
    HEALTH GRADES, INC., Plaintiff-Appellant, v. DECATUR MEMORIAL HOSPITAL, Defendant-Appellee.
    No. 05-1445.
    United States Court of Appeals, Tenth Circuit.
    June 22, 2006.
    Kris J. Kostolansky, Thomas M. Rogers III, Leah P. Vanlandschoot, Rothgerber, Johnson & Lyons, Samuel Martin Ventola, Ventola & Staggs, Denver, CO, for Plaintiff-Appellant.
    Kimberly Elizabeth Lord, Johnson & Repucci, Boulder, CO, Richard William Young, Nicole M. Murray, Gardner, Carton & Douglas, Chicago, IL, for Defendant-Appellee.
    Before HENRY, BRISCOE, and MURPHY, Circuit Judges.
   ORDER AND JUDGMENT

MARY BECK BRISCOE, Circuit Judge.

This appeal challenges a district court order dismissing for lack of personal jurisdiction and improper venue Health Grades, Inc.’s (HGI’s) complaint against Decatur Memorial Hospital. HGI argues that the district court either (1) erred because Decatur consented to jurisdiction and venue or (2) abused its discretion in denying HGI an opportunity to conduct discovery on the jurisdictional issue. Persuaded by the second alternative, we reverse and remand for further proceedings.

Background

HGI, a Colorado corporation, is a ‘Web-based health information resource for the distribution of free healthcare provider ratings and information.” Aplt.App. at 18. Visitors to the HGI website encounter HGI’s user agreement and can access provider ratings only after clicking an “I agree” icon displayed with the user agreement. Id. at 15. The agreement governs “access to and use of th[e] Site and the information, materials and other content available on or through th[e] Site.” Id. at 18. Acceptance of the agreement confers a “license to access and view th[e] Site and the Site Materials, and to copy, download, store and/or print a single copy of any Site Materials, solely for ... non-commercial use and not for resale or distribution to anyone else.” Id. at 19. Additionally, the agreement specifies that “[a]ny action to enforce this User Agreement will be brought in the federal or state courts presiding in Denver, Colorado, U.S.A., and both parties expressly agree to be subject to the jurisdiction of such courts.” Id. at 24.

Illinois-based Decatur contacted HGI about using its ratings to promote the hospital. In response, HGI vice-president Nora Sugintas notified Decatur by email on October 1, 2003, that Decatur was “ranked # 1 in the state of Illinois for orthopedic services.” Id. at 65. Sugintas offered a license to use the rating, as well as marketing assistance and a quality assessment report, for the price of $25,000. She cautioned Decatur that this “information may be utilized only with a signed and executed HealthGrades agreement.” Id. Decatur declined.

“In late-2003,” Decatur posted on its website an article written by its president, revealing that HGI had ranked Decatur number one in orthopedics and had requested $25,000 for use of the ranking. Id. at 55, 58. The article criticized HGI for analyzing performance “in secret ways using secret data,” and stated, “we don’t know how [HGI] arrived at their [ranking] conclusion, and I don’t think paying them $25,000 helps our patients or community in any way.” Id. at 58. In January 2004, HGI demanded that Decatur remove the article from its website. After Decatur removed the article, HGI sued for copyright infringement and breach of contract in July 2004.

Five months later, on December 3, 2004, a Decatur-affiliated surgeon, Dr. Ronald Meng, emailed various individuals, proclaiming that “Healthgrades.com has announced ... that our cardiac surgery program here at [Decatur] is the only 5 star program in central and southern [I]llinois for coronary bypass surgery!” Id. at 78-79. Dr. Meng “enclosed ... the [uniform resource locator] for the announcement,” which, with a mouse click, would take the email recipient to HGI’s user-agreement page. Id. at 79. On December 10, 2004, HGI amended its complaint to include Dr. Meng’s email as an instance of copyright infringement and to add a cause of action for trademark infringement.

On Decatur’s motion, the district court dismissed HGI’s complaint, reasoning that it lacked personal jurisdiction because (1) Decatur had not directed its activities toward Colorado residents; (2) HGI failed to show that Decatur accepted the user agreement, or that if Decatur employees had accepted the agreement, that those employees had the authority to bind the corporation; and in any event (3) exercising jurisdiction over Decatur would offend traditional notions of fair play and substantial justice. The court acknowledged, but did not address, HGI’s request to conduct discovery to show Decatur’s acceptance of the user agreement. The district court also found that HGI’s failure to establish personal jurisdiction defeated its choice of venue. HGI appeals.

Discussion

We review the district court’s jurisdictional and venue assessments de novo, Bell Helicopter Textron, Inc. v. Heliqwest Int’l, Ltd., 385 F.3d 1291, 1296 (10th Cir.2004); Pierce v. Shorty Small’s of Branson Inc., 137 F.3d 1190,1191 (10th Cir.1998), and its refusal to permit jurisdictional discovery for an abuse of discretion, Sizova v. Nat’l Inst, of Standards & Tech., 282 F.3d 1320, 1326 (10th Cir.2002). “When, as in this case, a district court grants a motion to dismiss for lack of personal jurisdiction without conducting an evidentiary hearing, the plaintiff need only make a prima facie showing of personal jurisdiction to defeat the motion.” Benton v. Cameco Corp., 375 F.3d 1070, 1074 (10th Cir.2004) (quotation omitted), cert. denied, 544 U.S. 974, 125 S.Ct. 1826, 161 L.Ed.2d 723 (2005). All factual disputes must be resolved in the plaintiffs favor when determining whether the plaintiff has met its burden. Id.

“Consistent with due process, a court may exercise personal jurisdiction over a nonresident defendant if minimum contacts exist between the defendant and the forum state such that maintenance of the lawsuit would not offend traditional notions of fair play and substantial justice.” Doering ex rel. Barrett v. Copper Mountain, Inc., 259 F.3d 1202, 1210 (10th Cir. 2001) (quotations omitted). But since the requirement of personal jurisdiction represents an individual due process right, the “parties to a contract may agree in advance to submit to the jurisdiction of a given court.” Ins. Corp. of Ireland, Ltd. v. Compagnie des Bauxites de Guinee, 456 U.S. 694, 704, 102 S.Ct. 2099, 72 L.Ed.2d 492 (1982) (quotation omitted). HGI does not contest the district court’s ruling that Decatur’s contacts with Colorado were insufficient to confer jurisdiction. Consequently, our review is limited to the effect of HGI’s user agreement and its forum-selection provision.

HGI argues that it submitted sufficient evidence showing that Decatur is bound by the user agreement. Specifically, HGI points to the affidavit of its database administrator, who testified that from September 2001 through December 2004, someone with the internet protocol (IP) address 207.0.246.194 visited HGI’s website forty-seven times and consented to the terms of the user agreement. According to the administrator, this address “clearly belongs to Decatur” because Decatur’s domain name, www.dmhcares.org, translates into the internet protocol address 207.0.246.195, which is only one digit different from the visitor’s address. Aplt. App. at 78. Nevertheless, the district court rejected the administrator’s opinion as conclusory. We disagree with the district court.

The administrator was not required to provide a detailed explanation for his opinion, given that the relationship of the addresses is clear from the numbers employed. Decatur’s IP address is only one digit different from the address of the repeat visitor to HGI’s website. Only the actual network computers are different: 194 and 195. Thus, HGI’s database administrator had a sufficient basis on which to opine that the 194 address belonged to Decatur. We decline HGI’s invitation, however, to proceed further and simply “infer that some of the individuals who accepted the User Agreement from Decatur’s IP address had authority to bind the company.” Aplt. Br. at 11.

“An agent can make his principal responsible for his actions if he is acting pursuant to either actual or apparent authority, regardless of whether the principal has knowledge of the agent’s conduct.” Willey v. Mayer, 876 P.2d 1260, 1264 (Colo.1994) (footnote omitted). HGI concedes that “only Decatur and its employees know who uses the 194 address, and whether those using the 194 address were acting with authority when they agreed to the User Agreement.” Aplt. Br. at 19. Discovery should be permitted, HGI asserts, to definitively answer the jurisdictional issue. We agree. ‘When a defendant moves to dismiss for lack of jurisdiction, either party should be allowed discovery on the factual issues raised by that motion.” Sizova, 282 F.3d at 1326 (quotation omitted). While the district court has broad discretion in determining whether to permit jurisdictional discovery, a refusal to grant discovery constitutes an abuse of discretion if either the pertinent jurisdictional facts are controverted or a more satisfactory showing of the facts is necessary. Id. Here, the district court had evidence that a Decatur computer was likely used on numerous occasions to accept the HGI agreement and that Decatur’s Dr. Meng had accessed HGI’s website ratings and had invited others to do so. The only jurisdictional component missing was evidence that these visitors to HGI’s website had authority to bind Decatur to the user agreement. The district court gave no explanation for its refusal to allow jurisdictional discovery, and based on the evidence before it, we can only conclude that the district court abused its discretion.

The judgment of the district court is REVERSED, and the case is REMANDED for further proceedings consistent with this order and judgment. 
      
       After examining the briefs and appellate record, this panel has determined unanimously that oral argument would not materially assist the determination of this appeal. See Fed. R.App. P. 34(a)(2); 10th Cir. R. 34.1(G). The case is therefore ordered submitted without oral argument. This order and judgment is not binding precedent, except under the doctrines of law of the case, res judicata, and collateral estoppel. The court generally disfavors the citation of orders and judgments; nevertheless, an order and judgment may be cited under the terms and conditions of 10th Cir. R. 36.3.
     
      
      . In addition to other locations, venue is appropriate in any judicial district in which the corporate defendant in an infringement action would be subject to personal jurisdiction. 28 U.S.C. § 1391(b) & (c); id. § 1400(a).
     
      
      
        . Where such "provisions have been obtained through freely negotiated agreements and are not unreasonable and unjust, their enforcement does not offend due process.” Burger King Corp. v. Rudzewicz, 471 U.S. 462, 472 n. 14, 105 S.Ct. 2174, 85 L.Ed.2d 528 (1985) (quotation and citation omitted). Consequently, the district court erred in considering whether enforcing HGI’s user agreement would offend traditional notions of fair play and substantial justice. See Dominium Austin Partners, L.L.C. v. Emerson, 248 F.3d 720, 726 (8th Cir.2001); Christian Science Bd. of Directors v. Robinson, 123 F.Supp.2d 965, 972 (W.D.N.C.2000); Provident Mut. Life Ins. Co. of Philadelphia v. Bickerstaff 818 F.Supp. 116, 118 (E.D.Pa.1993).
     
      
      . Decatur contends HGI "has conceded that the information in the ... article [written by Decatur’s president] was obtained directly from [HGI]- — not from the [HGI] web site and that it was obtained free of any constraints of the click-through User Agreement.” Aplee. Br. at 11. But Decatur offers no record citation for such a concession, and HGI disputes the point. Moreover, HGI’s user agreement protects information "available on or through” the website. Aplt.App. at 18 (emphasis added). Decatur does not suggest that the rating its president revealed was not available on the website. Thus, if Decatur accepted the user agreement, its use of HGI's rating would appear to be restricted no matter how it learned of the rating.
     
      
      . We note that HGI limits its request for jurisdictional discovery on the authority issue to actual authority. Thus, HGI’s purported failure to "show that it relied on any act or representation of Decatur,” Aplee. Br. at 11, is not relevant, because reliance is a requirement for only apparent authority, see Willey, 876 P.2d at 1264; Rush Creek Solutions, Inc. v. XJte Mountain Ute Tribe, 107 P.3d 402, 407 (Colo.Ct.App.2004).
     