Neogenic Terms of Service

1. Who these terms are between

1.1 These terms are between Scality Ltd (company HE459172, registered in Cyprus at Attikis 3, City Residences 1, 6045 Larnaca, Cyprus; VAT CY60062286C), which provides Neogenic ("we"), and the clinic or business whose authorized person accepts them during onboarding ("you").

1.2 These terms, the Data Processing Agreement (DPA) and the subprocessor list form the whole agreement. The DPA takes priority on the protection of personal data. Marketing pages and demos do not change what is agreed.

1.3 The person accepting confirms they are authorized to bind the clinic. We record who accepted, when, and which version.

2. The service

2.1 Neogenic is software for running a clinic's operations: contacts and leads, companies, opportunities and pipelines, tasks, scheduling and appointments, forms, content, communications, documents and files with a "Patient records" Space, a patient status on a Contact, the Patient Portal, invoices and receipts to your clients, payment records, online card payments through your own Stripe account, invoice links for your clients, memberships and plans for your clients, and Neo, an AI assistant that acts within each staff member's permissions. The features available to you are those shown in the product.

2.2 We provide the service with reasonable care and skill. We may improve and change it. We give at least 30 days' notice of a change that materially reduces a feature you use or changes how we process personal data. Urgent security fixes may apply immediately, with an explanation afterwards.

2.3 Health information. From this version you may store health information about your patients in Neogenic, in these places:

• a Contact's fields, custom fields, tags and notes;
• a patient's deal: its name, its notes and its custom data;
• the notes of an appointment;
• the questions and answers of a form;
• documents in the "Patient records" Space;
• tasks and task comments about a person.

Do not put health information in any of these:

• an email template;
• an email you send from Neogenic: our email provider also uses email content for its own security and abuse checks;
• an email with a Contact, sent or received, that is stored in Neogenic;
• the name of a catalogue item, which is what an invoice line shows (section 4.5);
• the text of a membership plan;
• the reason on a refund or a credit note;
• a company's notes;
• the title or description of an event in a connected calendar;
• a chat with Neo: what your staff type and what Neo answers;
• a file attached to a chat with Neo.

A place that is on neither list is not allowed. If health information reaches a place where it is not allowed, remove it or ask us to. A mistake of this kind is not by itself a breach of these terms.

2.4 Your confirmation. By accepting this version you confirm that, where you store health information in Neogenic, your clinic provides health care under the law of your country, and that you and your staff are bound by the duty of confidentiality of that law. If that is not so, do not store health information in Neogenic; section 2.3 then does not apply to you, and the rest of the service is unchanged.

3. Your account, users and acceptable use

3.1 You choose who uses Neogenic and what each person may do, using the roles and permissions in the product. Each person uses their own login and keeps it secure. Access to one clinic never grants access to another.

3.2 You keep your clinic details, privacy contact and security-incident contact current in the product.

3.3 You and your users must not bypass access controls, upload malicious content, attempt to access other customers' data, or use the service unlawfully. Do not send patient files, passwords or private links to support.

3.4 Prohibited AI uses. You must not use Neogenic or Neo for any practice prohibited by Article 5 of the EU Artificial Intelligence Act. This includes: manipulating or deceiving people in ways that are likely to harm them; exploiting a person's age, disability or social or economic situation; scoring people's trustworthiness or social behaviour; inferring the emotions of staff or students; sorting people by biometric data to infer sensitive characteristics; and building facial-recognition databases from scraped images.

3.5 Decisions about people. You must not use Neo to make a decision that has a legal or similarly significant effect on a person, such as refusing a service, without review by a member of your staff. Section 5.2 sets out decisions about your staff, for which you must not use Neo at all. Neo is not built to decide anything about a patient, and you must not use Neo or an automation to do so.

3.6 Messaging. You send marketing only to people you may lawfully contact, and you do not use Neogenic to send unsolicited bulk messages. You do not use a person's health information to choose who receives marketing, or in a marketing message, unless that person gave you explicit consent for it.

3.7 Security testing. You do not probe, scan or test the security of Neogenic without our written permission. To report a vulnerability, follow our vulnerability disclosure page.

3.8 A serious breach of sections 2.3 or 3.3 to 3.7 is unlawful use under section 10.2.

3.9 Patient portal. You invite into the patient portal only patients who are 18 or over.

4. Your data and your responsibilities

4.1 You own your data. We use it only to provide the service to you, as set out in the DPA. We do not sell it, use it for our own marketing, or use it to train AI models.

4.2 You are the controller of the personal data you put into Neogenic. You are responsible for having a lawful basis for it, including for marketing, for giving people the notices they need, and for honouring objections and unsubscribes. Neogenic's unsubscribe and suppression features help you do this. For health information you are also responsible for:

• (a) the legal ground that allows you to process it, for each purpose you use;
• (b) telling your patients how you use their data, including that you use Neogenic and, if you do, Neo;
• (c) your own data protection impact assessment, where the law requires one;
• (d) deciding who may consent for a child, and who may see a child's record.

4.3 In the product you can download single items: a form's responses as CSV, a single Library or Space document, an uploaded Library file. For any other data, you export by asking us: we provide an export of your clinic's data on request, in a usable format, within 30 days. When a person asks about their own data and the request reaches us, we pass it to your privacy contact within 2 working days. We carry out your written instruction about one person's data within 10 working days.

4.4 Invoices to your clients, and their payments to you. You decide what you charge your clients, what each invoice says and which tax applies. You are responsible for your invoices meeting the invoicing and tax rules that apply to you.

4.5 A line on an invoice, receipt or credit note is the name of an item in your catalogue. Keep the names in your catalogue, and the names of your memberships and plans, in neutral words that reveal nothing about a person's health, for example "Consultation, 30 minutes" or "Gold membership". Do not use a diagnosis, a condition, a symptom or the medical reason for a service as a name. This is your responsibility: invoices, invoice links and card payments are free of health information only if your catalogue's names are.

4.6 Your staff record in Neogenic the payments you take yourself, for example in cash, by card terminal or by bank transfer.

4.7 Online card payments. If your Owner or an Admin connects your clinic's own Stripe account, your clients can pay invoices, including membership invoices, by card on Stripe's payment page. Your agreement for these payments is with Stripe, and the payments go to your Stripe account. Card details are entered only on Stripe's page: Neogenic never receives or stores card numbers. Refunds of card payments are made through your Stripe account. Your Owner or an Admin can disconnect your Stripe account at any time.

4.8 Invoice links. Your staff can send a client a link to view, download or pay an invoice or receipt. We send the link only to the email address on the invoice. The email shows your clinic's name and contact details, the type of document, its number, the link and its expiry date. It shows no amounts, services or attachments. The link expires 7 days after it is sent. Your client opens it with a 6-digit code that we email to them, which is valid for 10 minutes; the client can then use the link for up to 60 minutes. Before a link is sent, your staff see the exact recipient address, and a link is not sent if that address changed.

4.9 An invoice, receipt or credit note is issued when your staff finalise it and it receives its number. After that, nobody can edit it in the product. You correct an issued invoice with a credit note, and a payment record with a refund or a cancellation; the original stays on record. If health information reaches an issued document against section 4.5, we remove that information from the document at your request and keep a record that we did; the document itself stays on record.

4.10 Your issued invoices, receipts and credit notes are your accounting records. You keep them for as long as the law requires you to. Where billing is switched on for your clinic, you can download a single invoice or receipt as a PDF at any time. For credit notes, or for all of them at once, ask us (section 4.3). When the service ends, we delete them after the export period, so ask for the export before then (section 10).

4.11 Memberships and plans for your clients. You set the terms of the memberships and plans you offer your clients, and you agree those terms with your clients. Neogenic keeps the memberships and plans your staff set up, with their payment schedules and the sessions or credits used.

5. Neo and other AI features

5.1 Neo is an AI assistant. It can make mistakes. Review what it produces before relying on it or sending it to anyone.

5.2 Neo helps with administrative and operational work. It is not designed or permitted for diagnosis, treatment decisions, or interpreting clinical or lab results, and you must not use it for those purposes. You must not use Neo to screen, evaluate, rank or monitor your staff's work or behaviour. Do not use it to make or prepare decisions about hiring, promotion, dismissal or pay, including about people who apply to work for you. Do not use it to give out tasks based on a person's behaviour or personal traits. This does not stop everyday work with tasks, such as giving a task to a named staff member.

5.3 Neo acts only within the signed-in staff member's permissions, through a fixed set of reviewed actions. Among other things it can read: a Contact's name, email and phone; emails with a Contact; the questions and answers of forms; the names and notes of deals; a company's name and notes; the text of tasks; your own appointments with the service name; the titles and times of events in a connected calendar; shared Library documents; email templates; blog drafts; and your service and clinic settings. It cannot read a Contact's custom fields, appointment notes, task comments, or a patient's documents and files, including the "Patient records" Space. It sees a Contact's note only when a staff member asks it to change or delete that exact note. A file that a staff member attaches to a chat with Neo is read by Neo; do not attach a patient's file. Changes that are hard to undo, such as deleting, archiving or publishing, ask for the person's approval first.

5.4 AI features use only the providers listed on the subprocessor list, under terms that do not allow them to train on your data. Requests from Neo are processed in the regions shown on that list.

5.5 Neo is not built to decide anything about a patient. It drafts, finds and records at a staff member's request, and that staff member remains responsible for what is done.

6. Connected accounts

6.1 If you connect a Google or Microsoft account, Neogenic acts on it only as you instruct, within the permissions you grant. You can disconnect at any time. Your contract with that provider stays between you and them. Mail and calendar entries in those accounts are held by that provider, outside Neogenic. Neogenic does not write your clinic appointments to those calendars. An event that your staff or Neo create there carries the title, description, place and guests that were given; keep the service and any health detail out of it.

6.2 If your Owner or an Admin connects a Stripe account, Neogenic sends Stripe what each payment needs (the email address on the invoice, the invoice number, the amount, the currency and our own reference numbers) and receives the payment's result. Your agreement with Stripe stays between you and Stripe.

7. Price and payment

7.1 Your fees are those of the plan or written offer you accept, in the product or in an order confirmation. Any free, trial or discounted period is stated in that plan or offer. We never charge you without an accepted plan or offer.

7.2 We give at least 30 days' notice of a price change, and you may leave before it applies.

7.3 Late payment. Our invoices to you are due on the terms of the plan or offer you accepted. If an invoice is unpaid 14 days after its due date, we send you a written reminder. If it is still unpaid 14 days after that reminder, we may suspend access to the service. You can still export your data while suspended. If payment is not made within 30 days of suspension, we may end the service under section 10. Unpaid fees remain owed.

8. Support and incidents

8.1 Support is available 08:00–20:00, Monday to Saturday, Cyprus time, at support@neogenic.ai. Support hours are not a guaranteed response time.

8.2 Report security issues to security@neogenic.ai. Urgent security or data incidents are handled outside support hours as well. We notify your incident contact of a personal-data breach affecting your data without undue delay, and within 48 hours of becoming aware of it, as set out in the DPA. As controller, you decide whether to notify the authority and your patients; we give you what we know to help you do so.

9. Confidentiality and intellectual property

9.1 Each side keeps the other's non-public information confidential and uses it only for this agreement.

9.2 We own the Neogenic software. You may use it for your clinic's operations while these terms apply. You keep all rights in your data and content.

9.3 We will not use your name or logo publicly without your permission.

10. Ending the service and switching provider

10.1 You may stop using Neogenic at any time by notifying us. We may end the service with 60 days' notice, or sooner if you seriously breach these terms and do not fix the breach within 15 days of our written notice.

10.2 We may suspend access only for late payment under section 7.3, or as far as needed to deal with a serious security threat or unlawful use. We tell you why, and we restore access when the reason ends. Suspension never blocks you from exporting your data.

10.3 After the service ends you have 30 days to export your data. Conversations with Neo are included if you ask for them before the service ends; otherwise they are deleted when it ends. We then delete the rest as set out in the DPA; backups expire on their normal schedule and are not restored into use. Exporting or switching to another provider carries no charge.

10.4 Switching (EU Data Act). You may ask at any time to move your data to another provider or to your own systems, or to have it erased. We require no minimum notice, and never more than two months.

10.5 Transition period. From your request, or from the date you choose, we complete the switch within 30 days. During that time we help you and any provider you name with reasonable assistance, keep the service running with the same security, and tell you of any risk to continuity that we know of. If the switch cannot technically be completed in 30 days, we tell you within 14 working days, with the reasons and a new date that is at most seven months after your request. You may extend the transition period once.

10.6 What you can take with you. All data that you and your users entered or that your use of Neogenic generated: contacts, companies, opportunities and pipelines, tasks, appointments, calendars and scheduling settings, forms and their submissions, notes, documents and files including the "Patient records" Space, the record of who viewed a patient's data, email and message history, content and Library items, files, invoices, receipts, credit notes, payment records, memberships and plans, conversations with Neo on request, and your clinic's settings, roles and permissions. We provide this export on request, with records as CSV, one file per kind of record, and stored files in their original format. Our software, its internal configuration and our security logs are not part of the export.

10.7 Retrieval and erasure. After the transition period you have at least 30 days to retrieve your data. We then erase all of it, except a copy that EU or Member State law requires us to keep, and confirm the erasure in writing to your privacy contact.

10.8 Where your data is held. The countries where your data is stored and processed, and the safeguards for any processing outside the EEA, are on the subprocessor list.

11. Liability

11.1 Nothing in these terms limits liability that cannot be limited by law, or your rights under data-protection law.

11.2 Otherwise, each party's total liability under these terms is limited to the greater of the fees you paid in the 12 months before the claim and €5,000. Neither party is liable for indirect or consequential loss, or lost profit.

11.3 This limit does not apply to fees you owe us.

12. Changes to these terms

12.1 We may publish a new version of these terms or the DPA. We tell you at least 30 days before it applies, and your Owner or Admin accepts it in the product. A version that adds new kinds of processing, such as health data, applies only once accepted. Your Owner or Admin may accept a new version as soon as we publish it; it then applies to your clinic from that acceptance.

13. General

13.1 Formal notices go to your privacy contact by email, and to us at legal@neogenic.ai.

13.2 These terms are governed by the laws of the Republic of Cyprus, and the courts of Cyprus have jurisdiction. This does not remove any mandatory protection you have under the law of your own country.

13.3 If part of these terms is unenforceable, the rest still applies.

Other earlier versions: Version 9 (22 October 2026), Version 8 (16 October 2026), Version 5 (9 October 2026), Version 4 (1 October 2026), Version 3 (30 September 2026), Version 2 (30 September 2026), Version 1 (24 September 2026)