These Terms and Conditions (“Terms”) govern access to and use of Compliance Studio (“the Service”), provided and operated by Hoodin AB, organisation number 556911-9778, Sweden (“Hoodin”, “we”, “us”).

The Service is intended for professional and business use. “Customer” means the organisation or individual entering into the agreement with Hoodin. “User” means an individual authorised to access the Service.

By accepting these Terms, the Customer agrees to be bound by them, including Annex A: Personal Data Processing where applicable. A person accepting on behalf of an organisation confirms that they have authority to bind that organisation.

1. Nature and purpose of the Service

Compliance Studio is a regulatory governance and decision-support environment for life science professionals.

The Service supports activities including:

• Establishing Regulatory Positions for products and companies across markets.

• Identifying potentially applicable regulations.

• Documenting applicability assessments and supporting rationale.

• Investigating regulatory instruments and provisions.

• Reviewing regulatory developments through Signals.

• Using Studio Agent for contextual exploration, analysis and preparation of working materials.

• Maintaining register history and collaborating with authorised users.

The Service does not provide legal advice, make binding regulatory interpretations or guarantee regulatory completeness, conformity, certification or market authorisation.

It does not replace the Customer’s quality management system, professional judgement or required approval procedures.

2. Definitions

3. Access and permitted use

Subject to these Terms and the applicable subscription, Hoodin grants the Customer a non-exclusive, non-transferable right to access and use the Service for its professional activities, including authorised consultancy work.

The Customer must:

• Ensure that Users have appropriate authority and competence for their activities.

• Maintain accurate account and organisational information.

• Protect login credentials and promptly report suspected unauthorised access.

• Manage project membership and permissions appropriately.

• Use the Service within the applicable subscription limits and any agreed usage conditions.

• Ensure that it has the rights and permissions necessary to submit Customer Content.

Users must not attempt to bypass access controls, access another customer’s information without authorisation, interfere with the Service, introduce malicious code or use the Service unlawfully.

The Service is not intended for patient records, clinical trial subject data or sensitive health information.

4. AI-supported outputs and professional responsibility

AI-supported outputs may be incorrect, incomplete, outdated or inappropriate for a particular question.

An applicability proposal is a candidate for review. An analysis is working material. A Signal identifies a development whose consequences require assessment. None constitutes an approved regulatory determination solely because it appears in the Service.

The Customer is responsible for:

• Providing accurate and sufficiently complete context.

• Checking relevant sources, legal status, dates and jurisdiction.

• Reviewing material assumptions, omissions and uncertainty.

• Documenting and approving final conclusions through its applicable procedures.

• Determining and implementing resulting regulatory activities.

The Customer remains responsible for its regulatory decisions, submissions and compliance activities. This does not remove Hoodin’s responsibility for providing the Service in accordance with its contractual commitments.

The AI Literacy Statement provides further guidance on appropriate use and review.

5. Regulatory coverage and Signals

Coverage may vary between jurisdictions, topics and available sources.

Hoodin does not warrant that the Service identifies every relevant instrument, provision or regulatory development. The absence of an item or Signal does not establish that no requirement or change exists.

A regulatory development may affect the Customer before it is detected or reviewed. The Customer must maintain review arrangements appropriate to its activities and assess Signals in the relevant product, company and market context.

Source publications may change or become unavailable. Customers should retain the evidence needed to support their reviewed conclusions.

6. Customer Content, outputs and confidentiality

The Customer retains its rights in Customer Content.

The Customer grants Hoodin a limited, non-exclusive right to process Customer Content as necessary to provide, secure, maintain and troubleshoot the Service and fulfil the agreement. This includes processing by providers engaged for the relevant functions, subject to applicable confidentiality and data protection arrangements.

This permission does not authorise use of Customer Content to train general-purpose AI models. Hoodin’s optional OpenAI data-sharing settings for model training are disabled.

Hoodin retains its rights in the Service, including its software, architecture, interface and underlying methods. Third-party materials remain subject to their respective rights.

As between Hoodin and the Customer, the Customer may use Generated Outputs for its professional purposes. Hoodin does not warrant that such outputs qualify for intellectual property protection, are unique or are free from third-party rights.

Each party must protect the other party’s confidential information and use it only for the agreement’s purposes. Disclosure is permitted to personnel, advisers and service providers who need access and are subject to appropriate confidentiality obligations, or where legally required.

These confidentiality obligations do not cover information that is lawfully public, independently developed or lawfully obtained without a confidentiality restriction.

7. Subscriptions and payments

Available functionality, usage limits, fees, billing periods and renewal arrangements are specified in the applicable subscription offer, checkout or separately agreed order.

Subscription purchases made through the external checkout are sold through Link, LLC, 354 Oyster Point Boulevard, South San Francisco, California 94080, United States.

The applicable checkout terms govern the sale and payment arrangements with that seller. Hoodin AB remains responsible for providing and operating Compliance Studio.

Unless otherwise agreed, subscription fees are billed in advance. Cancellation, renewal and changes to a subscription take effect as stated in the applicable subscription arrangements.

Except where required by applicable law or expressly provided in the applicable purchase terms, fees are non-refundable.

Any price change affecting a future renewal will be communicated before that renewal, allowing the Customer to decide whether to continue the paid subscription.

8. Downgrading, account closure and inactivity

Downgrading

Ending a paid subscription or downgrading to freemium does not itself close the User account.

Access to paid features and project information depends on the resulting subscription entitlement. Retention of information does not imply continued access to it.

Customers should export information they require before paid access ends, using the available export functions or contacting Hoodin to discuss their needs. These Terms do not promise a period of continued export access after paid access ends.

Account closure and deletion requests

The Service does not provide self-service account deletion. Requests must be submitted through Contact Hoodin.

Hoodin verifies identity and authority as appropriate. A User’s request to close their account does not automatically authorise deletion of a shared project controlled by an organisation.

Personal data requests and deletion of customer-controlled information are handled under applicable law, the Privacy Policy and Annex A.

Inactive freemium accounts

For freemium accounts inactive for 12 months, Hoodin will send an email asking whether the User wishes to retain the account.

Unless the User logs in or confirms within 30 days, the account will be closed and deleted. Shared project information will be assessed separately to avoid improperly affecting other Users or the Customer organisation.

9. Service operation and changes

Hoodin will provide the Service with reasonable care and skill.

The Service may evolve through changes to functionality, infrastructure, sources and AI components. Changes to subprocessors and personal data processing remain subject to Annex A and applicable law.

Hoodin will provide reasonable advance notice where a planned change materially reduces core paid functionality. Where advance notice is impracticable because of security, legal or urgent operational circumstances, information will be provided as soon as reasonably practicable.

The Service may be unavailable during maintenance, incidents or events outside Hoodin’s reasonable control. Uninterrupted or error-free availability is not guaranteed.

Specific service levels, recovery commitments or support response times apply only where expressly agreed.

10. Suspension and termination

Hoodin may restrict or suspend affected access where reasonably necessary to address a material breach, security threat, unlawful use or payment failure.

Where practicable, Hoodin will explain the reason and provide an opportunity to resolve the issue. Restrictions will be proportionate to the circumstances.

Either party may terminate the agreement for a material breach that remains unremedied following notice and a reasonable opportunity to remedy it. Immediate termination may apply where the breach cannot reasonably be remedied or continued performance would be unlawful.

The Customer may end a paid subscription in accordance with its subscription arrangements. Closing the account and ending the agreement are distinct from downgrading to freemium.

Termination does not affect accrued payment obligations or provisions intended to survive, including confidentiality, intellectual property, liability and applicable data processing obligations.

11. Data protection

The Privacy Policy explains processing for which Hoodin acts as controller.

Annex A governs personal data processed by Hoodin on the Customer’s behalf. It forms part of these Terms and prevails over conflicting provisions concerning that processing.

The parties’ actual processing activities determine their data protection roles.

12. Liability

To the extent permitted by applicable law, Hoodin is not liable for indirect or consequential loss, including lost profits, lost business opportunities or losses arising from the Customer’s unreviewed reliance on Generated Outputs.

The Service does not guarantee a regulatory approval, certification or compliance outcome.

Hoodin’s total aggregate liability arising from the agreement shall not exceed the subscription fees paid by the Customer for the Service, whether directly or through the authorised seller, during the twelve months preceding the event giving rise to the claim.

These limitations do not exclude or restrict liability for fraud, wilful misconduct, gross negligence or liability that cannot lawfully be excluded or limited. They do not restrict individuals’ rights or supervisory authorities’ powers under applicable data protection law.

13. Third-party claims

The Customer is responsible for third-party claims to the extent caused by its unlawful submission of Customer Content, infringement of third-party rights or material misuse of the Service in breach of these Terms.

Any claim for reimbursement must relate to reasonably incurred and substantiated losses. Hoodin must notify the Customer promptly and allow reasonable participation in the defence. Hoodin must not agree a settlement imposing obligations on the Customer without its consent.

The Customer is not required to reimburse Hoodin for losses attributable to Hoodin’s own breach or misconduct. Ordinary regulatory decisions made through permitted use do not, by themselves, trigger this clause.

14. Amendments

Hoodin may propose amendments reflecting changes in the Service, applicable law or contractual arrangements.

Material amendments will be notified directly to the Customer before the proposed effective date, with a summary of the changes and the applicable acceptance or termination arrangements.

Where express acceptance is required, Hoodin will obtain it before applying the relevant amendment. Continued use will constitute acceptance only where legally effective and clearly explained in the notice.

Changes to Annex A remain subject to applicable data protection requirements. Merely publishing an amended version does not, by itself, establish a binding amendment.

15. Governing law and agreement hierarchy

These Terms are governed by Swedish law. Disputes are subject to the jurisdiction of the courts of Sweden.

The agreement concerning Hoodin’s provision of the Service comprises these Terms, Annex A and any separately agreed service or subscription agreement.

In the event of conflict:

• Mandatory applicable law prevails.

• Annex A prevails for processing performed on the Customer’s behalf.

• A separately signed agreement prevails over these standard Terms for matters it expressly addresses.

• These Terms otherwise apply.

Separate purchase terms govern the Customer’s transaction with Link, LLC and do not alter Hoodin’s obligations unless expressly agreed.

16. Contact

Hoodin AB

Organisation number: 556911-9778

Humlegatan 4

211 27 Malmö

Sweden

Contact Hoodin

Annex A: Personal Data Processing

A1. Application and roles

This Annex applies where Hoodin processes personal data on the Customer’s behalf in providing Compliance Studio.

The Customer acts as controller, or as a processor authorised by its controller to appoint Hoodin. Hoodin acts as processor or subprocessor accordingly.

“Personal data”, “processing”, “personal data breach”, “controller” and “processor” have the meanings given in Regulation (EU) 2016/679 (“GDPR”).

This Annex does not govern processing for Hoodin’s independently determined purposes, which is described in the Privacy Policy.

A2. Processing description

The Customer determines the rights and obligations associated with its processing, including its lawful basis, notices, authorised Users and instructions.

A3. Documented instructions

Hoodin will process personal data only on documented Customer instructions, including concerning international transfers, unless required by applicable EU or Member State law.

The agreement, the Customer’s configuration and authorised use constitute instructions within the agreed service scope. Additional instructions must be documented.

Where law requires other processing, Hoodin will inform the Customer before processing unless legally prohibited.

Hoodin will immediately inform the Customer if it considers an instruction to infringe the GDPR or other applicable EU or Member State data protection provisions.

A4. Confidentiality and security

Hoodin will ensure that persons authorised to process personal data are bound by confidentiality obligations or an appropriate statutory duty. Hoodin will implement appropriate technical and organisational measures under Article 32 GDPR, taking account of processing risks.

The agreed baseline measures comprise:

• Encryption of production data at rest using AES-256.

• TLS protection for production communications.

• Authentication and project-permission checks at the API level.

• Two-factor protection of administrative AWS access.

• Production access limited to authorised personnel.

• Daily database backups with limited retention.

• A tested database restoration procedure.

Further descriptions appear in Security & data handling overview. Changes to measures must not reduce the overall protection below the level required by this Annex and applicable law.

Hoodin will maintain a process for regularly assessing the effectiveness of relevant security measures proportionate to the risks.

A5. Subprocessors

The Customer gives general written authorisation for Hoodin to engage subprocessors necessary to provide the Service.

The currently identified services are:

Hoodin will maintain and make available the identity of the applicable contracting entities, processing functions and relevant processing locations.

Before a new or replacement subprocessor begins processing Customer personal data, Hoodin will provide at least 30 days’ notice and an opportunity to object on reasonable data protection grounds.

The parties will seek a reasonable resolution to an objection. If none is available, the Customer may terminate the affected service before the new processing begins without a penalty for that termination.

Hoodin will impose substantially the same applicable data protection obligations on subprocessors and remains responsible to the Customer for their performance as required by Article 28 GDPR.

A change of model within an existing authorised provider does not automatically constitute a change of subprocessor, but remains subject to the agreed processing scope and safeguards.

A6. International transfers

Hoodin will not transfer Customer personal data outside the EEA without the Customer’s documented instruction or authorisation and compliance with Chapter V GDPR.

Where required, the parties or relevant providers will enter into applicable transfer Standard Contractual Clauses or establish another valid transfer mechanism.

This Annex is not itself an international-transfer mechanism. Hosting within the EU does not exclude transfers arising from other processing or access arrangements.

Hoodin will provide information reasonably required to assess relevant transfers and safeguards.

A7. Assistance and individual rights

Taking account of the nature of processing, Hoodin will assist the Customer through appropriate technical and organisational measures in responding to requests concerning individual rights.

Hoodin will promptly notify the Customer of requests concerning Customer-controlled personal data and will not independently decide them unless instructed or legally required.

Hoodin will also assist with obligations under Articles 32–36 GDPR, including security assessments, breach handling, data protection impact assessments and prior consultation, taking account of the information available to Hoodin.

Reasonable charges for additional assistance may be agreed in advance where permitted. Charges must not prevent fulfilment of legal obligations.

A8. Personal data breaches

Hoodin will notify the Customer without undue delay after becoming aware of a personal data breach affecting data processed under this Annex.

Available information will include the nature of the breach, affected data and individuals where ascertainable, likely consequences, measures taken or proposed and a contact for follow-up.

Information may be supplied in stages as the investigation develops. Hoodin will cooperate with the Customer’s response and take appropriate containment and corrective measures.

Notification does not require a completed investigation and does not itself constitute admission of liability.

A9. Return and deletion

On termination of services involving processing under this Annex, Hoodin will, at the Customer’s choice, return or delete the personal data and delete existing copies unless EU or Member State law requires retention.

The Customer’s choice and practical completion arrangements will be documented. Hoodin will not retain the information indefinitely merely because the Customer has not supplied instructions; it will seek instructions and agree the necessary closure arrangements.

Downgrading to freemium does not constitute termination of processing where services continue.

Deletion from active systems is handled manually. Backup copies remain protected and expire under the applicable backup rotation. If a backup is restored before expiry, the relevant deletion instructions must be reapplied.

Hoodin will apply deletion instructions to relevant subprocessors in accordance with their processing obligations and identify any lawful retention exceptions. Retention exceptions must not be treated as permission for unrelated reuse.

On request, Hoodin will confirm completion and identify any remaining retention required by law.

A10. Information and audits

Hoodin will make available information necessary to demonstrate compliance with Article 28 GDPR and allow and contribute to audits, including inspections, by the Customer or its mandated auditor.

The parties will use available documentation and remote review where these adequately meet the assessment need. This does not remove necessary inspection rights.

Audit arrangements must protect other customers’ information and service security. Auditors must observe appropriate confidentiality obligations.

Routine audits will be arranged on reasonable notice. Additional or urgent assessment may be necessary following a relevant breach, credible compliance concern or competent authority request.

A11. Duration and precedence

This Annex remains effective while Hoodin processes personal data on the Customer’s behalf, including during return or deletion.

It prevails over conflicting provisions in the Terms concerning that processing. Nothing in the agreement limits mandatory GDPR obligations.

Document revision history