Ryfinr Master Subscription Agreement

Please read these terms carefully before clicking “I Agree.” By clicking “I Agree,” “I Accept,” or by accessing or using the Services following your review of these terms, you acknowledge that you have read, understood, and agree to be bound by this Agreement with Knight Labs Inc. or an affiliate (the “Provider”).

The Services are provided for business and commercial use only. By clicking “I Agree” or using the Services, you represent and warrant that: (i) you have the authority to enter into this Agreement on behalf of the company or other legal entity you are registering (the “Customer”); (ii) you are entering into this Agreement for business purposes and not as a consumer; and (iii) you are at least 18 years of age.

If you do not agree to these terms, or you do not have authority to bind the Customer, do not click “I Agree” and do not access or use the Services.

This document has three parts, all of which form part of the Agreement:

• Part A: Master Subscription Agreement. The commercial terms of your subscription.
• Part B: Data Processing Addendum. How Ryfinr processes personal data on your behalf.
• Part C: Privacy Notice. How Ryfinr handles personal data about you as a user.

Where Part B conflicts with Part A, Part B prevails on matters of data protection, as set forth in section A9.12.

• “Affiliates” means, with respect to a party, the entities within its corporate group that are under common control.
• “Agreement” means these terms and conditions, any service appendices attached to or incorporated in an Order, any Order, and Parts B and C of this document.
• “Applicable Law” means any legally binding obligation on a party, including statutes, rules, regulations, codes, or any other binding requirement.
• “Claim” means any claim, action, suit, dispute, or proceeding.
• “Confidential Information” means any information that a party discloses to the other party that is marked as confidential or that a reasonable person would understand to be confidential (including trade secrets).
• “Customer” means the party identified as the customer on an Order.
• “Customer Data”means data that Customer makes available to Ryfinr for the purpose of Ryfinr processing that data on Customer’s behalf, including source content, brand and product terminology, style guides, glossaries, translation memories, reference documents, and any files Customer uploads to the Services.
• “Indemnitees”means, with respect to a party, that party, its Affiliates, and its own and its Affiliates’ own directors, officers, employees, agents, and other representatives.
• “Losses”means any losses, damages, liabilities, awards, and costs (including court costs and reasonable attorneys’ fees) related to a Claim.
• “Order” means an ordering document that sets out the products or services that Ryfinr or a third party is to provide to Customer.
• “Output” means content generated, localized, translated, back-translated, or otherwise produced by the Services in response to Customer Data or Customer instructions.
• “Ryfinr”, “we”, “us”, or “our” means the selling party on an Order (Knight Labs Inc. or its applicable Affiliate).
• “Ryfinr Data”means any data in Ryfinr’s platform that Ryfinr makes available to Customer or that Ryfinr uses or creates in the course of providing the Services, excluding Customer Data and Output.
• “Resold Services” means the products or services that a third party is to provide to Customer as set out on an Order.
• “Services” means the services that Ryfinr provides to Customer as set out on an Order.
• “Term” is defined in section A6.
• “User” means an individual that Customer (directly or indirectly) has authorized to use the Services and/or the Resold Services.

A2. Services

This Agreement sets out the terms of the contract between Customer and Ryfinr and the Services that Ryfinr provides, including any Ryfinr Data that Customer accesses.

During the Term, Ryfinr will:

• provide the Services with reasonable skill and care;
• not make a material adverse change to the functionality of the Services;
• provide the Services in material accordance with any descriptions of the Services on an Order;
• process any personal data in accordance with Part B of this document, which shall govern and control in the event of any data protection conflict; and
• comply with Applicable Law.

Where an Order specifies Services and Resold Services, Ryfinr provides Services subject to this Agreement, and the third party provides Resold Services subject to its own terms stated in the Order. Ryfinr is only responsible for its own Services and not any Resold Services.

A3. Use of the Services

Customer:

• is responsible for its compliance with this Agreement and its usage of the Services, Ryfinr Data, and Output, and will ensure that each User complies with the terms of this Agreement as if that User were Customer;
• has the right, title, permissions, and interest in the Customer Data to make it available to Ryfinr for processing;
• will comply with Applicable Law;
• is responsible for any business decisions made on the basis of information derived from using the Services, including any decision to publish, distribute, or submit Output; and
• represents that it will not upload, and acknowledges that the Services are not designed to receive, Protected Health Information (PHI) or other patient-identifiable health data.

Customer will not:

• sell, resell, license, sublicense, distribute, or otherwise make the Services (or the results of the Services, including Ryfinr Data) available to anybody other than its Users for their own internal use, unless stated otherwise on an Order;
• subject to Applicable Law, attempt to reverse-compile, disassemble, reverse engineer, or otherwise reduce to human-perceivable form any part of the Services or underlying code;
• use the Services, Ryfinr Data, or Output in a manner that violates Applicable Law, including law about data protection, privacy, information security, or the advertising and promotion of regulated healthcare products;
• use the Services, Ryfinr Data, or Output to build a competitive product or use in a competitive service, including to train or fine-tune any machine learning model;
• interfere with or disrupt the performance of the Services, including spamming, hacking, and violating Ryfinr’s API rate limits; or
• use the Services in a manner that violates the acceptable use or usage policies of Ryfinr’s third-party model providers, as notified to Customer in writing or published at ryfinr.com/acceptable-use.

Each party will use reasonable efforts to ensure that any User IDs and passwords to use Services are kept confidential, and will promptly notify the other party upon discovery if the security of a User ID or password may be or is compromised.

A4. Fees

Customer will pay Ryfinr the fees for the Services and any Resold Services set out in an Order. Fees are exclusive of legally applicable taxes, levies, duties, or similar governmental assessments. Customer will provide Ryfinr with the information it reasonably requires to send an invoice. All fees are invoiced annually in advance, and are non-cancellable and non-refundable unless stated otherwise on an Order or in these terms.

A5. Confidential Information and intellectual property

Confidential Information does not include information that is or becomes public, was already known, was received from a third party, or was independently developed, in each case without breach of an obligation owed to the disclosing party.

The receiving party will keep Confidential Information confidential using at least a reasonable degree of care, and use it only to perform its obligations under this Agreement. Upon termination, each party shall delete or destroy the other party’s Confidential Information within the timeframes required by Applicable Law, or retain it for seven (7) years after the end of the Term where deletion is not legally permitted, or longer if required by life-sciences regulatory recordkeeping obligations. Trade secrets remain confidential until they are no longer trade secrets. Confidential Information may be shared with Affiliates, data licensors, vendors, and professional advisers with a need to know, or disclosed where required by Applicable Law.

Ryfinr owns all intellectual property rights in the Services and Ryfinr Data. Customer owns all intellectual property rights in the Customer Data. Subject to Customer’s payment of all applicable fees, Ryfinr assigns to Customer all right, title, and interest it may have in the Output generated for Customer. Customer acknowledges that Output is generated by automated systems and may not be unique, that Ryfinr makes no representation or warranty that Output is original, accurate, non-infringing, or fit for any regulatory or promotional purpose, and that Customer is solely responsible for reviewing, verifying, and approving Output before any use.

A breach of this section will cause substantial and irreparable damage; either party may seek injunctive and equitable relief without being required to prove damages or furnish a bond.

Ryfinr may use any Feedback Customer or its Users provide about the Services. Ryfinr may also collect and commercialize Blind Data derived from Aggregated Data, but Blind Data will never include Customer’s source content, brand or product names, proprietary terminology, glossaries, or translation memories without Customer’s consent.

Ryfinr may offer Beta Modules — features still being tested, offered as-is, usable or declinable at Customer’s option, and which may change or be withdrawn at any time. Customer’s purchases are never contingent on the delivery of future functionality.

This Agreement begins when signed or agreed to via an Order, whichever is earlier, and continues until all Orders have expired or been terminated (the “Term”).

A party may terminate this Agreement on written notice if the other party is in material, unremedied breach (following 30 days’ notice where remediable), or begins insolvency proceedings.

Ryfinr may suspend the Services if Customer fails to pay an undisputed invoice within ten (10) days of notice, if Customer’s use violates Applicable Law or breaches this Agreement in a way that threatens the platform’s integrity, or if Customer’s use would place Ryfinr in breach of its agreements with its third-party model providers.

At termination, all licenses granted by either party terminate and each party will delete data to which it no longer has a license within thirty (30) days, subject to routine backup expiry, audit/generation/review records Customer has elected to export, and records Applicable Law requires Ryfinr to retain.

Subject to the exclusions below, each party’s aggregate liability for Losses arising as a direct and reasonably foreseeable result of a party’s breach is capped by reference to fees paid for the Services in the 12 months preceding the Claim:

• Less than $100,000 in fees — cap of 110% of fees for the Services.
• $100,001–$1,000,000 in fees — cap of 150% of fees for the Services.
• $1,000,001 or greater in fees — cap of two times the fees for the Services.

Nothing in this Agreement excludes or limits liability that cannot be excluded under Applicable Law (including fraud, wilful misconduct, or gross negligence), or Customer’s indemnification obligations. Neither party is liable for consequential, incidental, special, punitive, exemplary, or indirect damages. Customer is responsible for all legal fees and collection costs incurred in connection with collection of fees.

Except as expressly stated in sections A2.2 and A3.1, all other warranties, conditions, and representations are excluded, subject to Applicable Law. Ryfinr does not warrant the Services will be uninterrupted or error-free. Customer is solely responsible for Ryfinr Data and Output once exported or downloaded.

AI output disclaimer. The Services use artificial intelligence and machine learning to generate and localize content. Output may contain errors, omissions, mistranslations, or statements that are inaccurate, non-compliant, or unsuitable for regulated use. Customer is solely responsible for human review, medical/legal/regulatory (MLR) review, and approval of all Output prior to any use, publication, or submission. Ryfinr does not provide regulatory, medical, legal, or promotional-compliance advice, and no feature of the Services — including any compliance indicator, badge, score, or quality metric — constitutes a determination that Output is compliant with any law, regulation, or industry code.

No regulatory validation. Ryfinr expressly disclaims any representation or warranty that the Services are validated for GxP or 21 CFR Part 11 compliance. Output should not be relied on in formal regulatory submissions unless separate, specific validation arrangements have been executed with Ryfinr in writing.

Ryfinr will indemnify Customer against third-party claims that the Services (excluding third-party content and Output) infringe a third party’s intellectual property rights, except where the claim is based on Customer’s breach of this Agreement. Ryfinr may secure continued rights to use the Services, replace or modify them, or, failing that, terminate the infringing Services on 30 days’ notice with a pro rata refund of unused prepaid fees.

Customer will indemnify Ryfinr against third-party claims that:

• Customer Data or Customer’s use of the Services, Ryfinr Data, or Output infringes or misappropriates a third party’s intellectual property rights;
• arise from Customer’s publication, distribution, or regulatory submission of Output, including any failure to conduct required medical, legal, or regulatory review; or
• arise from Customer’s breach of the acceptable-use restrictions in section A3.2(f).

Notable general terms include: Ryfinr processes User data per Part C; neither party is liable for breaches caused by force majeure events (with fees still due, and either party able to terminate affected Services if the event continues more than 30 days); the relationship and existence of this Agreement are confidential absent consent; invalid terms are severable; delay in enforcement is not a waiver; and Customer may not assign this Agreement without Ryfinr’s prior written consent.

Legal notices go by courier or recorded delivery to each party’s registered address on an Order; other notices may be sent by email — to brian.knight@klabs.com (with Customer’s account manager copied) for notices to Ryfinr.

Order of priority. If there is a conflict within this Agreement: (1) Part B governs on any matter of data protection; (2) an Order; (3) any service appendices; and (4) Parts A and C. The English version of this Agreement prevails over any non-English version.

Governing law.This Agreement is governed by the laws of Ontario, and the parties submit to the exclusive jurisdiction of the courts located in Toronto, Ontario, regardless of Customer’s domicile.

Service levels.Ryfinr will use commercially reasonable efforts to make the Services available at least 99.5% of the time in each calendar month, excluding scheduled and emergency maintenance and factors outside Ryfinr’s reasonable control, and to respond to support requests within five (5) business days.

Changes to these terms.Ryfinr may modify these Terms from time to time. Material changes take effect at the start of Customer’s next renewal term, with at least thirty (30) days’ notice through the Services or by email. If Customer does not agree to a material change, it may elect not to renew or terminate before the change takes effect, with a refund of unused prepaid fees.

This Data Processing Addendum (“DPA”) forms part of the Agreement between Ryfinr and Customer. Ryfinr and Customer are independent controllers of Ryfinr Personal Data (business contact details of Ryfinr personnel). Customer is the controller and Ryfinr is the processor of Customer Personal Data that Customer submits to the Services.

Ryfinr will process Customer Personal Data only on Customer’s written instructions as set out in this DPA. Ryfinr will not sell or share Customer Personal Data, combine it with data from other sources, or retain, use, or disclose it outside the direct business relationship with Customer.

International transfers. Customer acknowledges that Ryfinr processes and stores Customer Personal Data in the United States and does not currently offer EU, UK, or in-region data residency. Any provision of Customer Personal Data by a Customer established in the EEA, UK, or Switzerland constitutes a Restricted Transfer, and the applicable Standard Contractual Clauses (and, for the UK, the UK Addendum) apply in every such case, as detailed in this DPA.

Sub-processors.Customer authorizes Ryfinr to appoint the Sub-Processors below in connection with the Services. All processing occurs in the United States (us-east-1). Ryfinr will give Customer at least 30 days’ notice of any change to this list and an opportunity to object in good faith.

• Amazon Web Services, Inc. — object storage (S3), authentication and identity (Cognito), application hosting (Amplify), serverless compute (Lambda), and transactional email (SES). Processes Customer Data including uploaded source documents, Output, identity and contact data, and authentication events. United States (us-east-1).
• Anthropic, PBC — large language model inference for content generation and localization. Processes Customer Data submitted for processing, including uploaded source documents and any personal data incidentally contained in them. United States.
• Google LLC — large language model inference for content generation and localization. Processes Customer Data submitted for processing, including uploaded source documents and any personal data incidentally contained in them. United States.
• n8n GmbH / Self-Hosted on AWS — workflow orchestration across storage and inference planes, self-hosted by Ryfinr on dedicated AWS infrastructure (n8n GmbH cloud processing is not used). Processes Customer Data in transit and workflow execution metadata. United States (us-east-1).

A current list of Sub-Processors is maintained at ryfinr.com/sub-processors.

Personal data breach.Ryfinr will notify Customer within 36 hours of becoming aware of a Personal Data Breach involving Customer Personal Data, and will cooperate in good faith with Customer’s obligations under Applicable Privacy Laws.

Audit.Ryfinr will support compliance audits Customer conducts, at Customer’s cost, on 30 days’ written notice, during normal business hours, and limited to Ryfinr’s processing activities as a processor. Customer will accept a Ryfinr-supplied third-party audit report in lieu of conducting its own audit where the scope has been addressed within the prior twelve months and Ryfinr confirms no material changes to controls.

Termination. Following termination of this DPA, Ryfinr will, within thirty (30) days, delete or return all Customer Personal Data, unless required to retain it by Applicable Privacy Laws or life-sciences regulatory recordkeeping obligations.

Ryfinr’s privacy contact for matters under this DPA is legal@klabs.com. The full Standard Contractual Clause incorporation terms, UK Addendum terms, and Swiss Federal Data Protection Act amendments referenced in this DPA are available on request from that address.

This Privacy Notice applies to you as a Ryfinr customer or authorized user of Ryfinr’s AI-powered content generation and localization platform for healthcare and life sciences teams. Ryfinr is a product of Knight Labs Inc., an Ontario, Canada-incorporated company, which acts as the data controller responsible for your personal data.

• Registered office: 150 King Street West, Suite 200, Toronto, Ontario M5H 1J9, Canada
• Privacy contact: legal@klabs.com

The Knight Labs Group Privacy Policy describes the Group’s general privacy practices; where it differs from this Ryfinr-specific notice, this Privacy Notice governs.

Data we collect.Identity Data, Contact Data, Financial Data (processed securely by our PCI-compliant payment processor — Ryfinr does not directly store full card numbers), Transaction Data, Technical Data, Profile Data, Usage Data, Content Data (the source content, terminology, glossaries, style guides, and translation memories you submit, together with the Output generated from them), and your Marketing & Communications preferences.

Strict data protection guardrails.Ryfinr does not collect, store, or process Protected Health Information or patient-identifiable health data — customers and users are strictly prohibited from uploading PHI or clinical patient data. Ryfinr does not collect or hold special categories of personal data about platform users, such as race, ethnicity, religious beliefs, political opinions, trade union memberships, or biometric data. Your submitted content and terminology are treated as strictly confidential and are explicitly excluded from generic commercialized “Blind Data” sets or aggregate models unless your organization grants affirmative, explicit consent.

How we collect it. Directly from you (registration, submitted content, support and sales correspondence); through automated technologies as you navigate the platform (server logs, cookies, telemetry, and Google Invisible reCAPTCHA to prevent bot abuse — non-essential cookies are set only with consent where required, and you may withdraw it at any time); through product analytics; and through recorded product demonstrations or technical calls, where permitted.

Artificial intelligence and disclaimers.Ryfinr uses AI and ML to generate, localize, translate, and back-translate content, and to produce quality and readiness indicators. Your personal data is entirely incidental to these functions, and these automated outputs are not used to make automated decisions with legal or similarly significant effects on you. Ryfinr does not determine whether any content is compliant with any law, regulation, or industry code — any compliance badge, score, indicator, or quality metric shown in the platform is an automated aid only, not a certification, approval, or legal opinion. The customer retains sole and exclusive responsibility for medical, legal, and regulatory review of all Output. Ryfinr’s platform is not validated for GxP or 21 CFR Part 11 compliance, and Output should not be deployed in formal regulatory submissions absent separate, specific validation arrangements with Ryfinr.

How we share your data. With infrastructure, AI model, and customer-success providers who help deliver the Services (see ryfinr.com/sub-processors for the current list); with Knight Labs Group affiliates where necessary for service delivery and corporate administration; with professional advisors as needed for corporate compliance; and, in the event of a corporate transaction, with parties involved in that transaction. All third-party partners are contractually required to protect your data and are prohibited from using it for their own independent marketing.

International transfers. Ryfinr processes and stores data in the United States and does not currently offer EU, UK, or other in-region data residency. Where your organization is established in the EEA, UK, or Switzerland, your data is transferred to and processed in the United States under the safeguards set out in Part B.

Retention.Ryfinr stores your personal data for the active duration of your organization’s subscription. Upon termination or expiration, personal data is permanently deleted or anonymized within thirty (30) days, unless a longer timeline is legally required or mutually mandated for life-sciences regulatory recordkeeping.

Your rights and governing law. Depending on your domicile, you may have rights to request access, rectification, deletion, or restriction of processing, or to object to specific uses of your data. To exercise these rights, contact legal@klabs.com. If you are based in Canada and are not satisfied with our response, you may escalate to the Office of the Privacy Commissioner of Canada. This Privacy Notice is governed by the laws of Ontario and the federal laws of Canada, under the exclusive jurisdiction of the courts of Toronto, Ontario.