Terms of Service
& Security Policy

HANA is a clinical workflow and patient engagement infrastructure platform. It is not a medical device, does not provide diagnoses, and does not prescribe or recommend treatment.

• HANA augments, not replaces, clinical relationships and human clinical judgement
• All AI-generated outputs are advisory and must be reviewed by a licensed clinician before clinical decisions are made
• HANA operates on a human-in-the-loop architecture: AI workflows are designed to escalate to clinical staff whenever uncertainty, risk indicators, or safety flags are detected
• HANA is not an emergency service. Patients in acute crisis are directed to emergency services

Patients are always informed they are interacting with an AI system. HANA never impersonates a human clinician.

3.1 Licensing and Clinical Responsibility

• Clients must hold all relevant licences and regulatory approvals required to deliver healthcare services in their jurisdiction
• Clients retain full clinical and professional responsibility for all patient care decisions, regardless of AI-generated outputs
• Clients must designate a named clinician responsible for reviewing HANA-generated summaries and escalation alerts
• Clients must ensure their deployment of HANA complies with all applicable national and local healthcare regulations

3.2 Patient Consent

• Clients are responsible for obtaining informed consent from patients prior to deploying HANA engagement workflows
• Consent must include: notification that interactions are AI-mediated; explanation of data use; right to opt out; escalation procedures
• For minors or patients lacking capacity, clients must obtain consent from an appropriate legal representative
• Clients must provide patients with access to HANA's Privacy Policy at onboarding

3.3 Appropriate Use

• HANA may only be used for legitimate clinical and healthcare operational purposes
• Clients must not use HANA for marketing, commercial profiling, or non-clinical communications
• Clients must promptly notify HANA of any adverse events, safeguarding concerns, or patient safety issues arising from platform use
• Clients must implement and maintain appropriate access controls for the HANA clinical dashboard

Patients may opt out of HANA engagement workflows at any time by replying STOP to any SMS or WhatsApp message, or by informing their healthcare provider. Opting out of HANA does not affect the patient's right to clinical care.

• Opt-out requests are processed within 24 hours
• No further automated engagement will be initiated following opt-out
• Data deletion requests are handled under the Privacy Policy and applicable DPA

Clients and patients must understand the following limitations of HANA's AI systems:

• AI systems may produce outputs that are incomplete, inaccurate, or insufficiently nuanced — clinical review is always required
• HANA's AI performs best within its validated clinical protocols; use outside trained parameters may reduce accuracy
• AI performance may vary across languages, dialects, and patient demographics — HANA conducts ongoing bias monitoring but cannot guarantee uniform performance
• Voice analysis features (tone, pace, acoustic biomarkers) are indicative only and should not be used as standalone clinical evidence

• The HANA platform, including all AI models, clinical protocols, conversation designs, APIs, and documentation, is the exclusive intellectual property of HANA Health, Inc.
• Client-specific data, clinical outputs, and conversation histories generated through the platform belong to the Client and their patients, subject to the DPA
• HANA retains the right to use anonymised, aggregated, non-identifiable data to improve platform performance, subject to applicable law
• Clients may not reverse-engineer, resell, sublicense, or replicate the HANA platform without prior written consent

HANA's liability to Clients is limited to the total fees paid by the Client in the 12 months preceding the claim, except in cases of gross negligence, wilful misconduct, or breach of data protection obligations.

8.1 HANA is not liable for:

• Clinical decisions made by Client clinicians, regardless of whether AI-generated outputs were consulted
• Harm resulting from the Client's failure to review escalation alerts
• Service disruptions caused by third-party infrastructure failures (telephony, cloud), provided HANA has met its own SLA obligations
• Outcomes in deployments where HANA's clinical protocols have been materially modified without HANA's approval

8.2 Client Indemnification

Clients agree to indemnify HANA against claims arising from: unlicensed clinical practice; failure to obtain patient consent; breach of these Terms; misuse of the platform for non-clinical purposes.

• Initial contract term: 12 months, renewing automatically unless 60 days' written notice is provided
• Either party may terminate with 30 days' notice in the event of a material breach not remedied within 14 days of written notice
• Upon termination, HANA will provide a full data export within 30 days and will securely delete all Client and patient data within 90 days, unless legal retention obligations apply
• During the offboarding window, clinical access to summaries and escalation logs remains available for continuity of care

These Terms are governed by the laws of the State of Delaware, United States, without regard to its conflict-of-laws rules. For US-based Clients, HIPAA governs Protected Health Information obligations and is incorporated into the Business Associate Agreement (BAA). For Clients or patients located in the EU or UK, the GDPR / UK GDPR and applicable national implementing legislation govern the processing of their personal data. The parties will first attempt to resolve any dispute through good-faith negotiation. Any dispute not so resolved will be submitted to binding arbitration administered by JAMS in Wilmington, Delaware under its applicable rules, and judgment on the award may be entered in any court of competent jurisdiction; either party may nonetheless seek injunctive or other equitable relief in a court of competent jurisdiction. Patients (End Users) are not required to arbitrate and retain all non-waivable rights under applicable consumer-protection law.

HANA maintains a formal Information Security Management System (ISMS) aligned with ISO 27001 principles. Security governance is the joint responsibility of the CTO and Privacy Lead, with quarterly reviews by the leadership team.

Compliance Framework Summary

• Role-based access control (RBAC) applied to all platform components
• Clinicians access only their own patients' data; cross-clinic data isolation enforced at infrastructure level
• Multi-factor authentication (MFA) mandatory for all clinical dashboard access
• Privileged access management (PAM) controls applied to all infrastructure administration
• Access logs retained for 24 months; anomaly detection alerts are reviewed daily
• Employee access rights reviewed quarterly; terminated immediately upon offboarding

• Automated vulnerability scanning: daily on all production infrastructure
• Penetration testing: annual third-party external pentest; results reviewed within 5 business days
• Patch management: critical vulnerabilities patched within 48 hours; high within 7 days; medium within 30 days
• Dependency scanning: all third-party libraries monitored via automated tooling (CVE tracking)
• Bug bounty programme: responsible disclosure policy available at hana.health/security

All sub-processors with access to personal or health data must meet the following minimum standards before engagement:

• Signed Data Processing Agreement (DPA) incorporating GDPR Standard Contractual Clauses where required
• Evidence of SOC 2 Type II or ISO 27001 certification, or equivalent
• BAA executed for any US-based processor with access to PHI
• Annual security assessment by HANA's security team
• Right to audit provisions included in all sub-processor contracts

An up-to-date list of active sub-processors is available at hana.health/subprocessors. Clients will be notified 30 days in advance of any new sub-processor engagement and may object.

• Recovery Time Objective (RTO): 4 hours for P1 platform failure
• Recovery Point Objective (RPO): 1 hour (continuous replication; point-in-time recovery available)
• Hot standby infrastructure maintained in secondary AWS region
• Full DR tests conducted bi-annually; results reviewed by leadership
• Clinical escalation routing remains operational during platform outages via SMS failover

Given HANA's AI-driven architecture, the following additional security controls apply:

• Prompt injection prevention: all patient inputs are sanitised and validated before reaching AI models
• Model output filtering: AI responses are passed through safety classifiers before delivery
• Hallucination mitigation: clinical reasoning engine is grounded in clinic-specific protocols and knowledge bases; outputs outside validated parameters are flagged for human review
• Data isolation between clients: AI model inference is stateless; no cross-client data leakage at model layer
• Open-source model deployments (Llama 3.1): run on HANA-controlled infrastructure; no patient data transmitted to external model providers
• AI audit logs: all AI inference requests and outputs are logged with full traceability for auditability

• HANA is a cloud-native company; no patient data is processed on employee devices
• For on-premise deployments (Italy, Middle East): physical server access is controlled by the healthcare institution partner, with HANA providing hardened server configurations and audit logging
• All HANA employees complete mandatory security awareness training on joining and annually thereafter
• Clean desk / clear screen policy enforced for all remote and office workers