TERMS AND CONDITIONS OF HICORA.AI

Website, Platform and AI-Assisted Clinical Documentation Services
Version 2.0

Table of contents

1. About us
2. Definitions
3. Scope and who may use the Service
4. Description of the Service
5. Account registration and account security
6. Subscriptions, fees and payments
7. hiCora.ai clinical documentation features
8. Patient consent, recording and health information
9. No medical advice and User responsibility
10. AI output accuracy
11. AI training and data use
12. User obligations and prohibited use
13. Privacy, data processing and subprocessors
14. Regional addenda
15. Newsletter and informational content
16. License and intellectual property
17. Contact and support
18. Complaints
19. Withdrawal from a distance contract
20. Technical downtime and changes to the Service
21. Suspension and termination
22. Liability and provisions for entrepreneurs
23. Incidents, defects and safety-related notifications
24. Illegal content and Digital Services Act
25. Final provisions
26. Model withdrawal form
27. Personal Data Processing Agreement

1. About us

Thank you for visiting hiCora.ai, available at https://hicora.ai (the “Website”, the “Platform”, or the “Service”).

The Service is operated by iDocly sp. z o.o. with its registered office in Krakow, Poland, at ul. Bonarka 8, 30-415 Krakow, Poland, entered in the Register of Entrepreneurs of the National Court Register under KRS number 0000960776; registry court: District Court in Rzeszow, 12th Commercial Division of the National Court Register; share capital: PLN 6,000; NIP: 8133876161; REGON: 521493568; email: [email protected] (the “Service Provider”, “Operator”, “iDocly”, “we”, “us”).

hiCora.ai is an AI-assisted clinical documentation and transcription platform for healthcare professionals and healthcare organizations. The Service helps Users record or transcribe consultations and generate draft clinical documentation for review, editing and approval by the User.

hiCora.ai is intended to support clinical documentation and administrative workflows. It does not provide medical advice, diagnosis, treatment recommendations, prescription decisions, referral decisions, or independent clinical decision support.

These Terms and Conditions establish the general rules and conditions for accessing and using the Website, the Platform, user accounts, subscriptions, support, and related electronic services.

2. Definitions

3. Scope and who may use the Service

• The public Website may be browsed by visitors for informational purposes. Clinical Documentation Features are intended only for Healthcare Users.
• A person who is not a Healthcare User must not use Clinical Documentation Features or upload, enter, record, transcribe or otherwise process Patient Health Information.
• By creating an Account or using Clinical Documentation Features, the User confirms that they are a healthcare professional or are authorized by a healthcare organization to use the Service.
• The User is responsible for ensuring that their use of the Service is permitted under applicable professional, privacy, healthcare, employment and organizational rules.
• These Terms do not regulate the agreement between the User and the patient. iDocly is not a provider of healthcare services to patients.
• The User remains solely responsible for services provided to patients and for the contents of any medical record, patient communication or clinical decision.

4. Description of the Service

The Service provides selected software functionalities that may include, depending on the subscription plan and configuration:

• audio recording or audio upload for consultation documentation purposes;
• speech-to-text transcription;
• AI-assisted generation of draft clinical documentation based on User-provided information;
• editing, reviewing, exporting and copying documentation drafts;
• account, organization and team management;
• subscription and billing management;
• support and administrative communications;
• optional non-binding administrative coding suggestions, where enabled.

The Service does not independently create final medical documentation. All outputs must be reviewed, edited where necessary and approved by the User before being used in a medical record, patient communication, billing process or clinical context.

The Service may be updated, changed, limited, expanded or discontinued in accordance with these Terms. New or modified features may be subject to additional terms, fees, configuration requirements or Regional Addenda.

5. Account registration and account security

• To access the Platform, the User must create an Account and provide required registration data, including name, email address, password and, where applicable, organization and billing information.
• The User must provide accurate, complete and current information and update Account information when it changes.
• The User is responsible for maintaining the confidentiality of login credentials and for all activity under the Account.
• The User must promptly notify iDocly of suspected unauthorized Account access, credential compromise or security incident.
• A User may not share individual login credentials with another person. Organization accounts should use individual user profiles where available.
• iDocly may verify the User status, professional role, organization affiliation or billing information where reasonably necessary for security, compliance, fraud prevention or subscription administration.
• iDocly may suspend or restrict an Account if there is a suspected breach of these Terms, security risk, unlawful use, unpaid fees, inaccurate information, unauthorized use, or regulatory risk.

6. Subscriptions, fees and payments

• The Service may be provided under free, trial, paid or enterprise plans. The scope, limits, prices and billing periods are specified in the Price List, order flow, Account settings or separate agreement.
• Fees may be charged monthly, quarterly, annually or on another agreed billing cycle.
• Fees are charged in advance unless otherwise agreed.
• Subscription prices may be displayed in PLN, EUR, USD, AUD or another currency, depending on User location, selected plan and payment provider configuration.
• Taxes may be added or calculated according to applicable law, including VAT, GST, sales tax or similar taxes.
• For business Users, it may be necessary to provide company name, billing address, tax identification number, VAT number, GST number or other billing information required for invoicing depending on the User country.
• Payment may be made by bank transfer, payment card, Stripe or another payment method made available by iDocly.
• Unless otherwise stated, subscriptions renew automatically for the next billing period unless cancelled before the end of the current period.
• Cancellation does not release the User from payment obligations for an already started billing period unless mandatory law provides otherwise.
• iDocly may suspend access to paid features if payment is overdue or payment processing fails.

7. hiCora.ai clinical documentation features

• Clinical Documentation Features are designed to assist Healthcare Users with documentation work. They are not designed to replace professional judgment or to independently determine diagnosis, treatment, prescriptions, referrals, monitoring, prognosis or other clinical matters.
• Where administrative coding suggestions are enabled, such suggestions are non-binding and provided for User review only. The User remains solely responsible for selecting, validating and submitting any billing codes, visit codes, ICD codes, CPT codes, MBS item numbers or similar codes to any payer, insurer, public authority or medical record system.
• If optional template libraries are made available, they are provided only to allow the User to select, modify and approve content. The Service does not independently recommend exercises, therapeutic programs or treatment plans to patients.

8. Patient consent, recording and health information

• The User is solely responsible for obtaining all patient consents, notices, authorizations and approvals required under applicable law, professional rules and the User internal policies before recording, transcribing, uploading or otherwise processing Patient Health Information through the Service.
• Before initiating any recording or AI-assisted documentation session, the User must confirm in the Service that all required patient consents and notices have been obtained.
• iDocly does not store or manage patient consent records unless expressly agreed otherwise. iDocly may store only the User confirmation event, where implemented, for audit and compliance purposes.
• The User must not upload or enter Patient Health Information unless the User has authority to do so and such processing is lawful.
• The User must not include patient-identifiable information in support emails, marketing forms, analytics events, error reports, screenshots or other channels not intended for Patient Health Information.
• Where a Regional Addendum requires additional consent wording, workflow, retention or audit records, the Regional Addendum applies.

9. No medical advice and User responsibility

• The Service is intended solely to support clinical documentation and administrative workflows. The Service does not provide medical advice, diagnosis, treatment recommendations, prescription decisions, referral decisions, clinical decision support, emergency support or real-time patient monitoring.
• The Service does not replace the professional judgment, assessment or responsibility of the User. The User remains solely responsible for all medical decisions, clinical assessments, patient communications, billing decisions and final medical documentation.
• The User must manually review, edit, verify and approve all outputs generated by the Service before using them in any medical record, patient communication, billing process or clinical context.

10. AI output accuracy

• The User acknowledges that the Service uses artificial intelligence and machine learning technologies. Outputs generated by the Service may be inaccurate, incomplete, inappropriate, outdated, biased, not suitable for a specific patient context, or inconsistent with the source consultation.
• The User is solely responsible for verifying all outputs against the consultation, source information, patient record, professional standards and applicable law before relying on or using such outputs.
• iDocly does not warrant that AI-generated outputs will be complete, accurate, clinically appropriate or free from errors.

11. AI training and data use

• Patient Health Information processed through the Service is not used to train, fine-tune or improve AI or machine learning models by default.
• Any use of Patient Health Information for model training, product development, research or scientific purposes requires a separate written agreement, a valid legal basis under applicable law and, where required, valid patient authorization or legally effective anonymization or de-identification.
• iDocly may use non-identifiable, aggregated or legally anonymized operational data to operate, secure, monitor and improve the Service where permitted by applicable law and contractual documentation.
• Feedback provided by Users may be used to improve the Service, provided that such feedback should not include Patient Health Information unless a separate agreement allows it.
• Regional Addenda may impose stricter restrictions. In such case, the stricter Regional Addendum controls.

12. User obligations and prohibited use

The User must use the Service in accordance with its purpose, these Terms, applicable law, professional obligations, data protection rules and good practices.

The User must in particular:

• provide accurate and lawful information;
• use the Service only for authorized professional or organizational purposes;
• maintain appropriate local records and copies of medical documentation as required by law;
• ensure that personnel using the Service are trained and authorized;
• protect Account credentials and prevent unauthorized access;
• cooperate with iDocly on security, privacy, quality and regulatory matters.

The User must not:

• use the Service as the sole basis for any clinical, diagnostic, treatment, prescription, referral or emergency decision;
• upload Patient Health Information without lawful authority, required notices and required consents;
• attempt to reverse engineer, decompile, disassemble, bypass safeguards or interfere with the Service;
• use the Service to generate unlawful, misleading, discriminatory or harmful content;
• send Patient Health Information to support, analytics, marketing or other channels not approved for such information;
• use the Service in a way that exposes iDocly, Users, patients or third parties to avoidable cybersecurity or privacy risks;
• misrepresent the Service as providing diagnosis, treatment recommendations, medical advice or autonomous clinical decisions;
• use the Service in violation of any applicable Regional Addendum.

13. Privacy, data processing and subprocessors

• The processing of personal data is described in the hiCora.ai Privacy Policy and, where applicable, in a Personal Data Processing Agreement, Business Associate Agreement, Data Processing and Security Schedule or Regional Privacy Addendum.
• For account, billing, support, security, marketing and business communication data, iDocly may act as controller or independent controller, depending on the context.
• For Patient Health Information entered by the User, the User is normally the controller or equivalent responsible entity and iDocly processes such information on the User behalf as processor/service provider.
• iDocly may use subprocessors to provide hosting, storage, AI inference, transcription, security, payments, support, analytics and other operational services.
• Only approved subprocessors may process Patient Health Information. Subprocessors used for payments, marketing, analytics, customer support or internal business operations are not permitted to receive Patient Health Information unless expressly listed as approved for that purpose.
• The current Subprocessor List is made available at the Website, in the Account, or upon request at [email protected].

14. Regional addenda

If the User is located outside the European Economic Area or processes information of individuals located outside the European Economic Area, additional regional terms may apply, including without limitation a U.S. Healthcare Addendum, Business Associate Agreement, U.S. Privacy and HIPAA Addendum, Australia Healthcare Addendum, Australia Privacy Addendum, or other jurisdiction-specific documents.

In the event of a conflict between these Terms and an applicable Regional Addendum, the Regional Addendum shall prevail solely with respect to jurisdiction-specific healthcare, privacy, data protection, security or regulatory matters.

15. Newsletter and informational content

• The Website may provide newsletters, product updates, educational content, blog posts, guides and informational materials. Such materials are for informational purposes only and do not constitute medical advice, legal advice, regulatory advice or professional advice.
• Newsletter subscription is voluntary. Users may unsubscribe using the link in the email or by contacting iDocly.
• Marketing communications are sent in accordance with applicable electronic communications and privacy laws.
• Patient Health Information is not used for marketing, advertising, retargeting or sale to third parties.

16. License and intellectual property

• All rights, title and interest in the Website, Platform, software, user interface, workflows, templates, documentation, know-how, designs, trademarks, content and other materials belong to iDocly or its licensors, except for materials provided by the User.
• Subject to these Terms and payment of applicable fees, iDocly grants the User a limited, non-exclusive, non-transferable, non-sublicensable license to access and use the Service during the applicable subscription period for the User internal professional or organizational purposes.
• The User may not copy, distribute, sell, lease, sublicense, modify, translate, reverse engineer, decompile or create derivative works of the Service except where mandatory law allows it.
• The User retains rights in User-provided materials and Patient Health Information, subject to the rights needed by iDocly to provide the Service.
• The User grants iDocly the right to process User-provided materials solely as necessary to provide, secure, support and improve the Service in accordance with these Terms and applicable privacy documents.

17. Contact and support

The primary contact point for support is [email protected]. Security matters should be sent to [email protected]. Privacy matters should be sent to [email protected].

iDocly may provide support through email, in-product messaging, help center materials, ticketing systems or other channels. Users must not include Patient Health Information in support requests unless the support channel is expressly approved for that purpose.

18. Complaints

• Complaints related to the functioning of the Website, Platform, Electronic Services or Agreement may be submitted by email to [email protected].
• The complaint should include a description of the issue, date of occurrence, expected resolution and contact details. These requirements are recommendations only and do not affect the effectiveness of a complaint submitted without them.
• iDocly will respond to complaints without undue delay, no later than 14 calendar days from receipt, unless mandatory law requires a shorter period or the issue requires additional investigation.

19. Withdrawal from a distance contract

• This section applies only where mandatory consumer law grants a User a statutory right of withdrawal.
• A consumer who concluded a distance contract may withdraw within 14 calendar days without stating reasons unless an exception applies.
• The right of withdrawal may not apply where digital content or digital services are provided before the withdrawal deadline with the consumer express consent and acknowledgment of losing the right of withdrawal, to the extent permitted by law.
• If performance begins at the consumer express request before the withdrawal deadline, the consumer may be required to pay for services performed until withdrawal, where permitted by law.
• Withdrawal statements may be sent to [email protected]. A model withdrawal form is included at the end of these Terms.

20. Technical downtime and changes to the Service

• iDocly makes commercially reasonable efforts to ensure proper and uninterrupted operation of the Service. Due to the complexity of software and external factors, errors, interruptions, maintenance windows and technical failures may occur.
• iDocly may conduct planned maintenance and will make reasonable efforts to schedule it at times that reduce inconvenience.
• iDocly may update, modify, replace, restrict or discontinue features where reasonably necessary for security, compliance, product development, legal requirements or operational reasons.
• Material changes to these Terms will be notified with reasonable notice where practicable, unless immediate changes are required by law, security or urgent operational needs.

21. Suspension and termination

iDocly may suspend, restrict or terminate access to the Service where reasonably necessary, including where:

• the User breaches these Terms, an Agreement, a Regional Addendum or applicable law;
• payment is overdue or payment processing fails;
• the User provides inaccurate information or fails verification;
• continued access creates a security, privacy, legal, regulatory or patient safety risk;
• the User misuses the Service or attempts to bypass safeguards;
• iDocly is required to do so by law, regulator, court or competent authority.

The User may cancel a subscription or request Account deletion in accordance with the Account settings or by contacting support. Termination does not affect accrued rights, payment obligations or provisions intended to survive termination.

22. Liability and provisions for entrepreneurs

• To the maximum extent permitted by law, the Service is provided as is and as available. iDocly does not guarantee that the Service will be uninterrupted, error-free, clinically accurate, suitable for any particular patient or free from all security vulnerabilities.
• iDocly is not responsible for clinical decisions, medical documentation approved by the User, patient communications, billing submissions, coding choices, or healthcare services provided by the User.
• For business Users, iDocly liability, regardless of legal basis, is limited to the amount of fees paid by the User to iDocly for use of the Service during the 12 months preceding the event giving rise to liability, unless mandatory law provides otherwise.
• iDocly is not liable for lost profits, lost revenue, loss of goodwill, indirect damages, consequential damages or damages resulting from User misuse, unlawful use, unauthorized use, or failure to review outputs, to the extent permitted by law.
• Nothing in these Terms excludes liability that cannot be excluded under mandatory law.

23. Incidents, defects and safety-related notifications

The User must promptly notify iDocly if the User becomes aware of any suspected error, defect, unsafe output, complaint, adverse incident, privacy issue, security issue or potential issue with the Service that may affect patient safety, documentation accuracy, data protection, cybersecurity or regulatory compliance. Notifications should be sent to [email protected] or another contact point designated by iDocly.

iDocly may investigate such reports and may request additional information. The User must reasonably cooperate with iDocly in the investigation, mitigation and remediation of such matters.

24. Illegal content and Digital Services Act

• This section contains provisions related to the Digital Services Act where applicable to the Website and the Service.
• iDocly designates [email protected] as a single electronic contact point for communications with service recipients, Member State authorities, the European Commission and the European Board for Digital Services.
• Reports of illegal content should include a substantiated explanation, precise electronic location, contact details of the reporting person where required, and a statement that the report is made in good faith.
• iDocly may moderate, remove, disable access to, restrict visibility of, or otherwise act on content that is unlawful, violates these Terms, creates security risk, violates third-party rights, or creates legal or regulatory risk.
• Moderation may be manual or assisted by automated tools. iDocly will act diligently, objectively and proportionately, with regard to the rights and legitimate interests of affected parties.
• Users may submit complaints or objections concerning moderation decisions to the same contact point.

25. Final provisions

• Matters not regulated in these Terms are governed by generally applicable Polish law, unless a Regional Addendum or mandatory law provides otherwise for specific jurisdictional matters.
• Disputes with business Users are submitted to the court having jurisdiction over the registered office of iDocly, unless mandatory law or a Regional Addendum provides otherwise.
• If any provision is invalid or unenforceable, the remaining provisions remain effective, and the invalid provision will be replaced by a valid provision that most closely reflects its purpose.
• These Terms may be made available in different language versions. If there is a conflict, the version accepted by the User or indicated as controlling for the applicable market prevails.

26. Model withdrawal form

Complete and send this form only if you wish to withdraw from the contract and are entitled to do so under applicable law.

27. Personal Data Processing Agreement

This section applies where the User acts as controller under GDPR or equivalent data protection law and iDocly processes personal data, including Patient Health Information, on behalf of the User as processor. If a separate data processing agreement, Business Associate Agreement, Data Processing and Security Schedule or Regional Addendum is executed, that document prevails for its subject matter.

27.1 Parties and roles

• The User is the controller of Patient Health Information entered, uploaded, recorded, transcribed or otherwise processed through the Service.
• iDocly is the processor acting on documented instructions of the User for the purposes of providing the Service.
• The User confirms that personal data entrusted to iDocly have been collected lawfully and that the User has authority to instruct iDocly to process them.

27.2 Subject matter and duration

• Processing concerns personal data processed in connection with the provision of the Service.
• Processing lasts for the duration of the Agreement and thereafter only as required for deletion, return, backup retention, legal obligations, dispute resolution or as otherwise agreed.

27.3 Categories of data

• User account and organization data, including names, email addresses, roles, organization information and billing data;
• Patient Health Information, including health data, consultation audio recordings, transcripts, draft documentation, visit summaries and other patient-related information entered by the User;
• technical data necessary for operation, security, audit logs, access logs, device information, IP addresses and similar data.

27.4 Processing operations

collecting, recording, storing, hosting, organizing, structuring, transcribing, generating draft documentation, displaying, making available, exporting, copying for backup, securing, modifying, restricting, deleting and returning personal data as required to provide the Service.

27.5 Instructions

• iDocly processes personal data only on documented instructions of the User, including these Terms, the Agreement, Service configuration and applicable data processing documentation.
• If iDocly believes that an instruction infringes GDPR or other applicable law, it will inform the User unless prohibited by law.

27.6 Security

• iDocly implements appropriate technical and organizational measures under Article 32 GDPR, taking into account the state of the art, costs of implementation, nature, scope, context and purposes of processing and risks to individuals.
• Measures may include encryption, access controls, role-based permissions, confidentiality obligations, audit logging, backup, incident response, security monitoring and personnel authorization.

27.7 Confidentiality and personnel

iDocly ensures that persons authorized to process personal data are bound by confidentiality obligations and process data only as necessary to perform their duties.

27.8 Subprocessors

• The User grants general authorization for iDocly to use subprocessors necessary to provide, secure and support the Service.
• iDocly will impose data protection obligations on subprocessors that are substantially equivalent to those in this Processing Agreement.
• The current Subprocessor List is made available on the Website, in the Account or upon request.

27.9 Assistance

Taking into account the nature of processing and information available, iDocly assists the User with data subject requests and obligations under Articles 32 to 36 GDPR, including security, breach notification, DPIA and prior consultation where applicable.

27.10 Personal data breach

• iDocly will notify the User without undue delay after becoming aware of a personal data breach affecting personal data processed on behalf of the User.
• The notification will include available information about the nature of the breach, affected data, likely consequences and measures taken or proposed.

27.11 Return and deletion

• After completion of services, iDocly will delete or return personal data in accordance with the Agreement, User instructions, backup retention cycles and applicable law.
• The User remains responsible for maintaining medical records and other records required by applicable law.

27.12 Audit and information

• iDocly will make available information reasonably necessary to demonstrate compliance with Article 28 GDPR and this Processing Agreement.
• Audits must be reasonable, proportionate, subject to confidentiality and not disrupt the security or operation of the Service.