Customer terms of service and data processing addendum.

Last updated: 13 October 2026 · This version effective 13 October 2026

PART 1 — CUSTOMER TERMS OF SERVICE

1. Parties & acceptance

These Terms of Service (the “Terms”) govern access to and use of the HOSP platform and related services (the “Service”). They form a binding agreement between Litson PLLC, a Tennessee professional limited liability company located at 54 Music Sq E, Suite 300, Nashville, TN 37203 (“HOSP,” “we,” or “us”), and the business that registers for or uses the Service (“Customer”). By signing an Engagement Letter that references these Terms, the person accepting agrees on behalf of the Customer and represents they are authorized to do so and are at least 18 years old.

2. Definitions

• “Service” — the HOSP web and mobile applications and related services.
• “Customer Data” — data, including Personal Data, that Customer or its Authorized Users submit to or generate in the Service.
• “Authorized User” — an individual the Customer permits to use the Service, including its staff and administrators.
• “Personal Data” — information relating to an identified or identifiable individual within Customer Data.
• “DPA” — the Data Processing Addendum in Part 2.
• “Engagement Letter” — an engagement letter, representation agreement, order form, or online plan selection that references these Terms.
• “Calendar Link” — a private, read-only calendar subscription link (an iCalendar or “ICS” link) that an Eligible User creates in the Service and copies into a Third-Party Calendar App to view HOSP compliance dates. “Eligible User” means (a) Customer’s administrators and managers, once Customer’s administrator has turned calendar integrations on; and (b) where Customer is a legal client of Litson PLLC d/b/a BevLaw Group, BevLaw Group lawyers and associates assigned to Customer, unless Customer has turned that use off (see Section 4).
• “Third-Party Calendar App” — a calendar application or service not provided by HOSP (for example, Microsoft Outlook, Google Calendar, or Apple Calendar) that an Eligible User chooses to use with a Calendar Link.

3. The Service & license

Subject to these Terms, HOSP grants Customer a non-exclusive, non-transferable, revocable right to access and use the Service during the subscription term for Customer’s internal business operations. HOSP may improve or modify the Service from time to time.

Calendar integrations. The Service includes optional calendar integrations that let Eligible Users view HOSP compliance dates in a Third-Party Calendar App using a Calendar Link. A Calendar Link shows only the dates its Eligible User is permitted to see in the Service. Anyone who has a Calendar Link can view the dates it provides. HOSP re-checks the Eligible User’s permissions each time a Calendar Link is fetched, so dates the Eligible User can no longer see are no longer provided at the next refresh; calendar apps normally drop events that leave the feed, but HOSP cannot guarantee this. HOSP may disable, revoke, or replace any Calendar Link at any time, including to protect the security of the Service or prevent misuse. Calendar Links are also disabled automatically when the Eligible User’s password is changed or reset, when a temporary password is issued, when the Eligible User logs out of all devices, when the account is deactivated or deleted, and, for Customer’s administrators and managers, when Customer turns calendar integrations off. If a Calendar Link, including one created by a BevLaw Group lawyer or associate, is leaked or misused and this results in a Personal Data breach, HOSP will handle it under Section C of the DPA.

4. Accounts, administrators & Customer responsibilities

• Customer designates administrators and is responsible for all activity under its account and by its Authorized Users (including staff it adds).
• Customer must keep account credentials and Calendar Links confidential and secure, and notify HOSP promptly of any unauthorized use.
• Customer is responsible for the accuracy and lawfulness of the data it submits.
• Customer represents that it has all rights, notices, and consents necessary to provide staff and third-party personal data (for example, emergency-contact details) to HOSP.
• Calendar integrations are off by default. Only Customer’s administrator can turn them on for Customer; HOSP can turn them off but cannot turn them on. Once they are on, Customer’s administrators and managers can use them; other staff cannot. Customer is responsible for the decision to turn them on. If Customer is a legal client of Litson PLLC d/b/a BevLaw Group, BevLaw Group lawyers and associates assigned to Customer may also use calendar integrations for Customer’s compliance dates, under a firm-wide decision by BevLaw Group. That use is allowed by default and does not depend on whether Customer has turned calendar integrations on for its own users, but Customer’s administrator can turn it off in the Service’s settings, in which case those lawyers’ and associates’ Calendar Links stop including Customer’s dates from the next refresh. Customer is responsible for providing any notice to, or obtaining any consent from, staff whose names and certification dates will be sent to Third-Party Calendar Apps, whether by its Authorized Users or by BevLaw Group lawyers and associates assigned to Customer.
• Customer is responsible for complying with employment, child-labor, and privacy laws regarding its staff (including any minors it chooses to add as Authorized Users), and for its own legal and regulatory obligations.

Electronic communications. By creating an account or using the Service, Customer and its Authorized Users consent to receive communications from HOSP electronically — including notices, agreements, disclosures, and operational messages — and agree that such electronic communications satisfy any legal requirement that a communication be in writing.

5. Acceptable use

Customer will not, and will not permit others to: use the Service unlawfully or to store unlawful or infringing content; attempt to breach or circumvent security; reverse engineer, decompile, or copy the Service; introduce malicious code; harvest data without consent; share a Calendar Link other than as permitted below; or resell or provide the Service to third parties except its Authorized Users. Each Calendar Link is personal to the Eligible User who created it. It must not be shared, or added to a shared or public calendar, unless every person who can see that calendar can already see the same dates in the Service. BevLaw Group applies the same rule to its lawyers and associates.

6. Customer Data

As between the parties, Customer retains all rights in Customer Data. Customer grants HOSP a non-exclusive, worldwide license to host, copy, process, and display Customer Data solely to provide, secure, and support the Service and as set out in the DPA. HOSP will treat Customer Data as confidential.

7. Fees & payment

Fees, billing frequency, and payment terms are as set out in the applicable Engagement Letter or plan. Fees are exclusive of taxes. Overdue amounts may accrue interest and/or result in suspension.

8. Term & termination; return/deletion of data

These Terms run for the subscription term and renew as stated in the Engagement Letter. Either party may terminate for material breach not cured within the cure period stated in the Engagement Letter. On termination, Customer’s access ends and HOSP will, at Customer’s choice, return or delete Customer Data within 30 days of termination, subject to any legally required retention. Customer may also close its account at any time by contacting HOSP. Terms that by their nature survive will survive (see §16).

9. Intellectual property

HOSP and its licensors own all rights in the Service and its underlying technology. No rights are granted except as expressly stated. If Customer provides feedback, HOSP may use it without restriction or obligation.

10. Confidentiality

Each party will protect the other’s Confidential Information with at least reasonable care and use it only for the purposes of these Terms, excluding information that is public, independently developed, or rightfully received from a third party.

11. Warranties & disclaimers

HOSP warrants the Service will perform materially as described in its documentation. EXCEPT AS EXPRESSLY STATED, THE SERVICE IS PROVIDED “AS IS” AND “AS AVAILABLE,” AND HOSP DISCLAIMS ALL OTHER WARRANTIES, EXPRESS OR IMPLIED, INCLUDING IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT. HOSP does not warrant that the Service will be uninterrupted or error-free.

HOSP does not provide legal advice; the Service assists with compliance and operations and is not a substitute for professional or legal judgment. HOSP does not warrant that use of the Service will cause Customer to achieve or maintain compliance with any law or standard, and Customer is responsible for its own compliance decisions and outcomes.

If customer uses HOSP through an agreement with Litson PLLC d/b/a BevLaw Group, Litson attorneys will provide legal advice and services in the manner described by, and limited to the scope identified in, the Engagement Letter.

Third-Party Calendar Apps. Third-Party Calendar Apps are not part of the Service and are provided by third parties under their own terms with the Eligible User, who directs the disclosure of calendar details to them. Third-Party Calendar Apps fetch calendar details periodically, so they may not reflect the latest information in the Service. HOSP is not responsible for any Third-Party Calendar App’s processing, security, or availability, or for copies of calendar details it has downloaded, which HOSP cannot delete; to remove them, the Eligible User must remove the HOSP calendar from the Third-Party Calendar App.

12. Limitation of liability

To the maximum extent permitted by law, neither party is liable for indirect, incidental, special, or consequential damages, or for lost profits, revenue, goodwill, business, or anticipated savings, or for loss or corruption of data, however arising. Subject to the carve-outs below, each party’s aggregate liability arising out of or relating to these Terms is capped at the greater of (a) the total fees Customer paid in the 12 months before the event giving rise to the claim, or (b) US$100.

Confidentiality obligations, data-protection breaches, and indemnification obligations are excluded from the foregoing cap. Because some jurisdictions do not allow the exclusion or limitation of certain damages, parts of this section may not apply.

13. Indemnification

Customer will defend, indemnify, and hold harmless HOSP against third-party claims arising from Customer Data or Customer’s unlawful use of the Service. HOSP will defend, indemnify, and hold harmless Customer against third-party claims that the Service, as provided, infringes intellectual-property rights. Each indemnity is subject to prompt written notice, the indemnifying party’s control of the defense, and the other party’s reasonable cooperation.

14. Data protection

The Data Processing Addendum (Part 2) is incorporated into these Terms and governs the processing of Personal Data. If there is a conflict regarding Personal Data, the DPA controls.

15. Governing law & dispute resolution

These Terms are governed by the laws of the State of Tennessee, without regard to its conflict-of-laws principles. Subject to the informal-resolution step below, the parties submit to the exclusive jurisdiction of the state courts located in Davidson County, Tennessee, and the United States District Court for the Middle District of Tennessee.

Informal resolution. Before filing any claim, the parties will attempt to resolve the dispute informally by written notice and good-faith discussion for 30 days.

16. General

Assignment. Neither party may assign without consent, except HOSP may assign to an affiliate or in connection with a merger or sale of assets.

Force majeure. Neither party is liable for any failure or delay resulting from causes beyond its reasonable control, including acts of God, natural disasters, war, terrorism, civil unrest, governmental action, labor disputes, internet or utility outages, or pandemic.

Relationship of the parties. The parties are independent contractors; nothing in these Terms creates any agency, partnership, joint venture, or employment relationship.

Survival. Sections 6 (Customer Data), 9 (Intellectual Property), 10 (Confidentiality), 11 (Warranties & disclaimers), 12 (Limitation of liability), 13 (Indemnification), 14 (Data protection), 15 (Governing law & dispute resolution), and any provisions that by their nature should survive, survive termination.

Other. Notices, entire agreement, severability, and no-waiver terms apply. These Terms, together with any Engagement Letter and the DPA, are the entire agreement and supersede prior agreements on the subject. HOSP may update these Terms with reasonable notice; continued use after the effective date constitutes acceptance.

PART 2 — DATA PROCESSING ADDENDUM (DPA)

A. Roles & scope

This DPA applies where HOSP processes Personal Data on Customer’s behalf in providing the Service. For such Personal Data, Customer is the controller (or a processor acting for its own controllers) and HOSP is the processor. HOSP processes Personal Data only to provide the Service and on Customer’s documented instructions, which these Terms and Customer’s configuration and use of the Service constitute. Customer’s documented instructions include the calendar-integration provisions of Terms §§3–4, including, where Customer is a BevLaw Group legal client, use by BevLaw Group lawyers and associates assigned to Customer, unless Customer has turned that use off. HOSP will inform Customer if, in its opinion, an instruction infringes applicable data-protection law.

B. Nature of processing

The subject-matter, duration, nature and purpose of processing, the types of Personal Data, and the categories of data subjects are described in Appendix 1. Processing also includes pseudonymous, device-level product analytics and diagnostics via our analytics subprocessor (PostHog), as further described in Appendix 1 and Appendix 2.

C. HOSP’s obligations as processor

• Process Personal Data only on Customer’s documented instructions.
• Ensure persons authorized to process Personal Data are bound by confidentiality.
• Implement appropriate technical and organizational security measures (Appendix 3).
• Taking into account the nature of processing, assist Customer in responding to data-subject requests (access, correction, deletion).
• Assist Customer with security, breach notification, and (where applicable) data-protection impact assessments.
• Notify Customer without undue delay after becoming aware of a Personal Data breach.
• On termination, at Customer’s choice delete or return Personal Data, subject to legally required retention, and excluding copies of calendar details already downloaded by a Third-Party Calendar App, which HOSP cannot delete.
• On deletion of an individual’s account, remove or de-identify that individual’s personal data (name, email, phone, emergency-contact details, certifications), retaining only a de-identified record where required for legal, compliance, audit, or security purposes.
• Make available information necessary to demonstrate compliance and allow reasonable audits (Section F).

D. Subprocessors

Customer authorizes HOSP to engage the subprocessors listed in Appendix 2. HOSP imposes data-protection terms on each subprocessor that are no less protective than this DPA and remains responsible for their performance. HOSP will give Customer at least 30 days’ prior notice of any new subprocessor and an opportunity to object on reasonable data-protection grounds. If Customer objects on reasonable data-protection grounds and the parties cannot resolve the objection within 30 days, Customer may, as its sole remedy, terminate the affected portion of the Service without penalty by written notice. Third-Party Calendar Apps are not subprocessors of HOSP; each receives calendar details at the direction of the Eligible User who chooses it, under its own terms with that Eligible User.

E. International transfers

HOSP processes Personal Data in the United States. If Customer or its data subjects are located outside the United States, the parties will implement an appropriate transfer mechanism.

F. Audit

HOSP will make available information reasonably necessary to demonstrate compliance with this DPA and, on reasonable prior notice and no more than once per year, allow Customer, at its own expense, to audit, subject to confidentiality. HOSP may satisfy audit requests through third-party reports (for example, the SOC 2 reports of its subprocessors).

G. Liability & order of precedence

With respect to Personal Data, this DPA prevails over conflicting terms in the Terms. Liability under this DPA is subject to the limitations in the Terms.

H. California (CCPA/CPRA) — service provider

With respect to Personal Data subject to the California Consumer Privacy Act (as amended by the CPRA), HOSP is a “service provider.” HOSP shall not: (a) sell or “share” such Personal Data; (b) retain, use, or disclose it for any purpose other than the business purposes of providing the Service specified in these Terms, including retaining, using, or disclosing it for a commercial purpose other than providing the Service; or (c) retain, use, or disclose it outside the direct business relationship between the parties, other than disclosures to Third-Party Calendar Apps made under Section A. HOSP certifies that it understands and will comply with these restrictions.

Appendix 1 — Processing details

• Data subjects: Customer’s staff (including managers, and front- and back-of-house employees), administrators, and individuals named in records (for example, emergency contacts and individuals referenced in incident reports).
• Categories of Personal Data: identity & contact (name, email, phone); employment details (role, venue, department, start date, certifications); user-generated content (incident reports, write-ups, photos, documents); emergency-contact details; technical/usage data, including IP address — recorded in connection with sign-in, security and audit records for both the web and mobile apps — together with device and application identifiers and application event logs; product-analytics data, comprising a pseudonymous device-level identifier, screen-view events recorded as generic route patterns, app-lifecycle events, and device and app metadata; and calendar-integration data, comprising a hashed form of each Calendar Link with its creation and last-used times, the IP address of each calendar request, held in a rate-limit counter deleted automatically after about an hour, a record of which administrator turned calendar integrations on, when, and which version of the authorization wording they accepted, and, for BevLaw Group legal clients, a record of who turned BevLaw Group lawyers’ calendar access off or back on, and when.
• Special-category data: incident content may include health/injury information, processed only as part of providing the Service.
• Nature & purpose: providing the HOSP compliance and operations Service, including automated summarization, classification, and indexing of Customer content via our AI subprocessor (OpenAI), and, where calendar integrations are in use, making compliance dates and short titles (license type or name and venue, contract name, or certification name with the staff member’s name, and, for BevLaw Group lawyers and associates, the client’s name) available through Calendar Links to the Third-Party Calendar Apps Eligible Users choose.
• Duration: the subscription term plus any legally required retention.

Appendix 2 — Subprocessors

Appendix 3 — Security measures (summary)

• Encryption of Personal Data in transit.
• Authentication and role-based access controls; logical separation (organization-scoping) of each customer’s data.
• Infrastructure security provided through Google Cloud (United States).
• Monitoring and error tracking; confidentiality obligations on personnel.
• Calendar Links stored only in hashed form; permissions re-checked on every fetch; rate limiting, with requesting IP addresses deleted automatically after about an hour; Calendar Links disabled automatically on password change or reset, temporary-password issue, “log out all devices”, account deactivation or deletion, and, for Customer’s administrators and managers, when Customer turns calendar integrations off; BevLaw Group lawyers’ and associates’ Calendar Links stop including a legal client’s dates when that client turns lawyer use off.