Terms of Service

Effective 5 October 2026. These terms govern use of NPIsign, operated by Tributary of St. Petersburg, Florida ("Tributary", "we"). By creating an account, accepting an invitation, or using NPIsign in any way, you and the organization you act for agree to them. No signature is needed.

The one thing to know. NPIsign is a working tool that turns sign-in sheets into attendee files. It is not your system of record. You are responsible for keeping your own copies of every attendee record, export and sign-in image for as long as the law and your own policies require. Details in section 5.

1. Agreement

Using NPIsign is your acceptance of these terms. If you use NPIsign on behalf of a company or other organization, you confirm you are authorized to bind it, and "you" means both you and that organization. If you do not agree, do not use the service. Where your organization has a signed agreement with Tributary, that agreement controls if it conflicts with these terms.

2. The service

NPIsign reads attendee sign-in records from an event (a photographed sheet, a tablet form or a CSV), looks each person up in the public National Plan and Provider Enumeration System (NPPES) registry, and produces an attendee file formatted for your expense system. It flags anything uncertain for a person to confirm. It supports your transparency reporting under the Physician Payments Sunshine Act (Open Payments) and state laws. It does not file anything with any regulator on your behalf.

3. Accounts and organizations

Accounts are for named individuals using a work email. Keep your password private and tell us promptly about any unauthorized use.
Data belongs to the organization (workspace) it was entered under. The organization's admins control membership, roles, settings and billing, and may remove users and their access at any time.
Roles (rep, manager, admin, compliance) limit what each user can see and change. Your organization is responsible for assigning them correctly.
You are responsible for everything done under your account or by users your organization invites.

4. Data you put in

You keep ownership of everything you upload or enter: event details, attendee names, sign-in images, signatures, your import template and configuration.
You give Tributary a licence to store, process and transmit that data only as needed to run the service for you, including sending sign-in images to a handwriting-recognition model provider for extraction.
No patient data. NPIsign is for healthcare-professional attendee information only. Do not upload protected health information, patient records, payment card numbers, government ID numbers other than NPI and license numbers, or any data you are not permitted to share with us.
You confirm that your attendees were told, as your policies require, that their attendance is recorded for transparency reporting.

5. Records and retention: your responsibility

Federal rules (42 CFR 403.912(e)) require applicable manufacturers and group purchasing organizations to keep records supporting their Open Payments reports for at least five years from the date the payment is published, and many companies and states require longer. That duty is yours, not Tributary's. NPIsign is a working tool, not an archive or system of record.

Keep your own copies. Download every export and the original sign-in images, and store them in your organization's own records system for the full period your policies and the law require. Treat the download at export time as the moment the record leaves NPIsign and enters your archive.
We keep data only while your account is active. We do not promise to retain any record for any period. We may purge events, attendees, images, exports and audit entries after your subscription ends or an organization goes unused.
Deletion in the app is permanent. When a user with the right role deletes an event, its attendees, sheets, exports and images are removed and cannot be recovered. Use Archive to hide an event while keeping its records. Tributary is not responsible for records your users delete.
On termination you may export your records for 30 days, after which we delete them. See section 13.
If you need Tributary to hold records for a defined period, that must be agreed in writing in a separate data processing or retention addendum, and is not part of these terms.

6. Accuracy and your review

Registry matches, handwriting reads and suggested providers are aids to a person's judgment. Flags mean "check this". A row marked ready still needs your organization's normal review before it goes into your expense system or any regulatory report.
NPPES data is maintained by CMS and the providers themselves. It can be wrong, stale or incomplete, and NPIsign reports what it finds.
You are solely responsible for the accuracy, completeness and timeliness of anything you submit to your expense system, to Open Payments, or to any state program, and for the consequences of errors in those submissions.

7. How we handle your data

We process your data only to provide and support the service, to keep it secure, to bill you and to meet legal obligations. We do not sell it, share it with other customers, or use it to train models.
Each organization's data is separated by row-level access control in the database. Access within your organization follows the roles your admins assign.
Data is encrypted in transit and at rest. Downloads use signed, time-limited links. Changes to attendee, export, configuration and membership data are written to an audit log your admins and compliance users can see.
Sub-processors: Cloudflare (hosting and edge functions), Supabase (database, authentication and file storage), Resend (email), and the model provider used for handwriting recognition, which receives sign-in images for extraction only and does not keep them under its API terms. Hosting and processing take place in the United States.
Tributary staff access customer data only to operate and support the service, and are bound by confidentiality.
If we confirm unauthorized access to your data, we will notify your organization's admin contact without undue delay, and within 72 hours, with what we know and what we are doing.
Organizations that need a signed data processing addendum can ask for Tributary's standard DPA.

8. Acceptable use

Do not use NPIsign to break the law, to look up providers for any purpose other than your own event and transparency reporting, to probe or overload the service, to share accounts, to copy the service, or to upload malware or data you have no right to upload. We may suspend access that we reasonably believe breaks these rules, and will tell your admin when we do.

9. Fees and the pilot

During a pilot, use is free unless agreed otherwise in writing. Pilots can be ended by either side at any time.
Paid plans are billed per licensed seat at the price agreed with your organization. Seat changes requested in the app take effect when Tributary confirms them. Fees are non-refundable except where the law requires otherwise.
Prices may change with at least 30 days' notice to your billing contact.

10. Availability and changes

We aim to keep NPIsign available at all times but do not guarantee uninterrupted service. We may change, add or remove features, and will give reasonable notice of changes that remove something you rely on. Offline capture is best effort: anything queued on a device is only safe once the app confirms it was uploaded.

11. No warranty

NPIsign is provided "as is" and "as available". To the fullest extent the law allows, Tributary disclaims all warranties, express or implied, including merchantability, fitness for a particular purpose, non-infringement, and any warranty that the service, its registry lookups or its handwriting reads will be accurate, complete, error-free or uninterrupted.

12. Limitation of liability

To the fullest extent the law allows: Tributary is not liable for indirect, incidental, special, consequential or punitive damages, or for lost profits, lost data, regulatory penalties, or costs of substitute services, arising from or related to the service, even if advised of the possibility. Tributary's total liability for all claims in any twelve-month period is limited to the fees your organization paid for the service in that period, or one hundred US dollars if no fees were paid. Nothing in these terms limits liability that cannot be limited by law.

13. Termination

You may stop using NPIsign at any time. An organization admin may ask us to close the organization by emailing the contact below.
We may suspend or end access for breach of these terms, non-payment, or if we discontinue the service, with notice where practicable.
For 30 days after an organization is closed, its admins may export its records (CSV files and original images). After that we delete the organization's data and confirm on request. Backups age out on their normal schedule.
Sections 4 to 7 and 11 to 16 survive termination.

14. Changes to these terms

We may update these terms. The effective date at the top changes when we do, and material changes are announced in the app or by email to your organization's admins. Continuing to use NPIsign after a change means you accept the new terms.

15. Governing law

These terms are governed by the laws of the State of Florida, without regard to conflict-of-law rules. Disputes are heard in the state or federal courts for Pinellas County, Florida, and both sides consent to that venue. If any part of these terms is unenforceable, the rest still applies. These terms, plus any signed agreement with Tributary, are the whole agreement about the service.

16. Contact

Tributary, St. Petersburg, Florida. Questions, data requests and notices: [email protected].

Back to sign in · Contact and support