Terms and Conditions

1. Parties and Definitions

1.1 Provider: PROMOTION MEDIA S.R.L, a limited liability company registered in Romania, e-mail: catalin@stomichat.ai (hereinafter the Provider).

1.2 Customer: a legal entity or authorised natural person that subscribes to the Service as a dental practice (hereinafter the Customer).

1.3 Definitions:

• "Agreement" — this document together with the Order Form and the Data Processing Agreement (DPA).
• "Service" — the Stomichat software platform, including its interfaces, APIs and artificial-intelligence chatbot features, made available on a subscription basis.
• "Order Form" — the document or online purchase page specifying the subscription plan, the fees and the billing cycle.
• "Personal Data" — any information relating to an identified or identifiable natural person, as defined by the GDPR.
• "Patient Data" — personal data of the dental practice's patients processed through the Service.
• "User" — any employee or authorised representative of the Customer who accesses the Service.
• "LLM Provider" — the provider(s) of the large language model(s) used by the Provider to power the chatbot functionality (see Annex 1 of the DPA).
• "AI-Generated Content" — the answers or text generated by the Service through the LLM.

2. Subject of the Service

2.1 The Provider grants the Customer a non-exclusive, non-transferable and revocable right to access and use the Service for the duration of the subscription, solely for the purposes of the Customer's internal business.

2.2 The Service may include: an AI chatbot for handling patient enquiries, appointment assistance, automation of frequently asked questions and integration with the practice management software (where available).

2.3 The Provider may update, modify or improve the Service at any time. Where changes materially reduce functionality, the Provider will give at least 30 days' notice.

2.4 The Service is provided "as is" and "as available", subject to the availability commitments in Section 9.

2.5 Flexibility of AI models and providers. The Service relies on large language models (LLMs) supplied by third parties. The Customer acknowledges and accepts that:

• Change of model — The Provider may change, update or replace the AI models used at any time, without prior notice and without the Customer's consent, as long as the data continues to be processed by an entity already included in the Sub-processor List (Art. 6.6). Such changes are purely technical, do not constitute an amendment of this Agreement and do not give rise to a right of termination.
• Change of provider — Adding or replacing an entity that processes Patient Data follows the sub-processor procedure set out in Art. 6.6.

The Provider uses reasonable efforts to maintain a broadly equivalent level of Service following any such change.

2.6 Continuity of the Service in case of deprecation: If an AI model used by the Service becomes unavailable or is deprecated by its provider, the Provider will use reasonable efforts to replace it with an equivalent model without significant interruption of the Service. Any short periods of degraded performance caused solely by such situations will not be considered breaches of this Agreement.

3. Subscription and Payment

3.1 The Customer will pay the subscription fees set out in the Order Form. Fees are expressed in EUR or RON, excluding VAT, as applicable.

3.2 VAT will be applied in accordance with the Romanian and European tax legislation in force. The Customer is responsible for providing correct billing information and VAT number.

3.3 Monthly subscriptions are billed in advance on the same day of each month. Annual subscriptions are billed in full in advance, unless otherwise agreed in writing.

3.4 Payment is due within 14 days of the invoice date. Late payments will bear interest in accordance with Government Ordinance No. 13/2011 (the National Bank of Romania reference rate + 8 percentage points for B2B transactions).

3.5 The Provider may suspend access to the Service if payment is more than 15 days overdue, after prior written notice. Suspension does not release the Customer from the obligation to pay.

3.6 The Provider may change the subscription fees with 60 days' written notice. The Customer may terminate the Agreement without penalty if it does not accept the new fees, provided that written notice is given before they take effect.

4. Term and Termination

4.1 This Agreement takes effect on the date the Customer activates the subscription and remains in force for the selected subscription period.

4.2 Renewal: Subscriptions renew automatically at the end of each billing period, unless either party gives written notice of non-renewal at least 30 days before the renewal date.

4.3 Termination by the Customer: The Customer may terminate at any time by giving 30 days' written notice. For annual subscriptions paid in full in advance, no refunds are given for the unused period, unless termination results from a material breach by the Provider.

4.4 Termination by the Provider: The Provider may terminate the Agreement with immediate effect, without refund, if the Customer:

• materially breaches this Agreement and fails to remedy the breach within 15 days of written notice;
• engages in illegal activities or misuses the Service;
• becomes insolvent or enters insolvency proceedings.

4.5 Upon termination of the Agreement, the Customer's access to the Service will end. The Provider will make the Customer's data available for export for 30 days from the termination date, after which personal data will be deleted in accordance with Section 6.

4.6 Retention of anonymised data after termination: After the 30-day period referred to in Art. 4.5 has expired, the Provider may retain and use data derived from the use of the Service, provided that such data is fully anonymised so that it does not allow the direct or indirect identification of any natural person, any patient or the Customer. The anonymisation process follows recognised technical standards (including those set by the Article 29 Working Party / EDPB), so that re-identification is reasonably impossible. Such anonymised data may be used by the Provider solely for the following purposes:

• improving and developing the Stomichat platform and its features;
• training and optimising the AI models used within the Service;
• generating aggregate statistics and anonymous industry reports;
• internal research and development.

Anonymised data does not constitute personal data within the meaning of the GDPR and is not subject to the deletion obligations it imposes. The Customer expressly acknowledges and accepts this practice by accepting this Agreement.

5. Acceptable Use

5.1 The Customer undertakes to use the Service solely for lawful purposes and in accordance with applicable law, including Romanian law, EU law and the professional regulations applicable to dental practice.

5.2 The Customer will not:

• use the Service to provide clinical diagnoses, prescriptions or any other content that constitutes the practice of medicine or dentistry;
• present the AI chatbot to patients as a human operator;
• collect through the Service data beyond what is necessary for the intended purpose;
• attempt to reverse engineer, decompile or extract the AI model or the underlying software;
• resell, sublicense or grant third parties access to the Service without the Provider's prior written consent.

5.3 The Customer is responsible for ensuring that all Users comply with this Agreement and for any actions taken using its account credentials.

6. Data Protection and GDPR

6.1 Both parties acknowledge that the Service involves the processing of personal data, which may include special categories of data (health data), within the meaning of Regulation (EU) 2016/679 (GDPR) and Romanian Law No. 190/2018.

6.2 Roles of the parties: The dental practice acts as the data Controller. The Provider acts as a Processor when it processes Patient Data on behalf of the Customer.

6.3 Data Processing Agreement (DPA): A separate Data Processing Agreement, which forms an integral part of this Agreement, governs the processing of personal data. The Customer will not use the Service to process Patient Data until the DPA has been signed.

6.4 The Provider undertakes to:

• process personal data only on documented instructions from the Customer;
• implement appropriate technical and organisational security measures (including encryption and access controls);
• not engage sub-processors except under the general authorisation and notification procedure set out in Art. 6.6;
• notify the Customer of any personal data breach within 24 hours of becoming aware of it;
• delete or return all personal data upon termination of the Agreement, as instructed by the Customer, except for data fully anonymised in accordance with Art. 4.6.

6.5 The Customer, as Controller, is solely responsible for:

• obtaining all necessary consents from patients before their data is processed through the Service;
• informing patients about the use of AI tools, in accordance with GDPR transparency requirements;
• handling data subject rights requests.

6.6 Sub-processors and the Right to Object

• Certain processing operations (including data hosting and storage, transactional communications and processing of chatbot messages through LLM providers) are carried out by third parties acting as sub-processors of the Provider. The up-to-date list of sub-processors — setting out their identity, processing location, categories of data processed and applicable safeguards — is permanently available at stomichat.ai/terms/subprocessors (the "Sub-processor List", in Romanian) and forms an integral part of this Agreement and of the DPA.
• By accepting this Agreement, the Customer gives the Provider a general written authorisation, within the meaning of Art. 28(2) GDPR, to engage the sub-processors included in the Sub-processor List.
• Before adding or replacing a sub-processor that processes Patient Data, the Provider will update the Sub-processor List and notify the Customer at least 30 days in advance, by e-mail to the account's contact address and/or through a subscription mechanism for the List.
• The Customer may object, in writing and stating its reasons, on reasonable data-protection grounds, within 14 days of the notification. The parties will make good-faith efforts to find a solution. If the Provider cannot offer a reasonable alternative within 30 days of the objection, the Customer may terminate the affected part of the Service without penalty and receive a pro-rata refund of any amounts prepaid for the unused period.
• The Provider ensures that each sub-processor, regardless of any changes, is bound by data-protection obligations equivalent to those set out in this Agreement and, where applicable, enters into Standard Contractual Clauses for transfers outside the European Economic Area.
• A change of AI model within a sub-processor already included in the Sub-processor List does not constitute a change of sub-processor and is not subject to the notification procedure set out in this article.

6.7 Data is stored on servers located in the European Economic Area. Any transfer outside the EEA will only take place with the Customer's prior written consent and in compliance with the appropriate GDPR safeguards (for example, Standard Contractual Clauses).

7. Intellectual Property

7.1 The Provider retains all intellectual property rights in the Service, including the underlying AI models, software, algorithms and platform design. Nothing in this Agreement transfers any ownership rights to the Customer.

7.2 The Customer retains ownership of all data and content submitted through the Service (Customer Data). The Customer grants the Provider a limited licence to process Customer Data solely for the purpose of providing the Service.

7.3 The Provider may use aggregated and anonymised data resulting from the use of the Service to improve the platform and develop new features. Such data will not identify any person or entity.

8. AI-Generated Content — Limitations and Assumed Risks

8.1 The Customer expressly acknowledges and accepts that the Service relies on large language models (LLMs) that operate on a probabilistic and non-deterministic basis. By their technical nature, these models may generate incorrect, incomplete, contradictory or fabricated answers (a phenomenon known as "AI hallucination"), and the Provider cannot prevent or guarantee the absence of such situations.

8.2 Risks expressly assumed by the Customer: The Customer expressly accepts the following risks inherent in the use of AI technology in a medical and dental context:

• the chatbot may provide incorrect or incomplete medical or dental information, including about treatment plans, procedures or prices;
• the chatbot has no access to the patient's medical history and cannot assess their individual clinical condition;
• the chatbot's answers do not constitute, and will not be presented as, a substitute for professional medical consultation;
• a patient may make wrong decisions based on the chatbot's answers, and this responsibility lies solely with the Customer and the patient, not with the Provider;
• the AI model may misinterpret ambiguous questions, regional dialect or non-standard medical terminology.

8.3 The Customer has an active obligation to implement mechanisms for supervising the chatbot's answers and not to allow its autonomous use in situations involving direct clinical decisions. The Provider is not responsible for the consequences of failing to comply with this obligation.

8.4 The Provider is not liable for any damage, fine or penalty resulting directly or indirectly from incorrect chatbot answers, whether the error originates in the AI model, in the LLM provider's training data, in misconfiguration by the Customer or in any other cause.

8.5 The chatbot interface will display a warning to patients, such as: "This is an AI assistant. My answers may contain errors and do not constitute medical advice. For any medical decision, consult your doctor."

9. Availability and Technical Support

9.1 The Provider uses reasonable efforts to ensure the continuous availability of the Service, excluding scheduled maintenance and circumstances beyond its reasonable control, including failures of LLM providers or of cloud infrastructure. The Provider does not guarantee a specific minimum availability or uninterrupted operation.

9.2 Scheduled maintenance will, as far as possible, be carried out outside peak hours, with prior notice to the Customer by e-mail or through the Stomichat platform. The Provider will use reasonable efforts to minimise the duration and impact of interruptions.

9.3 Technical support: The Provider offers technical support by e-mail at catalin@stomichat.ai. Support is provided within the operational capacity of the Provider's team. The Customer may report any technical issue at any time, and the Provider undertakes to review and respond to reports as soon as reasonably possible, depending on the complexity of the issue and the volume of existing requests.

9.4 The Provider classifies reported issues by severity and handles them in order of priority, paying particular attention to situations affecting the core functioning of the chatbot. However, the Provider does not guarantee fixed response or resolution times and accepts no liability for delays caused by external technical factors, the availability of LLM providers or the complexity of the issue.

9.5 The Provider does not guarantee that the Service will be error-free, that all issues will be resolved or that features will remain identical over time, given the continuously evolving nature of the AI technologies used. The Customer accepts that some technical limitations may be inherent in the nature of the Service and do not constitute breaches of this Agreement.

10. Limitation of Liability

10.1 Liability cap: To the maximum extent permitted by Romanian and European law, the Provider's total aggregate liability to the Customer, regardless of the nature or legal basis of the claim (contract, tort, negligence or otherwise), will not exceed the subscription fee paid by the Customer for the calendar month preceding the event giving rise to the claim. The parties acknowledge that this cap reasonably reflects the allocation of risk in a B2B contract for AI-based software services, given the probabilistic and non-deterministic nature of the technology used.

10.2 The Provider will not, under any circumstances, be liable for:

• indirect, consequential, incidental or special damages, whether or not the Provider was informed of the possibility of such damages;
• loss of profit, revenue, customers or business opportunities;
• loss, corruption or unavailability of data;
• clinical, medical or dental decisions made by the practice, medical staff or patients based on the chatbot's answers, whether correct or incorrect;
• incorrect, incomplete or inaccurate answers generated by the AI models, including LLM hallucinations;
• interruptions, degradation or unavailability of the Service caused by LLM providers or third-party cloud infrastructure;
• GDPR fines, penalties or compliance costs imposed on the Customer as a result of its own failures to comply with data protection law;
• third-party claims, including by patients, against the Customer, even if they attempt to involve the Provider;
• changes to features resulting from the deprecation of AI models or a change of LLM providers, made in accordance with Art. 2.5.

10.3 Nothing in this Agreement limits liability for death or personal injury caused by gross negligence or wilful misconduct (intent), fraud, or any liability that cannot be excluded under applicable mandatory law. The parties confirm that they have freely negotiated and accepted these limitations of liability in the context of a B2B commercial relationship.

11. Confidentiality

11.1 Each party undertakes to keep confidential all non-public information disclosed by the other party in connection with this Agreement and to use it solely for the purposes of this Agreement.

11.2 This obligation does not apply to information that: (a) becomes publicly available without any breach of this Agreement; (b) was already known to the receiving party; (c) must be disclosed by law or court order.

11.3 The confidentiality obligations survive the termination of this Agreement for a period of 5 years.

12. Warranties and Representations

12.1 The Provider warrants that: (a) it has the right to provide the Service; (b) it will provide the Service with reasonable care and skill; (c) it will comply with applicable law in providing the Service.

12.2 The Provider does not warrant that: (a) the Service will meet all of the Customer's specific requirements; (b) the chatbot's answers will be correct, complete or suitable for any specific clinical purpose; (c) the Service will be entirely free of errors or interruptions.

12.3 The Customer warrants that: (a) it has the legal capacity to enter into this Agreement; (b) it will use the Service in accordance with all applicable laws and professional regulations; (c) it holds all necessary patient consents for the data processed through the Service.

13. Governing Law and Dispute Resolution

13.1 This Agreement is governed by Romanian law, including the Civil Code (Law No. 287/2009), and applicable EU law.

13.2 The parties will first attempt to settle any dispute amicably, through good-faith negotiation, within 30 days of notification of the dispute.

13.3 If the dispute cannot be settled amicably, it will be submitted to the exclusive jurisdiction of the courts of Romania.

14. General Provisions

14.1 Entire agreement: This Agreement (including the Order Form and the DPA) constitutes the entire understanding of the parties and supersedes any prior agreements relating to its subject matter.

14.2 Amendments: The Provider may update this Agreement with 30 days' written notice. Continued use of the Service after the effective date constitutes acceptance of the changes.

14.3 Assignment: The Customer may not assign this Agreement without the Provider's prior written consent. The Provider may assign the Agreement to a successor in the context of a merger or acquisition.

14.4 Severability: If any provision is held void or unenforceable, it will be modified to the minimum extent necessary, and the remaining provisions will remain in force.

14.5 Waiver: Failure to exercise a right under this Agreement does not constitute a waiver of its future exercise.

14.6 Force majeure: Neither party is liable for delays or non-performance caused by circumstances beyond its reasonable control (e.g. natural disasters, cyber-attacks, government actions), provided that the other party is notified promptly.

14.7 Notices: Notices under this Agreement will be given in writing, by e-mail to the addresses stated in the Order Form or by registered post to the parties' registered offices.