Signal/pitch/legal/legal-research-notes.md

Legal Research Notes — Gaboro DME Pilot (Signal)

Prepared: June 7, 2026 For: LOI and Mutual NDA drafting — Robert Robinson call June 10, 2026 Attorney review: Nixon Law Group (Clyde), 30-minute review

---

DMEPOS Pilot Agreement Research

Standard Healthcare SaaS Pilot Structure

Healthcare SaaS pilot agreements for B2B DMEPOS or clinical workflow tools typically follow this structure:

1. LOI or Term Sheet phase — non-binding, sets commercial terms and data handling expectations before a formal agreement is executed. LOIs in healthcare tech commonly include: pilot duration, fee terms, data scope, feedback obligations, and IP ownership statements.

2. Pilot duration norms — 90 days is standard for DMEPOS workflow tools. Some vendors use 60-day pilots; 90 days allows at least one full CGM resupply cycle (typically 84 or 90 days) to be observed end-to-end, giving meaningful outcome data.

3. Termination notice — 30 days written notice is standard in healthcare B2B pilots. Pilots with federal program data (Medicare, Medicaid) sometimes use 15-day notice for data security reasons; 30 days is more protective of the supplier and gives adequate wind-down time.

4. Data deletion obligations — Healthcare SaaS agreements typically specify 30 days for data deletion post-termination. Signal's 10 business day standard (approximately 2 calendar weeks) is faster than typical and is a stronger commitment to Gaboro.

5. Reference rights — Common in early-stage B2B healthcare tech. Standard language: named reference right conditioned on prior written approval of specific usage, with revocation option. 30-day revocation notice is market standard.

6. Feedback and case study rights — Feedback obligations in healthcare pilot agreements are typically described as "good faith" with no minimum volume or format requirement. Case study rights requiring named attribution always require written approval; anonymized aggregate use is typically granted without separate approval.

7. Fee lock for founding partners — "Price lock for life" provisions are commercially common in SaaS early adopter programs. Must be clearly conditioned on the subscription remaining active and continuous (gap in subscription may reset the founding rate).

Data Use Provisions for De-identified DMEPOS Operational Data

Signal's data model (patient_id, device_type, shipment_date, payer) falls into a category that DMEPOS suppliers often share with third-party workflow vendors. Key considerations:

• Operational data shared with B2B vendors is typically governed by Business Associate Agreements (BAAs) when it includes PHI, or by standard data sharing provisions when it is de-identified.
• The LOI should explicitly state what data fields are in scope and exclude PHI fields by name.
• The burden of ensuring de-identification compliance should rest on the uploading party (Gaboro), since Gaboro controls what is included in the CSV export.

---

Pennsylvania Law Notes

PA Governing Law for Commercial Software Agreements

Pennsylvania's Uniform Commercial Code governs tangible goods. Software licensing and SaaS agreements in PA are governed by common law contract principles (not the UCC), which is the majority rule for software. PA has not adopted UCITA (Uniform Computer Information Transactions Act).

What PA governing law means for this agreement:

1. Venue — PA governing law in a commercial contract supports specifying PA state or federal courts as exclusive venue. Both state courts (Court of Common Pleas) and federal courts (Eastern or Western District of PA) are available. The NDA draft specifies "state and federal courts located in Pennsylvania" without pinning a specific district — this is intentional and appropriate for a mutual NDA at this stage.

2. Statute of Limitations — PA's statute of limitations for written contract breach is 4 years (42 Pa. C.S. § 5525). This is relevant to the NDA's remedies section.

3. Limitation of Liability — PA enforces limitation of liability clauses in commercial contracts between sophisticated parties. The current LOI and NDA drafts do not include a limitation of liability clause. This is a gap the attorney should address in the formal Pilot Agreement (the LOI defers LOL to the formal agreement).

4. Equitable Relief — PA courts enforce injunctive relief provisions in NDAs. The NDA's remedies section (Section 9) is appropriately drafted for PA law — it requests equitable relief without waiving bond requirements in a way that courts might reject, noting "without the requirement of posting bond" which is enforceable in PA for trade secret and confidentiality matters.

5. Attorney fee shifting — PA follows the American Rule (each party bears own fees absent a statute or contract clause). The current drafts do not include fee-shifting language. The attorney may advise adding a prevailing-party clause in the formal agreement.

PA-Specific Notes for SaaS Agreements

• PA does not impose specific state-level data protection obligations on B2B data exchanges of the type described in Signal's pilot (no PA equivalent of CCPA for business-to-business operational data).
• PA's Breach of Personal Information Notification Act (BPINA) applies to computerized data containing personal information. Signal's de-identified data model (no names, SSNs, DOBs) means BPINA does not apply to the pilot data set. This supports the LOI's de-identification statement.

---

HIPAA and Data Notes

Does Signal's Data Require a BAA?

The core question: Does Signal's data set (patient_id as internal MRN, device_type, shipment_date, payer) constitute PHI under HIPAA?

Analysis:

Under HIPAA, PHI is individually identifiable health information — information that relates to the past, present, or future health or condition of an individual, and that identifies or could identify the individual.

The 18 HIPAA safe harbor identifiers include: names, geographic data smaller than state, dates (other than year) for individuals, telephone numbers, SSNs, account numbers, and several others. HIPAA's safe harbor method (45 CFR 164.514(b)) requires removing all 18 identifiers and having no actual knowledge that the information could identify an individual.

Signal's patient_id issue: An internal MRN or account number assigned by the DMEPOS supplier is technically an "account number" — one of the 18 HIPAA safe harbor identifiers. This means the data as structured (with patient_id present) is NOT fully de-identified under the HIPAA safe harbor method.

Practical consequence:

• If patient_id is an account number (18th identifier), a BAA may be required even though Signal never sees names, SSNs, or DOBs.
• Alternatively, the supplier could hash or tokenize the patient_id before upload, which would remove the account number identifier and enable true safe harbor de-identification.

Signal's current architecture: Signal stores a hashed patient_id (SHA-256), not the raw patient_id. The hashing occurs in Signal's normalizer before storage. However, the raw patient_id is present in the uploaded CSV during transmission and processing.

Recommendation for attorney review: This is the most significant open legal question for the pilot. Nixon Law Group should advise whether:

1. A BAA is required given that raw account numbers (patient_id) are present in the CSV during upload/processing, even if hashed before storage.
2. The LOI should be amended to either require the supplier to hash patient_ids before upload, or to add a BAA alongside the pilot agreement.
3. The "no patient names, SSNs, DOBs" language in the LOI is sufficient for the pilot stage, or whether a formal HIPAA de-identification certification is needed.

Current LOI language: The LOI currently states that "Partner will not include patient names, Social Security numbers, dates of birth, addresses, or any other direct identifiers." This language does not resolve the account number / MRN question. The attorney should be asked directly about this gap.

Data Use Agreement vs. BAA

• A Business Associate Agreement (BAA) is required when a covered entity or business associate shares PHI with a vendor for purposes of treatment, payment, or healthcare operations.
• A Data Use Agreement (DUA) is used for limited data sets — data from which most direct identifiers have been removed, but dates and geographic data smaller than state may remain.
• Signal's data sits between these categories. If a BAA is required, it should be executed alongside or before the pilot agreement, not after.

Practical Risk Assessment for Pilot Stage

Signal's de-identification architecture (no names, no SSNs, no DOBs, hashed patient_ids in storage) is a reasonable good-faith effort at privacy protection for a pre-revenue pilot. The key risk is that "good faith" is not a HIPAA defense. The attorney should be asked to give a written opinion (even informal email memo) on BAA necessity before the first CSV upload.

---

Judgment Calls and Attorney Review Flags

The following items required judgment beyond the locked spec and should be reviewed by Nixon Law Group:

1. BAA vs. no BAA — The most critical open question. See HIPAA notes above. LOI Section 5 does not include or reference a BAA. If a BAA is required, the formal Pilot Agreement needs one.

2. Limitation of liability — Neither the LOI nor the NDA includes a LOL clause. The LOI defers to the formal Pilot Agreement. The attorney should advise on: (a) whether any LOL language belongs in the NDA, and (b) appropriate LOL for the formal agreement (e.g., 12 months of fees paid — which would be $0 during a free pilot, creating an odd cap).

3. Venue specificity — NDA Section 10 names "state and federal courts located in Pennsylvania" without specifying a district or county. For the formal agreement, the attorney should advise whether to specify Philadelphia or Allegheny County (STTIL's location should drive this).

4. Fee lock trigger — LOI Section 4 states the $199/month rate is locked "so long as the subscription remains active." The attorney should advise whether a grace period for subscription lapses is needed (e.g., 30 days to reinstate without losing founding rate), to prevent accidental loss of a founding partner's contractual benefit.

5. Reference rights revocation — LOI Section 7 grants Gaboro a 30-day revocation right. The attorney should confirm whether materials already published with Gaboro's approval (e.g., investor decks) must be recalled on revocation, or whether revocation only limits future use.

6. Case study rights scope — LOI Section 6 grants STTIL the right to "anonymized, aggregated data" for investor reporting during the pilot, without a separate approval requirement. The attorney should confirm this is sufficient for typical VC due diligence use cases, where aggregate outcome data (e.g., "a Midwestern DMEPOS supplier reduced denial rates by X%") is standard.