The Imprivata Master License and Services Agreement (MLSA) is the master contract between Imprivata, Inc. and the entity named as customer in an Order Form. It covers Imprivata’s On-Premise Software, Cloud Services, Managed Services, Professional Services and Hardware.[1] It replaced three documents that Imprivata archived on 2026-08-31: the End User License Agreement for Imprivata Software, the SecureLink End User License Agreement and the Master Cloud Services Agreement.[2] Product Specific Terms, “indicated by SKU on the applicable Order Form”, add product-level pricing metrics and limits.[1] For a licence manager, the MLSA settles four questions: who may use the software, whether a licence is perpetual or term, what Imprivata may audit, and how Support affects the right to new versions.
Editions
The MLSA has no editions. It sorts what a customer buys into three groups. Products are “the On-Premise Software and Cloud Services as set out in an Order Form”. Services are Managed Services and Professional Services. Hardware means Imprivata branded devices.[1] On-Premise Software includes object code, “all modules, interfaces, updates and enhancements” provided, customized features and documentation.[1] An Appliance is an Imprivata “virtual (or otherwise emulated) appliance that uses virtual processors”.[1]
The legal index links Product Specific Terms for Access Intelligence, Customer Connect, Enterprise Access, FairWarning, GroundControl, Hardware, Maintenance and Support, Managed Services and Patient Access. It also lists separate agreements for evaluations, managed services, technology partners and Imprivata OGiTiX GmbH software.[7]
Metrics
The MLSA defines two user metrics and leaves the rest to the Product Specific Terms.
- User. An individual authorized by the customer “to use the Products pursuant to a subscription”. Users can include employees, consultants, clients, external users, contractors, agents and third parties. The quantity must follow “the terms set forth in any Product Specific Terms”.[1]
- Non-Clinical User License. A named individual who works for the customer “but does not provide healthcare to patients and at no time uses the Products to access Customer’s electronic medical record system”. A separate licence is needed for every such user, because the product “is not licensed on a concurrent user basis”.[1] Catalog proof: Non-Clinical User licences exclude clinicians and EMR access.
The archived EULA had more metrics: User, Device, Managed Identity, Authentication, Named Hospital and Clinic. It used the same non-concurrent wording for users and devices.[3] Licences bought under it are still counted in those units. Catalog proof: Each named user needs a licence whether or not active.
Counting / floors
Licence grants
For On-Premise Software, Imprivata grants “for its direct and internal business purposes a limited, non-transferable, non-sublicensable license to install and use” the software “in the license quantities set out in the applicable Order Form”. The Order Form “shall specify whether the license is subscription-based (for the duration of the applicable Subscription Term) or perpetual”.[1] For Cloud Services, the grant runs only during the Subscription Term, for internal business purposes and “solely for the benefit of Customer”. The customer must provision Users, restrict access, manage administrators and deauthorize personnel who no longer need access.[1] Catalog proof: Order Form states whether On-Premise Software is subscription or perpetual.
The archived EULA granted a licence that was “perpetual (excluding term-based licenses)”. It covered employees, independent contractors, consultants and outsourced workers. It also allowed one backup copy of the Software.[3] For term-based licences, the licence key “is programmed to expire at the end of the applicable license term”.[3] Catalog proof: Term-based licence keys expire at term end.
Affiliates
The customer may let its Affiliates’ Users use Products bought under its Order Form. An Affiliate that signs an Order Form becomes bound “as if it were an original party”. The customer and each Affiliate are jointly and severally liable. “The usage of each Affiliate will be included when measuring usage and subscription compliance (including incremental subscription fees, if applicable).”[1] An Affiliate needs more than 50% ownership or control.[1] The archived EULA used a narrower term, “Licensed Facility”: majority-owned hospitals and healthcare facilities.[3] The Enterprise Access (vendor access) appendix switches the Affiliates clause off entirely.[9] Catalog proof: Affiliate usage counts toward subscription compliance.
Restrictions
Section 2.5 lists the prohibited uses. The following matter most for licence position:
- making a Product available to third parties other than Users, or including it “in a service bureau, time sharing or outsourcing offering”;
- using the Products “in a way that circumvents a contractual, technical, or usage limit”;
- performing “monitoring or evaluation or benchmarking, security, penetration, or other testing”;
- providing “timesharing, service bureau, subscription or managed service, hosting, outsourcing, rental or similar services”;
- using any output of a Product to train or benchmark artificial intelligence models;
- giving any competitor of Imprivata access to the Products, including read-only access.[1]
A breach of Section 2.5 lets Imprivata terminate the Agreement or any Order Form immediately.[1] Catalog proof: No service bureau, outsourcing or managed service use; No benchmarking or penetration testing of Products.
Audit, self-certification and monitoring
The customer “consents to Imprivata auditing it to ascertain Customer’s compliance with this Agreement and its Licensed Capacity, including the number of Users, and any other applicable metric used in pricing”. Imprivata or an independent auditor conducts the audit during business hours, “at Customer’s expense”. Underpaid subscription fees must be paid promptly.[1] Customers that do not implement analytics around performance and utilization reporting must send annual self-certification reports. An authorized officer signs and certifies each report. It must cover usage “for all Products across all environments” and identify “peak usage periods and maximum concurrent usage”.[1] Imprivata may also monitor use of the Products and suspend or throttle access where it suspects a violation.[1] Catalog proof: Audit of Licensed Capacity at customer expense; Annual officer-signed self-certification without usage analytics.
The archived agreements were milder. The EULA allowed a request “not more frequently than once during any 12 month period” for a certification by the Chief Financial Officer. An audit by an independent auditor followed only if the certification was not provided within 30 days.[3] The Master Cloud Services Agreement already had an audit consent covering “the number of Users, Affiliates and any other applicable metric used in pricing”.[4] Catalog proof: Archived EULA: CFO certification once a year on request.
Payment and term
Invoices are due within 30 days, and “all payment obligations are non-cancellable and non-refundable” unless the Agreement says otherwise. Undisputed fees 30 or more days overdue can lead to late charges of up to 1.5% per month and suspension.[1] The Agreement lasts until the last Subscription Term ends. On expiry or termination, “all Products and Services obtained by Customer … shall terminate, and Customer shall cease using the applicable Products”.[1] In a conflict the Order Form prevails, then the Agreement, then the Documentation. Pre-printed purchase order terms do not apply.[1] Catalog proof: Fees are non-cancellable and non-refundable; Products stop on expiry or termination; Order Form prevails over the MLSA and Documentation.
Virtualization & partitioning
The MLSA has no processor, core or host rule. The only virtualization term is the definition of the Appliance as a virtual appliance using virtual processors.[1] Maintenance and Support covers “Imprivata Product or Virtual Appliance” errors only in Supported Environments listed on Imprivata’s supported configuration matrices.[5] The archived SecureLink EULA counted instances. It allowed a single instance, two more for high availability and one for disaster recovery with a business continuity package, plus a Sandbox instance for non-production testing if bought.[8] Catalog proof: SecureLink: one instance plus HA, DR and sandbox options.
Cloud / BYOL
Cloud Services are a subscription right only. They carry a limited warranty that they conform substantially to the Documentation during the Subscription Term. If they do not, Imprivata repairs or replaces them, or terminates and refunds the unused term.[1] Imprivata may store Customer Data in any region where it operates. AI-Enabled Features are decision-support tools, and Imprivata may throttle them when usage “materially exceeds normal usage patterns”.[1] No bring-your-own-licence terms exist.
Programs
Maintenance and Support
Support “is included in the Cloud Services and/or On-Premise Software subscription cost”. Perpetual licences “do not entitle Customer to updates which shall require a current Support subscription”. A customer that buys Support for any perpetual On-Premise Software “must purchase the same level of Support for all On-Premise Software licensed by Customer”.[1] The Maintenance and Support terms add the following:
| Term | Rule |
|---|---|
| Term | 12 months from delivery, renewing annually unless 30 days’ notice[5] |
| Scope of renewal | “only for all Products and Hardware licensed by Customer; partial renewals will not be accepted”[5] |
| Price | Then-current price list; changes on 60 days’ notice for the next term[5] |
| Reinstatement | All fees for the lapsed period plus “an additional 5% reinstatement fee”[5] |
| Versions | Maintenance releases for the current and two prior versions; defect resolution for at least 24 months from release[5] |
| Levels | Standard (3 Named Support Contacts) and Premium (6), all ICE-trained; Premium adds out-of-hours Priority 1 calls[5] |
| New features | Features in major new versions, “if priced separately”, are not included[5] |
The Support terms also say Imprivata collects summary usage data, including “number of deployed and enrolled users per application”. Customers can opt out through Customer Support.[5] Catalog proof: Same Support level for all perpetual On-Premise Software; Support renews for all Products, no partial renewals; Support reinstatement costs back fees plus 5%; Maintenance releases for current and two prior versions; Named Support Contacts: 3 Standard, 6 Premium.
Trial Services
Products offered for evaluation, trial or beta may be used “solely for Customer’s internal evaluation purposes during the period designated by Imprivata on the Order Form (or if not designated, 30 days)”. They come without indemnification, support, service level agreement or warranty. They may not be used for competitive analysis, commercial, product development or for-profit purposes.[1] Catalog proof: Trial Services default to 30 days, internal evaluation only.
Hardware
Imprivata branded hardware carries a Hardware Warranty of twelve months from shipment. Third-party authentication devices get the manufacturer’s warranty instead.[6] Under the MLSA these devices are non-cancelable and non-returnable.[1] Firmware in the Hardware “is licensed, not sold, solely for use with the Hardware in which it is incorporated”.[6] Catalog proof: Embedded Software is licensed only with its Hardware.
Out of scope
This article does not analyse the Business Associate Agreement, the Data Processing Addendum, indemnities beyond intellectual property, or export control terms, except as quoted above. Product metrics are in Imprivata licensing and the product articles. The MLSA is governed by Massachusetts law.[1] Customers with a negotiated agreement should check whether its terms override the web MLSA.