Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The agreement establishes that W&B's Business Associate Agreement, which governs HIPAA-compliant processing of protected health information, applies only to Enterprise-tier customers and only when the BAA is explicitly included in the Customer's Order Form.
This analysis describes what Weights & Biases's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes that non-Enterprise customers, including those on standard paid plans, do not receive HIPAA-compliant data processing protections under the BAA, which is a material limitation for any organization in healthcare or life sciences that processes PHI through W&B.
The updated agreement no longer includes language stating that a previously executed written agreement between Customer and W&B would govern and supersede the master service agreement. This removal eliminates explicit recognition of contractual hierarchy that may have applied to customers with signed agreements predating the master terms. The practical effect depends on whether such customers have separate agreements in place and how contract interpretation and applicable law would treat the relationship between a posted master agreement and a signed customer agreement absent explicit supersession language.
View change record →The updated Terms of Service no longer include the previous statement that services would become inaccessible from certain locations starting September 1st, 2025. This removal means the geographic restriction that was previously announced in the agreement is no longer formally stated in the current terms. Users who were affected by or concerned about the prior restriction should review current documentation to confirm whether any geographic limitations remain in effect.
View change record →Under this clause, HIPAA-regulated data processing protections apply only to Enterprise customers who have included the BAA in their Order Form. Organizations in healthcare or life sciences that use W&B under non-Enterprise subscriptions should assess whether their use involves protected health information and whether this limitation creates compliance exposure.
Cross-platform context
See how other platforms handle BAA Limited to Enterprise Customers Only and similar clauses.
Compare across platforms →Monitoring
Weights & Biases has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"W&B will process all Customer Data for the purposes set forth in this Agreement and in accordance with the BAA, only for Enterprise Customers and only if the BAA is included in Customer's Order Form.Excerpt from Weights & Biases's Terms of Service
1) REGULATORY LANDSCAPE: HIPAA's Privacy Rule and Security Rule require covered entities and their business associates to execute a BAA before sharing PHI. This provision creates a structural gap under which non-Enterprise customers who process PHI through W&B may lack the contractual HIPAA protections required by law. HHS OCR is the primary enforcement authority. 2) GOVERNANCE EXPOSURE: High for healthcare and life sciences customers on non-Enterprise plans. The absence of a BAA for non-Enterprise customers means that any PHI submitted as Customer Data to W&B by a covered entity or business associate may not be processed under HIPAA-compliant terms, potentially constituting a HIPAA violation by the Customer. 3) JURISDICTION FLAGS: HIPAA applies to all U.S. covered entities and their business associates regardless of plan tier. Healthcare organizations outside the U.S. should assess whether equivalent data protection requirements apply in their jurisdiction. 4) CONTRACT AND VENDOR IMPLICATIONS: Procurement teams in healthcare, life sciences, and any sector where PHI may be embedded in machine learning training data or research datasets should confirm Enterprise tier status and BAA inclusion in the Order Form before submitting any PHI to W&B. Non-Enterprise customers should contractually prohibit submission of PHI pending BAA execution. 5) COMPLIANCE CONSIDERATIONS: Compliance teams should implement a data classification process to identify whether Customer Data submitted to W&B contains PHI, verify Order Form BAA inclusion for Enterprise customers, and establish internal controls preventing PHI submission by non-Enterprise users.
This provision establishes that non-Enterprise customers, including those on standard paid plans, do not receive HIPAA-compliant data processing protections under the BAA, which is a material limitation for any organization in healthcare or life sciences that processes PHI through W&B.
Under this clause, HIPAA-regulated data processing protections apply only to Enterprise customers who have included the BAA in their Order Form. Organizations in healthcare or life sciences that use W&B under non-Enterprise subscriptions should assess whether their use involves protected health information and whether this limitation creates compliance exposure.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Weights & Biases.