Szilva Terms of Service

Last updated: November 2, 2026

These terms are the agreement between Szilva and the healthcare providers and other organizations that use the Szilva service. Please read them before you create an account.

Sections 9 (Suspension), 12 (Liability), 13 (Claims about your data and use), 14 (Changes to these terms) and 15 (Law and courts) differ from what the law would otherwise provide. We point them out here, and you accept them expressly when you create your account.

1. Who we are

Szilva (“Szilva Health”, “we”, “us”) is run by Rudolf Bárdos, a sole proprietor (egyéni vállalkozó) registered in Hungary.

• Registered name: Bárdos Rudolf e.v.
• Registered address: 7623 Pécs, Szabadság utca 19/2, Hungary
• Registration number: 52430642, in the register of sole proprietors kept by Hungary’s National Tax and Customs Administration (NAV)
• Tax number: 68913964-1-22
• Email: [email protected]
• Hosting: the Szilva server is hosted by Amazon Web Services EMEA SARL (Luxembourg, aws.amazon.com), and szilvahealth.com by Cloudflare, Inc. (San Francisco, USA, cloudflare.com).

2. What these terms cover

• The service: the hosted Szilva service, made up of the Szilva server at api.szilvahealth.com and the apps that work with it. It stores your forms, your patients’ accounts and records, and their answers.
• The software: the Szilva WordPress plugin and the Szilva Astro integration connect your website to the service. They’re free software under the GNU General Public License, version 2 or later. These terms don’t limit anything that license allows; they cover only the hosted service. If you connect the software to a server of your own, these terms don’t apply to that server.
• The name: the license covers the code, not the Szilva name or logo.

3. Your account

• You use the service for an organization, such as a medical practice or clinic. By accepting these terms, you confirm that you can bind it, and “you” then means that organization.
• You decide who on your staff gets access, and you’re responsible for what’s done with your accounts. Keep passwords safe, and tell us right away if you suspect that someone else has access.
• Staff accounts are for adults acting for your organization.

4. Your patients

• Your patients and website visitors use the forms and patient accounts that the service provides to you. Their relationship is with you, not with us.
• You give them the notices and get the consents that the law requires for your use of the service, such as your website’s privacy policy and, where HIPAA applies, your Notice of Privacy Practices.
• Not for emergencies: Szilva doesn’t monitor what patients send. Make sure your patients know that forms aren’t for urgent matters.
• Not medical advice: we provide software, not healthcare. What your forms ask and say, and every clinical decision, are yours.

5. Health information and HIPAA

• If you’re a covered entity or a business associate under HIPAA, you must sign our Business Associate Agreement (BAA) before you store protected health information (PHI) in the service. Ask us for it at [email protected]. For PHI, the BAA takes precedence over these terms where the two differ.
• The service keeps patient information out of your website, on a server built for it. It doesn’t make you compliant on its own: your policies, your staff’s access, your patients’ rights and your forms’ content remain your responsibility.

6. Your data

• It’s yours. The forms you build, your patients’ records and answers, and everything else in your project (“your data”) belong to you and your patients. We acquire no rights in them beyond what we need to provide the service.
• How we use it. We use your data only to provide, secure and support the service, as you instruct us, and as the law requires. We don’t sell it, use it for advertising, or use it to train AI models without your written permission.
• Export. You can export your data at any time, in FHIR format, through the service’s FHIR API.

7. Processing your data for you

We’re established in the EU, so the GDPR applies to how we process your data. For that processing, you’re the controller and we’re your processor, and this section is our data processing agreement (GDPR Article 28).

• What we process: we host your data for as long as these terms last, and store, organize, display and transmit it to provide the service. It includes your patients’ and visitors’ identification and contact details, account details, health information from forms and records, and files, as well as your staff’s account details.
• Instructions: we process your data only on your documented instructions: these terms, the BAA, and how you use the service. You instruct us to store it in the United States. If EU or Hungarian law requires other processing, we tell you first, unless that law forbids it.
• Confidentiality: everyone at Szilva who can access your data is bound to keep it confidential.
• Security: we protect it as section 8 describes.
• Sub-processors: you authorize the sub-processors listed in our Privacy Policy. We tell you at least 30 days before we add or replace one, and you can object on reasonable grounds. If we can’t resolve the objection, you can end these terms. Each sub-processor is bound by data protection obligations as protective as these.
• Help: we help you answer requests from people exercising their rights, and with your obligations on security, breach notification, impact assessments and consulting authorities.
• Breaches: we tell you without undue delay after we become aware of a breach affecting your data.
• At the end: we delete your data as section 10 describes, unless the law requires us to keep it.
• Audits: we give you the information you need to show that we meet this section. You, or an auditor you mandate who is bound to confidentiality, can audit us once a year with 30 days’ notice and at your cost, or sooner after a breach or when an authority requires it.

8. Security

• We protect your data with safeguards suited to health information: encryption in transit and at rest, passwords stored only as salted hashes, access limited to the people and systems that need it, two-factor sign-in for our own administrative accounts, records of sign-ins, a history of every change to every record, and backups.
• On your side, make sure your staff choose strong passwords and don’t share their accounts.

9. Suspension

We may suspend access to the service, in whole or in part, without notice, when that’s necessary to stop a security threat, a serious breach of these terms or unlawful use, or when the law or an authority requires it. We limit the suspension to what’s necessary, tell you as soon as we can, and restore access once the reason is gone. A suspension doesn’t delete any data.

10. Ending these terms

• These terms apply from when you accept them until either of us ends them.
• You can end them at any time, by deleting your project or by emailing us.
• We can end them with 90 days’ notice by email, for example if we stop offering the service. We can end them sooner if you seriously breach them and don’t put it right within 30 days of our notice, or if the law requires it.
• Your data at the end: you can export your data for 30 days after the end. After that, we delete it within 60 days, and copies in backups expire within 35 days more. Where the law requires us to keep some of it, we keep only that, only for as long as required, and protect it as these terms describe.
• Sections 6, 7, 12, 13 and 15 continue to apply after the end, as far as they’re still relevant.

11. Availability and changes to the service

• We work to keep the service available, but we don’t guarantee uninterrupted availability. We plan maintenance for quiet hours, and announce major maintenance in advance when we can.
• The service will change over time. If a change removes something significant that you rely on, we tell you at least 30 days in advance, unless security or the law requires a faster change.

12. Liability

• Apart from what these terms and the BAA promise, the service is provided as it is, without other warranties, as far as the law allows.
• Neither of us is liable to the other for lost profits or indirect damages.
• Each party’s total liability arising from these terms is limited to the amount you paid us in the 12 months before the event that caused the damage, or USD 1,000 if that’s more.
• These limits don’t apply to damage caused intentionally or by gross negligence, to damage to life, physical integrity or health, or where the law doesn’t allow a limit.

13. Claims about your data and use

You’re responsible for, and will compensate us for, claims by third parties, including your patients and authorities, that arise from data you had no right to store in the service, from notices you didn’t give or consents you didn’t get, or from your use of the service in breach of these terms or the law.

14. Changes to these terms

We may update these terms. We email your account’s owner, and show a notice in the service, at least 30 days before an update takes effect, unless the law requires a change sooner. If you don’t agree with an update, you can end these terms before it takes effect, and it won’t apply to you. If you keep using the service after that, the update applies.

15. Law and courts

Hungarian law governs these terms, without its conflict-of-law rules. If a dispute arises, we’ll each first try to resolve it by email within 30 days. If that fails, the courts competent for our registered address in Hungary have exclusive jurisdiction.

16. How these terms are made, and other terms

• Making the contract: these terms become a contract when you accept them while creating your account. You can check and correct your details before you create the account, and at any time after. The contract is in English. We don’t file a separate signed copy, but we keep the version you accepted and send it to you on request. Because you use the service as a business, sections 5(2) and 6(1)–(2) of Hungary’s E-Commerce Act (Act CVIII of 2001) don’t apply between us.
• Transfer: we may transfer these terms to a company we set up, or to whoever takes over the service, if it continues them on the same terms. We tell you in advance. You may transfer them along with your organization’s business.
• Notices: we write to your account owner’s email address, and you write to [email protected].
• Whole agreement: these terms, the BAA if you’ve signed it, and our Privacy Policy are the whole agreement about the service. If any part of these terms is invalid, the rest still applies.