Customer agreement templates
Download the agreement that fits your use case, fill in your organisation's details, sign electronically, and email the executed copy back to info.qrcodekey@gmail.com. We will counter-sign within one business day and you can begin processing the relevant data immediately afterwards.
HIPAA Business Associate Agreement (BAA)
HealthcareWhen you need it: You are a Covered Entity or Business Associate under HIPAA (clinic, hospital, doctor, dentist, pharmacy, mental-health practice, lab, urgent-care) and want to process Protected Health Information (PHI) through QRCodeKey.
FERPA School Data Addendum
EducationWhen you need it: You are a U.S. K-12 school, school district, college, or university handling student "education records" under FERPA, or processing student data under state student-privacy laws (CA SOPIPA, NY Ed Law § 2-d, IL SOPPA, CT, CO, MD, TX).
GDPR Article 28 Data Processing Agreement
Enterprise / EUWhen you need it: You are an EU / UK / EEA / Swiss customer, or a global enterprise that wants a standalone Article 28 (or equivalent) processor agreement covering GDPR, UK GDPR, India DPDP, Brazil LGPD, CCPA / CPRA service-provider terms, PIPEDA, Australia APP, and other regimes.
After you sign and send
- We acknowledge receipt within 1 business day.
- We counter-sign and email a fully-executed PDF back to you within 2 business days.
- If we propose any redlines we will mark them up in tracked changes and explain.
- Once executed, both parties keep a copy. You can begin processing the relevant data through QRCodeKey immediately.
- Renewal is automatic — these agreements track the underlying QRCodeKey Terms of Service.
Need the editable Word (.docx) version?
Email info.qrcodekey@gmail.com with subject "Word version of customer agreement" and tell us which template you need (BAA, School Addendum, or DPA). We will send the .docx so you can fill in your fields, redline if needed, and return tracked changes.
Other agreement questions
- • Custom MSA / SOW for enterprise procurement: email us with your standard paper.
- • Insurance certificate (COI): available on request once your account is in good standing.
- • Sub-processor list (referenced in the DPA): live at /sub-processors.
- • SOC 2 / ISO 27001 reports: not yet — we're early-stage. We rely on our sub-processors' certifications (MongoDB Atlas, Render, Stripe — all SOC 2 Type II).
Last updated 2026-05-10. Template versions: BAA v1.0, School Addendum v1.0, DPA v1.0.