GENERAL TERMS AND CONDITIONS

OASYS NOW B.V.

September 2026

Who we are
1. OASYS NOW B.V. ("OASYS NOW", "we") is a private limited company under Dutch law, registered with the Chamber of Commerce under number 82393338, with its registered office at Molengraaffsingel 12, 2629 JD Delft, the Netherlands. VAT number NL862450780B01. Contact: info@oasysnow.com.
2. We develop software that helps hospitals, laboratories, research institutions and foundations, public authorities, clinical trial sponsors and other life sciences organizations identify potentially eligible patients for clinical studies and make health data available for research, care, quality and public health purposes, including ELaiGIBLE CT, ELaiGIBLE RWD, De-ID and any other related products and services we offer (the "Services"). Our website is www.oasysnow.com (the "Website").
Scope and definitions
1. These General Terms and Conditions ("Terms") apply to every offer, quotation and agreement between OASYS NOW and a client, to every use of the Services, and to every visit to the Website.
2. "Client" means the organization that enters into an agreement with us or on whose behalf the Services are used. "User" means any individual who uses the Services or the Website. The Client is responsible for its Users. "Agreement" means any written agreement between the Client and us, including its annexes. "Client Data" means all data the Client or its Users make available to us through the Services. Client Data does not include information that cannot be traced back to an individual or to the Client.
3. The Client's own general or purchase conditions do not apply, even if they are referred to in an order or elsewhere.
4. In the event of a conflict, the following order applies: (a) the data processing agreement, for the processing of personal data; (b) the Agreement; (c) these Terms.
5. By using the Services or the Website you accept these Terms. If you act on behalf of an organisation, you confirm that you are authorised to bind it.
The Services
1. The Services are intended for professional use by healthcare, laboratory, research and public sector organisations only. They support the identification of potentially eligible patients and the extraction and structuring of health data for research, quality and policy purposes. They do not provide a diagnosis, prognosis or treatment recommendation for an individual patient, are not medical advice and are not placed on the market as a medical device.
2. The Services use artificial intelligence, including large language models. Outputs are probabilistic and may contain errors. The Client must have qualified professionals verify all outputs before relying on them. Decisions on trial enrolment, patient care and research design remain entirely with the Client and its qualified professionals.
3. We perform the Services with due care and skill (best-efforts obligation). We do not guarantee that the Services are error-free, uninterrupted or produce a particular result. Availability, maintenance and support levels apply only where agreed in a service level agreement.
4. We may use subcontractors and improve, change or replace parts of the Services, provided that the agreed functionality is not materially reduced during the term of an Agreement.
Obligations of the Client
1. The Client ensures that it has a valid legal basis under the GDPR and applicable national law for all processing of personal data through the Services, and that it has obtained any required ethics committee (METC), institutional or patient-related approvals. The Client decides which data is made available to the Services and for what purpose.
2. Where we process personal data on behalf of the Client, the Client concludes a data processing agreement with us before such processing starts.
3. The Client keeps its account credentials confidential, is responsible for all use under its accounts, and informs us without undue delay of any suspected unauthorised use or security incident. We recommend multi-factor authentication.
4. The Client provides accurate information and the cooperation, access and connectivity (including to electronic health record and laboratory information systems) reasonably needed to perform the Services.
5. The Client and its Users will not: (a) use the Services in breach of law or these Terms; (b) copy, modify, reverse engineer or decompile the Services, or build a competing product from them; (c) circumvent security measures, introduce malicious code or overload our systems; (d) access the Services by automated means without our consent; or (e) give third parties access to the Services without our written consent.
Client Data, privacy and security
1. Client Data remains the property of the Client. We process Client Data only to provide, secure, maintain and improve the Services for the Client.
2. Where Client Data contains personal data, we act as processor and follow the Client's documented instructions and the data processing agreement.
3. We protect Client Data with appropriate technical and organisational measures under our information security management system, which is certified against ISO 27001 and NEN 7510. Our cloud Services are hosted within the European Economic Area. We do not transfer personal data outside the EEA without appropriate safeguards. A list of sub-processors is available on request.
4. For on-premise software such as De-ID, personal data remains within the Client's environment. The software exchanges only technical data with us, such as license checks, logs, telemetry and model calls, which do not contain personal data.
5. After the end of the Services we delete or return Client Data within the period set out in the data processing agreement and confirm deletion in writing on request.
6. Our processing of personal data of Users and Website visitors is described in our Privacy Statement on the Website.
Confidentiality
1. Each party keeps the other party's confidential information secret, uses it only for the purpose of the Agreement, and shares it only with employees and subcontractors who need it and are bound by confidentiality. This does not apply to information that is public, already lawfully known, or that must be disclosed by law.
2. This obligation continues for five years after the end of the Agreement, and indefinitely for Client Data and our source code, models and know-how.
Intellectual property
1. All intellectual property rights in the Services, the Website and everything we develop in performing the Services, including software, models, prompts, de-identification logic, documentation, know-how and improvements, belong to OASYS NOW or its licensors. Nothing in these Terms transfers any such rights to the Client.
2. For the term of the Agreement the Client receives a non-exclusive, non-transferable right to use the Services for its internal purposes. On-premise software is used under the licence terms provided with it.
3. If the Client gives us feedback or suggestions, we may use them freely and without compensation. Feedback does not include Client Data or confidential information.
4. We may refer to the Client as a customer by name and logo in our commercial communications, unless the Client objects in writing.
Fees and payment
1. Fees are set out in the Agreement and are exclusive of VAT. Unless agreed otherwise, invoices are payable within 30 days of the invoice date. Recurring fees are invoiced annually in advance.
2. We may adjust recurring fees once per calendar year in line with the Dutch consumer price index (CBS CPI), with at least one month's notice.
3. If the Client fails to pay on time, statutory commercial interest and reasonable collection costs are due, and we may suspend the Services after written notice until payment is received. The Client is not entitled to set-off or suspension of payment.
Term, termination and suspension
1. The term of the Services is set out in the Agreement. Unless the Agreement states otherwise, subscriptions run for twelve months and renew automatically for successive twelve-month periods unless either party gives notice at least three months before the end of the current term.
2. Either party may terminate the Agreement with immediate effect if the other party materially breaches it and fails to remedy the breach within 30 days of written notice, or becomes insolvent or is dissolved.
3. We may suspend access to the Services immediately if the Client breaches Article 4.5, poses a security risk to the Services or other clients, or if we are required to do so by law. We inform the Client as soon as reasonably possible.
4. Fees already paid are not refunded on termination, except in case of termination by the Client for our unremedied material breach. Articles 5, 6, 7, 10 and 13 survive termination.
Liability
1. Our total liability towards the Client, per calendar year and for all events together, is limited to the fees paid by the Client for the Services in the twelve months preceding the event giving rise to the claim.
2. We are not liable for indirect or consequential damage, including lost profit, lost revenue, lost savings, loss of goodwill, business interruption, or damage resulting from decisions made on the basis of outputs of the Services.
3. We are not liable for damage caused by incorrect or incomplete Client Data, by systems or services of third parties (including electronic health record systems and laboratory information systems), or by the Client's failure to comply with these Terms or applicable law.
4. These limitations do not apply if the damage is caused by our intent or deliberate recklessness.
5. The Client must notify us of a claim in writing within 30 days of discovering the damage. Any claim lapses twelve months after the event giving rise to it.
6. The Client indemnifies us against third-party claims resulting from the Client's use of the Services in breach of these Terms or applicable law, or from the Client not having a valid legal basis or the required approvals for its Client Data.
Force majeure
1. Neither party is obliged to perform, and neither is liable, if prevented by circumstances beyond its reasonable control, including failures of internet, hosting or third-party services, cyberattacks, government measures and epidemics. If force majeure lasts longer than 60 days, either party may terminate the affected part of the Agreement in writing.
Website
1. The Website is provided for information purposes. We take care over its content but do not guarantee that it is complete, accurate or up to date. Use of the Website is at your own risk. Our Privacy Statement applies.
Applicable law and disputes
1. These Terms and every Agreement are governed by Dutch law. The Vienna Sales Convention (CISG) does not apply.
2. Disputes are submitted to the competent court in The Hague, the Netherlands, unless the parties first try to resolve the dispute in good faith through consultation between their management.
Final provisions
1. We may amend these Terms. We publish the new version on the Website. For an existing Agreement, the new version applies from the start of the next contract term, provided we have informed the Client before the start of the notice period under Article 9.1. Amendments that are required by law or that are not to the Client's disadvantage apply immediately.
2. We may transfer our rights and obligations to a group company or to a successor of our business. The Client may not transfer the Agreement without our written consent.
3. If a provision of these Terms is invalid, the other provisions remain in force and the invalid provision is replaced by a valid one that comes as close as possible to its purpose.