Terms of Use and Sale

1.1 Platform Publisher

The DIAGNORA platform, accessible at https://www.diagnora.com (hereinafter the "Platform"), is published by:

DIAGNORA (formerly PARAFY), a simplified joint-stock company (SAS) under French law, with a share capital of [MONTANT] euros, whose registered office is located at:
18, rue Général Fabvier, 54000 Nancy, France
Registered with the Nancy Trade and Companies Register under number 920 841 590
Intra-community VAT number: FR90920841590
(hereinafter the "Company" or "DIAGNORA").

1.2 Contact Details

Email: contact@diagnora.com
Address: 18, rue Général Fabvier, 54000 Nancy, France

1.3 Hosting

The Platform is hosted by a provider certified as a Health Data Host (HDS) in accordance with the provisions of Article L.1111-8 of the French Public Health Code.

1.4 Publication Director

Mr. Marcos Saravia Flores, President of the Company.

1.5 Purpose of the GTCS

These General Terms and Conditions of Use and Sale (hereinafter the "GTCS") are intended to define the conditions under which the Company makes its SaaS (Software as a Service) Platform of digital solutions available to Clients, designed for healthcare professionals, including medical biology laboratories, radiologists, and anatomopathologists.

1.6 Acceptance

Any subscription to a Subscription Plan or use of the Platform implies the Client's unreserved acceptance of these GTCS. The Client acknowledges having read these GTCS prior to subscribing to any Subscription Plan and having accepted them by checking the box provided for this purpose.

These GTCS shall prevail over any general or specific terms and conditions of the Client, unless expressly and in writing derogated by the Company.

In these GTCS, the following terms, whether used in singular or plural form, shall have the meaning defined below:

• "Subscription Plan": refers to the Client's subscription to one of the Platform access plans offered by the Company, according to the terms and pricing described in the Order Form or the Commercial Offer.
• "Order Form": refers to the contractual document signed by the Client describing the subscribed Services, the duration of the Subscription Plan, the number of Authorized Users, and the applicable pricing.
• "Client": refers to any healthcare professional, legal entity, or natural person acting in the course of their professional activity, who has subscribed to a Subscription Plan for the Platform.
• "Client Content": refers to any data, information, document, or file uploaded, entered, or transmitted by the Client or its Authorized Users on the Platform, including health data where applicable.
• "Personal Data": refers to any information relating to an identified or identifiable natural person, within the meaning of the General Data Protection Regulation (GDPR).
• "Health Data": refers to personal data relating to the physical or mental health of a natural person, within the meaning of Article 4(15) of the GDPR and Article L.1111-8 of the French Public Health Code.
• "Documentation": refers to all user guides, technical manuals, and tutorials made available to the Client by the Company.
• "Commercial Offer": refers to the pricing and functional proposal sent to the Client by the Company.
• "Platform": refers to the DIAGNORA SaaS solution accessible online, comprising all functionalities, algorithms and data analysis models, interfaces, document processing tools, and associated services.
• "Services": refers to all services provided by the Company to the Client under the Subscription Plan, including access to the Platform, technical support, maintenance, and updates.
• "Authorized User": refers to any natural person duly authorized by the Client to access and use the Platform under the subscribed Subscription Plan.

3.1 General Overview

The DIAGNORA Platform is a SaaS (Software as a Service) productivity and administrative assistance solution designed for healthcare professionals. It offers the following functionalities, subject to the subscribed Commercial Offer:

• "Intelligent Scan": digitization and automated processing of anatomopathology forms and reports;
• "Automatic Teletransmission": automated verification and transmission of information related to health insurance organizations;
• "Reporting Tool": automated generation of documents and reports from structured and unstructured data;
• "AI Receptionist": automated management and processing of patient telephone calls.

3.2 Nature of Services

It is expressly stated that the Services provided by the Platform are administrative productivity and document processing assistance tools. They do not in any way constitute medical devices within the meaning of Regulation (EU) 2017/745 on medical devices (MDR) and are not intended to:

• formulate, suggest, or influence a medical diagnosis;
• substitute for the clinical judgment of a qualified healthcare professional;
• guide a therapeutic or care decision.

The Client remains solely responsible for any medical, diagnostic, or therapeutic decision made in the course of their professional activity.

3.3 Technical Prerequisites

Access to the Platform requires a stable high-speed Internet connection and a compatible web browser (the list of which is specified in the Documentation). The Client is solely responsible for the compliance of their computer equipment and Internet connection.

4.1 Restricted to Professionals

Access to the Platform and subscription to a Subscription Plan are reserved exclusively for healthcare professionals and legal entities acting in the course of their professional activity. The Client declares and warrants that they are acting in a professional capacity within the meaning of the French Consumer Code.

Consequently, the provisions of the French Consumer Code relating to consumer protection, and in particular the right of withdrawal provided for in Articles L.221-18 et seq. of the French Consumer Code, are not applicable to these GTCS.

4.2 Account Creation

To access the Platform, the Client must create an account by providing accurate, complete, and up-to-date information. The Client undertakes to update this information in the event of any change.

The Client is responsible for the confidentiality of their login credentials and those of their Authorized Users. Any use of the Platform made using the Client's credentials shall be deemed to have been made by the Client.

4.3 Authorized Users

The number of Authorized Users is defined in the Order Form. The Client is responsible for compliance with these GTCS by its Authorized Users. Any breach by an Authorized User shall be considered a breach by the Client.

5.1 Pricing

Subscription Plan pricing is as set out in the Order Form or the Commercial Offer accepted by the Client. Prices are expressed in euros and are exclusive of taxes (HT). The applicable VAT shall be added at the rate in effect on the date of invoicing.

The Company reserves the right to modify its pricing at any time. Any pricing change shall be notified to the Client at least thirty (30) days before it takes effect and shall only apply upon renewal of the current Subscription Plan.

5.2 Payment Terms

Payment shall be made in accordance with the terms set out in the Order Form: by direct debit, bank transfer, or credit card, according to the agreed terms (monthly, quarterly, or annual).

Invoices are issued in electronic format and sent to the Client electronically. The Client expressly accepts electronic invoicing.

5.3 Late Payment

In accordance with Articles L.441-10 et seq. of the French Commercial Code, any late payment shall automatically result in:

• the application of late payment penalties calculated at a rate of three (3) times the legal interest rate in effect, payable from the day following the due date shown on the invoice;
• a fixed compensation of forty (40) euros for recovery costs, without prejudice to additional compensation upon proof of higher costs;
• the possibility for the Company to suspend access to the Platform after a formal notice that has remained unsuccessful for fifteen (15) days.

6.1 Subscription Plan Duration

The Subscription Plan is taken out for the initial period defined in the Order Form. Unless otherwise stipulated, the initial period is twelve (12) months from the date the Platform is activated.

6.2 Renewal

Unless terminated by either party by registered letter with acknowledgment of receipt or by electronic means with acknowledgment of receipt, sent at least thirty (30) days before the expiration of the current period, the Subscription Plan shall be automatically renewed for successive periods of the same duration.

6.3 Termination for Breach

In the event of a serious breach by either party of its obligations under these GTCS, not remedied within thirty (30) days following notification by registered letter with acknowledgment of receipt detailing the alleged breach(es), the aggrieved party may terminate these GTCS as of right.

The Company may also immediately terminate the Subscription Plan, without notice or compensation, in the event of use of the Platform contrary to applicable laws and regulations, or in the event of a violation of obligations relating to Health Data.

6.4 Consequences of Termination

Upon expiration or termination of the Subscription Plan:

• access to the Platform shall be deactivated;
• the Client shall have a period of thirty (30) days to retrieve their data in a structured and commonly used format (data portability);
• after this period, the Company shall proceed with the secure deletion of the Client Content, subject to legal retention obligations.

7.1 Availability Commitment

The Company undertakes to use reasonable means to ensure the availability of the Platform twenty-four (24) hours a day, seven (7) days a week, subject to maintenance operations and cases of force majeure.

7.2 Maintenance

The Company reserves the right to temporarily interrupt access to the Platform for preventive, corrective, or evolutionary maintenance operations. Where possible, the Client shall be informed at least forty-eight (48) hours in advance of scheduled interruptions.

7.3 Exclusions

Service interruptions resulting from force majeure, telecommunications network failures, acts of third parties, or non-compliant use of the Platform by the Client shall not give rise to any liability on the part of the Company.

8.1 Compliant Use

The Client undertakes to use the Platform in accordance with these GTCS, the Documentation, and applicable laws and regulations, in particular the provisions relating to medical confidentiality, professional ethics, and health data protection.

8.2 Security

The Client is responsible for the security of their IT environment, their login credentials, and the implementation of adequate security measures within their organization. The Client undertakes to immediately notify the Company of any unauthorized use of their account or any security breach of which they become aware.

8.3 Client Content

The Client is solely responsible for the Client Content that they upload, enter, or transmit via the Platform. They warrant that such content is lawful, that they hold all necessary rights for its use, and that its processing via the Platform complies with applicable regulations, in particular the GDPR and provisions relating to health data.

8.4 Prohibitions

The Client is specifically prohibited from:

• using the Platform for unlawful purposes or purposes not authorized by these GTCS;
• attempting to circumvent, disable, or disrupt the Platform's security measures;
• carrying out any reverse engineering, decompilation, or disassembly operations on the Platform;
• reselling, sublicensing, or making access to the Platform available to third parties;
• using the Platform in a manner likely to impair its operation or the security of the data it contains.

9.1 Company Rights

The Company is and remains the holder of all intellectual property rights relating to the Platform, including, without limitation, software, algorithms, data analysis models, interfaces, designs, databases, trademarks, logos, texts, images, and any other element composing the Platform (hereinafter the "Elements").

These GTCS do not confer on the Client any intellectual property rights over the Platform or its Elements. The Client only benefits from a non-exclusive, non-assignable, and non-transferable right of access and use, for the duration of the Subscription Plan and within the limits provided herein.

9.2 Client Content

The Client retains all of its intellectual property rights over the Client Content. By uploading or entering content on the Platform, the Client grants the Company a limited, non-exclusive, and revocable license to use such content solely for the purposes of providing the Services.

9.3 Prohibitions

No Element of the Platform may, in whole or in part, be modified, reproduced, copied, duplicated, sold, resold, transmitted, published, communicated, distributed, broadcast, represented, stored, used, rented, or exploited in any manner whatsoever, whether free of charge or for consideration, by the Client or by a third party, regardless of the means and/or media used, without the express, prior, and written authorization of the Company.

10.1 Regulatory Compliance

Each party undertakes to comply with applicable regulations regarding the protection of personal data, and in particular:

• Regulation (EU) 2016/679 of 27 April 2016 (GDPR);
• French Law No. 78-17 of 6 January 1978 as amended, relating to data processing, files, and freedoms;
• the recommendations of the French National Commission for Information Technology and Freedoms (CNIL);
• the provisions of the French Public Health Code relating to health data.

10.2 Respective Roles

In the context of the performance of these GTCS, the Client acts as the data controller and the Company acts as the data processor within the meaning of the GDPR, for the processing of Personal Data and Health Data carried out on behalf of the Client via the Platform.

10.3 Obligations of the Company as Data Processor

The Company undertakes in particular to:

• process Personal Data only on documented instructions from the Client;
• ensure the confidentiality of the processed data and ensure that persons authorized to process such data are subject to a confidentiality obligation;
• implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, in accordance with Article 32 of the GDPR;
• assist the Client in fulfilling its obligations regarding the rights of data subjects;
• notify the Client of any personal data breach as soon as possible and no later than seventy-two (72) hours after becoming aware of it;
• delete or return all Personal Data at the end of the service, in accordance with the Client's choices and legal retention obligations.

10.4 Health Data Hosting

Where the Services involve the processing of Health Data, such data is hosted by a provider certified as a Health Data Host (HDS) in accordance with the provisions of Article L.1111-8 of the French Public Health Code and the certification provided for by Decree No. 2018-137 of 26 February 2018.

10.5 Data Processed by the Company for Its Own Purposes

The Company collects and processes certain data relating to the Client and its Authorized Users for the purposes of managing the contractual relationship, including:

• identification data (surname, first name, position, professional contact details);
• Platform login and usage data;
• billing data.

Identity of the data controller: DIAGNORA, SAS, 18 rue Général Fabvier, 54000 Nancy, France.

Legal bases: performance of the contract (Article 6(1)(b) of the GDPR), legitimate interests of the Company (Article 6(1)(f) of the GDPR), compliance with legal obligations (Article 6(1)(c) of the GDPR).

Retention period: data is retained for the duration of the contractual relationship, then archived in accordance with legal retention obligations (in particular accounting and tax obligations), and for a maximum period corresponding to the applicable statutory limitation periods.

10.6 Rights of Data Subjects

In accordance with the GDPR and the French Data Protection Act, data subjects have the following rights over their personal data:

• right of access, rectification, and erasure;
• right to restriction of processing;
• right to data portability;
• right to object;
• right to define directives regarding the fate of their data after their death.

These rights may be exercised by contacting the Company by email at dpo@diagnora.com or by mail at: DIAGNORA – 18, rue Général Fabvier, 54000 Nancy, France, enclosing proof of identity.

Each party undertakes to treat as confidential and not to disclose, without the prior written consent of the other party, all information of a technical, commercial, financial, or strategic nature transmitted by the other party in the context of the performance of these GTCS (hereinafter "Confidential Information").

This confidentiality obligation shall not apply to information that:

• is or becomes publicly available through no fault of the receiving party;
• was legitimately in the possession of the receiving party prior to its disclosure;
• is communicated by an authorized third party without any confidentiality restriction;
• the disclosure of which is required by law or by a competent authority.

This confidentiality obligation shall survive the termination of these GTCS for a period of five (5) years.

12.1 Best Efforts Obligation

The Company is subject to a best efforts obligation in the provision of the Services. It undertakes to provide the Services with diligence and competence, in accordance with industry standards and best practices.

12.2 Exclusions of Liability

The Company's liability may under no circumstances be engaged in respect of:

• indirect damages, including, without limitation, loss of data, revenue, profits, customers, business, or any indirect financial loss;
• cases of force majeure as defined in Article 1218 of the French Civil Code;
• use of the Platform that does not comply with these GTCS or the Documentation;
• any medical, diagnostic, or therapeutic decision made by the Client or its Authorized Users based on the results provided by the Platform;
• the inadequacy of the Services to meet specific needs of the Client not expressly defined in the Order Form;
• interruptions or malfunctions resulting from Internet network failures, the Client's IT infrastructure, or the actions of third parties.

12.3 Liability Cap

In any event, the total and cumulative liability of the Company under these GTCS, for all causes combined, shall be limited to the total amount of sums actually received by the Company under the Client's Subscription Plan during the twelve (12) months preceding the event giving rise to the liability.

12.4 Insurance

The Company declares that it has taken out professional liability insurance covering the financial consequences of its professional liability.

The Company implements technical and organizational measures in accordance with the state of the art and applicable standards, in particular:

• encryption of data in transit (TLS/SSL) and at rest;
• access controls and access rights management;
• traceability of access and actions (logging);
• regular backups and a business continuity plan;
• regular security audits and penetration testing.

The Company undertakes to pursue compliance with ISO 27001 standards and, where applicable, HDS certification, according to service requirements.

The Platform may contain hyperlinks to third-party websites not published by the Company. These links are provided for informational purposes and are not subject to any review by the Company.

The Company shall not be held responsible for the content, practices, or terms of use of such third-party websites. Access to these third-party websites is at the Client's sole responsibility.

The Platform uses cookies and similar technologies to ensure its proper operation, improve the user experience, and compile usage statistics. The categories of cookies used are as follows:

• Strictly necessary cookies: essential for the operation of the Platform and the provision of the Services (authentication, session security);
• Analytical cookies: used to measure and analyze the use of the Platform, in compliance with CNIL recommendations;
• Functional cookies: used to personalize the user experience (display preferences, language).

The Authorized User may at any time configure their cookie preferences via the consent manager integrated into the Platform, in accordance with CNIL recommendations and the provisions of Article 82 of French Law No. 78-17 of 6 January 1978 as amended.

The Company provides the Client with a technical support service accessible:

• by email at: support@diagnora.com;
• Monday to Friday, from 9:00 AM to 6:00 PM (Paris time), excluding public holidays.

Neither party shall be held liable for the non-performance or delay in the performance of any of its obligations under these GTCS, if such non-performance or delay results from a case of force majeure within the meaning of Article 1218 of the French Civil Code.

The party invoking force majeure must notify the other party as soon as possible and take all reasonable measures to limit its effects. If the impediment is temporary, the performance of the obligation shall be suspended. If the impediment is permanent or lasts more than ninety (90) consecutive days, either party may terminate the GTCS without compensation.

18.1 Entire Agreement

These GTCS, the Order Form, the DPA, and any annexes thereto constitute the entire agreement between the parties with respect to their subject matter and supersede all prior negotiations, commitments, and agreements relating to the same subject matter.

18.2 Severability

If any provision of these GTCS is declared null or unenforceable under any law, regulation, or as a result of a final court decision, the remaining provisions shall retain their full force and effect.

18.3 Assignment

The Client may not assign all or part of its rights and obligations under these GTCS without the prior written consent of the Company. The Company may freely assign these GTCS in the context of a restructuring, merger, acquisition, or asset transfer, provided that it informs the Client within a reasonable period.

18.4 Waiver

The failure by either party to enforce any breach by the other party of any of its obligations shall not be construed as a waiver of the right to enforce such breach in the future.

18.5 Modification of the GTCS

The Company reserves the right to modify these GTCS at any time. Modifications shall be notified to the Client at least thirty (30) days before they take effect. Continued use of the Platform after the modifications take effect shall constitute acceptance of the new GTCS.

In the event of a complaint, the Client is invited to first contact the Company's customer service department:

• by email: contact@diagnora.com
• by mail: DIAGNORA – 18, rue Général Fabvier, 54000 Nancy, France.

The Company undertakes to acknowledge receipt of any complaint within five (5) business days and to provide a reasoned response within thirty (30) days.

20.1 Applicable Law

These GTCS are governed, interpreted, and applied in accordance with French law, to the exclusion of any international convention, and in particular the Vienna Convention on the International Sale of Goods.

20.2 Amicable Settlement

In the event of a dispute relating to the validity, interpretation, performance, or termination of these GTCS, the parties undertake to attempt to resolve the dispute amicably prior to any legal action.

20.3 Competent Jurisdiction

Failing amicable resolution within thirty (30) days from the notification of the dispute by either party, the Commercial Court of Nancy shall have sole jurisdiction to hear any dispute relating to these GTCS, including in the event of multiple defendants, third-party claims, or emergency proceedings.