary to Section 3.

12. Governing law

These Terms are governed by the laws of the Commonwealth of Kentucky, without regard to conflict-of-law rules, and disputes will be resolved in the state or federal courts located in Kentucky.

13. Changes to these Terms

We may update these Terms from time to time. If we make material changes, we will post the updated Terms with a new effective date and, for significant changes, notify you by email or in the Service. Continued use after changes take effect constitutes acceptance.

14. Contact

Questions about these Terms? Reach us through the support page.