Terms of Service & Business Associate Agreement

FirstAssistantAI, Inc. — Clinical Decision Support Platform

These Terms of Service ("Terms") govern your access to and use of the FirstAssistantAI clinical decision support platform, including all associated web applications, APIs, scoring modules, and related services (collectively, the "Platform") operated by FirstAssistantAI, Inc., a Delaware corporation ("Company," "we," "us," or "our").

These Terms include an embedded Business Associate Agreement (BAA) in Section 10, which governs the handling of Protected Health Information (PHI) under the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations (collectively, "HIPAA").

1. Eligibility and Professional Qualifications

The Platform is intended exclusively for use by licensed physicians, surgeons, and other qualified healthcare professionals ("Healthcare Professionals") who hold a valid, unrestricted license to practice medicine in their respective jurisdiction and who are using the Platform in a professional clinical capacity.

By creating an account, you represent and warrant that you:

• Are a licensed physician or other qualified healthcare professional with authority to make or assist in clinical surgical decisions;
• Are at least 18 years of age;
• Are using the Platform solely for lawful professional purposes in connection with actual patient care;
• Have the authority to enter into these Terms on behalf of yourself and, where applicable, your employing institution;
• Will comply with all applicable federal, state, and local laws and professional licensing requirements in connection with your use of the Platform; and
• Will not permit unauthorized persons to access the Platform using your credentials.

We reserve the right to verify your professional credentials and to suspend or terminate access if we have reason to believe eligibility requirements are not met.

2. Nature of the Platform — Clinical Decision Support

The Platform's scoring outputs, recommendation cards, surgical technique guidance, and flagging system are derived from peer-reviewed literature and structured clinical logic. They are provided as educational and informational tools to assist qualified professionals. They do not account for every patient-specific variable, and they may not reflect the most current clinical evidence at any given time.

You acknowledge that:

• Platform outputs are advisory only and must be interpreted in the context of your full clinical assessment of each patient;
• The Company does not practice medicine and no physician-patient relationship is created by your use of the Platform;
• You bear sole professional and legal responsibility for all clinical decisions made in connection with your use of the Platform;
• The Platform is not cleared or approved by the U.S. Food and Drug Administration (FDA) as a medical device; and
• Clinical evidence evolves and Platform content may not always reflect the most recent publications or guidelines.

3. Accounts, Registration, and Security

To access the Platform you must register for an account and provide accurate, complete, and current information. You are responsible for maintaining the confidentiality of your account credentials and for all activity that occurs under your account. You agree to:

• Provide and maintain accurate, current, and complete registration information;
• Protect your password and not share credentials with any other person;
• Log out after each session, particularly on shared or public devices;
• Notify us immediately at legal@firstassistantai.com upon discovery of any unauthorized use of your account or any security breach; and
• Accept responsibility for all activity occurring through your account prior to notification of unauthorized access.

Accounts are personal and non-transferable. You may not create accounts on behalf of others without their explicit knowledge and consent, or use automated means to create accounts. We reserve the right to reclaim usernames and suspend accounts at our discretion.

4. Acceptable Use and Prohibited Conduct

You agree to use the Platform only for its intended clinical decision support purpose. You may not:

• Use the Platform for any unlawful purpose or in violation of any federal, state, local, or international law or regulation;
• Use the Platform for any non-clinical commercial purpose, including resale, sublicensing, or competitive intelligence gathering;
• Attempt to reverse engineer, decompile, disassemble, or derive the source code, scoring methodology, weight parameters, algorithm logic, or underlying clinical rules of the Platform;
• Scrape, crawl, or otherwise extract data from the Platform using automated means;
• Attempt to gain unauthorized access to any portion of the Platform, its servers, or any connected systems;
• Introduce viruses, malware, or other harmful code into the Platform;
• Share, publish, or disclose any proprietary outputs, scoring logic, recommendation structures, or Platform content in a manner that reveals the Company's trade secrets or proprietary methodology;
• Use the Platform to enter fabricated, simulated, or non-real patient data for purposes other than legitimate testing authorized by us in writing; or
• Permit any third party to access the Platform through your account.

We reserve the right to investigate suspected violations and to suspend or terminate access, report violations to appropriate authorities, and pursue all available legal remedies.

5. Intellectual Property Rights

5.1 Company Intellectual Property

The Platform and all of its components — including but not limited to the Article Relevance Score (ARS) methodology and formula, scoring domain architecture, penalty weight structures, hard floor logic, clinical interaction penalty system, recommendation card frameworks, surgical technique guidance content, patient-reported outcomes integration pipeline, source code, user interface, visual design, documentation, and all related trade secrets and proprietary clinical logic — are the exclusive intellectual property of the Company and are protected by U.S. and international copyright, trade secret, and other applicable intellectual property laws.

These Terms do not grant you any ownership interest in the Platform or any of its components. The Company's name, logo, and all related marks are trademarks of the Company. Nothing in these Terms grants you any right to use Company trademarks without prior written permission.

5.2 Limited License to Use

Subject to these Terms, we grant you a limited, non-exclusive, non-transferable, non-sublicensable, revocable license to access and use the Platform solely for your own professional clinical decision support purposes. This license does not include any right to copy, modify, distribute, sell, or create derivative works of the Platform or its content.

5.3 Feedback

If you submit feedback, suggestions, or ideas regarding the Platform, you grant the Company a perpetual, irrevocable, royalty-free, worldwide license to use, incorporate, and commercialize such feedback without restriction or compensation to you.

6. Data Ownership, Use, and Research

6.1 Your Patient Data

You retain ownership of any patient-specific data you enter into the Platform. We process this data solely to provide the clinical decision support services described herein and as set forth in the BAA (Section 10) and our Privacy Policy.

Trainee and educational accounts (residents, fellows, and students). If your account is designated as a trainee or educational account, you agree to enter only de-identified, hypothetical, or training data, and not to submit Protected Health Information (PHI) or other individually identifiable patient information. Trainee accounts are provided for educational use, are not intended for the entry of real patient PHI, and are not covered by the Business Associate Agreement in Section 10 unless and until the account is upgraded to an attending account for which a BAA is in effect.

6.2 De-Identified Aggregate Data — Research and Platform Improvement

By using the Platform, you grant the Company a perpetual, irrevocable, royalty-free, worldwide license to use, reproduce, analyze, and commercialize de-identified aggregate data derived from your use of the Platform, provided such data has been de-identified in accordance with HIPAA's de-identification standards (45 C.F.R. § 164.514(b)). De-identified data retains no information that could reasonably be used to identify any individual patient or healthcare professional.

De-identified aggregate data may be used for the following purposes without further notice or compensation to you:

• Improving, training, and validating Platform algorithms and scoring models, including the development of machine learning and artificial intelligence models;
• Clinical research, including publication of outcomes studies and methodology papers;
• Product development and feature enhancement;
• Quality assurance and platform performance analysis; and
• Commercial purposes, including licensing to third parties in de-identified, aggregated form.

6.2.1 Clinical Outcomes Registry

The Platform maintains a de-identified clinical outcomes registry. De-identified data derived from your use of the Platform may be contributed to this registry and used by the Company, its personnel, and its academic or research collaborators for retrospective research, quality improvement, methodology development, benchmarking, and academic publication, including research purposes not specified at the time of collection. To enable longitudinal outcomes analysis, the Company may assign and retain a non-identifying linkage code to associate de-identified records of the same case or patient over time, in accordance with 45 C.F.R. § 164.514(c). Such coded data remains de-identified, contains no Protected Health Information, and cannot be re-linked to any individual by recipients of the data. The Company does not conduct research on, publish, or disclose Protected Health Information; all research and registry activities use de-identified data only.

You represent and warrant that you have obtained all necessary patient consents and authorizations required by applicable law to permit the Company's processing of patient data as described herein, and that your submission of patient data to the Platform complies with all applicable laws including HIPAA.

6.3 No PHI in Research Outputs

The Company will not include any Protected Health Information (PHI) in any research publication, dataset shared with third parties, or AI training dataset. All external use of data is limited to information that has been de-identified in compliance with HIPAA.

7. Confidentiality of Platform Methodology

The scoring methodology, ARS formula and weights, domain penalty architecture, clinical logic rules, hard floor thresholds, and recommendation frameworks embodied in the Platform constitute proprietary trade secrets of the Company. You agree to:

• Maintain the strict confidentiality of any non-public Platform methodology that you observe, infer, or become aware of through your use of the Platform;
• Not disclose, reproduce, publish, or describe the Platform's underlying methodology, scoring logic, or algorithmic structure to any third party without prior written consent from the Company;
• Take reasonable precautions to prevent unauthorized access to or disclosure of Platform methodology; and
• Promptly notify the Company of any known or suspected unauthorized disclosure.

These confidentiality obligations survive termination of these Terms indefinitely.

8. Fees, Payment, and Subscription

Access to certain features of the Platform may require payment of fees as set forth in the applicable subscription plan selected at registration or subsequently. All fees are stated in U.S. dollars. You authorize us to charge your payment method on a recurring basis according to your selected subscription tier.

We reserve the right to modify fees upon reasonable advance notice. Continued use of the Platform after a fee change constitutes acceptance of the new fees. Unless otherwise stated, fees are non-refundable except as required by applicable law or as expressly provided in a separate written agreement.

During any designated beta period, the Platform may be provided at no charge. We reserve the right to begin charging fees upon the conclusion of any beta period with advance notice to registered users.

9. Privacy

Your use of the Platform is subject to our Privacy Policy, which is incorporated into these Terms by reference. By using the Platform, you consent to the collection, use, and disclosure of your information as described in the Privacy Policy. In the event of any conflict between these Terms and the Privacy Policy with respect to data handling, the Privacy Policy controls.

10. Business Associate Agreement (HIPAA)

10.1 Definitions

Capitalized terms in this Section 10 have the meanings set forth in HIPAA (45 C.F.R. Parts 160 and 164), including the HIPAA Privacy Rule, Security Rule, and Breach Notification Rule, as amended by the HITECH Act. Key terms include:

• Covered Entity (CE): You, the licensed healthcare professional using the Platform.
• Business Associate (BA): FirstAssistantAI, Inc.
• Protected Health Information (PHI): Individually identifiable health information created, received, maintained, or transmitted by the BA on behalf of the CE.
• Electronic PHI (ePHI): PHI that is created, received, maintained, or transmitted in electronic form.
• Breach: An impermissible use or disclosure of unsecured PHI that compromises its privacy or security, as defined under 45 C.F.R. § 164.402.

10.2 Permitted Uses and Disclosures of PHI

The BA may use and disclose PHI only as necessary to provide clinical decision support services to the CE as described in these Terms, and:

• As required by law;
• For BA's proper management and administration, provided that disclosures are required by law or the BA obtains reasonable assurances of confidential handling;
• To report violations of law to appropriate authorities consistent with 45 C.F.R. § 164.502(j)(1); and
• As otherwise permitted under these Terms, including for de-identification and subsequent use as described in Section 6.2.

The BA will not use or disclose PHI in any manner that would violate HIPAA if done by the CE, except as permitted under this BAA. The BA will not sell PHI or use PHI for marketing purposes without authorization as required by HITECH.

10.3 BA Obligations

The BA agrees to:

• Safeguards. Implement and maintain appropriate administrative, physical, and technical safeguards to prevent the use or disclosure of PHI other than as permitted under this BAA, consistent with HIPAA Security Rule requirements (45 C.F.R. Part 164, Subpart C);
• Subcontractors. Ensure that any subcontractor or agent that creates, receives, maintains, or transmits PHI on behalf of the BA agrees to restrictions and conditions at least as protective as those in this BAA. Current subprocessors, each under an executed HIPAA-compliant Business Associate Agreement, are: Supabase, Inc. (database, authentication, and infrastructure); Vercel, Inc. (application hosting and edge network); and Google LLC (transactional email via Google Workspace). This list may be updated from time to time, with at least thirty (30) days' advance notice for any change to a subprocessor that handles PHI;
• Minimum Necessary. Use or disclose only the minimum PHI necessary to accomplish the intended purpose;
• Individual Rights. To the extent the BA carries out CE's obligations under the Privacy Rule, comply with applicable requirements. The BA will cooperate with CE to facilitate individual rights requests (access, amendment, accounting of disclosures) as required by HIPAA;
• Access. Make its internal practices, books, and records relating to PHI available to the Secretary of the U.S. Department of Health and Human Services (HHS) for compliance purposes; and
• Accounting. Document and make available information required for CE's accounting of disclosures as required under 45 C.F.R. § 164.528.

10.4 Breach Notification

The BA will notify the CE without unreasonable delay, and in no case later than 30 calendar days following discovery of a Breach of unsecured PHI. Notification will include, to the extent known: (i) identification of individuals affected; (ii) description of the Breach; (iii) type of PHI involved; (iv) steps taken to investigate and mitigate; and (v) steps the CE should take to protect itself. The BA will also report to the CE any Security Incident of which it becomes aware, including unsuccessful attempts to compromise PHI.

10.5 CE Obligations

The CE agrees to:

• Obtain any required patient authorizations prior to submitting PHI to the Platform;
• Notify the BA of any limitation in the CE's Notice of Privacy Practices that may affect the BA's use or disclosure of PHI;
• Notify the BA of any changes in individual permissions or restrictions that may affect the BA's permitted uses or disclosures of PHI; and
• Not request the BA to use or disclose PHI in a manner that would violate HIPAA.

10.6 Term and Termination of BAA

This BAA is effective as of the date CE first accepts these Terms and continues until termination of the CE's account or these Terms. Upon termination, the BA will, at the direction of the CE and to the extent feasible, return or destroy PHI received from or on behalf of CE. If return or destruction is not feasible, the BA will extend the protections of this BAA to such PHI indefinitely. The CE may terminate this BAA immediately upon written notice if the BA materially breaches this BAA and fails to cure such breach within 30 days of written notice.

10.7 Regulatory Updates

The parties agree to amend this BAA as necessary to comply with changes to HIPAA, HITECH, and applicable regulations. Either party may request amendments to this BAA by providing written notice to the other party. This BAA will be interpreted to comply with the requirements of HIPAA and HITECH as they may be amended from time to time.

11. Disclaimers of Warranty

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, THE PLATFORM IS PROVIDED "AS IS" AND "AS AVAILABLE" WITHOUT WARRANTIES OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, ACCURACY, COMPLETENESS, OR RELIABILITY OF CLINICAL CONTENT.

We do not warrant that the Platform will be uninterrupted, error-free, or free of viruses or other harmful components. Clinical content, scoring outputs, and recommendation cards are provided for informational purposes only and are not warranties of clinical accuracy or outcome. Evidence-based medicine evolves and Platform content reflects the literature available at the time of compilation.

12. Limitation of Liability

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, IN NO EVENT WILL THE COMPANY, ITS OFFICERS, DIRECTORS, EMPLOYEES, AGENTS, LICENSORS, OR SERVICE PROVIDERS BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, OR PUNITIVE DAMAGES, INCLUDING BUT NOT LIMITED TO DAMAGES ARISING FROM CLINICAL DECISIONS MADE IN RELIANCE ON PLATFORM OUTPUTS, PATIENT OUTCOMES, LOSS OF PROFITS, LOSS OF DATA, BUSINESS INTERRUPTION, OR PERSONAL INJURY, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

THE COMPANY'S TOTAL CUMULATIVE LIABILITY TO YOU FOR ALL CLAIMS ARISING FROM OR RELATING TO THESE TERMS OR YOUR USE OF THE PLATFORM, REGARDLESS OF THE FORM OF ACTION, WILL NOT EXCEED THE GREATER OF: (A) THE TOTAL FEES PAID BY YOU TO THE COMPANY IN THE TWELVE (12) MONTHS PRECEDING THE CLAIM, OR (B) ONE HUNDRED DOLLARS ($100).

Some jurisdictions do not allow the exclusion or limitation of certain damages. In such jurisdictions, our liability is limited to the greatest extent permitted by law.

13. Indemnification

You agree to defend, indemnify, and hold harmless the Company and its officers, directors, employees, contractors, agents, licensors, and service providers from and against any claims, liabilities, damages, judgments, awards, losses, costs, and expenses (including reasonable attorneys' fees) arising out of or relating to:

• Your use of the Platform;
• Any clinical decision made by you in connection with Platform use;
• Your violation of these Terms;
• Your violation of any applicable law, regulation, or third-party right;
• Your submission of inaccurate, incomplete, or unlawfully obtained patient data; or
• Any breach of your representations and warranties under these Terms.

14. Term and Termination

These Terms are effective from the date you first accept them and continue until terminated. We may suspend or terminate your access at any time, with or without cause, effective immediately upon notice. You may terminate your account at any time by contacting us at legal@firstassistantai.com.

Upon termination: (i) your license to use the Platform immediately ceases; (ii) you must immediately cease all use of the Platform; (iii) data deletion and retention will proceed as described in the Privacy Policy and Section 10.6; and (iv) Sections 5, 6.2, 7, 11, 12, 13, 15, and 16 survive termination indefinitely.

15. Governing Law and Dispute Resolution

These Terms are governed by and construed in accordance with the laws of the State of Delaware, without regard to its conflict of law provisions. Any dispute arising from or relating to these Terms or the Platform that cannot be resolved informally shall be submitted to binding arbitration administered by JAMS under its Streamlined Arbitration Rules, conducted in English, with proceedings in Delaware unless otherwise agreed. The arbitrator's decision shall be final and binding and may be entered as a judgment in any court of competent jurisdiction.

Class Action Waiver: You agree that any arbitration or proceeding shall be limited to the dispute between you and the Company individually. To the fullest extent permitted by law, you waive the right to participate in a class action, class arbitration, or representative action.

Notwithstanding the foregoing, either party may seek injunctive or other equitable relief in any court of competent jurisdiction to prevent irreparable harm, including to protect intellectual property or trade secrets.

16. General Provisions

16.1 Modifications

We reserve the right to modify these Terms at any time. We will provide notice of material changes by email to your registered address, by in-Platform notification, or by posting updated Terms with a revised effective date. Your continued use of the Platform after the effective date of any modification constitutes acceptance of the updated Terms. If you do not agree to modified Terms, you must discontinue use and notify us to close your account.

16.2 Entire Agreement

These Terms, together with the Privacy Policy and any applicable subscription or enterprise agreement, constitute the entire agreement between you and the Company regarding the Platform and supersede all prior agreements, representations, and understandings relating to its subject matter.

16.3 Severability

If any provision of these Terms is found to be unenforceable or invalid, that provision will be limited or eliminated to the minimum extent necessary so that the remaining Terms continue in full force and effect.

16.4 No Waiver

Failure by the Company to enforce any right or provision of these Terms does not constitute a waiver of that right or provision.

16.5 Assignment

You may not assign or transfer your rights or obligations under these Terms without our prior written consent. The Company may assign these Terms freely, including in connection with a merger, acquisition, or sale of substantially all of its assets, with notice to you.

16.6 Force Majeure

The Company will not be liable for any delay or failure to perform resulting from causes outside its reasonable control, including acts of God, natural disasters, pandemic, war, terrorism, government actions, internet or power failures, or third-party service provider outages.

16.7 Contact

Questions regarding these Terms should be directed to: legal@firstassistantai.com
FirstAssistantAI, Inc.
A Delaware Corporation