Master Services Agreement (Template)
Standard terms for pilot and ongoing engagements. Covers scope, fees, IP ownership, confidentiality, liability caps, termination.
Request MSA template →Legal
Agreement templates, privacy, and data processing.
Our legal framework is designed for regulated life sciences environments. Templates available for review — finalized agreements executed per engagement.
Templates provided for review. Final agreements customized per engagement.
Available Agreement Templates
Templates provided for review — finalized agreements customized per engagement.
Data Processing Agreement (Template)
GDPR Art. 28 compliant. Covers subprocessors, data subject rights, breach notification, international transfers, audit rights.
Request DPA template →Business Associate Agreement (Template)
HIPAA-compliant BAA for customers requiring it. Covers permitted uses, safeguards, breach notification, termination.
Request BAA template →Mutual NDA (Template)
Standard mutual confidentiality agreement for evaluation discussions. 2-year term, standard carveouts.
Request NDA template →Privacy Policy (Template)
Last updated: July 2025. Next review: January 2026.
Template provided for review — finalized per engagement.
1. Data Controller
NextConsensus, Inc. (Delaware corporation). Contact: [email protected]
2. Personal Data We Process
We process minimal personal data:
- Contact form submissions: Name, work email, organization, submitted claim context (voluntary)
- Authentication data: Email, IdP attributes (via OIDC/SAML) for platform users
- Usage analytics: Aggregated, pseudonymous platform usage (no PII)
We do not process PHI, sensitive health data, or proprietary clinical data.
3. Lawful Basis
- Contract performance (Art. 6(1)(b)): Platform access, assessment delivery
- Legitimate interest (Art. 6(1)(f)): Security, fraud prevention, product improvement
- Consent (Art. 6(1)(a)): Marketing communications (opt-in only)
3. Data Subject Rights
You may exercise: Access, Rectification, Erasure, Restriction, Portability, Objection. Submit via contact form or [email protected]. Response within 30 days.
4. International Transfers
Infrastructure on Cloudflare (US/EU). Standard Contractual Clauses (2021) for US-EU transfers. EU data residency available via regional routing.
5. Retention
- Contact form data: 2 years from last interaction
- Platform user data: Duration of contract + 7 years (regulatory)
- Analytics: 13 months aggregated, then deleted
6. Security
See Security & Compliance for SOC 2, encryption, access controls, incident response.
Terms of Service (Template)
Last updated: July 2025. Next review: January 2026.
Template provided for review — finalized per engagement.
1. Service Description
NextConsensus provides evidence-sensitive claim support intelligence: ranked re-review lists and claim-specific assessments for approved claims, based on public evidence sources and customer-provided claim text.
2. Customer Responsibilities
- Provide accurate, approved claim text and use context
- Designate qualified reviewers for assessment review
- Maintain authority over final disposition decisions
- Comply with applicable laws, regulations, and promotional review requirements
3. Intellectual Property
- Customer owns: Claim text, use context, reviewer decisions, internal documents
- NextConsensus owns: Assessment methodology, evidence mapping, platform, Refract engine
- Assessments: Joint work product — customer may use internally, NextConsensus may use aggregated/anonymized for model improvement
4. Confidentiality
Mutual. 2-year obligation post-termination. Standard carveouts (public domain, independent development, legal compulsion).
5. Liability
- Cap: Fees paid in prior 12 months (excluding pilot/free tier)
- Exclusions: Indirect, consequential, punitive damages
- No liability for: Customer reviewer decisions, regulatory outcomes, clinical judgments
6. Warranty Disclaimer
Assessments are evidence-impact analyses, not clinical, legal, or regulatory judgments. No warranty of clinical truth, regulatory outcome, or commercial result.
7. Term & Termination
- Pilot: Per pilot agreement (typically 90 days)
- Ongoing: Annual, auto-renew unless 60-day notice
- Termination for cause: 30-day cure period
- Data return/deletion: 30 days post-termination
8. Governing Law
Delaware law, exclusive jurisdiction Delaware state/federal courts. GDPR Art. 27 EU representative designated.
Data Processing Agreement (DPA) — Summary
Full DPA available on request. Key terms:
Roles
Customer = Controller. NextConsensus = Processor.
Processing Scope
Claim text, use context, evidence sources → Assessments. No PHI/PII.
Subprocessors
Cloudflare (infrastructure). Written notice 30 days before new subprocessor. Objection right.
Security
SOC 2 Type II (in progress), encryption at rest/in transit, access controls, audit logging.
Data Subject Rights
Processor assists Controller with access, rectification, erasure, portability requests within 15 days.
Breach Notification
Processor notifies Controller within 24 hours of confirmed breach affecting personal data.
International Transfers
SCCs (2021) for US-EU. EU residency option via regional routing.
Audit
Controller may audit annually with 30-day notice. Third-party auditor acceptable. Costs shared unless material non-compliance.
Deletion/Return
30 days post-termination. Certification of destruction available.
Full DPA (GDPR Art. 28 compliant) available via contact form.
Business Associate Agreement (BAA) — Template Summary
Full BAA template available on request for HIPAA-covered entities. Key terms:
PHI Scope
NextConsensus does not create, receive, or maintain PHI. BAA covers incidental exposure risk only.
Safeguards
Administrative, physical, technical per 45 CFR §164.308/310/312. Encryption, access controls, audit logs, workforce training.
Breach Notification
Business Associate notifies Covered Entity within 15 days of discovery (45 CFR §164.410).
Termination
Return/destroy PHI (if any) per 45 CFR §164.504(e)(2)(ii)(J). Certification of destruction.
Full BAA available via contact form.
Need an agreement reviewed?
We'll send the full document package within 1 business day.