Disclosures and agreements
Version 2026-09-20. Everything a provider signs at signup and everything a patient is told before applying, in one place.
Electronic signature and records consent
By checking the agreement box at signup and typing your name, you agree that your typed name is your electronic signature and has the same effect as a handwritten one; that EMRfi may deliver notices, agreements, and receipts electronically to the email on your account; that you can access these records with a current web browser and email; that you may withdraw this consent or request paper copies through the contact form, in which case EMRfi may be unable to continue providing the service; and that EMRfi records your name, title, the date and time, your IP address, and the version of each document you accept.
Patient disclosure
This is shown to every patient before a payment form appears.
- Who you are paying. The provider named on the page. EMRfi (Belmont Labs Inc.) operates the page on the provider's behalf and is not the lender, the provider, or the payment processor.
- Fees. Where the provider has chosen the patient-pays model, the plan amount equals your balance plus an EMRfi service fee (2.9% of the balance) and the payment processor's fee. The exact dollar amounts are shown above the form before you decide. Where the provider absorbs fees, the plan amount equals your balance.
- Pay over time. Offered by Affirm, Inc. or its lending partners under Affirm's own terms, rates, and eligibility rules. Affirm will ask you to complete its application, may check your credit, and alone decides whether to approve you. Approval is not guaranteed, and declining to apply does not affect your care.
- Your information. Card and bank details go directly to Stripe; application details go directly to Affirm. EMRfi stores the amount, your provider's reference number, the outcome, and, if the provider sent you the link, the phone number or email it was sent to. See the Privacy Policy.
- Questions about your balance go to the provider, using the phone number on the page. Questions about a payment plan go to Affirm.
Business Associate Agreement
This agreement is entered into between the organization identified at signup ("Covered Entity") and Belmont Labs Inc., doing business as EMRfi ("Business Associate"), and is effective on the date of electronic acceptance. Capitalized terms have the meanings given in HIPAA (45 CFR Parts 160 and 164).
1. Purpose
Business Associate provides pay-over-time technology under the EMRfi Terms of Service (the "Services") and may receive or create Protected Health Information ("PHI") on behalf of Covered Entity in doing so, limited to payment amounts, account references, contact information used to deliver payment links, and payment outcomes.
2. Permitted uses and disclosures
Business Associate may use and disclose PHI only to perform the Services, as required by law, and for its own proper management and administration provided any disclosure for that purpose is required by law or made under written assurances of confidentiality. Business Associate will not sell PHI or use it for marketing.
3. Safeguards
Business Associate will implement administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of electronic PHI as required by the Security Rule, including encryption in transit and at rest, access controls, audit logging, and workforce training.
4. Reporting
Business Associate will report to Covered Entity any use or disclosure of PHI not permitted by this agreement, any Security Incident, and any Breach of Unsecured PHI, without unreasonable delay and no later than ten (10) business days after discovery, with the information Covered Entity needs to meet its notification obligations under 45 CFR 164.410.
5. Subcontractors
Business Associate will ensure that any subcontractor that creates, receives, maintains, or transmits PHI on its behalf agrees in writing to the same restrictions and conditions. Current subcontractors are listed in the Privacy Policy and include the hosting provider and message-delivery vendor. Stripe and Affirm receive information directly from the patient under their own agreements and are not subcontractors of Business Associate.
6. Individual rights
Within ten (10) business days of request, Business Associate will make PHI available to Covered Entity to fulfill an individual's right of access, amendment, or accounting of disclosures under 45 CFR 164.524, 164.526, and 164.528.
7. Books and records
Business Associate will make its internal practices, books, and records relating to PHI available to the Secretary of Health and Human Services for purposes of determining compliance.
8. Minimum necessary
Business Associate will request, use, and disclose only the minimum PHI necessary to perform the Services, and Covered Entity will not send PHI beyond what the Services require.
9. Term and termination
This agreement lasts as long as Business Associate holds PHI for Covered Entity. Covered Entity may terminate it and the Services if Business Associate materially breaches it and does not cure within thirty (30) days of notice. On termination, Business Associate will return or destroy all PHI, or, where that is infeasible, extend these protections for as long as it is retained and limit further use to the purposes that make return infeasible.
10. General
This agreement is interpreted to permit compliance with HIPAA and amended as needed to keep it compliant. Where it conflicts with the Terms of Service, this agreement controls as to PHI. It creates no third-party rights. Texas law governs, except where HIPAA preempts.
Electronic acceptance at signup, with the signer's typed name, title, date, and IP address, constitutes execution by both parties. Organizations that require their own BAA form may submit it through the contact form.