1Agreement and parties
These Terms of Service govern the business use of Zoe Diagnostics’ websites, software and related services. They form an agreement between Zoe Diagnostics Inc., a Michigan corporation, referred to as Zoe, we or us, and the organization identified in the applicable Order or account registration, referred to as Customer or you. An individual purchasing in a professional capacity contracts in that capacity where no organization is identified. A person accepting for an organization represents that they have authority to bind it. The service is intended for adults acting for business purposes, not for personal, family or household use.
The service agreement begins when Customer affirmatively accepts these Terms or signs an Order that incorporates their identified version. Each acceptance identifies the document version provided at that time. Merely browsing a public page, submitting an inquiry or receiving an invitation does not purchase a service, create payment duties or authorize access to company systems. Section 19 addresses use of public website materials. Creating or using an account does not authorize anyone to accept an agreement for an unrelated company. These Terms do not charge a company whose data is being examined merely because its representative authorizes access to a source.
2Documents that govern
An Order is a purchase confirmation, checkout record, statement of work or order form identifying the purchased service, price, term and applicable limits. For a self-service purchase, it includes the features, deliverables, billing and renewal terms, access period, material limits and delivery or refund commitments expressly offered for the selected plan on the applicable offer and checkout pages when Customer purchases. Zoe will provide a durable purchase confirmation. These Terms do not withdraw an express commitment in that accepted offer.
A Read means one paid diligence run on one Company, and the signed document received at the end of it. The Order defines included Reads and reruns, including those supplied under a subscription. A Deal Package is the collection of Read outputs described in an Order. A Workspace is the account environment in which Customer’s authorized users access the service. A Company is the business a Read examines. Its Company contact is a person authorized to represent it for the stated data-processing and connection permissions. A Data Provider is an organization that separately authorizes Zoe to process data within its authority, including a Company. Customer may also be a Data Provider when submitting its own data. The product names Deal, Desk and Portfolio identify offerings; the applicable Order defines what is included.
The agreement consists of these Terms, the applicable Order, the Data Processing Agreement, or DPA, where applicable, and any expressly agreed additional terms. The DPA describes the standard processing and safeguards and governs processing on behalf of Customer or another Data Provider, including its protection of specified confidential business information that is not personal data. Each Data Provider must be bound through its own recorded acceptance or an authorized contractual arrangement.
Engagement Records means the applicable Order, authenticated account and source selections, uploads, access and sharing settings, service requests and written communications that record the engagement. An Authorization means a Data Provider’s instructions recorded there, including the Company, authorized sources or materials, permitted outputs and recipients, and any requested service communications. A separate authorization form is not required for the standard service.
The Privacy Notice explains personal-information practices, including Zoe’s own website, account and related controller activities. It is a separate transparency notice, not incorporated into this agreement as an additional service warranty or supplier register. The service’s contractual processing, security, supplier and transfer obligations are set out in the DPA, the documented engagement instructions and any expressly agreed additional terms or legally required transfer instruments. This distinction does not retroactively change an accepted commitment, excuse inaccurate or misleading disclosures, waive mandatory rights or replace consent where required.
Mandatory transfer clauses prevail to the extent required by law. Next, the DPA controls processing and protection of data it covers. The Authorization controls source access, permitted disclosures and supported service communications. An Order controls commercial particulars such as price, quantity, purchased scope and subscription term. These Terms control other matters. No Order, purchase-order boilerplate, marketing material, instruction embedded in source content or broader technical permission silently overrides a DPA safeguard or expands the Authorization. A conflict must be resolved through the applicable agreement and change process before the affected activity proceeds.
If Zoe and Customer enter into a separately signed written customer agreement governing the same services, that agreement controls conflicting provisions of these Terms for those services. It replaces these Terms in their entirety only if it expressly says so; otherwise, provisions not in conflict continue to apply. A later agreement does not automatically release obligations or claims arising before its effective date. The applicable DPA retains its subject-specific priority unless its parties expressly identify and agree to its amendment or replacement. Changes to an Authorization require recorded instructions from the entity with authority over the affected data and must remain consistent with the DPA. A signed agreement may expressly provide a different allocation of liability for DPA claims as permitted by the DPA, without using a particular cap label; a general inconsistent limitation does not silently displace the DPA’s allocation. Mandatory requirements, transfer instruments and third-party statutory rights continue to prevail. A customer agreement does not bind a separate Data Provider without its authority, authorize a new use of previously collected data or itself expand source, disclosure or communication permissions.
The canonical public Terms, DPA and Privacy Notice are maintained on zoediagnostics.ai with archived versions. The version identified in an acceptance record governs that acceptance. A later website revision does not rewrite an earlier acceptance or a separately signed agreement.
3Service and limits
Zoe supplies operational diligence and company-health decision support using authorized connected-system information, supplied documents and other sources identified for an engagement. Outputs may include a Zoe Score, findings, questions, evidence references, summaries and the Read or Deal Package artifacts identified in the Order. The available features and purchased deliverables are those included in the accepted offer under Section 2. A roadmap or feature expressly described as planned is not a delivery commitment. Zoe will identify material evidence and coverage gaps; absence of evidence is not proof that a Company is healthy or that a concern exists. These Terms do not promise that every dimension can be scored from every set of sources.
Outputs use automated analysis and may be incomplete, inaccurate or affected by source quality, coverage and timing. They are not investment, financial, legal, tax, accounting, employment or other professional advice; an audit; a quality-of-earnings opinion; or a guarantee of a company’s performance. A signed or finalized Read identifies a product artifact, not an auditor’s certification or professional assurance opinion. A confidence or coverage indicator describes the evidence or analytical measure identified in the output; it is not a guarantee or a calibrated probability that a finding is correct. Customer must apply independent judgment, verify material findings and use appropriate professional advisers.
A delivery commitment in the accepted offer, including a stated 24-hour turnaround, is binding. Its starting event and material input or permission requirements must be clearly disclosed before purchase. Zoe cannot defer the clock by introducing an undisclosed condition afterward. A disclosed Customer or source-provider dependency extends the period only to the extent it actually causes delay; Zoe will promptly identify material missing inputs and notify Customer of a material delay. Zoe remains responsible for its own performance. Section 12 provides remedies when delivery fails, including where late delivery can no longer meaningfully provide the purchased service. No additional uptime or service-credit commitment is created unless agreed.
Zoe must perform its express obligations with reasonable care and skill. Zoe remains responsible for its personnel, selected service providers and the access, processing and delivery controls allocated to it. A source outage or model error does not by itself establish a breach, but using an outside provider or AI does not excuse Zoe’s own breach. Customer must not use outputs as the sole basis for a decision producing legal or similarly significant effects on an individual, including decisions about employment, credit or insurance.
4Accounts and authorized users
Customer designates its authorized users and administrators and is responsible for their use under these Terms. Users must provide accurate registration information, protect credentials, avoid sharing individual logins and promptly report suspected compromise to security@zoediagnostics.ai. Customer must remove access when a user’s authority ends. Zoe may verify authority before transferring administration or granting access to an organization’s Workspace.
Customer controls its Workspace and authorized users within the purchased limits. Access to a Workspace does not grant ownership of a Data Provider’s source information or authority to change that organization’s processing instructions. Zoe may maintain reasonable technical limits to protect the service and will identify any material purchased limits in the Order.
5Fees purchases and renewal
Customer pays the fees and applicable taxes shown in the Order. Unless the Order says otherwise, fees are due at checkout or within 30 days of an invoice. Zoe may use a payment processor to collect an authorized charge. Taxes based on Zoe’s net income are Zoe’s responsibility. Customer should promptly raise a good-faith billing dispute and must pay undisputed amounts when due.
A one-time purchase does not renew automatically. Its included Reads or reruns, hosted-access term and any unused-credit expiry must be stated before purchase. Zoe will not impose an undisclosed expiry, additional charge or reduced access period on an existing purchase. A subscription renews only for the recurring period and price disclosed and accepted when purchased, unless cancelled before renewal through the available account controls or by contacting hello@zoediagnostics.ai. Cancellation is effective when the request is received, even if Zoe processes it later, and Zoe will provide confirmation. It stops the next renewal; it does not ordinarily end access before the paid period expires. Zoe will provide at least 30 days’ notice of a renewal price increase, which applies no earlier than the next renewal after that notice. Customer may cancel before the increase takes effect. If notice arrives after an applicable nonrenewal deadline, Customer has at least 15 days after receiving it to decline the increase without an additional renewal commitment.
Except as stated in the accepted offer, these Terms or mandatory law, fees for a completed Read or an elapsed subscription period are non-refundable, and cancellation alone does not create a prorated subscription refund. For an unused prepaid Read that Zoe has not completed, Customer may request cancellation and a refund, including when the Company declines access or the available authorized evidence cannot support the purchased service. Merely attempting a connection or starting an unsuccessful run does not complete the Read. Zoe may retain only a separately priced fee for specifically scoped work actually completed, where that fee and its non-refundable treatment were clearly disclosed and separately accepted before the work began. A credit, another Company or a reduced-scope deliverable may replace the refund only if Customer agrees. Contact hello@zoediagnostics.ai to request the refund; Zoe will process it promptly.
If Zoe terminates for its convenience, it will refund prepaid fees attributable to an unperformed Read or the unused remainder of the paid subscription term. Section 12 addresses a failed or materially nonconforming service. An express refund promise in the accepted offer remains binding. These Terms do not create a general free trial or satisfaction-based cooling-off period.
Zoe may suspend paid access for an undisputed amount more than 15 days overdue after giving at least 7 days’ written notice and a reasonable opportunity to resolve the issue. Suspension does not authorize new collection from company systems or eliminate applicable data-return obligations. Zoe will provide a lawful return method required by the DPA or mandatory law without conditioning it on payment of a disputed amount or a further agreement.
6Company data and source authorization
Customer must have the lawful basis and necessary rights to submit information, invite a Company and receive the intended outputs. Paying for a Read does not authorize access to another organization’s systems. Before processing its information, the relevant Data Provider must accept the applicable DPA and authorize the sources, materials and disclosures within its authority. This includes a Company that supplies data without purchasing a service. Its representative confirms that they are authorized to act for that organization. An investor cannot authorize access for a Company solely because it initiated or funded the Read.
The DPA and Engagement Records together describe the processing. The Order, account details, source selections, submitted materials, recipient and access settings, and explicit service requests may record the engagement’s particulars and instructions. Together they must identify the relevant organizations and provide sufficient information about the permitted sources, data, purpose, recipients and processing duration. Standard use does not require separate Processing Particulars, supplier-register acceptance or an Engagement and Data Access Authorization form. Zoe will retain the applicable acceptance and material instruction records and make them available to the relevant party.
An Authorization may cover multiple Reads within its scope and term. Approved recipient categories may include Customer’s authorized diligence team, investment committee and professional advisers. Expanded source access, materially different data or recipients outside that audience require the affected Data Provider’s recorded instruction before use and must remain within the agreed service purpose, DPA and Section 8. Supplier appointment and changes, binding supplier protections and international transfers remain governed by the DPA and applicable law.
The invitation and recorded Authorization identify the organization receiving outputs, the permitted evidence or output scope and any authorized onward recipients. A source connection is not a blanket authorization to expose every accessible record or an entire source archive. Customer must use the information only within that authorization and its own legal obligations, and must not imply that a technical connection supplies permissions it does not have. An organization’s representative does not thereby provide blanket consent on behalf of every individual whose information may appear in its systems.
Zoe uses connections to read authorized information and does not use them to create, update or delete the connected provider’s business records. Provider permission scopes can be broader than the operations Zoe performs. Zoe and its authorized connection providers may hold and manage access tokens needed for the connection; the investor receives neither the Company’s passwords nor its source-access tokens. Connection and revocation actions may change authorization settings as necessary to manage the grant. Source content, retrieved pages, documents, emails and model responses are data for analysis, not instructions that can broaden Zoe’s authority. Zoe will use reasonable measures to enforce the agreed source and recipient boundaries and pause affected processing where required authority is missing or materially unclear.
Within supported authenticated product interfaces, authorized users may request Reads, reruns or refreshes, import materials, and share or export permitted outputs within the agreed source, purpose, frequency and recipient limits. Authority to trigger a Read or refresh is authority for that agreed analysis inside Zoe, not permission to change the connected Company’s business records. Repeated collection requires the recorded frequency and duration; this clause does not promise continuous monitoring.
Supported service features may send invitations, Company follow-up questions or access links when an authorized person expressly instructs that communication and the permitted recipients and information are recorded in the Authorization or the applicable approved request. Permission to prepare a question or draft does not itself permit sending it. Zoe must follow the approved recipients, content and disclosure limits. These bounded service communications do not authorize autonomous prospect outreach, public posting, general business-system changes, funds transfers, contract acceptance or decisions on a person’s legal rights. An Order cannot activate a capability that is not supported and authorized for the engagement. Zoe is not Customer’s general agent.
Customer is responsible for its business decisions, lawful instructions, permissions within its authority and sharing it authorizes. Zoe is responsible for its performance within the purchased scope, including using the authorized data and recipients and honoring agreed access and stop controls. Customer’s approval of a business objective, source or question does not excuse Zoe from materially changing the approved details, bypassing a required approval or failing to exercise the promised care and skill. Responsibility for loss follows each party’s contribution and applicable law, subject to Section 13; neither an unfavorable investment outcome nor the use of AI alone establishes liability.
A Data Provider may revoke a connection or instruct Zoe to stop processing within its authority through supported product controls or privacy@zoediagnostics.ai. Zoe will promptly stop new collection and initiating affected communications within the revoked authority, use reasonable efforts to cancel queued or in-flight communications, and apply the DPA to data already held. Zoe will identify any material cancellation limitations; an email request should not be assumed to produce an instantaneous technical stop. Revocation does not retroactively invalidate an authorized disclosure or automatically remove copies an authorized recipient previously exported. Those recipients remain responsible for their retention and use. If instructions conflict or authority is reasonably disputed, Zoe will pause the affected processing to the extent necessary to avoid exceeding valid authority while obtaining a lawful resolution and will inform the relevant parties unless prohibited by law. A Customer instruction cannot override a separate Data Provider’s rights merely because Customer paid for the Read.
7Permitted use
Customer may use the service and outputs for its lawful internal business evaluation and diligence and may share purchased outputs with its advisers, investment committee, board and other direct stakeholders who need them for the authorized engagement. Such recipients must be bound by confidentiality duties or professional obligations at least as protective as Section 9. Sharing must respect the Data Provider’s authorization and third-party rights. Customer remains responsible for sharing it authorizes. A recipient does not acquire a separate right to rely on Zoe as its professional adviser or a third-party beneficiary merely by receiving an output; mandatory rights remain unaffected. Public distribution, resale or commercial repackaging requires Zoe’s written permission and any required Data Provider permission.
Customer must not use the service unlawfully; submit information it lacks authority to provide; evade access controls; interfere with the service; introduce malicious code; scrape or redistribute the service at scale; or reverse engineer it except where applicable law permits despite this restriction. Customer must not submit highly sensitive personal information, such as government identifiers, medical records, biometric templates or payment-card details, unless Zoe expressly agrees to the relevant use and safeguards in writing. The service does not provide a general-purpose repository for those data.
Zoe may restrict the affected activity where reasonably necessary to address unlawful use, a security threat or a material breach. Where practicable, it will give notice, describe the issue and allow correction. Restrictions should be proportionate and lifted once the issue is resolved. Emergency action does not expand Zoe’s rights to use Customer or Data Provider information.
8Ownership and limited rights
As between the parties, Customer and the relevant Data Providers or licensors retain their rights in submitted data and source materials. Customer owns its purchased outputs to the extent ownership can be granted under applicable law, subject to underlying third-party rights and Zoe’s retained technology. Automated outputs may not be unique or eligible for exclusive intellectual-property protection. Customer receives a perpetual, worldwide, royalty-free, nonexclusive right to use Zoe material embedded in its lawfully obtained, fully paid outputs for the purposes permitted by Section 7. Ending a subscription does not itself revoke that output-use right, but it does not continue hosted access or override lawful retention, confidentiality or Data Provider restrictions.
Zoe retains its software, methods, scoring framework, models, templates, know-how and other pre-existing or independently developed technology. Customer receives a limited right to access the service during the purchased term. No ownership of Zoe’s technology transfers merely because it appears in an output.
Customer grants Zoe only the rights needed to provide, secure and support the purchased service, follow authorized instructions and meet applicable legal obligations. A Data Provider’s grant is governed by its DPA and Authorization. Zoe may process Read data for the authorized diligence analysis, evidence references, scores, findings, questions, outputs and related Ask Zoe responses within that engagement. This agreement grants no right to sell or rent Customer or Data Provider content, train or fine-tune a model on it, or reuse it or its derived Company scores in a cross-customer benchmark or scoring dataset. Zoe will not sell or rent personal data. Zoe must impose and enforce equivalent no-training restrictions on model providers receiving that content under the DPA. Pseudonymization or replacing a company name with a codename does not create an authorization or make personal data anonymous.
Zoe may use technical telemetry and aggregated non-content operational measurements, such as feature counts, latency and error rates, to operate and improve the service, subject to applicable law and the DPA where relevant. This permission does not allow source content, Read findings, Company scores or personal information to be repurposed under an analytics label. Customer may voluntarily provide feedback that does not contain confidential or personal information; Zoe may use such feedback without an obligation to pay for it.
9Confidentiality
Non-public business, technical, financial and personal information disclosed in connection with the service, including source information, engagement details and Read outputs, is Confidential Information when identified as confidential or reasonably understood to be confidential. Each recipient will protect it with reasonable care, use it only to perform or exercise rights under the agreement, and disclose it only to authorized recipients with a need to know and appropriate confidentiality duties. Zoe may use authorized service providers as permitted by the DPA.
These duties do not apply to information the recipient can demonstrate was lawfully known without restriction, becomes public without breach, is independently developed without use of the information, or is lawfully obtained from another source without a confidentiality duty. A legally compelled disclosure must be limited to what is required, with prior notice and reasonable assistance where legally permitted. A corporate transaction is not a blanket permission to disclose service data; any permitted transfer must preserve applicable contractual and data-protection duties.
Confidentiality duties continue for 5 years after the agreement ends, and for trade secrets and personal data for as long as the information remains protected by applicable law or the DPA. Return, deletion and legally required retention are governed by Section 11 and the DPA. Publicity, use of Customer’s or a Company’s name or logo and an identifiable case study require the relevant organization’s separate written permission.
10Privacy and security
Zoe processes personal data on another organization’s behalf under the DPA, which sets out the applicable security, supplier, incident and assistance obligations. Zoe’s separate controller activities, such as account administration, billing and website use, are subject to applicable privacy law and the information provided in its Privacy Notice. Accepting a service agreement does not provide consent to optional advertising, visitor identification or unrelated data use. Privacy requests may be sent to privacy@zoediagnostics.ai and will be handled under applicable law and the DPA where relevant.
The parties will cooperate reasonably on security incidents and privacy requests relevant to the service. Zoe will notify the affected contracting party without undue delay after becoming aware of material unauthorized source access or disclosure, compromised authorization or failure of an agreed access, recipient or stop control; it will contain the affected activity where reasonably needed, investigate, preserve proportionate evidence and provide material updates and reasonable correction assistance. The DPA’s incident duties also apply where its data is involved. Zoe will not charge extra to investigate or correct its own breach; other exceptional assistance requires agreed charges without delaying mandatory duties. Zoe will retain proportionate records of material authorizations, access, disclosures and revocations under the agreed retention rules and make relevant records reasonably available subject to security, privacy and third-party confidentiality. A missing record is not automatically proof of Customer or Data Provider approval. A person seeking to exercise privacy rights should use the contact route in the Privacy Notice; a Data Provider may also instruct Zoe under the DPA. Neither these Terms nor an acceptance record waives a person’s statutory rights.
11Cancellation termination and data handling
Customer may cancel future renewals at any time, effective on receipt under Section 5. Paid access ordinarily continues until the end of the paid term unless Customer separately requests immediate termination or deletion. Either party may terminate the affected agreement for a material breach that remains uncured 30 days after written notice. Immediate termination is permitted where the breach cannot lawfully be cured or continued performance would create a material security or legal risk. Zoe may end a month-to-month or free service for convenience on 30 days’ notice; it will otherwise honor a prepaid fixed term unless the parties agree or another termination right applies. If Customer terminates for Zoe’s uncured material breach, Zoe will refund unused prepaid fees for the affected service, without limiting other express remedies or permitting double recovery.
During the authorized service, Zoe retains synced records and Read evidence for the agreed service purposes and duration under the DPA and documented engagement instructions. Ending billing, disconnecting a source, closing a case or finalizing a Read does not itself initiate complete workspace deletion. Revoking a source stops collection within that revoked authority but does not by itself erase information already collected. These distinctions do not permit indefinite retention, continued collection after authority ends or retention beyond the DPA’s requirements.
At termination, Zoe will promptly stop new source collection and initiation of service communications under ended authority, disable unnecessary access and provide an export-only opportunity of 30 days for information Customer is authorized to receive. A verified earlier deletion instruction, binding Data Provider instruction, legal restriction or applicable DPA requirement may shorten that window for affected data. If a self-service export is incomplete or unavailable, Zoe will use its assisted or manual procedure to return the information required by the DPA; a technical or temporary access restriction does not remove that duty. Customer should export before requesting irreversible deletion. The export opportunity is not an additional license to use the data for another purpose.
When processing ends, Zoe will return or delete processor-held data at the relevant Data Provider’s choice, delete remaining copies as the DPA requires, and apply the agreed instructions without undue delay. If no choice has been provided, Zoe will seek it and follow the DPA’s end-of-processing procedure. A Data Provider may request return, deletion or revocation through privacy@zoediagnostics.ai or the supported product controls. Zoe will fulfill authorized requests using automated tools or assisted or manual procedures as needed. Requests require processing and may include work by connection providers or other subprocessors; receipt of a request or a partial result is not confirmation that every copy has been deleted or every grant revoked. Zoe will promptly report material outstanding work, pursue completion and provide a truthful completion status, including any lawful retained data. Operational limitations do not relieve Zoe of the DPA’s return, deletion or assistance obligations.
Zoe must protect backups and residual copies, restrict them from ordinary use when deletion is required, and apply the DPA’s return/deletion requirements and the recorded, justified expiry applicable to the affected system. Deletion instructions must be reapplied before restored data resumes ordinary use. Zoe cannot extend retention merely by labelling an active copy a backup. The only exception to deleting processor-held personal data is retention required by applicable law, for the required scope and duration. Separate minimal billing, agreement-acceptance and security records may be retained for a documented lawful purpose only as long as necessary; this does not permit retaining full source records, Read evidence or indefinite audit archives under a business-records label.
Customer and other authorized recipients may retain their lawfully received signed documents and other outputs subject to the authorized disclosure, confidentiality, retention and personal-data rights that apply to them. This does not authorize Zoe to preserve the underlying workspace, source evidence or processor copies after their deletion is required. Zoe will explain the scope of a deletion confirmation and any lawful retained copy; it cannot recall a file already lawfully exported to an independent recipient. Those recipients remain responsible for their own copies. Ending a subscription does not itself revoke Customer’s lawful output-use rights or guarantee perpetual hosted access. Termination does not seal or certify a Read. Accrued payment duties and provisions concerning ownership, confidentiality, permitted output use, liability, disputes and necessary data handling survive to the extent needed to give them effect.
12Limited warranty and remedies
Zoe warrants that it will provide the service with reasonable care and skill and that the purchased functionality will materially conform to the applicable Order and service documentation during the purchased term. Customer should notify Zoe promptly of a material failure, with enough detail to investigate. Zoe will correct or reperform the affected service at no additional charge, and a retry needed to correct Zoe’s failure will not consume another purchased Read. A source limitation, Customer modification or third-party change excuses correction only to the extent it caused the failure and Zoe otherwise performed its duties; Section 5 still applies to an unperformed prepaid Read. If Zoe cannot correct a material failure within 30 days after sufficient notice, or correction can no longer meaningfully provide the purchased service, Customer may terminate the affected service and receive a refund of fees paid for the materially nonconforming Read or subscription period, together with unused prepaid fees for the terminated service. A shorter express remedy or refund commitment remains binding, and Customer need not wait 30 days where late delivery cannot meaningfully meet the purchased purpose. The same fees are not refunded twice, and expiry of a monthly period during the correction process does not eliminate the remedy for that failed period.
Except for these express commitments and rights that cannot lawfully be excluded, the service and outputs are provided as available without other express or implied warranties, including merchantability, fitness for a particular purpose and non-infringement. Zoe does not warrant uninterrupted operation or the accuracy of every source or output. This paragraph does not excuse Zoe from the DPA, confidentiality, an express service commitment or applicable law. The remedies are cumulative with otherwise available remedies, subject to Section 13 and no double recovery. The correction/refund process does not delay emergency containment or limit separate remedies for unauthorized access or disclosure, failed agreed controls, a security breach, confidentiality breach, indemnified claim or non-excludable liability.
13Liability
To the extent permitted by law, neither party is liable to the other for lost profits, lost business opportunities or indirect, incidental, special, consequential, exemplary or punitive damages arising from the agreement. This exclusion does not prevent recovery of reasonable, documented direct costs of investigating, containing and correcting a breach, restoring data, required notifications or substitute performance reasonably necessary to restore the contracted service, or amounts payable to a third party under Section 14, subject to the applicable cap below. Such costs are not excluded merely because they involve data loss, interrupted operations or a third-party provider. Speculative investment valuations, lost deal opportunities and an assumed guarantee of the desired business result are not direct restoration costs. Loss must be caused by the responsible party’s breach, reasonably mitigated and net of actual recoveries, without double recovery.
For a one-time Read, Relevant Fees means fees paid or payable for the Read under the affected Order, and the cap applies in aggregate to claims concerning that Read. For a subscription, each Liability Period is a successive 12-month period beginning on the start date of the affected subscription service. Relevant Fees means fees paid or payable under that Order for the affected service during the applicable Liability Period; this calculation does not create a minimum purchase commitment. All claims allocated to that Order’s Liability Period share one aggregate cap. An independent event first occurring in a later Liability Period has a fresh cap.
Each party’s aggregate liability for the applicable Read or Liability Period is limited to the greater of Relevant Fees and US$1,000, the General Cap. For claims arising from a party’s breach of confidentiality, data-protection or security duties, its indemnification obligations under Section 14, or Zoe’s access or disclosure outside valid authority or failure of an agreed source-scope, recipient, approval or stop control, the Enhanced Cap is the greater of twice Relevant Fees and US$5,000. Ordinary claims in total may not exceed the General Cap; if there are enhanced-category claims, the total recovery for ordinary and enhanced-category claims together may not exceed the Enhanced Cap. The two caps are not added together.
Claims from the same incident or causally connected series are allocated to the Liability Period in which the first event causing those claims occurred, including where consequences continue into a later period. An independent later incident is not part of that group merely because it involves the same service or type of error. An event before the subscription starts is allocated to its first Liability Period. Renewal does not restart the 12-month timetable or multiply a cap for the same incident. For related claims involving multiple Orders, the Relevant Fees for the affected services in their applicable periods are added without counting a fee twice, and each monetary floor applies once to the group. Unrelated claims under separate Orders have separate caps. For a claim not attributable to an Order, Relevant Fees is zero and the same monetary floors and non-stacking rules apply to claims from the same or related events. These rules do not permit double recovery or diminish the mandatory rights identified below.
Neither the exclusions nor the caps limit liability for fraud, willful misconduct, gross negligence, death or personal injury caused by negligence where liability cannot be excluded, or any other liability that applicable law does not permit the parties to limit. Customer’s obligation to pay agreed fees and Zoe’s express obligation to return or refund fees under the agreement are payment adjustments, not damages claims subject to these caps. Nothing limits a data subject’s statutory remedies, a regulator’s authority or mandatory rights under applicable standard contractual clauses. Each party must take reasonable steps to mitigate its losses. Insurance does not increase a cap or create coverage by implication. An expressly negotiated DPA liability allocation is governed by Section 2 and the DPA, without requiring the later agreement to use the terms General Cap or Enhanced Cap.
14Third party claims
Zoe will defend Customer against a third-party claim that Zoe’s service technology or a Zoe-created deliverable, as supplied and used as authorized, infringes that party’s intellectual-property rights, and will pay damages and reasonable settlement amounts finally awarded or agreed by Zoe. This commitment excludes claims to the extent caused by Customer or Data Provider materials, third-party source content, unauthorized modifications, combinations neither supplied nor reasonably contemplated by Zoe, or continued infringing use after Zoe supplies a materially equivalent non-infringing alternative. It does not promise that automatically generated statements or outputs are unique or have exclusive intellectual-property protection; that limitation does not excuse a covered infringement claim attributable to Zoe’s supplied technology or deliverable.
Customer will defend Zoe against a third-party claim arising from information Customer supplies without necessary rights or Customer’s unlawful use or disclosure of the service or outputs, and will pay damages and reasonable settlement amounts finally awarded or agreed by Customer. This commitment does not extend to a target company’s independent conduct or materials merely because Customer paid for a Read, and does not cover losses caused by Zoe’s breach or unlawful conduct.
The protected party must give prompt notice, reasonable cooperation and control of the defense to the defending party. Delay relieves a duty only to the extent it materially prejudices the defense. No settlement may admit fault, impose a non-monetary obligation or leave the protected party without an unconditional release without its consent, not unreasonably withheld. Zoe may obtain rights, modify or replace affected technology without materially reducing purchased functionality, or terminate the affected service and refund its unused prepaid fees and fees paid for an unusable affected deliverable if those measures are not reasonably available. Section 13 applies to these obligations. Reasonable defense costs, settlements and judgments count toward the applicable indemnity cap. If documented payments exhaust that cap, the defense and indemnity duty ends after reasonable prior notice and an orderly handover of the defense; this does not limit an obligation that mandatory law makes non-excludable.
15Changes
Material changes to an active Order, its permissions or these Terms require recorded agreement by authorized representatives. Routine maintenance within agreed limits does not require a contract amendment. Zoe may propose updated standard Terms for renewal with the text of the change and at least 30 days’ notice. Customer may decline by not renewing. If notice arrives after an applicable nonrenewal deadline, Customer has at least 15 days after receipt to decline without an additional renewal commitment. A changed website page or version number alone does not amend a signed agreement or establish acceptance of different text.
A material change to permissions, processing or a committed fixed-term right cannot be imposed by continued website use. A change strictly required by law applies only to the necessary extent; if it materially prevents delivery of the purchased service, Customer may terminate the affected portion and receive its unused prepaid fees. Urgent action necessary for security may temporarily restrict affected operations, but cannot expand data use, source access or communication authority. Changes to the DPA, subprocessors or transfer safeguards follow the additional requirements in the DPA, including agreement by the appropriate Data Provider where required.
Updates to the separate Privacy Notice follow its stated process and applicable law. A notice update alone does not amend the service agreement or DPA, supply consent or authorize a new purpose for previously collected Read data.
16Governing law and disputes
Delaware law governs the agreement, without its conflict-of-law rules. The parties submit disputes to the state courts located in New Castle County, Delaware, or the United States District Court for the District of Delaware where that court has jurisdiction. There is no mandatory arbitration clause in these Terms. The parties will first try in good faith to resolve a written dispute through representatives authorized to settle it for 30 days, except that either may seek urgent protective relief or act before a limitation period expires.
Mandatory data-protection, transfer, consumer or other non-waivable laws prevail where applicable. This clause does not restrict a data subject’s right to complain to a regulator or bring a claim in a court permitted by mandatory law. Each party bears its own legal costs unless a court awards otherwise or mandatory law provides otherwise.
17General provisions
Neither party may assign the agreement without the other’s consent, not unreasonably withheld, except to a successor in a merger or sale of substantially all relevant assets that assumes the obligations and can lawfully perform them. An assignment does not expand the permitted uses of personal data, source access or recipient authority, and does not revoke Customer’s continuing output-use rights. The parties are independent contractors; the agreement does not create a partnership, employment relationship or fiduciary duty.
A party is excused from a delay caused by an event beyond its reasonable control to the extent it could not reasonably prevent or mitigate it, provided it promptly notifies the other party and resumes performance. This does not excuse payment already due, inadequate ordinary security, failure of agreed controls within the responsible party’s control, confidentiality or non-waivable data-protection duties. If the event materially prevents the purchased service for more than 30 days, either party may terminate the affected service and Customer receives the unused prepaid refund described in Section 5.
An unenforceable provision will be limited only as necessary, with the rest remaining effective. Failure to enforce a provision is not a waiver. The agreement is the entire agreement on its subject, without excluding liability for fraud or superseding an expressly controlling signed agreement. Amendments must be in writing, including a valid electronic acceptance process under Section 15. No third party has enforcement rights except where the DPA, applicable transfer clauses or mandatory law expressly provides them.
18Notices and contact
Legal notices to Zoe should be sent to legal@zoediagnostics.ai, identifying Customer and the affected agreement. Privacy requests may also be sent to privacy@zoediagnostics.ai and security reports to security@zoediagnostics.ai. Zoe will send contractual notices to the administrator or notice contact recorded for Customer; Customer must keep that contact current. A notice is effective when received, or on the next business day after successful email delivery if no failure notice is received, except that a cancellation or revocation received sooner is effective on that receipt. This email process does not replace any mandatory method for service of legal proceedings or a different notice method in a signed agreement.
19Website use and service agreements
Zoe’s purchased and agreed services are governed by the version of these Terms of Service affirmatively accepted for the service and the applicable Order. A separately signed customer agreement controls conflicting provisions for its defined services as provided in Section 2; it does not automatically replace the DPA, release earlier obligations or expand data access or communication authority. The Privacy Notice explains information practices and does not provide blanket processing consent. Browsing this website, submitting a contact form or receiving an invitation alone does not purchase a service, authorize access to Company systems or permit disclosure of Company information. Required DPA acceptance and authorization for Company access or disclosure must be obtained before the affected processing and may be recorded through the ordinary service flow or another agreed written process.
Zoe permits lawful access to its public website and viewing, downloading or printing of publicly offered materials for legitimate business evaluation, subject to any stated download terms, intellectual-property rights and confidentiality restrictions. No general right to republish, resell or commercially repackage Zoe’s content, branding or technology is granted. Visitors must not bypass access controls, introduce harmful code, misrepresent their identity or interfere with the site. Rights that applicable law does not permit Zoe to restrict remain unaffected.
Public examples and demonstrations illustrate the service; they do not enlarge purchased scope, establish actual customer results or promise an investment outcome. Information may change and is not a substitute for independent review. Links to third-party sites are provided for convenience; those sites have their own terms and privacy practices. Zoe does not control their content or operations. These website provisions do not reduce Zoe’s express service commitments, applicable DPA duties or liability for its own breach. Use of optional marketing or tracking tools is governed by the Privacy Notice and applicable choices, not inferred from service acceptance.