Terms of Service

The agreement between you and Spark AI Partners for use of MAPD Tool.

Last updated: September 8, 2026

These Terms of Service (“Terms”) are an agreement between you and Spark AI Partners (“Spark AI Partners,” “we,” or “us”), the provider of the MAPD Tool platform (the “Service”). By creating an account or using the Service, you agree to these Terms. If you do not agree, do not use the Service.

1. Who may use the Service

The Service is offered only to insurance professionals who hold an active license to sell Medicare Advantage and Medicare Part D products, who hold current carrier appointments, and who have been granted their own individual access to the CMS Medicare Advantage Prescription Drug System (“MARx”) through a plan sponsor. You must be at least 18 years old and able to enter into a binding contract. You may not use the Service on behalf of anyone whose access has been suspended, revoked, or terminated.

2. What the Service does

We want you to understand precisely what the Service does before you connect anything to it. The Service:

• Reads the contact records you designate from your CRM, including client names and Medicare Beneficiary Identifiers (MBIs).
• Signs in to the CMS MARx portal using the credentials you supply, in a browser session running on our servers, and, where you have enabled it, does so on a recurring schedule at times when you are not present.
• Retrieves the multi-factor authentication code that CMS emails to the address associated with your MARx account, in order to complete that sign-in. See Section 4.
• Reads the enrollment status of the beneficiaries you designate and records what it finds.
• Writes the results back into your CRM, and, where you have enabled optional features, generates written summaries for your use.

Every action the Service takes in MARx is taken as you, under your credentials, and is attributed to you in CMS logs.

3. Your credentials, and the authority you are granting

When you enter your MARx username and password into the Service, you are appointing the Service to act at your direction as an automation of your own access. You represent and warrant that:

• The credentials are yours, individually issued to you, and you are the person CMS identity-proofed to hold them;
• You have the authority to use those credentials for the purposes described in Section 5; and
• You have determined, for yourself, that using an automation tool with those credentials is consistent with every agreement you have signed, including the HHS Rules of Behavior for Privacy and Security Awareness, your CMS system access agreements, and your carrier appointment and agent agreements.

How CMS access works, and what we hold. CMS grants MARx access to individuals. It identity-proofs a specific person, issues that person credentials through a plan sponsor, requires multi-factor authentication, and logs activity against that person. Separately, CMS operates authorization pathways for organizations that connect their own systems to CMS interfaces — plan sponsors and entities under contract with CMS. Those two things are often conflated, so to be precise about which one applies here:

• The Service does not connect to any CMS system interface, data feed, or API. It operates the same web portal you operate, in the same way a person operates it, using the credentials you supply.
• CMS certifies vendors where CMS has decided vendors should be certified. For the ACA Marketplace it runs exactly such a program — Enhanced Direct Enrollment — which puts a vendor through an independent audit against roughly 300 CMS security and privacy standards and publishes the resulting list of approved partners. Medicare has no counterpart. MARx access is granted to individuals through the CMS Enterprise Portal, sponsored by a carrier against its contract codes, and CMS operates no certification, approval, or registration program for software that operates a user's own MARx session. There is no MARx vendor approval to hold, to publish, or to withhold — not for us, and not for anyone else offering a tool in this category. If CMS establishes one, we will pursue it.
• The agreements governing MARx access — the HHS Rules of Behavior, your CMS system access agreements, and your carrier appointment and agent agreements — are between you, CMS, and your carriers. We are not a party to any of them. We therefore cannot authorize your use of the Service under them, and no statement by us should be read as doing so.

What this means for you. The decision about whether automating your own MARx access is consistent with the agreements you have signed is yours to make, and it is a real decision that deserves real thought. By entering your credentials into the Service, you confirm that you have considered it, that you believe your use is permitted, and that you accept responsibility for that determination. We would rather you take the time to be sure — including by asking your upline, your carrier, or your own counsel — than connect your credentials on the assumption that a vendor has made the determination for you. No vendor can make it for you, and any vendor telling you otherwise is describing an approval that does not exist.

4. Access to your verification-code email

CMS delivers a one-time verification code by email each time a sign-in occurs. To complete an automated sign-in, the Service must be able to read that code.

Today, the Service obtains the code through a Google account authorization you grant, and the technical permission Google issues for that purpose (gmail.readonly) is broader than the code itself: it is a read permission over the mailbox. The Service queries only for messages from no-reply@idm.cms.gov with a verification-code subject, and does not read, store, index, or transmit any other message. We nevertheless consider a mailbox-wide permission to be more access than this function requires, and we are replacing it with a narrower mechanism in which you forward only CMS verification messages to a dedicated address, and no mailbox authorization is held at all.

You may revoke the Service's access to your email at any time, from your Google account security settings or from your MAPD Tool settings page. Automated checks will stop working until an alternative is configured.

5. Permitted use and purpose limitation

You may use the Service only to check the Medicare enrollment status of beneficiaries with whom you have, or have had, a bona fide agent-client relationship, and only for purposes connected to servicing that relationship — including confirming that an enrollment you submitted took effect, identifying enrollments that terminated, and meeting your own obligations to your clients and carriers.

6. Prohibited uses

You may not use the Service to:

• Look up any individual with whom you do not have, and have never had, an agent-client relationship;
• Look up individuals on behalf of another person, agency, or downline that does not hold its own MARx access;
• Share your MAPD Tool account, or the MARx credentials stored in it, with anyone who is not individually authorized to use them;
• Compile, resell, license, or otherwise distribute beneficiary data obtained through the Service;
• Use beneficiary data obtained through the Service for any marketing purpose that is not permitted under 42 C.F.R. Part 422 Subpart V and applicable CMS marketing guidance; or
• Use the Service in any way that violates the HHS Rules of Behavior, your CMS access agreements, your carrier agreements, HIPAA, or applicable state or federal law.

We may suspend or terminate your account immediately if we believe in good faith that any of the above has occurred.

7. Protected Health Information

Information the Service handles on your behalf — including client names, MBIs, and plan enrollment data — is Protected Health Information (“PHI”) under HIPAA. In handling it, we act as your business associate or as a subcontractor business associate, as applicable. A Business Associate Agreement is available on request and, where required, must be executed before you place PHI into the Service. Our handling of PHI is described in the Privacy Policy, which forms part of these Terms.

8. Your own compliance obligations

You remain solely responsible for your compliance with the agreements governing your MARx access, your carrier appointments, HIPAA, and applicable law. Nothing in the Service, in our documentation, or in any statement by us is legal or compliance advice. The Service does not relieve you of any obligation, and we do not monitor or certify your use for compliance on your behalf.

9. Third-party services

The Service integrates with third parties in order to function, including your CRM, our payment processor, and an artificial-intelligence provider used for optional plan-comparison features. Those integrations, and the data shared with each, are itemized in the Privacy Policy. Your use of a third-party service is governed by that provider's own terms.

10. Fees, billing, and cancellation

Subscription fees and any usage-based charges are billed to the payment method you provide, in advance for subscription periods and in arrears for usage-based charges, through our payment processor. Fees are non-refundable except where required by law. You may cancel at any time; cancellation takes effect at the end of the then-current billing period. We may change pricing on at least 30 days' notice.

11. Service availability

The Service depends on systems we do not control, including MARx, your CRM, and your email provider. Changes to any of them can interrupt or degrade the Service without notice. We do not commit to any uptime level, and the Service is provided “as is” and “as available,” without warranties of any kind, express or implied, including any warranty of merchantability, fitness for a particular purpose, accuracy, or non-infringement.

12. Accuracy of results

The Service reports what MARx returns at the moment it is read. MARx data can be incomplete, delayed, or subsequently corrected, and automated reading can fail. You are responsible for verifying any result before acting on it, particularly before contacting a beneficiary or taking any action that affects a beneficiary's coverage.

13. Limitation of liability

To the maximum extent permitted by law, neither party will be liable for indirect, incidental, special, consequential, exemplary, or punitive damages, or for lost profits, lost revenue, or loss of data. Our total aggregate liability arising out of or relating to the Service will not exceed the amounts you paid us for the Service in the twelve months preceding the event giving rise to the claim. Nothing in this section limits liability that cannot be limited under applicable law.

14. Indemnification

You will indemnify and hold harmless Spark AI Partners from any claim, loss, or liability arising out of your use of the Service in violation of these Terms, your misuse of credentials, or your breach of any agreement governing your MARx access or carrier appointments.

15. Suspension and termination

You may terminate at any time by cancelling your account. We may suspend or terminate your access for breach of these Terms, non-payment, or where we believe continued operation creates legal or security risk to you, to beneficiaries, or to us. On termination we will, at your direction, return or delete the data we hold on your behalf, as described in the Privacy Policy.

16. Changes to these Terms

We may update these Terms. If a change is material, we will give notice in the application or by email before it takes effect, and continued use after that date constitutes acceptance. The “Last updated” date above always reflects the current version.

17. Governing law

These Terms are governed by the laws of the State of Utah, without regard to its conflict-of-laws rules. The exclusive venue for any dispute is the state and federal courts located in Utah County, Utah.

18. Contact

Spark AI Partners — support@sparkaipartners.com