Neogenic Terms of Service

1. Who these terms are between

1.1 These terms are between Scality Ltd (company HE459172, registered in Cyprus at Attikis 3, City Residences 1, 6045 Larnaca, Cyprus; VAT CY60062286C), which provides Neogenic ("we"), and the clinic or business whose authorized person accepts them during onboarding ("you").

1.2 These terms, the Data Processing Agreement (DPA) and the subprocessor list form the whole agreement. The DPA takes priority on the protection of personal data. Marketing pages and demos do not change what is agreed.

1.3 The person accepting confirms they are authorized to bind the clinic. We record who accepted, when, and which version.

2. The service

2.1 Neogenic is software for running a clinic's operations: contacts and leads, companies, opportunities and pipelines, tasks, scheduling and appointments, forms, content, communications, documents and files with a "Patient records" Space, a patient status on a Contact, the Patient Portal, invoices and receipts to your clients, payment records, online card payments through your own Stripe account, invoice links for your clients, memberships and plans for your clients, and Neo, an AI assistant that acts within each staff member's permissions. The features available to you are those shown in the product.

2.2 We provide the service with reasonable care and skill. We may improve and change it. We give at least 30 days' notice of a change that materially reduces a feature you use or changes how we process personal data. Urgent security fixes may apply immediately, with an explanation afterwards.

2.3 Health information. From this version you may store health information about your patients in Neogenic, in these places:

• a Contact's fields, custom fields, tags and notes;
• a patient's deal: its name, its notes and its custom data;
• the notes of an appointment;
• the questions and answers of a form;
• documents in the "Patient records" Space;
• tasks and task comments about a person;
• the events that calendar sync writes to your staff's connected calendars (section 6.1).

Do not put health information in any of these:

• an email template;
• an email you send from Neogenic: it leaves Neogenic and is kept by the mail services that carry it;
• an email with a Contact, sent or received, that is stored in Neogenic;
• the name of a catalogue item, which is what an invoice line shows (section 4.5);
• the text of a membership plan;
• the reason on a refund or a credit note;
• a company's notes;
• the title or description of an event that your staff or Neo create in a connected calendar;
• a chat with Neo: what your staff type and what Neo answers;
• a file attached to a chat with Neo.

A place that is on neither list is not allowed. If health information reaches a place where it is not allowed, remove it or ask us to. A mistake of this kind is not by itself a breach of these terms.

2.4 Your confirmation. By accepting this version you confirm that, where you store health information in Neogenic, your clinic provides health care under the law of your country, and that you and your staff are bound by the duty of confidentiality of that law. If that is not so, do not store health information in Neogenic; section 2.3 then does not apply to you, and the rest of the service is unchanged.

3. Your account, users and acceptable use

3.1 You choose who uses Neogenic and what each person may do, using the roles and permissions in the product. Each person uses their own login and keeps it secure. Access to one clinic never grants access to another.

3.2 You keep your clinic details, privacy contact and security-incident contact current in the product.

3.3 You and your users must not bypass access controls, upload malicious content, attempt to access other customers' data, or use the service unlawfully. Do not send patient files, passwords or private links to support.

3.4 Prohibited AI uses. You must not use Neogenic or Neo for any practice prohibited by Article 5 of the EU Artificial Intelligence Act. This includes: manipulating or deceiving people in ways that are likely to harm them; exploiting a person's age, disability or social or economic situation; scoring people's trustworthiness or social behaviour; inferring the emotions of staff or students; sorting people by biometric data to infer sensitive characteristics; and building facial-recognition databases from scraped images.

3.5 Decisions about people. You must not use Neo to make a decision that has a legal or similarly significant effect on a person, such as refusing a service, without review by a member of your staff. Section 5.2 sets out decisions about your staff, for which you must not use Neo at all. Neo is not built to decide anything about a patient, and you must not use Neo or an automation to do so.

3.6 Messaging. You send marketing only to people you may lawfully contact, and you do not use Neogenic to send unsolicited bulk messages. You do not use a person's health information to choose who receives marketing, or in a marketing message, unless that person gave you explicit consent for it.

3.7 Security testing. You do not probe, scan or test the security of Neogenic without our written permission. To report a vulnerability, follow our vulnerability disclosure page.

3.8 A serious breach of sections 2.3 or 3.3 to 3.7 is unlawful use under section 10.2.

3.9 Patient portal. You invite into the patient portal only patients who are 18 or over.

4. Your data and your responsibilities

4.1 You own your data. We use it only to provide the service to you, as set out in the DPA. We do not sell it, use it for our own marketing, or use it to train AI models.

4.2 You are the controller of the personal data you put into Neogenic. You are responsible for having a lawful basis for it, including for marketing, for giving people the notices they need, and for honouring objections and unsubscribes. Neogenic's unsubscribe and suppression features help you do this. For health information you are also responsible for:

• (a) the legal ground that allows you to process it, for each purpose you use;
• (b) telling your patients how you use their data, including that you use Neogenic and, if you do, Neo;
• (c) your own data protection impact assessment, where the law requires one;
• (d) deciding who may consent for a child, and who may see a child's record.

4.3 In the product you can download single items: a form's responses as CSV, a single Library or Space document, an uploaded Library file. For any other data, you export by asking us: we provide an export of your clinic's data on request, in a usable format, within 30 days. When a person asks about their own data and the request reaches us, we pass it to your privacy contact within 2 working days. We carry out your written instruction about one person's data within 10 working days.

4.4 Invoices to your clients, and their payments to you. You decide what you charge your clients, what each invoice says and which tax applies. You are responsible for your invoices meeting the invoicing and tax rules that apply to you.

4.5 A line on an invoice, receipt or credit note is the name of an item in your catalogue. Keep the names in your catalogue, and the names of your memberships and plans, in neutral words that reveal nothing about a person's health, for example "Consultation, 30 minutes" or "Gold membership". Do not use a diagnosis, a condition, a symptom or the medical reason for a service as a name. This is your responsibility: invoices, invoice links and card payments are free of health information only if your catalogue's names are.

4.6 Your staff record in Neogenic the payments you take yourself, for example in cash, by card terminal or by bank transfer.

4.7 Online card payments. If your Owner or an Admin connects your clinic's own Stripe account, your clients can pay invoices, including membership invoices, by card on Stripe's payment page. Your agreement for these payments is with Stripe, and the payments go to your Stripe account. Card details are entered only on Stripe's page: Neogenic never receives or stores card numbers. Refunds of card payments are made through your Stripe account. Your Owner or an Admin can disconnect your Stripe account at any time.

4.8 Invoice links. Your staff can send a client a link to view, download or pay an invoice or receipt. We send the link only to the email address on the invoice. The email shows your clinic's name and contact details, the type of document, its number, the link and its expiry date. It shows no amounts, services or attachments. The link expires 7 days after it is sent. Your client opens the invoice or receipt with a 6-digit code that we email to them, which is valid for 10 minutes; the client can then use the link for up to 60 minutes. Without the code, the link shows only your clinic's name, the document number, the amount due and whether it is paid, and lets the client pay online; after paying, the confirmation shows the amount and the date of payment. Before a link is sent, your staff see the exact recipient address, and a link is not sent if that address changed.

4.9 An invoice, receipt or credit note is issued when your staff finalise it and it receives its number. After that, nobody can edit it in the product. You correct an issued invoice with a credit note, and a payment record with a refund or a cancellation; the original stays on record. If health information reaches an issued document against section 4.5, we remove that information from the document at your request and keep a record that we did; the document itself stays on record.

4.10 Your issued invoices, receipts and credit notes are your accounting records. You keep them for as long as the law requires you to. Where billing is switched on for your clinic, you can download a single invoice or receipt as a PDF at any time. For credit notes, or for all of them at once, ask us (section 4.3). When the service ends, we delete them after the export period, so ask for the export before then (section 10).

4.11 Memberships and plans for your clients. You set the terms of the memberships and plans you offer your clients, and you agree those terms with your clients. Neogenic keeps the memberships and plans your staff set up, with their payment schedules and the sessions or credits used.

5. Neo and other AI features

5.1 Neo is an AI assistant. It can make mistakes. Review what it produces before relying on it or sending it to anyone.

5.2 Neo helps with administrative and operational work. It is not designed or permitted for diagnosis, treatment decisions, or interpreting clinical or lab results, and you must not use it for those purposes. You must not use Neo to screen, evaluate, rank or monitor your staff's work or behaviour. Do not use it to make or prepare decisions about hiring, promotion, dismissal or pay, including about people who apply to work for you. Do not use it to give out tasks based on a person's behaviour or personal traits. This does not stop everyday work with tasks, such as giving a task to a named staff member.

5.3 Neo acts only within the signed-in staff member's permissions, through a fixed set of reviewed actions. Among other things it can read: a Contact's name, email and phone; emails with a Contact; the questions and answers of forms; the names and notes of deals; a company's name and notes; the text of tasks; your own appointments with the service name; the titles and times of events in a connected calendar; shared Library documents; email templates; blog drafts; and your service and clinic settings. It cannot read a Contact's custom fields, appointment notes, task comments, or a patient's documents and files, including the "Patient records" Space. It sees a Contact's note only when a staff member asks it to change or delete that exact note. A file that a staff member attaches to a chat with Neo is read by Neo; do not attach a patient's file. Changes that are hard to undo, such as deleting, archiving or publishing, ask for the person's approval first.

5.4 AI features use only the providers listed on the subprocessor list, under terms that do not allow them to train on your data. Requests from Neo are processed in the regions shown on that list.

5.5 Neo is not built to decide anything about a patient. It drafts, finds and records at a staff member's request, and that staff member remains responsible for what is done.

5.6 Patient Neo. If you turn on Patient Neo, your connected patients can use Neo in the patient portal. For the patient who asks, it reads that patient's appointments, invoices and memberships and your services, prices, opening hours and contact details; it can request an appointment, ask to move one or cancel one, and send you a message, each confirmed by the patient; and, with the patient's consent, it lists the reports you released to that patient and opens their files, and reads the lab reports the patient added. It does not give medical advice or interpret results. You can turn Patient Neo off at any time.

6. Connected accounts

6.1 If you connect a Google or Microsoft account, Neogenic acts on it only as you instruct, within the permissions you grant. You can disconnect at any time. Your contract with that provider stays between you and them. Mail and calendar entries in those accounts are held by that provider; Neogenic keeps only the copies this section describes, and what Neo shows you in a chat when you ask it (section 5.3).

Email through a connected mailbox. If a staff member connects an Outlook mailbox (Gmail mailboxes are not offered), Neogenic acts on it when that member asks. It sends an email to a Contact from that mailbox. When the member refreshes a Contact's emails, it reads up to 50 messages of the last 30 days exchanged with that Contact's email address, leaving out drafts and deleted items. Neogenic stores a copy of each email it sends or reads this way with that Contact: the sender, the recipients, the subject, the text, a cleaned copy of the formatted text and the time. These copies are visible to the member who connected the mailbox. If that member has left, your Owner and Admins can see them, and only if the member saw the record notice before leaving. They stay until the member who connected the mailbox, or your Owner or an Admin, removes the email of a disconnected mailbox, or until the Contact is erased or your clinic leaves Neogenic.

Calendar sync. When calendar sync is on, Neogenic writes each appointment as a private event to the business calendar that each staff member assigned to it has connected with permission to add events. The event carries the service and the patient's name as its title, the place, the names of the assigned staff, the video-meeting link if the appointment has one, and one link back to Neogenic. The appointment's notes go only to the calendar of a member who may see clinical notes in Neogenic. Patients and other outside people are never invited. Neogenic changes or deletes the event when the appointment changes, is cancelled or unassigned, or is removed. Neogenic deletes its events when a member disconnects or leaves, or when your clinic leaves Neogenic. If a provider cannot be reached, or the deletion does not finish in time, an event can stay in that member's calendar; the member can delete it there. Neogenic sends this information only to calendar accounts that your staff connect. You remain responsible for who connects an account to your clinic. Calendar sync applies to your clinic only after your clinic has accepted this version of these terms (section 12.1).

An event that your staff or Neo create in those calendars carries the title, description, place and guests that were given; keep the service and any health detail out of it.

6.2 If your Owner or an Admin connects a Stripe account, Neogenic sends Stripe what each payment needs (the email address on the invoice, the invoice number, the amount, the currency and our own reference numbers) and receives the payment's result. Your agreement with Stripe stays between you and Stripe.

7. Price and payment

7.1 Your fees are those of the plan or written offer you accept, in the product or in an order confirmation. Any free, trial or discounted period is stated in that plan or offer. We never charge you without an accepted plan or offer.

7.2 We give at least 30 days' notice of a price change, and you may leave before it applies.

7.3 Late payment. Our invoices to you are due on the terms of the plan or offer you accepted. If a payment fails, we show a notice in Neogenic, email your clinic's billing email address, and try the payment again. Neogenic keeps working normally for 7 days. If the payment is still not made 7 days after it failed, your staff can no longer make changes in Neogenic and Neo pauses, until the payment goes through. You can still see and export your data, update your payment details, and act on requests from the people whose data it holds. On that day we email your Owner and your privacy contact the date on which the service will end. If the payment is still not made 30 days after that day, the service ends and section 10.3 applies. Unpaid fees remain owed.

8. Support and incidents

8.1 Support is available 08:00–20:00, Monday to Saturday, Cyprus time, at support@neogenic.ai. Support hours are not a guaranteed response time.

8.2 Report security issues to security@neogenic.ai. Urgent security or data incidents are handled outside support hours as well. We notify your incident contact of a personal-data breach affecting your data without undue delay, and within 48 hours of becoming aware of it, as set out in the DPA. As controller, you decide whether to notify the authority and your patients; we give you what we know to help you do so.

9. Confidentiality and intellectual property

9.1 Each side keeps the other's non-public information confidential and uses it only for this agreement.

9.2 We own the Neogenic software. You may use it for your clinic's operations while these terms apply. You keep all rights in your data and content.

9.3 We will not use your name or logo publicly without your permission.

10. Ending the service and switching provider

10.1 You may stop using Neogenic at any time by notifying us. We may end the service with 60 days' notice, or sooner if you seriously breach these terms and do not fix the breach within 15 days of our written notice, or as set out in section 7.3 for a payment that is not made.

10.2 We may make Neogenic read-only or suspend access only for late payment under section 7.3, or as far as needed to deal with a serious security threat or unlawful use. We tell you why, and we restore access when the reason ends. Neither blocks you from exporting your data.

10.3 After the service ends you have 30 days to export your data. When you cancel, the service ends at the end of the period you have paid for, and Neogenic stays read-only for these 30 days so you can export your data. Conversations with Neo are part of the export. Neo's working records (its traces and transcripts) are not part of the export and are deleted when the service ends. We then delete the rest as set out in the DPA; backups expire on their normal schedule and are not restored into use. Exporting or switching to another provider carries no charge.

10.4 Switching (EU Data Act). You may ask at any time to move your data to another provider or to your own systems, or to have it erased. We require no minimum notice, and never more than two months.

10.5 Transition period. From your request, or from the date you choose, we complete the switch within 30 days. During that time we help you and any provider you name with reasonable assistance, keep the service running with the same security, and tell you of any risk to continuity that we know of. If the switch cannot technically be completed in 30 days, we tell you within 14 working days, with the reasons and a new date that is at most seven months after your request. You may extend the transition period once.

10.6 What you can take with you. All data that you and your users entered or that your use of Neogenic generated: contacts, companies, opportunities and pipelines, tasks, appointments, calendars and scheduling settings, forms and their submissions, notes, documents and files including the "Patient records" Space, the record of who viewed a patient's data, email and message history, content and Library items, files, invoices, receipts, credit notes, payment records, memberships and plans, conversations with Neo, and your clinic's settings, roles and permissions. We provide this export on request, with records as CSV, one file per kind of record, and stored files in their original format. Our software, its internal configuration and our security logs are not part of the export.

10.7 Retrieval and erasure. After the transition period you have at least 30 days to retrieve your data. We then erase all of it, except a copy that EU or Member State law requires us to keep, and confirm the erasure in writing to your privacy contact. The record of who viewed a patient's data is part of your export and is then erased; until 13 November 2026 we instead keep it for 6 years after the end of the service. We also keep, for 6 years after the end of the service, our own record of the agreement and of your instructions to access your data, to establish or defend legal claims, and our accounting records, including the cost records of AI use. None of these holds content of your records.

10.8 Where your data is held. The countries where your data is stored and processed, and the safeguards for any processing outside the EEA, are on the subprocessor list.

11. Liability

11.1 Nothing in these terms limits liability that cannot be limited by law, or your rights under data-protection law.

11.2 Otherwise, each party's total liability under these terms is limited to the greater of the fees you paid in the 12 months before the claim and €5,000. Neither party is liable for indirect or consequential loss, or lost profit.

11.3 This limit does not apply to fees you owe us.

12. Changes to these terms

12.1 We may publish a new version of these terms or the DPA. We tell you at least 30 days before it applies, and your Owner or Admin accepts it in the product. A version that adds new kinds of processing, such as health data, applies only once accepted. Your Owner or Admin may accept a new version as soon as we publish it; it then applies to your clinic from that acceptance.

13. General

13.1 Formal notices go to your privacy contact by email, and to us at legal@neogenic.ai.

13.2 These terms are governed by the laws of the Republic of Cyprus, and the courts of Cyprus have jurisdiction. This does not remove any mandatory protection you have under the law of your own country.

13.3 If part of these terms is unenforceable, the rest still applies.

Previous versions: Version 9 (22 October 2026), Version 8 (16 October 2026), Version 6 (15 October 2026), Version 5 (9 October 2026), Version 4 (1 October 2026), Version 3 (30 September 2026), Version 2 (30 September 2026), Version 1 (24 September 2026)