The agreement establishes that W&B's Business Associate Agreement, which governs HIPAA-compliant processing of protected health information, applies only to Enterprise-tier customers and only when the BAA is explicitly included in the Customer's Order Form.
This analysis describes what Weights & Biases's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes that non-Enterprise customers, including those on standard paid plans, do not receive HIPAA-compliant data processing protections under the BAA, which is a material limitation for any organization in healthcare or life sciences that processes PHI through W&B.
The updated agreement no longer includes language stating that a previously executed written agreement between Customer and W&B would govern and supersede the master service agreement. This removal eliminates explicit recognition of contractual hierarchy that may have applied to customers with signed agreements predating the master terms. The practical effect depends on whether such customers have separate agreements in place and how contract interpretation and applicable law would treat the relationship between a posted master agreement and a signed customer agreement absent explicit supersession language.
View change record →The updated Terms of Service no longer include the previous statement that services would become inaccessible from certain locations starting September 1st, 2025. This removal means the geographic restriction that was previously announced in the agreement is no longer formally stated in the current terms. Users who were affected by or concerned about the prior restriction should review current documentation to confirm whether any geographic limitations remain in effect.
View change record →Under this clause, HIPAA-regulated data processing protections apply only to Enterprise customers who have included the BAA in their Order Form. Organizations in healthcare or life sciences that use W&B under non-Enterprise subscriptions should assess whether their use involves protected health information and whether this limitation creates compliance exposure.
Cross-platform context
See how other platforms handle BAA Limited to Enterprise Customers Only and similar clauses.
Compare across platforms →"W&B will process all Customer Data for the purposes set forth in this Agreement and in accordance with the BAA, only for Enterprise Customers and only if the BAA is included in Customer's Order Form.Excerpt from Weights & Biases's Terms of Service
1) REGULATORY LANDSCAPE: HIPAA's Privacy Rule and Security Rule require covered entities and their business associates to execute a BAA before sharing PHI.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
This provision establishes that non-Enterprise customers, including those on standard paid plans, do not receive HIPAA-compliant data processing protections under the BAA, which is a material limitation for any organization in healthcare or life sciences that processes PHI through W&B.
Under this clause, HIPAA-regulated data processing protections apply only to Enterprise customers who have included the BAA in their Order Form. Organizations in healthcare or life sciences that use W&B under non-Enterprise subscriptions should assess whether their use involves protected health information and whether this limitation creates compliance exposure.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Weights & Biases.