Terms of Service

Effective: 2026-09-24 · Version: 2026-09-24

These Terms of Service (the "Terms") are a binding agreement between Bluemill Digital, LLC ("Keen", "we", "us"), a company organized under the laws of the State of Indiana, and the dental practice or other organization that creates an account ("you", "Practice"). By creating an account, clicking to accept, or using the service, you agree to these Terms. If you are accepting on behalf of a practice, you represent that you are authorized to bind it.

If your practice will receive patient or prospective-patient information through a website Keen hosts for you, Exhibit A (the Business Associate Addendum) applies and forms part of this agreement. You do not need to sign a separate BAA; accepting these Terms executes one.

1. What Keen does

Keen is a website service for dental practices. You describe your practice; our software — which uses AI models to generate and edit code and copy — produces a website, which you review, refine, and publish to a Keen-hosted address or a domain you control. We also host the published site, deliver its contact and appointment-request forms to an inbox inside the app, and keep the site online for as long as your subscription is current.

2. Your account

You must be 18 or older and provide accurate registration information. You are responsible for everything done under your account, for keeping credentials secret, and for the people you invite to it. Each person with access must use their own login; shared logins are prohibited (this is also a condition of Exhibit A). Tell us at security@keen.dental promptly if you believe an account has been compromised.

3. Your content, and who owns the site

You own your content. Practice name, photographs, logos, staff bios, service descriptions, documents you upload, and anything you type into the builder remain yours. You grant us a non-exclusive licence to host, reproduce, adapt, and display that content for the sole purpose of operating the service for you — including passing it to the AI models that generate your site.

You own the generated site. On payment, the website output we generate for you — its code, copy, layout, and configuration — is yours to use, modify, and take with you. We retain ownership of the Keen platform itself: the builder, the scaffold and component conventions, our hosting infrastructure, and anything we develop generally rather than specifically for you. Nothing here transfers our trademarks.

You are responsible for having the rights to what you give us, and for the accuracy of clinical, pricing, insurance, and credentialing claims your site makes. We do not review your site for professional-advertising compliance; dental-board advertising rules are yours to satisfy.

4. AI-generated output

Your site is produced by AI models working from your inputs. AI output can be wrong. It can invent a service you do not offer, state hours you do not keep, or produce text that resembles text elsewhere. You are the editor of record. Review your site before you publish it and after any change, and correct anything inaccurate. We provide the tools and the preview step precisely so that review happens before anything goes live. We do not warrant that generated output is accurate, original, or fit for any particular purpose, and we do not provide legal, clinical, or advertising-compliance advice.

5. Acceptable use

Do not use Keen to publish unlawful, deceptive, infringing, or harassing material; to impersonate another practice or provider; to make claims prohibited by your dental board or by consumer-protection law; to attempt to breach or overload our systems or another customer's site; or to resell the service without our written agreement.

Do not configure your site to collect medical history, treatment details, insurance identifiers, government ID numbers, or payment card numbers through Keen forms. The form pipeline is built for contact and appointment-request information. Collecting clinical intake through it is outside what this agreement covers, and we may disable a form that does so.

6. Fees, publishing, and lapse

Building and previewing a site is metered by usage; publishing and keeping a site live requires a current hosting subscription. Current pricing, allowances, and the billing mechanics are shown in the app before you are charged. Fees are billed through our payment processor; you authorize us to charge the payment method on file. Amounts are exclusive of taxes, which you are responsible for.

If a subscription payment fails, your published site enters a grace period during which it stays online and we try again. If it is not cured by the end of that period, the published site goes offline. Your data, your drafts, and your leads remain in your account and the site comes back when billing is restored. Fees already incurred are not refundable except where required by law.

7. Custom domains

If you connect a domain you own, you are responsible for the registration, the DNS records we ask you to add, and keeping both current. We issue and renew TLS certificates for connected domains. We may remove a domain connection if you no longer control the domain or if it is used in breach of Section 5.

8. Suspension and termination

You may stop using Keen at any time, and may deactivate a site from within the app. Deactivation takes the site offline permanently and cannot be reversed. We may suspend or terminate an account for material breach of these Terms, for non-payment after the grace period, or where continuing would expose us or another customer to legal risk — with notice where practicable, immediately where the risk is serious.

On termination: you may export your site and your leads before your access ends; on request at legal@keen.dental within 30 days we will provide an export. Protected Health Information is handled under Exhibit A §8, which governs over this section.

9. Service levels, warranties, and liability

We work to keep published sites available, but we do not offer a contractual uptime guarantee at this tier. Except as expressly stated here and in Exhibit A, the service is provided "as is", and we disclaim all implied warranties, including merchantability, fitness for a particular purpose, and non-infringement, to the fullest extent the law allows.

To the fullest extent permitted by law, neither party is liable for indirect, incidental, special, consequential, or punitive damages, or for lost profits, revenue, goodwill, or data. Our total aggregate liability arising out of or relating to this agreement is limited to the amounts you paid us in the twelve months before the event giving rise to the claim. These limits do not apply to your payment obligations, to either party's indemnification obligations, or to a party's breach of its confidentiality or PHI obligations under Exhibit A.

10. Indemnity

You will defend and indemnify us against third-party claims arising from your content, from claims your site makes, from your breach of Section 5, or from your failure to hold the rights you represented you hold. We will defend and indemnify you against third-party claims that the Keen platform itself infringes their intellectual property rights.

11. Changes to these Terms

We may update these Terms. Material changes take effect 30 days after we notify you by email or in the app; non-material changes take effect when posted. Each version carries a version number, and the version you accepted is recorded against your account. Continuing to use the service after a change takes effect means you accept the new version. If you do not accept a material change, stop using the service before it takes effect and contact legal@keen.dental; we will not charge you for the period after you stop.

Exhibit A may not be changed in a way that reduces our obligations to you as a business associate without your written agreement.

12. General

These Terms are governed by the laws of the State of Indiana, without regard to conflict-of-law rules, and the state and federal courts located there have exclusive jurisdiction. If a provision is unenforceable, the rest survives. Neither party may assign this agreement without the other's consent, except to a successor in a merger or sale of substantially all assets. These Terms, together with Exhibit A and any order you place, are the entire agreement between us on this subject. Notices to us — including any notice under Exhibit A — must be sent to legal@keen.dental, and are effective on delivery; notices to you go to the email on your account.

---

Exhibit A — Business Associate Addendum

Effective: the date you accept these Terms · Version: 2026-09-24

This Business Associate Addendum ("BAA") is entered into between Bluemill Digital, LLC ("Business Associate") and the Practice ("Covered Entity") and is incorporated into the Terms of Service. It governs Business Associate's Use and Disclosure of Protected Health Information on Covered Entity's behalf. Capitalized terms not defined here have the meanings given in 45 C.F.R. Parts 160 and 164 (the "HIPAA Rules").

A1. Scope — what PHI Keen actually receives

Business Associate provides website generation and hosting. The only Covered Entity data Business Associate receives that constitutes PHI is submissions from contact and appointment-request forms on the Practice's website — typically a visitor's name, contact details, and a free-text message about seeking care — together with the submission's timestamp, originating page, and delivery status.

Business Associate does not receive treatment records, medical histories, diagnosis or procedure codes, insurance identifiers, or payment card data, and Covered Entity agrees not to route them through the service (Terms §5). The public marketing pages of the website — browsing, click-to-call, maps, unauthenticated content — do not involve PHI.

A2. Permitted Uses and Disclosures

Business Associate may Use and Disclose PHI only:

(a) to perform the services described in the Terms — receiving, storing, and displaying form submissions to Covered Entity's authorized users; (b) for Business Associate's proper management and administration, or to carry out its legal responsibilities, provided that any Disclosure to a third party is either Required By Law or made with written assurances of confidentiality and of notice to Business Associate of any breach; (c) to provide Data Aggregation services relating to Covered Entity's health care operations, if requested; and (d) to create De-identified information in accordance with 45 C.F.R. § 164.514(b), which is no longer PHI.

Business Associate will not: Use or Disclose PHI other than as permitted by this BAA or Required By Law; Use or Disclose PHI in a manner that would violate Subpart E of 45 C.F.R. Part 164 if done by Covered Entity; sell PHI; use PHI for marketing or for training general-purpose AI models; or use PHI for its own product analytics.

PHI is never sent to the AI models that build your site. Site generation runs on your practice's marketing content only; the build system has no access to the leads store.

A3. Safeguards

Business Associate will use appropriate administrative, physical, and technical safeguards, and will comply with Subpart C of 45 C.F.R. Part 164 (the Security Rule) with respect to Electronic PHI, to prevent Use or Disclosure of PHI other than as provided by this BAA. These include, at minimum:

• Encryption of PHI in transit (TLS) and at rest, through the cloud services named in A4;
• Access control — PHI is readable only by authenticated users whom Covered Entity has added to its account, enforced at the database layer rather than in application code alone; unique accounts, no shared logins;
• Boundary control — form submission content is stored in Business Associate's database and displayed only inside the application. It is not written to logs, analytics, or any third-party service that has not signed a business associate agreement. Email notifications sent to Covered Entity are content-free pointers ("you have a new request — open it in Keen") and contain no visitor name, contact detail, or message text;
• Minimum necessary — Business Associate personnel do not access PHI in the ordinary course; access for support or incident response is on request or necessity, logged, and limited to what the task requires.

A4. Subcontractors

Business Associate will ensure that any Subcontractor that Creates, Receives, Maintains, or Transmits PHI on its behalf agrees in writing to restrictions and conditions at least as protective as those in this BAA, as required by 45 C.F.R. § 164.502(e)(1)(ii) and § 164.308(b)(2). Business Associate's current PHI-handling subcontractors are:

Business Associate's content-delivery and email vendors are deliberately outside the PHI boundary: the content-delivery layer passes submissions through without storing or logging their content, and the email vendor receives only content-free pointers. A current list of PHI-handling subcontractors is available on request at legal@keen.dental, and Covered Entity will be notified before a new one is added.

A5. Individual rights

Business Associate will, within ten (10) business days of a written request from Covered Entity:

• make PHI in a Designated Record Set available to Covered Entity so it can meet its obligations under 45 C.F.R. § 164.524 (access);
• make amendments to PHI in a Designated Record Set as directed by Covered Entity, per 45 C.F.R. § 164.526;
• provide the information Covered Entity needs to account for Disclosures under 45 C.F.R. § 164.528.

To the extent Business Associate is to carry out a Covered Entity obligation under Subpart E directly, it will comply with the requirements that apply to Covered Entity in performing it. Covered Entity's authorized users can retrieve, and export, their form submissions from the application at any time without making a request.

If an Individual contacts Business Associate directly with a request concerning their PHI, Business Associate will refer them to Covered Entity and notify Covered Entity.

A6. Reporting and breach notification

Business Associate will report to Covered Entity:

• any Use or Disclosure of PHI not permitted by this BAA, and any Security Incident, of which it becomes aware — without unreasonable delay and no later than ten (10) business days after discovery;
• any Breach of Unsecured PHI — without unreasonable delay and no later than five (5) business days after discovery, with the information required by 45 C.F.R. § 164.410(c) to the extent then known, supplemented as the investigation develops.

Unsuccessful Security Incidents that result in no unauthorized access — routine scans, blocked connection attempts, failed logins, denied requests — are reported on request rather than individually. Covered Entity remains responsible for notifications to Individuals, HHS, and media under 45 C.F.R. §§ 164.404–164.408; Business Associate will provide the cooperation and information reasonably needed for them. Report suspected incidents to Business Associate at security@keen.dental.

A7. Covered Entity's obligations

Covered Entity will: not request Business Associate to Use or Disclose PHI in a way that would be impermissible if done by Covered Entity; notify Business Associate of any limitation in its notice of privacy practices, of any change to or revocation of an Individual's permission, and of any restriction agreed under 45 C.F.R. § 164.522, in each case to the extent it affects Business Associate's Use or Disclosure; keep its own user list current and remove access promptly when a person leaves; and refrain from routing clinical intake or payment card data through the form pipeline.

A8. Term, termination, and return or destruction

This BAA takes effect when Covered Entity accepts the Terms and continues until all PHI is returned or destroyed. Covered Entity may terminate the Terms if Business Associate materially breaches this BAA and does not cure within thirty (30) days of written notice.

On termination, Business Associate will return or destroy all PHI it Maintains on Covered Entity's behalf, and will retain no copies, except where return or destruction is infeasible — in which case the protections of this BAA continue to apply to the retained PHI and further Use or Disclosure is limited to what makes return or destruction infeasible. Covered Entity has thirty (30) days after termination to export its form submissions, after which they are destroyed. Business Associate's ordinary retention limit for form submissions is described in the Privacy Policy and applies during the term.

A9. Texas HB 300

Business Associate is a "covered entity" as that term is defined in Texas Health & Safety Code § 181.001 and will comply with Chapter 181 with respect to PHI it Maintains for Covered Entity, including its training and electronic-access provisions. Where Chapter 181 imposes a stricter requirement than the HIPAA Rules, the stricter requirement applies.

A10. Miscellaneous

This BAA is to be interpreted to permit compliance with the HIPAA Rules, and will be deemed amended as necessary to comply with changes to them. Sections A3, A6, and A8 survive termination. In the event of a conflict between this BAA and the rest of the Terms with respect to PHI, this BAA controls. The limitation of liability in Terms §9 does not limit either party's obligations under this BAA.