Ownership, licensing & freedom to operateModule 05 · Founders, governance & business assets
IGNITE EXTENDED / LESSON 27
Ownership, licensing & freedom to operate
Does the company have the rights its plan requires?
A chain-of-rights and licensing review map.
1
27 / OpeningOwnership, licensing & freedom to operate
The decision and the learning goals
Trace creators, contributions and governing agreements.
Compare a license’s permissions with intended uses.
Separate ownership, protection and freedom-to-operate questions.
90-minute workshopOpening 5 minConcepts and original examples 35 minPractice 25 minDebrief 15 minReview 10 min
2
27 / TheoryOwnership, licensing & freedom to operate
The chain of ownership follows the contributions
An IP asset can pass through several people and agreements before a company relies on it. Founders, employees, contractors, universities and prior employers can have relevant rights or restrictions. A clean chain connects the actual creators and obligations to the company’s intended use.
Gather the contribution history and the governing documents. Do not infer ownership from a job title, payment or access to a repository. Where rights are missing or uncertain, identify the specific assignment, permission or review needed before the company makes a conflicting promise.
3
27 / TheoryOwnership, licensing & freedom to operate
A license defines permission and its limits
A license can specify permitted uses, users, territories, duration, modification, distribution and sublicensing. Payment terms describe only part of the arrangement. The company’s intended product or customer promise may require a right that the license does not grant.
Read obligations together. A component can be usable internally while imposing additional conditions when distributed. A service may restrict data reuse or require a particular attribution. The practical question is whether the rights and obligations fit the actual activity.
4
27 / TheoryOwnership, licensing & freedom to operate
Owning a copy and owning rights
Possessing a file or paying for an object does not describe every permitted use of the underlying work. A business must connect its intended activity to the rights it actually holds.
A copy or a service
Receiving code, a file or a product does not by itself explain all IP rights.
Rights and permissions
Ownership and licenses determine which uses, modifications, distributions or transfers are permitted.
Worked application
Illustrative application: a team receives a contractor’s source files and pays the invoice. Before promising commercial distribution, inspect the agreement, pre-existing components and third-party licenses. The ability to open and modify a local copy does not by itself explain who may license it to customers.
Trace each contribution to the permission required for the planned customer promise.
5
27 / TheoryOwnership, licensing & freedom to operate
A chain of ownership
Find gaps, restrictions and inconsistent promises before relying on the asset.
6
27 / TheoryOwnership, licensing & freedom to operate
Prior commitments can follow the work
Prior-employer, university or funded-research arrangements can affect ownership.
Contractors and collaborators may have rights that need agreement.
Keep contributions and relevant documents identifiable.
Do not infer a clean chain of title from someone’s job title.
7
27 / Source pageOwnership, licensing & freedom to operate
Leave the past behind: clean separation from prior employers
8
27 / Source pageOwnership, licensing & freedom to operate
Get it in writing: assignment, not just payment
9
27 / Source pageOwnership, licensing & freedom to operate
Deal with it: inbound IP claims
10
27 / Source pageOwnership, licensing & freedom to operate
Avoid a mess: joint ownership
11
27 / Source pageOwnership, licensing & freedom to operate
Watch the clock: patent deadlines and provisional applications
12
27 / TheoryOwnership, licensing & freedom to operate
Protection and freedom to operate
A right to exclude others from a protected invention does not automatically establish permission to practice every part of a product. The product may depend on another party’s rights, licenses or restrictions. This is why the source treats freedom to operate as a separate question.
A review should consider the intended product, market and geography. Identify the components and activities that create exposure. Avoid turning a preliminary search into an assurance that no relevant rights exist. The purpose of the learning exercise is to formulate the questions and evidence needed for a qualified review.
13
27 / TheoryOwnership, licensing & freedom to operate
Open-source compliance depends on the license and use
Open-source software arrives with permissions and conditions. Licenses differ, and the consequences can depend on modification, distribution, linking and the way a service uses the code. “Free to download” is not a complete rights analysis.
Maintain a component inventory with version, source, license and intended use. Review obligations that affect the delivery model, such as notices, source availability or redistribution terms. Also consider maintenance and security responsibilities, which are related operating questions but distinct from copyright permission.
14
27 / TheoryOwnership, licensing & freedom to operate
Protection and freedom to operate
A company’s ability to protect its own asset and its ability to carry out a planned activity are separate questions. Analyze both against the actual product and market.
Protection
The rights the company can assert or license.
Freedom to operate
Whether the proposed activity conflicts with other rights or obligations. Owning an asset does not answer every permission question.
Worked application
Illustrative application: a company develops an original interface around a licensed dataset and a third-party component. Its own work may have protectable aspects while commercial distribution still depends on upstream permissions. Identify the component, right, territory and use before assuming protection resolves delivery.
An IP map should connect assets, contributors, agreements and planned uses, then identify the decision or review each gap requires.
15
27 / TheoryOwnership, licensing & freedom to operate
Open-source and commercial licenses need inspection
Identify the component and the applicable license.
Check obligations for the intended modification, distribution or service use.
Track dependencies and compatibility of obligations.
Avoid broad claims that every free component has the same conditions.
16
27 / TheoryOwnership, licensing & freedom to operate
An IP map should lead to decisions
Inventory the important assets.
Record owners, creators, licenses and obligations.
Prioritize the uncertainties that affect financing or operations.
Get the specific technical and legal questions reviewed.
17
27 / Deep diveOwnership, licensing & freedom to operate
Relay's chain of rights before the seed
Every customer promise traces back to an upstream permission.
Read each row left to right: what Relay relies on, what it actually holds, what it promises clinics, and the gap. The gaps, not the assets, go to the top of the data-room list.
Figures and contract terms are illustrative; application depends on current law, the actual documents and review by qualified counsel.
Contribution
Governing document
What Relay holds
What Relay promises
Gap and action
Founders' code and designs
Founder IP assignment (L25)
Assigned rights from incorporation
Clean title to investors
Pre-incorporation work: confirm the assignment covers it
Daniel's SMS throttling module
Prior employer invention-assignment agreement
Uncertain
Proprietary platform
Review dates and terms; clean-room rewrite if any doubt
Change and termination risk; second EHR; information-blocking assessment
Open-source packages (412)
Each package license
Permissive and copyleft permissions
No restrictions on customer use
One AGPL library: replace or isolate; adopt SBOM scanning
LLM API (Relay Scheduler)
Vendor commercial terms and BAA
Output ownership; no training on customer content; indemnity with exclusions
PHI protected; no reuse by third parties
Confirm the BAA covers the exact configuration; set retention
Clinic data for model training
Clinic BAAs and subscription agreements
Use only as the BAA permits
Better predictions for every clinic
Add an explicit de-identified service-improvement right
18
27 / Source pageOwnership, licensing & freedom to operate
Stay free: contract terms that limit future freedom
19
27 / Source pageOwnership, licensing & freedom to operate
Keep an eye on the exit: assignability
20
27 / Source pageOwnership, licensing & freedom to operate
Should I sign that NDA?
21
27 / Source pageOwnership, licensing & freedom to operate
Open source 101: no warranties, strings attached, SaaS triggers
22
27 / Current practiceOwnership, licensing & freedom to operate
Current practice: licensing AI models, APIs and open source
LLM vendor terms set the ceiling
Major API terms now state that customers own outputs and that the vendor does not train on business customer content by default. Anthropic's Commercial Terms (effective June 17, 2025) bar training on customer content and include an IP indemnity for paid use with listed exclusions; OpenAI states API data is not used for training unless the customer opts in, and may be retained for up to 30 days by default. Read the exclusions and retention settings, not just the headline.
Upstream training-data risk is real
In Bartz v. Anthropic, a June 2025 ruling found training on lawfully purchased books to be fair use but not the use of pirated copies; the court approved a $1.5 billion class settlement on July 20, 2026. For a company building on an LLM, vendor indemnities and their exclusions are part of freedom to operate.
License changes in infrastructure software
Redis moved from BSD to source-available licenses in 2024, then added AGPLv3 as an option with Redis 8 in May 2025. A dependency's license can change between versions, so the bill of materials must record versions and be re-scanned on upgrade.
EHR API access and information blocking
On September 3, 2025, HHS announced active enforcement of the 21st Century Cures Act information-blocking rules; certified health IT developers face civil monetary penalties of up to $1 million per violation. Whether a particular API restriction is information blocking depends on the facts and the exceptions, so it is an argument to assess with counsel, not a guarantee of access. Application to Relay depends on current law and facts.
27 / PracticeOwnership, licensing & freedom to operate
A rights gap before customer delivery
Illustrative venture: a founder wrote an early algorithm during a prior job; a contractor built the current interface under a short invoice; the application incorporates an open-source library; and a supplier licenses a dataset for evaluation only. A prospective customer requests a perpetual right to distribute the complete product to its affiliates.
Your task
Trace each contribution to the proposed customer promise. Identify rights gaps, documents needed and which assumptions could block delivery.
24
27 / DebriefOwnership, licensing & freedom to operate
Worked answer and reasoning
Review the prior-employer arrangements before assuming the founder can contribute the algorithm.
Inspect the contractor agreement and the actual library license, version and distribution obligations.
Evaluation-only data permission does not establish commercial distribution rights. Compare the customer’s requested affiliate use with every relevant upstream right.
25
27 / Venture stepOwnership, licensing & freedom to operate
Venture step: Relay's chain-of-rights and license review
Relay · venture step 27
Month 14, two months before the seed. The lead investor's counsel sends a diligence list. Relay's v1 reads and writes appointments through the ClinicOS API, which serves about 35% of independent clinics; ClinicOS's marketplace terms take a 30% revenue share and let ClinicOS revise API terms on 30 days' notice (illustrative). A scan finds 412 open-source packages (illustrative), including one AGPL-licensed library. Daniel wrote an early SMS throttling module in his last month at his prior health-tech employer. Relay Scheduler will run on a third-party LLM API, and Northpoint PT will ask for rights to use its data for model training.
Your task
Build Relay's chain-of-rights table (contribution, creator, governing document, rights Relay holds, rights its customer promises require, gap) and a prioritized resolution plan of five items with owner and deadline for the data room.
26
27 / Venture stepOwnership, licensing & freedom to operate
Venture step: worked reasoning
Daniel's module: read his prior invention-assignment and confidentiality agreements and compare dates. If the prior employer has a credible claim, rewrite the module clean-room (a different engineer, from a written specification) and record it; do not rely on 'it was only a throttler'.
ClinicOS API: Relay's freedom to operate with 35% of independents rests on a contract that ClinicOS can revise on 30 days' notice. Check permitted use, data-storage limits, competing-product clauses, assignment on change of control and termination. Mitigation: a second EHR integration (L21 to L23) and an information-blocking assessment of whether ClinicOS restrictions are permissible.
Open source: an AGPL library in a network service obliges Relay to offer corresponding source of the modified program to users interacting with it over a network. Replace or isolate it, adopt a software bill of materials with license scanning in CI, and keep notices for permissive (MIT, Apache 2.0) packages.
LLM vendor: confirm under the commercial terms that Relay owns outputs, that the vendor does not train on Relay's customer content, the IP indemnity and its exclusions, retention settings, and that a BAA covers the exact API configuration Relay will use. Relay cannot promise clinics more than these upstream terms allow.
Northpoint's data-use request: Relay may use PHI only as its BAA permits. Ask for a narrow, explicit right to use de-identified data to improve the service, and do not promise exclusivity over model improvements that the rest of the customer base funds.
27
27 / DebriefOwnership, licensing & freedom to operate
Reasoning traps
The prior-employer blind spot
A founder's work from before incorporation, or from the last weeks at a former employer, is the gap investors find most often. Date every early contribution and match it against the founder's old agreements.
Treating 'open source' as one license
MIT, Apache 2.0, GPL, AGPL and source-available licenses such as SSPL differ on notices, patents, distribution and network use. A list of package names without license, version and use is not a compliance review.
Promising customers more than upstream terms allow
Relay's data-use, uptime and indemnity promises to clinics are capped by the ClinicOS API terms, the LLM vendor's terms and its BAAs. Map each customer promise to the upstream right before signing.
28
27 / ReviewOwnership, licensing & freedom to operate
What you can now explain
Relay's chain-of-rights table and a prioritized five-item resolution plan ready for the seed data room.
Ownership follows contributions and documents: founders, contractors and prior employers each need a traced link, and payment alone does not transfer rights.
A license defines permitted uses, users, territories and conditions; Relay's dependencies (ClinicOS API, open source, LLM vendor) define its freedom to operate.
Freedom to operate is a separate question from protection, and it includes contract terms Relay itself signs: exclusivity, MFN, feedback licenses and change-of-control clauses.
Next lesson: Privacy, security & data responsibilities
29
Current rules: IRS: business structures · USPTO: IP tools. Legal, tax and privacy examples teach concepts; application depends on current law and the actual facts.
Check your understanding
Does the company have the rights its plan requires?
Score
Question 1
A contractor built Relay's waitlist sign-up page under a one-paragraph invoice that says nothing about IP. Relay has paid in full. Who most likely owns the copyright in the new code under US law?
Software by an independent contractor is generally not a work made for hire outside narrow statutory categories with a written agreement. Without an assignment, the author keeps the copyright and the payer usually has only an implied license, which does not let Relay grant exclusive rights or assure investors of clean title.
Question 2
Relay runs a modified AGPL-licensed library inside its hosted scheduling service. It never ships software to clinics; they use it through a browser. What is the most accurate statement?
The AGPL's network clause closes the 'SaaS loophole' that the GPL leaves open, so remote interaction with a modified version triggers source-offer obligations. Its scope is the covered program, not every separate service, and the boundary needs engineering and legal review.
Question 3
Relay holds a hypothetical patent on its matching workflow. ClinicOS holds a broader patent on automated waitlist messaging. What does Relay's patent give it with respect to ClinicOS's patent?
A patent is a right to exclude, not a right to practice. Relay's improvement can still infringe ClinicOS's broader claims, so protection and freedom to operate are separate questions, as the lesson's comparison slide stresses.
Question 4
Before building Relay Scheduler, which LLM vendor term is most critical given that patient messages will pass through the model?
Patient messages contain PHI, so HIPAA requires a BAA with the vendor, and Relay's own BAAs with clinics restrict onward use. Without a no-training commitment and suitable retention terms, Relay cannot keep the promises it makes to clinics.
Question 5
Northpoint PT asks for a perpetual, exclusive license to 'all model improvements trained on Northpoint data.' What is the main rights problem?
A customer promise must fit the chain of rights. Pooled improvements cannot be carved out exclusively without blocking Relay's core product, and data-use terms are limited by each clinic's BAA. A non-exclusive license or a narrow configuration right is the usual resolution.
Question 6
ClinicOS changes its API terms to bar 'products that replicate scheduling functionality' and gives 30 days' notice. Relay has 22 clinics on ClinicOS. Which response reflects freedom-to-operate thinking?
Relay's own IP does not grant access to ClinicOS's system. The response combines contract review, a possible regulatory argument and reduced dependence. Scraping a system in breach of its terms creates new contract and security exposure rather than permission.
Workbook
Does the company have the rights its plan requires?
Module output: A founder discussion brief, governance questions, IP map and privacy data map.
Library
Every original page used in this lesson
9 appear in the slides with notes; the rest are kept here for reference.
Leave the past behind: clean separation from prior employersAdvises founders not to use a prior employer's equipment, confidential information or time, to resign before building if the new company relates to the old employer's business, and not to use university or government resources without understanding the IP consequences. The Waymo, Uber and Oculus logos point to well-known disputes over what departing staff carried with them. This is the first link in the chain of rights. Daniel built SMS and scheduling systems at a health-tech company, so Relay must check his invention-assignment and confidentiality agreements and the dates of his early Relay work before investors do.Richardson - Intellectual Property and Data Privacy Slides · PDF page 16 · in the slides
1
Get it in writing: assignment, not just paymentLists everyone who should sign IP agreements (founders, advisors, employees, contractors, testers), warns that someone working for you does not mean you own their work, and recommends a written assignment rather than relying on 'work made for hire', plus keeping digital copies. For contractors, 'work made for hire' covers only limited statutory categories, so a present assignment of rights ('hereby assigns') is the reliable tool. A paid invoice transfers money, not copyright.Richardson - Intellectual Property and Data Privacy Slides · PDF page 17 · in the slides
2
Deal with it: inbound IP claimsSays successful companies will face IP disputes, that threats and infringement accusations (including open-source claims) should not be ignored, that receiving notice has consequences for what you tell investors and for willful patent infringement, and that some fights are not worth having. Knowledge matters: a company that continues after notice risks enhanced damages for willful infringement, and the claim becomes a disclosure item in diligence. Log every letter and route it to counsel rather than replying ad hoc.Richardson - Intellectual Property and Data Privacy Slides · PDF page 18 · in the slides
3
Avoid a mess: joint ownershipOwning IP is good but not always necessary, while joint ownership is messy because co-owners have different goals and the rules differ by IP type and country. Under US patent law each co-owner can generally exploit and license without the other's consent, while copyright co-owners must account to each other for profits; the rules differ again abroad. If a clinic group asks to co-own Relay Scheduler improvements, a license-back is usually cleaner than joint title.Richardson - Intellectual Property and Data Privacy Slides · PDF page 21 · in the slides
4
Watch the clock: patent deadlines and provisional applicationsUS patent rights can be lost through public use, disclosure, sale or offer for sale, subject to a one-year grace period that is risky to rely on; the US is first-to-file, so file early and describe many applications. Provisional applications are not a shortcut: they need the same technical disclosure as a full application. The grace period is mainly a US feature; most other countries require absolute novelty, so a demo or pitch before filing can forfeit foreign rights. A thin provisional application protects only what it actually discloses.Richardson - Intellectual Property and Data Privacy Slides · PDF page 22 · in the slides
5
Stay free: contract terms that limit future freedomFlags most-favored-nation, right-of-first-refusal and exclusivity clauses; notes that free is not freedom for open source and freemium services; and warns about covenants not to sue, feedback and improvement licenses, and an old cloud-hosting agreement whose terms surprised customers. These clauses are freedom-to-operate issues created by your own signature. The hosting example refers to a patent non-assert clause AWS removed from its standard customer agreement in 2017; today's equivalent is an API or LLM vendor term on feedback, competing products or data use.Richardson - Intellectual Property and Data Privacy Slides · PDF page 23 · in the slides
6
Keep an eye on the exit: assignabilityAsks whether contracts can be assigned in an IPO or change of control, and whether spin-outs are possible. An anti-assignment or change-of-control clause in the ClinicOS API agreement or a large customer contract can let the counterparty block or reprice an acquisition. Diligence teams read these first.Richardson - Intellectual Property and Data Privacy Slides · PDF page 25 · in the slides
7
Should I sign that NDA?Distinguishes mutual from one-way NDAs and disclosing from receiving, notes that confidentiality clauses in other agreements act like mini NDAs, and lists what to check: the definition and marking of confidential information, permitted use and duration. It adds that confidentiality duties can exist without a signature and that investors often will not sign NDAs. Investors' refusal to sign means founders should disclose the pitch, not the acceptance model's features. When Relay receives an NDA from ClinicOS, the danger is a broad definition plus a long term that could taint independent development of a competing feature.Richardson - Intellectual Property and Data Privacy Slides · PDF page 28 · in the slides
8
Open source 101: no warranties, strings attached, SaaS triggersOpen-source licenses typically give no warranty, indemnity, support or maintenance. Copyleft licenses such as the GPL come with conditions, and network licenses (Affero GPL, MongoDB's Server Side Public License, Redis's source-available license) can reach SaaS. Two lines are overstated. GPL obligations to offer source arise on distribution, not on every private modification, and SaaS use without distribution generally does not trigger GPL source duties; the AGPL is the license that adds a network-use trigger. Also, the SSPL and Redis's RSAL are source-available, not OSI-approved open source; Redis 8 (May 2025) added AGPLv3 as an option.Richardson - Intellectual Property and Data Privacy Slides · PDF page 30 · in the slides
