Terms and Conditions of Service

TERAL website, platforms, applications and integrations

1. Identification, scope and acceptance

TERAL S.A.S., Tax ID (NIT) 901.616.741-2, with its principal domicile in Medellín and address for notices at Cra 43F #10-38, Manila, El Poblado, Medellín, Antioquia, Colombia, develops technology for clinical communication, case management, consults, administration and artificial intelligence.

These Terms govern access to the website, registration, web and mobile applications, administrative modules, tests, pilots, support and integrations. The institutional agreement, service order, DPA, security annex, SLA and particular conditions supplement these Terms and prevail as to their specific subject matter. That precedence operates between the parties to the specific instrument and in accordance with the hierarchy agreed; it does not impose obligations on third parties nor reduce mandatory rights. Publication of these Terms does not by itself modify agreements already executed.

Contracting requires an affirmative and verifiable manifestation, through signature, an unchecked box or an electronic flow that allows these Terms to be consulted and retained before acceptance. Creating or activating an account does not replace that manifestation. TERAL will retain the text and version accepted, the identity or account, the date and the evidence of acceptance. Mere browsing does not imply contracting or express authorization for health data, marketing or non-necessary cookies.

2. Users and authority to act

The Platform may be used by health professionals, specialists, administrators, institutional clients and other authorized persons according to the account and the agreement. Anyone acting on behalf of an organization represents that they have sufficient authority; anyone administering institutional users must assign, review and revoke permissions in a timely manner.

The user must have legal capacity and, where practicing a regulated profession, keep their credentials, authorizations and licenses current. TERAL's documentary verification is an access control and does not constitute certification, clinical endorsement or a guarantee of competence.

3. Technological nature and absence of a care relationship

Except under a written agreement and express legal authorization, TERAL is not a healthcare provider, does not directly provide health or telemedicine services, does not establish a doctor-patient relationship, does not diagnose, does not prescribe and does not replace the professional's judgment or the obligations of the licensed entity. This delimitation does not exempt TERAL from its technological obligations nor alter the legal classification of the activities it actually carries out. Care services enabled through the Platform must identify the provider and comply with the applicable health regulations.

Opinions, responses, summaries, classifications and recommendations available on the Platform must be reviewed by the competent professional or institution. TERAL provides the technological means and the traceability, but does not direct the clinical autonomy of third parties.

4. Accounts, credentials and security

• Accounts are personal or institutional according to their configuration; they must not be shared outside authorized users.
• The user must protect their credentials, apply the available controls and immediately report suspicious access or events.
• TERAL may limit, block or suspend an account on the grounds and with the safeguards in section 17.
• Actions taken from an account may be attributed to its holder or administrator, without excluding investigation of unauthorized access or failures attributable to the Platform.

5. Surfaces and features

Depending on the product, plan, country and agreement, TERAL may enable an informational website, web platform, mobile applications, administration modules, user management, upload and consultation of cases, consults, comments, generation of supporting documents, notifications, analytics, AI assistance, support and integrations.

The commercial description does not guarantee that every feature is active for every user. The enforceable scope, availability, limits, regions and service levels will be those indicated in the order, agreement or configuration in force. The foregoing does not exclude the objective conditions of the offer or advertising that are legally binding.

6. Integrations and origin of the data

An integration may only be activated by an authorized user or client, through a written agreement and under a documented scope. TERAL has identified four methods; some are activated per project and their description does not evidence that they are in production for every client:

• Medical Bridge/browser extension: capability available for configuration on a per-project basis, with no active clinical integration as of this date. Before deployment, the minimum set of fields, the institutional authorization and the result of de-identification in the browser must be validated.
• Native integration: solution adaptable per project through a signed payload, patient and case identifiers, encoded files, client authentication, API key/secret or JWT, webhooks and UUID traceability. It is not integrated with any client as of this date; Base64 does not constitute encryption and transport must use HTTPS and the other agreed controls.
• Desktop application: processing of screenshots or clipboard content under the user's action and permissions. OCR of embedded text is not implemented. External inference on identifiable images must not be enabled without effective and documented prior blocking or review; this obligation is not presented as a control already deployed.
• Corporate integration: API, GraphQL, VPN or another authenticated channel agreed with the client.

As of this version there is no evidenced clinical integration in production. Every activation requires its own agreement and technical annex. An image may contain identifiers in its text or metadata and reach Gemini directly; masking faces or tattoos does not guarantee anonymization.

7. Clinical information, authorization and custody

Before uploading or allowing access to clinical information, the institution or professional that determines the purpose must have the applicable relationship, authorization or legal exception, inform the data subject, limit the data to what is necessary and retain the evidence. TERAL will process that information as Processor and under documented instructions.

TERAL will be Controller for its own purposes of website, contact, account, credentials, billing, support and security. With respect to clinical data used to provide the service, it will act as Processor for the professional or the institution. Reuse for evaluation, research, training or TERAL's own improvement would make TERAL the Controller of that purpose and would require separate support. Acceptance of these Terms does not replace express authorization for sensitive data or clinical informed consent. These roles are determined by the actual decisions and activities of each flow, not solely by their contractual designation.

The party responsible for care must incorporate into the medical record the opinions or results that legally correspond, preserving their integrity, authorship, date, scope and context. TERAL does not become custodian of the medical record merely by hosting or technically transporting information. However, it must comply with the duties of security, integrity, availability and retention that correspond to it as provider or Processor.

• Individual sign-up: the professional is Controller of the clinical data and TERAL is Processor; TERAL retains the record of acceptance of its documents and the professional retains the patient's authorization or exception.
• Institutional sign-up: the institution is Controller for patients, professionals and users brought in through its relationship; TERAL is Processor for the contracted operation.
• Manual upload and clinical integration: the institution or professional that defines the purpose is Controller; TERAL records the upload or receipt and applies the controls it has committed to as Processor.
• Teral AI and RAG to provide the service: the client or professional retains the decision on purpose and sources; TERAL is Processor and its authorized providers act as sub-processors.
• Internal testing: TERAL does not develop proprietary models and limits its comparative testing to synthetic or effectively anonymous data. The processing mandate to provide the service does not permit reusing personal clinical information for a purpose of its own.

8. Consults and professional opinions

Opinions, views and responses are issued by their authors under professional autonomy and on the basis of the information available. They do not guarantee an outcome and do not replace an in-person assessment where one is necessary. Their clinical scope depends on the service, the professional's competence and the rules applicable to the modality used. The professional must refrain from concluding where the information is insufficient, ambiguous or illegible, and must indicate whether the case requires priority or in-person care.

The Platform may record author, date, time, case, version, attachments and related events. That technological traceability is not equivalent to clinical validation by TERAL.

9. Artificial intelligence tools

TERAL may offer search, classification, summarization, draft generation, consistency auditing, conversational assistance or information retrieval. Outputs may contain errors, omissions, bias, hallucinations or out-of-context references.

• The user must review and validate every output before using it in a decision, communication or record.
• Clinical or care decisions must not be made solely on the basis of an automated output.
• For the text flow described by TERAL, AWS Comprehend and internal rules operate before inference in Bedrock/Claude or Vertex/Gemini. This sequence does not automatically cover images: an image may reach Gemini directly with identifiable text. No anonymization or prior control of that flow is presumed.
• TERAL does not authorize the user to export clinical information to external AI tools that have not been approved.
• TERAL reports logical separation between clients and admission to RAG only of approved sources. The cases, documents, vectors and indexes used to provide the service follow the purpose, permissions, retention and deletion of their sources. Evidence of isolation and deletion must be retained.
• TERAL's own benchmarks and internal testing are limited to synthetic or effectively anonymous data. These Terms do not authorize training, evaluation or improvement with personal clinical information; any change requires prior review, legal basis and controls.

9.1 AI-assisted auditing

TERAL may classify, organize and cross-check information using rules and criteria defined for each service and generate observations, alerts or recommendations for human review. These functions may support the review of documentation, billing, procedures or medical prescriptions. Their outputs do not by themselves constitute a finding of fraud or a final decision on care, dispensing, coverage or payment. Recommendations are not binding. The competent person must review the output and may accept or disregard it according to their professional judgment and the applicable rules. The scope, the authorized data, the rules, their versions and the responsibilities will be established for each project.

Before using AI with clinical impact, the required technical and clinical validations, the information to be given to the patient in advance, human supervision and traceability must be documented. If the use requires health authorization or registration, it must be obtained before operating. TERAL and the provider will comply with the obligations that correspond to each; this text does not evidence licensing, INVIMA registration or clinical validation of the product.

10. Obligations of users and professionals

• Use the Platform lawfully, ethically, professionally and solely for authorized purposes.
• Provide truthful, relevant and up-to-date information, and verify the identity of the case where applicable.
• Respect confidentiality, professional secrecy, the medical record, intellectual property and data protection.
• Do not share credentials, re-identify, extract in bulk, sell, advertise, discriminate or reuse data outside the authorized purpose.
• Do not copy data to personal channels or unapproved external tools, and do not train models with Platform content.
• Report errors, insufficient content, improper access and security incidents.
• Maintain independent judgment and assume responsibility for the professional decisions they make.

11. Obligations of the institutional client

• Maintain the licenses, protocols and conditions required for its care or institutional activity.
• Act as Controller of the clinical information under its control and document the purpose, legal basis, users, permissions, retention and instructions given to TERAL.
• Obtain and retain authorizations, notices and consents; handle data subject rights where it is the controller.
• Execute and maintain the agreement, DPA, security annex, processing instructions and authorization of sub-processors.
• Manage the addition, modification and removal of users; supervise their use and report incidents.
• Retain responsibility for care, the clinical decision and custody of the medical record where these correspond to it.

12. Prohibited uses

• Using the Platform for a life-threatening emergency or as the sole emergency channel, except under an expressly enabled institutional protocol.
• Accessing without authorization, circumventing controls, introducing malware, carrying out unlawful reverse engineering or affecting availability.
• Extracting, scraping, copying or downloading content or data in bulk, except through an enabled and authorized export.
• Uploading excessive, false, unlawful, discriminatory, offensive data or data unrelated to the purpose.
• Using names, signatures, credentials or professional opinions outside their context or without authorization.
• Commercializing, re-identifying, transferring or training external tools with Platform data.

13. Privacy, security and sub-processors

Data processing is governed by the Privacy Policy and, for institutional relationships, by the DPA and the security annex. Where there is a conflict regarding instructions, data categories, sub-processors, incidents, return or deletion, the specific document valid for the flow will prevail, without reducing the data subject's legal rights.

TERAL may rely on infrastructure, database and artificial intelligence providers located in the United States. As of this version, the following are reported as active in production: Amazon Web Services —including Comprehend and Bedrock—, Google Cloud Vertex AI/Gemini and MongoDB Atlas; direct connections with Anthropic and OpenAI are configured but not active in production. Each agreement or DPA must identify the entities, roles, regions and applicable mechanisms. No security measure constitutes an absolute guarantee of invulnerability.

In the event of an incident affecting the information or the contracted service, TERAL will adopt containment measures, preserve evidence and communicate without undue delay to the client or Controller the information available regarding scope, data affected, consequences and measures. It will not wait until the investigation is complete to issue the initial notice and will update it as appropriate. The specific deadlines in the DPA, the agreement and the law will be complied with; each party will handle the notifications to authorities or data subjects that correspond to it. Users may report events through the channels in section 24 or the agreed institutional channel, avoiding sending unnecessary clinical data.

14. Confidentiality and professional signature or identification

Users must maintain confidentiality regarding patients, cases, credentials and other non-public information. If the Platform incorporates a name, professional registration number, electronic signature, digital signature or signature image, its use will be limited to the act actually issued by the professional. Copying, cropping, editing or reusing those elements outside their context without specific authorization is prohibited. A signature image does not by itself constitute a digital signature or sufficient proof of authorization for other acts. The applicable method must make it possible to evidence identity, approval, integrity and retention; these Terms do not grant a mandate to sign opinions or invoices on behalf of a professional.

15. Content, intellectual property and technical license

Each party retains the rights to its pre-existing content. The user or client grants TERAL a limited, non-exclusive license, revocable upon termination of the purpose, to host, technically reproduce, transmit, transform and display the content solely to the extent necessary to provide the service, comply with instructions and apply security.

The license does not authorize TERAL to sell clinical information or to use it to train models for undisclosed purposes of its own. The Platform, trademarks, software, interfaces, documentation and developments of TERAL remain protected, except for rights expressly granted by agreement.

16. Availability, support and changes to the service

Support is provided Monday to Friday during the technical team's business hours. Response times by severity and other commitments on availability, RTO, RPO or credits are governed by the applicable institutional SLA; no general guarantee of response time or continuous support is published. The institutional support channels are those agreed with each client.

Changes that materially reduce a contracted feature will be handled in accordance with the agreement. TERAL may withdraw experimental or non-contracted features, giving notice where reasonable.

17. Suspension and termination

TERAL may suspend or limit access due to a security risk, order of an authority, request of the institutional administrator, contractual default, prohibited use or material breach. Where the risk allows, it will communicate the cause and offer a reasonable opportunity to cure. The measure will be proportionate, limited to what is necessary and reviewed when its cause ceases. The legal obligations of continuity, access to records, export and handling of data subject requests that apply will be preserved; suspension does not authorize deleting evidence or withholding clinical data as leverage for payment.

During the term of the agreement, client documents are retained according to the purpose and lawful instructions, with no general automatic purge by age. Per-institution retention configuration is contemplated, not deployed. The term of the agreement does not legitimize unnecessary or unlawful retention. Upon termination, export, return, deletion and the custodian's legal duties apply. A requested and well-founded deletion removes the case from active environments and indexes; emergency backups may persist until their next cycle of thirty (30) days, with restricted access and without ordinary reuse. That capability is not to be confused with general automatic deletion.

18. Financial terms

Prices, taxes, billing, term, renewal, suspension for non-payment and other financial conditions will be those established in the proposal, service order or agreement. These Terms do not incorporate card processing, automatic renewal, refunds or charges not expressly confirmed for the applicable product or plan. Where consumer legislation applies, the warranties, withdrawal, reversal and returns that are legally available will be respected; particular conditions may not eliminate them.

19. Warranties and limitation of liability

TERAL will provide the service with reasonable diligence and in accordance with the contracted scope. It does not guarantee clinical, commercial or regulatory outcomes; absolute accuracy of third-party or AI content; the total absence of interruptions; or compatibility with undocumented systems.

In business relationships where it is legally permissible, each party will be liable for direct damages attributable to its proven breach, in accordance with the limits validly agreed. This section does not exclude liability that cannot legally be waived, the rights of consumers, patients or data subjects, nor does it cover willful misconduct or gross negligence. TERAL retains liability for its own technological and data protection breaches. The legal burden of proof is not reversed, nor is a prior court ruling required as a general condition for bringing a claim.

20. Indemnity and cooperation

Each party will be liable for third-party claims to the extent that they arise causally from a demonstrated breach legally attributable to it. This includes, where applicable, unlawful uploading of data, prohibited use, the party's own professional decisions or TERAL's technological breaches; it does not automatically attribute every Platform claim to the user. Defense costs must be reasonable and evidenced. Timely notice will be given, participation in the defense will be allowed, and no payments chargeable to the other party will be agreed without its consent, except where legally required. Personal sanctions and liabilities that the law makes non-transferable are not transferred. The parties will cooperate in preserving evidence and mitigating damages.

21. Emergencies

The Platform is not an emergency service.

In the event of an emergency or risk to life, the user must use the care and emergency channels defined by their institution and by local regulations. They must not wait for a response from TERAL or base immediate care on a consult or an AI output.

22. Governing law and dispute resolution

These Terms are governed by the laws of the Republic of Colombia. The parties may seek a direct, good-faith resolution. If no valid mechanism has been agreed in a specific contract, the competent authorities will hear the matter in accordance with the law. Negotiation does not prevent seeking urgent measures or bringing actions, rights or claims before the competent authority; the legal admissibility requirements and the non-waivable rights of consumers, patients and data subjects are respected.

23. Changes, notices and version evidence

TERAL will identify the version and effective date and will retain evidence of previous texts. Material changes will be communicated through an appropriate channel before they are applied and, where they modify essential obligations or processing that requires consent, a new and separate acceptance or authorization will be obtained.

24. Contact and effective date

Operational contact and service claims: daniela@teral.com.co. Privacy: alan@teral.ai; alternate: teralai@teralmed.co. Contact phone: +57 300 467 8602. Address: Cra 43F #10-38, Manila, El Poblado, Medellín, Antioquia, Colombia.

This version 2.6, dated October 1, 2026, takes effect upon its publication on TERAL's website; the effective date will be indicated alongside the published text. It has no retroactive effect and does not supersede executed agreements by publication. Users subject to a previous version will receive the information and, where applicable, the acceptance process set out in section 23.