Terms of service.

These Platform Terms of Service (“Terms”) govern your organisation’s access to and use of the BiotrackOS platform (“Service”) operated by BiotrackOS Ltd (“BiotrackOS”, “we”, “our”), a company incorporated in Scotland (company number SC737158) with its registered office at Canniesburn Gate, 10 Canniesburn Drive, Bearsden, Glasgow, Scotland, G61 1BF. By signing an Order Form, creating an account, or otherwise using the Service, the organisation identified (“Customer”) agrees to these Terms in full. If you are entering into these Terms on behalf of a Customer, you represent that you have authority to bind that Customer. These Terms do not apply to Users of the BiotrackOS personal app; see the Personal App Terms tab above.

Definitions

In these Terms, the following expressions have the following meanings:

• “Agreement” means these Terms together with the applicable Order Form, the Data Processing Addendum (“DPA”) published at biotrackos.com/data-processing, and any executed HIPAA Business Associate Agreement (“BAA”). In the event of conflict: the Order Form prevails over these Terms to the extent of any inconsistency; the DPA governs all data-protection matters and prevails over both the Order Form and these Terms in respect of those matters; and a BAA governs all HIPAA matters and prevails over the DPA to the extent of any conflict.
• “Confidential Information” means any non-public information disclosed by one party to the other in connection with the Agreement, whether disclosed orally, in writing, or by any other means, and identified as confidential or that should reasonably be understood to be confidential given its nature and the circumstances of disclosure. It does not include information that: (a) is or becomes publicly available without breach of any obligation owed to the disclosing party; (b) was known to the receiving party before disclosure; (c) is received from a third party without restriction; or (d) was independently developed by the receiving party without use of Confidential Information.
• “Member” means a natural person whose personal data is processed through the Service on behalf of Customer. A Member may also be a User if they independently use the BiotrackOS personal app; in that case both sets of terms apply in their respective contexts.
• “User” means a natural person who uses the BiotrackOS personal app under the Personal App Terms, whether or not that person is also a Member.
• “Order Form” means the commercial order form, subscription confirmation, or master agreement signed or accepted by Customer, setting out the subscription tier, fees, features, storage region, and any special terms agreed between the parties. In the event of any conflict between these Terms and an Order Form, the Order Form prevails to the extent of the inconsistency, unless the Order Form expressly states otherwise.
• “Personal Data” has the meaning given in applicable Data Protection Law.
• “Service” means the BiotrackOS health-data infrastructure platform, including the web dashboard, API, integrations, and associated tools and documentation, as described at biotrackos.com/product and in the applicable Order Form.

1. The Service

BiotrackOS is a health-data infrastructure platform that ingests, normalises, and surfaces data on behalf of Customer and its Members. Data types include, but are not limited to, connected-device and wearable streams, lab results, genomic and epigenetic reports, prescription and medication records, self-reported data, and manually imported records. Specific features are described at biotrackos.com/product and in the applicable Order Form. BiotrackOS is not a medical device and does not provide medical advice, diagnosis, or treatment.

2. AI-generated insights

The Service may include features that use artificial intelligence or machine learning to surface patterns, anomalies, or suggested actions from Member data (“AI Outputs”). AI Outputs are decision-support information only. They are not medical advice, clinical diagnosis, or treatment recommendations. Clinical responsibility for any decision made using AI Outputs rests with the qualified healthcare professional reviewing them. BiotrackOS does not guarantee the accuracy, completeness, or predictive value of AI Outputs and is not liable for clinical or other decisions made on their basis.

3. Accounts

Customer is responsible for maintaining the confidentiality of all account credentials and for all activity under Customer’s account. Customer must notify BiotrackOS immediately at security@biotrackos.com of any suspected unauthorised use or security breach.

4. Customer responsibilities

• Identify and document an appropriate lawful basis under applicable data protection law and, where applicable, a condition under GDPR Article 9(2) for each category of Member data processed through the Service, selecting the basis appropriate to the deployment context (which may be explicit consent, healthcare provision, or another applicable condition); obtain any required authorisation; and provide Members with required privacy notices before their data sources are connected.
• Configure appropriate access controls and ensure only authorised personnel access the Service.
• Comply with all applicable laws and regulations in the jurisdictions you operate in, including but not limited to UK GDPR, EU GDPR, HIPAA, the Australian Privacy Act 1988, the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021), the Saudi Personal Data Protection Law, and any other relevant data protection or healthcare legislation.
• Notify BiotrackOS promptly in writing of any actual or suspected security incident involving Member data.
• Not use the Service for any unlawful, abusive, or harmful purpose.

5. Acceptable use

Customer must not: (a) reverse-engineer or attempt to extract the source code of the Service; (b) process data belonging to individuals without a valid lawful basis; (c) resell or sublicense the Service without express written permission; (d) use the Service to train third-party machine learning models; (e) transmit malicious code or attempt to interfere with Service integrity or availability; (f) use the Service to make or facilitate solely automated decisions producing significant effects in the domains of employment, insurance, healthcare eligibility, or access to essential services without implementing the safeguards required by applicable law; or (g) submit or connect data of persons under 18 unless expressly permitted in the Order Form and all applicable lawful bases, safeguards, and authorisations are in place.

6. White-label and OEM use

Where Customer is licensed to deploy the Service under its own brand or as part of its own product (a “White-label Deployment”):

• Customer is granted a non-exclusive, non-transferable right to present the Service to its end users under Customer’s branding, within the scope set out in the Order Form.
• BiotrackOS retains all rights, title, and interest in the underlying platform, software, models, and infrastructure. Customer’s branding rights are limited to the user-facing layer agreed in the Order Form.
• Customer is the primary point of contact for its end users, including first-line support, end user billing relationships (where applicable), and end user complaints. BiotrackOS will provide reasonable second-line support to Customer.
• End users of a White-label Deployment must accept terms of use no less protective than these Terms in respect of platform security, data handling, and acceptable use. Customer is responsible for putting these in place.
• On termination of the Order Form, the White-label Deployment ends. End user data is handled in accordance with §18 (Termination).

7. Fees & billing

Fees are set out in the applicable Order Form. Annual subscriptions auto-renew unless written notice of non-renewal is provided at least 30 days before the end of the subscription term. Usage overages are billed monthly in arrears. All fees are exclusive of VAT, GST, sales tax, and other applicable taxes, which are Customer’s responsibility.

Undisputed invoices unpaid more than 30 days after the invoice date will accrue statutory interest and compensation in accordance with the Late Payment of Commercial Debts (Interest) Act 1998. Customer must raise any genuine dispute with an invoice in writing within 30 days of the invoice date; undisputed amounts remain due regardless.

8. Service levels

BiotrackOS targets 99.9% monthly uptime for the Service, measured monthly and excluding:

• scheduled maintenance windows communicated at least 48 hours in advance;
• issues caused by Customer’s misuse, third-party connected services, or factors outside BiotrackOS’s reasonable control;
• any single unplanned outage of 5 minutes or less in duration.

Where uptime falls below 99.9% in any calendar month, Customer is entitled to a service credit applied to the next invoice:

• <99.9% but ≥99.0%: 10% of monthly fees
• <99.0% but ≥95.0%: 25% of monthly fees
• <95.0%: 50% of monthly fees

Service credits are Customer’s sole remedy for uptime failures and are capped at the fees paid for the affected month. To claim a credit, Customer must notify support@biotrackos.com within 30 days of the end of the affected month. Real-time platform status is available at biotrackos.com/status.

9. Data & intellectual property

As between the parties, Customer retains all rights it has in Member data, subject to data-subject rights and applicable data protection law. Customer grants BiotrackOS a limited, non-exclusive, royalty-free licence to process Member data solely to the extent necessary to provide the Service under this Agreement; BiotrackOS acquires no ownership in Member data through this licence. BiotrackOS retains all rights, title, and interest in and to the Service, including its software, models, algorithms, and aggregated or irreversibly de-identified analytics that cannot reasonably be reverse-attributed to any individual or Customer. BiotrackOS will not sell, lease, or otherwise commercialise Member data. BiotrackOS will not use Member data to train or improve any machine learning or AI model without Customer’s prior written consent. The BiotrackOS name, logo, and trademarks may not be used without prior written consent, subject to the limited right granted in §12.

10. Security & compliance

BiotrackOS maintains technical and organisational security measures as described in the Data Processing Addendum at biotrackos.com/data-processing. Upon written request, no more than once per calendar year, BiotrackOS will provide Customer with:

• a copy of its most recent independent security audit report or certification (such as SOC 2 Type II or ISO 27001), where available and subject to confidentiality obligations; and
• a written summary of its current security controls and incident response procedures.

Where Customer is subject to regulatory audit or inspection requirements (including NHS DSPT, CQC requirements, or equivalent) that extend to BiotrackOS as a subprocessor, BiotrackOS will cooperate with such requirements on reasonable prior written notice, subject to reasonable confidentiality and operational safeguards.

11. Business continuity

BiotrackOS maintains a documented business continuity plan and disaster recovery procedure. In the event of a major service disruption, BiotrackOS will notify Customer within 4 hours of becoming aware of a significant incident and provide regular updates until the incident is resolved. Recovery Time Objectives and Recovery Point Objectives are set out in the applicable Order Form; where not specified, BiotrackOS targets an RTO of 4 hours and an RPO of 1 hour for Tier 1 incidents.

If BiotrackOS decides to permanently discontinue the Service, it will give Customer a minimum of 90 days’ prior written notice and will make all Customer data available for export in a standard, machine-readable format during that period, at no additional charge.

12. Publicity and case studies

Each party grants the other a limited right to use the other’s name and logo to identify the existence of the business relationship (for example, on customer lists, websites, and investor materials) during the term of the Order Form. This is the only permitted use of each party’s trademarks without further written consent; the general prohibition on trademark use in §9 continues to apply to all other uses. Detailed case studies, quotes, joint press releases, or specific deployment details require prior written approval of the other party. Either party may withdraw publicity rights on 30 days’ written notice.

13. Confidentiality

Each party agrees to protect the other’s Confidential Information with at least the same standard of care it uses to protect its own, and no less than reasonable care, and not to disclose it to any third party except as necessary to perform obligations under the Agreement or as required by law. Confidentiality obligations survive termination or expiry of the Agreement as follows: (a) general Confidential Information: five years; (b) source code, security architecture, cryptographic keys, and information constituting trade secrets: indefinitely; and (c) personal data: for as long as BiotrackOS retains the data concerned or as required by applicable data protection law.

14. Indemnification

Customer agrees to indemnify and hold harmless BiotrackOS, its officers, directors, and employees from any claims, damages, or costs (including reasonable legal fees) arising from: (a) Customer’s breach of these Terms; (b) Customer’s violation of any applicable law; or (c) Customer’s failure to obtain valid Member consents.

15. Warranties & disclaimers

BiotrackOS warrants that the Service will perform materially in accordance with its documentation under normal use. Except as expressly stated, the Service is provided “as is” and BiotrackOS disclaims all other warranties, express or implied, including merchantability, fitness for a particular purpose, and non-infringement. BiotrackOS does not warrant that the Service will be error-free or uninterrupted.

16. Limitation of liability

To the maximum extent permitted by applicable law, neither party’s aggregate liability to the other under or in connection with the Agreement shall exceed the total fees paid by Customer in the twelve months immediately preceding the claim. Neither party shall be liable for indirect, incidental, consequential, special, or punitive damages, including loss of profits, loss of data (beyond the cost of reconstitution), or business interruption, even if advised of the possibility of such damages.

The liability cap in this §16 does not apply to:

• death or personal injury caused by either party’s negligence;
• fraud or fraudulent misrepresentation by either party;
• wilful misconduct or gross negligence;
• Customer’s indemnification obligations under §14; or
• Customer’s payment obligations under §7.

17. Force majeure

Neither party shall be liable for delays or failures in performance resulting from causes beyond their reasonable control, including natural disasters, acts of government, pandemics, or internet infrastructure failures, provided the affected party gives prompt written notice and uses reasonable efforts to resume performance. If a force majeure event continues for more than 60 days, either party may terminate the Agreement on 14 days’ written notice without liability.

18. Termination

Either party may terminate these Terms: (a) for material breach that remains uncured 30 days after written notice identifying the breach; or (b) immediately on written notice if the other party becomes insolvent, enters administration or liquidation, has a receiver appointed, or makes an arrangement with its creditors. BiotrackOS may suspend access immediately where Customer’s use poses a security risk or legal liability, with prompt written notice. Upon termination or expiry, Customer (as controller) elects whether data is returned or deleted. BiotrackOS will make Customer’s data available for export for up to 60 days. Within that period, Customer may request return of all Customer data in a standard, machine-readable format or confirm in writing that BiotrackOS should delete it. At the end of the export period, BiotrackOS will delete Customer data from active systems and certify that deletion in writing upon request. Residual encrypted copies in scheduled backups will be overwritten on the documented backup cycle; BiotrackOS will not restore deleted data from backup except as required for disaster recovery, security, or legal compliance.

19. Governing law & dispute resolution

These Terms are governed by the laws of England and Wales, without regard to its conflict-of-law provisions. Before commencing any formal legal proceedings, the parties agree to attempt to resolve any dispute through good-faith senior-level discussions for a period of at least 30 days from written notice of the dispute. If unresolved, the courts of England and Wales shall have exclusive jurisdiction, except where mandatory applicable law requires otherwise.

20. Changes

BiotrackOS may update these Terms from time to time. For Customers on a fixed-term Order Form, material changes take effect at the next renewal date, except where required: (a) by law or regulation; (b) to address a security vulnerability; or (c) as agreed in writing between the parties. For all other Customers, material changes will be communicated at least 30 days in advance via the Service and by email to the Customer’s billing contact. If a material change would substantially reduce the scope of the Service during a fixed term, Customer may terminate on written notice within 30 days of receiving notification, with a pro-rata refund of prepaid fees for the unexpired period. Continued use of the Service after the effective date of any change constitutes acceptance.

21. General

The “In short” summaries throughout these Terms are provided for readability only and have no legal effect. In the event of any inconsistency between an “In short” summary and the operative text of a section, the operative text prevails.

These Terms, together with the applicable Order Form and incorporated documents, constitute the entire agreement between the parties on this subject matter and supersede all prior agreements, representations, and understandings. If any provision is found unenforceable, it will be modified to the minimum extent necessary and the remainder will remain in full effect. Neither party may assign these Terms without the other’s prior written consent, except to an affiliate or in connection with a merger, acquisition, or sale of substantially all of its assets. Notices under these Terms must be in writing and delivered by email (with read receipt) or by recorded post to the addresses in the Order Form. Failure to enforce any provision of these Terms is not a waiver of the right to enforce it later.

Contact

Legal enquiries: legal@biotrackos.com · Enterprise agreements, custom DPAs, and HIPAA BAAs are available on request. · BiotrackOS Ltd, Canniesburn Gate, 10 Canniesburn Drive, Bearsden, Glasgow, Scotland, G61 1BF.