General terms & conditions

Adhesion contract

COCO INVERSIONES TECNOLÓGICAS S.A.S, NIT 901.314.101–2 (hereinafter "COCO"), hereby informs the General Terms and Conditions of the Service contracted by the User. Customer Service will handle requests, complaints, claims, and inquiries at 322 495 6991 or hola@cocotech.ai from 8:00 a.m. to 6:00 p.m. (continuous schedule).

1. Definitions and interpretation rules

For the understanding of these Terms and Conditions, the following definitions shall apply: AWS: Amazon Web Services, the cloud adopted for data hosting and storage. API: Third-party application programming interface. COCO: COCO INVERSIONES TECNOLÓGICAS S.A.S, NIT 901.314.101–2. Use License: COCO's authorization for the User to use the Software under a SaaS model, per the contracted Plan and these Terms and Conditions. Parties: Joint reference to COCO and the User. Remuneration: Periodic fee (monthly, unless otherwise agreed) paid by the User for the Software Use License per the contracted plan. Software: COCO-owned software whose use is permitted strictly under the terms of this document. Terms and Conditions: The content of this document, which constitutes the contractual relationship between COCO and the User. User: The person who acquires the Software Use License. Service Implementation Fee: When applicable, the fee the User will pay COCO for Software implementation. Plan/Plans: Commercial modalities offered by COCO available in the commercial proposal, with different features, limits, and support levels. SLA: Service Level Agreements published by COCO regulating response times, availability, and support channels available with the commercial proposal. Payment Gateway: Payment platform authorized by COCO to process payments and automatic debits.

1.2. Interpretation rules

For the proper understanding of these Terms and Conditions, the following rules shall apply: 1. Titles and subtitles are for reference only and do not affect the interpretation of the clauses. 2. Capitalized terms shall have the meaning attributed herein, unless the context clearly indicates otherwise. 3. Singular references include the plural and vice versa; masculine gender references equally include the feminine, unless the context indicates otherwise. 4. The nullity, invalidity, or ineffectiveness of any provision of these Terms and Conditions shall not affect the validity and enforceability of the remaining provisions. 5. In case of conflict between these Terms and Conditions and other documents or informal communications, these Terms shall prevail unless otherwise provided by law.

2. Service information

2.1. Use License: The Use License covers only the Software features included in the contracted Plan. The User may not sublicense or transfer the Use License. COCO offers its Plans, published through official channels and at the link indicated in the definitions, each with different features, limits, and support levels. The User may change Plans according to established commercial rules; unless otherwise provided, the change will be effective in the next billing cycle.

2.2. Warranty, availability, and SLA

COCO will ensure Software operation and availability per current published SLAs. The User understands that intermittencies or scheduled/emergency maintenance may occur, managed per SLAs. This does not apply to force majeure or fortuitous events (including, but not limited to, terrorist attacks, hacking, widespread outages of AWS and/or Google or other infrastructure providers).

2.3. Interoperability and support

Once authorized, the User will be responsible for integrating and operating their systems as required. COCO will provide the User with the technical information necessary to achieve interoperability, subject to confidentiality, and will provide technical support in interoperability matters and service development per the SLAs.

2.4. Payment

The User agrees to pay the Remuneration and, when applicable, the Service Implementation Fee. a. Authorized payment methods: Plan payments must be made via payment link, credit card, automatic debit, or PSE. Cash payments or payments through COCO employees are not accepted; payments shall be made exclusively through authorized methods. b. Automatic debit: If approved, the User authorizes COCO to charge the Remuneration and the Service Implementation Fee via automatic debit through the payment methods registered in the Payment Gateway authorized by COCO when the Plan conditions require it or so established. In case of billing error, duplication, or unauthorized transaction, the User has the right to request payment reversal. c. Rate adjustment: COCO may adjust Plan prices with 20 calendar days' notice prior to the effective date. If the User does not accept the adjustment, they may terminate the Plan without penalty before the new price takes effect, through written notification. d. Payment timeliness: Payment shall be deemed timely when made within the established dates and through authorized methods. Failure to pay will result in access suspension or other consequences established in these Terms and Conditions or by Law. e. Taxes: Plan fees do not include Value Added Tax (VAT) or any other applicable tax. Should the National, Departmental, or Municipal Government establish levies, contributions, or rates applicable to the service, these shall be borne entirely by the User. f. Service start and go-live policy: For COCO's Operations team to begin service delivery, a first invoice must be issued including, at minimum, the concepts of implementation, interoperability, and the first month of billing, as applicable to the contracted Plan. In all cases, the activation of the Service for effective use by the User (go-live) shall be conditional upon full payment of said invoice. Until full payment is verified, COCO shall not be obligated to initiate operations or enable the Service. The User must keep their payment information up to date. In cases where the User, being enabled to use the Plan, decides not to use it, the payment obligation shall remain in the agreed terms, without generating any right to a refund.

2.5. Use license prohibitions

The User is prohibited from: a. Using the Use License in violation of these Terms and Conditions, Colombian regulations, or good practices. b. Assigning the rights granted under the Use License to a third party not authorized by COCO. c. Using the Use License to defraud COCO or third parties, or to obtain personal data through illicit or unauthorized means. d. Collecting information about COCO Users in an inadmissible or unauthorized manner. e. Using manual or automated processes to monitor or copy Software materials for unauthorized purposes. f. Using devices, software, or routines that interfere with Software operation. g. Introducing malicious code. h. Attempting unauthorized access, interfering with, damaging, or interrupting servers or databases connected to the Software; performing reverse engineering, altering, decompiling, or extracting code. i. Accessing, using, copying, adapting, modifying, creating derivative works, distributing, licensing, sublicensing, transferring, displaying, executing, or exploiting the Software in an inadmissible or unauthorized manner, or in ways that harm COCO or third parties. j. Interfering with or affecting the security, confidentiality, integrity, availability, or performance of the Software; creating accounts through automated or unauthorized means. k. Selling, reselling, renting, or charging for COCO services or COCO data obtained in an unauthorized manner. l. Creating software or APIs that function substantially the same as the Software and offering them in an unauthorized manner to third parties. m. Improperly using reporting channels (e.g., fraudulent or unfounded claims). n. Initiating proceedings to acquire rights over distinctive signs owned or used by COCO. o. Making unauthorized use of documents, databases, files, and other content protected by COCO's copyright.

2.6. Use license suspension

COCO may suspend the Use License in the following events: 1. Default: If the User has more than two overdue invoices or automatic debit cannot be processed due to outdated payment methods, COCO may immediately suspend the Use License. For reconnection, the User must pay the outstanding amount with default interest and update payment methods. 2. Breach: COCO may suspend for total or partial breach, following, when applicable, SLA cure periods or through reasonable notice.

2.7. Termination

Either Party may terminate this contract at any time by written notice with at least 30 calendar days' advance of the desired termination date. For User-requested termination to be effective, the User must be current on all contractual and payment obligations to COCO. Termination will result in suspension of Software access at the end of the current billing period. Notwithstanding the foregoing, in case of serious User breach of their obligations, COCO may revoke access immediately or within the reasonable period indicated in the breach notice, when required for the protection of security, service integrity, or third parties.

2.8. Software updates

When applicable, COCO may apply updates, patches, bug fixes, or other Software maintenance. COCO will make reasonable efforts to announce scheduled maintenance (emergency maintenance may be performed without prior notice). The CLIENT representative will make reasonable efforts to comply with notified maintenance requirements.

2.9. Implementation, schedule, and User obligations during service execution

a. Start date and team availability: Once the Client confirms service engagement by accepting these Terms and Conditions, COCO will schedule project start with at least two (2) calendar weeks' notice, subject to team availability and internal implementation prioritization. This period is allocated for resource assignment, internal handover preparation, initial requirements gathering, and information requests to the Client. Consequently, the Client accepts that the start date will not be immediate nor can it be unilaterally imposed, and that any request for an earlier start will be subject to express confirmation by COCO. b. Timely Client response and schedule adjustment: The Client commits to providing timely responses and maintaining communication continuity during implementation. If the Client fails to respond to requests, validations, or approvals for more than seven (7) calendar days, COCO may consider the project paused due to Client fault, and the schedule, milestones, and estimated go-live date shall be adjusted accordingly, without constituting a breach by COCO. Delays resulting from the Client's failure to respond may entail rescheduling of activities and reassignment of implementation resources, subject to team availability. Should this generate additional costs, they shall be borne by the Client. c. Information delivery, access, and third-party coordination: For project viability, the Client commits to timely delivery of information, access, and coordination with internal staff and third parties (including software providers such as HIS or others). The Client is obligated to deliver completely and promptly all information, documentation, access, credentials, test users, environments, and business rule definitions that COCO requires for implementation and interoperability execution. In cases where interoperability with the Client's systems is contracted, the Client commits to ensuring the availability and effective collaboration of their internal IT team and/or provider, including access to technical documentation, APIs or services, work windows, assigned contacts, and incident resolution. COCO shall not be liable for delays, blockages, or additional costs resulting from the Client's failure to deliver information, absence of access, or unavailability of the Client's provider, in which case the schedule shall be adjusted and the project may be rescheduled based on availability.

3. Limitation of liability

3.1. COCO shall not be liable for: (a) damages due to force majeure or fortuitous events (including, but not limited to, cyberattacks or widespread outages of AWS/Google); (b) damages from Software misuse by the User or their collaborators; (c) misuse of the User's database by the User or their collaborators; (d) Software misuse by third parties affecting the User. Limitation of liability: COCO's liability to the User, on any basis, shall correspond to damages effectively proven under the law, as determined by a competent authority, in accordance with applicable liability principles. 3.2. The User acknowledges and accepts that the Software developed and offered by COCO is a technological support tool for the management of healthcare and administrative processes, and does not in any case replace clinical judgment, professional experience, or medical decision-making by duly authorized personnel. COCO does not provide medical services, nor assumes any responsibility for diagnoses, treatments, prescriptions, or clinical acts resulting from decisions made by healthcare professionals using the Software. The platform must be used exclusively by authorized personnel, in accordance with current health regulations and the internal protocols of the user institution. The user institution and its professionals shall be solely responsible for: (i) the interpretation of information available in the system; (ii) medical decisions made based on such information; (iii) compliance with applicable health regulations and the ethical-legal obligations inherent to professional practice. COCO shall not be liable for damages or consequences arising from clinical or administrative decisions made by the User or their personnel.

4. Data privacy policy

COCO will act as Data Processor for personal data accessed through its services, and undertakes to process them in accordance with the instructions and purposes defined by the User, who will act as Data Controller. The User, as Controller, must comply with applicable personal data protection regulations, particularly Law 1581 of 2012, Law 1266 of 2008, and their regulatory decrees. Consequently, the User shall be exclusively responsible for: (i) defining the purposes for processing personal data collected, stored, or managed through the platform; (ii) providing privacy notices to end users and obtaining prior, express, and informed authorizations necessary for the processing of their personal data, expressly including authorization for the transmission of said data to COCO as Data Processor; (iii) guaranteeing the rights of personal data subjects to know, update, rectify, and delete their data, as well as revoke their authorization. For its part, COCO assumes the obligation to protect personal data to which it has access and to process them solely in accordance with the purposes and conditions defined by the User, implementing appropriate technical, human, and administrative measures to preserve their confidentiality, integrity, and availability, and refraining from using them for purposes other than those instructed by the Controller. The User, as holder of their own personal data, authorizes the processing of their data in accordance with COCO's Personal Data Processing Policy, available at www.cocotech.ai, as well as their international transmission and/or transfer when necessary for the fulfillment of the purposes informed and permitted by law. The User acknowledges that providing information regarding sensitive data or data of minors is voluntary, understood as data that affects privacy or may generate discrimination, and that the provision of such information is done under their entire responsibility. Upon termination of the contract or commercial relationship, the User shall be responsible for downloading and backing up their information before the effective termination date. COCO shall not be obligated to retain data or maintain active accounts once in termination.

5. Shared information security responsibilities

Within the framework of the provision of technology services, COCO and the User shall assume coordinated, specific responsibilities regarding information security, in order to guarantee the confidentiality, integrity, and availability of data managed through the technology platform provided by COCO. a. COCO's obligations: 1. Implement and maintain technical and organizational controls ensuring the protection of the technology infrastructure supporting the services provided. 2. Guarantee the availability, operational continuity, and resilience of the platform against technical and/or security incidents. 3. Apply access control policies, data encryption in transit and at rest, and permanent monitoring of security events in the infrastructure under its administration. 4. Manage and install updates, patches, and protection measures on the technology components comprising the base platform. b. User's obligations: 1. Manage users and passwords within their organization, ensuring the use of robust authentication mechanisms, including two-factor authentication (2FA). 2. Properly configure data access permissions within the platform according to their organizational structure. 3. Adopt and maintain security best practices on devices, systems, and networks from which the platform is accessed. 4. Immediately notify COCO of any incident, anomaly, or vulnerability detected in the use of the service. c. Collaboration and applicable standards: The Parties undertake to actively collaborate in the identification, prevention, and management of risks that may compromise information security. This shared responsibility model is adopted in conformity with international best practice standards, including those defined in ISO/IEC 27001 and ISO/IEC 27017 standards, as well as in compliance with applicable sectoral regulations.

6. Confidentiality

For purposes of these Terms and Conditions, Confidential Information means all technical, operational, commercial, legal, financial, strategic, and security information, as well as personal and/or sensitive health data, disclosed by one Party to the other, whether orally, in writing, digitally, visually, or by any means, directly or indirectly related to the execution of the contractual relationship. This expressly includes all information about users, patients, operational processes, technical configurations, integrations, documentation, code, internal procedures, and any non-public data. Each Party commits to: 1. Maintain Confidential Information under strict reserve and protect it with the same degree of diligence used to protect its own sensitive information; 2. Not disclose, publish, transmit, or reveal Confidential Information to third parties without the prior, express, written authorization of the disclosing Party; 3. Use Confidential Information solely for purposes related to the execution and fulfillment of these Terms and Conditions; 4. Adopt reasonable technical, organizational, and administrative measures to protect Confidential Information against loss, unauthorized access, misuse, alteration, or destruction. The confidentiality obligation shall not apply to information that: a. Is or becomes public domain without breach by the receiving Party; b. Was legitimately known by the receiving Party before its disclosure; c. Was disclosed by an authorized third party without confidentiality restrictions; d. Must be disclosed by legal, regulatory, or judicial mandate, in which case the receiving Party shall notify the disclosing Party in advance.

7. Intellectual property

The User acknowledges and accepts that all intellectual property rights in the Software, including but not limited to computer programs, source code, object code, interfaces, manuals, designs, trademarks, logos, trade names, and any associated improvements, updates, or developments, are and will remain exclusively owned by COCO. The Use License granted under these Terms and Conditions does not in any case imply transfer, assignment, alienation, or recognition of rights other than the limited use provided in the contracted Plan. The User is prohibited from performing acts of reverse engineering, modification, decompilation, copying, distribution, sublicensing, exploitation, or any unauthorized use of the Software or elements protected by COCO's copyright or industrial property. Furthermore, the User commits not to perform or publish public comparisons, performance tests, or studies about the Software without COCO's prior authorization, in order to preserve its integrity, reputation, and functioning.

8. Amendments to Terms and Conditions

COCO reserves the right to modify these Terms and Conditions at any time, for which it must follow the following procedure: if modifications are made, it will notify Users at least 15 calendar days in advance of the date on which the modification will take effect, by notification to the email address reported by them. The notification will include a detailed description of the changes and the date they will take effect. 1. Right of acceptance or rejection: If the User disagrees, they may discontinue the Plan at the end of the current period, informing before the effective date. Non-objection and/or continued use of the service after the effective date implies acceptance. 2. Justification of changes: Amendments to these Terms and Conditions will be justified by reasons such as regulatory changes, service improvements or changes, economic value improvements or changes, or technological adjustments necessary for the correct provision of the service. 3. Transparency and balance: No amendment shall create a significant imbalance in the rights and obligations between the User and COCO. Amendments will be made with the objective of maintaining a fair balance between them.

9. Governing law and jurisdiction

These Terms are governed by the laws of Colombia. Disputes will first be subject to direct negotiation for up to fifteen (15) calendar days from dispute notification. If unresolved, the Parties will proceed to conciliation before the Medellín Chamber of Commerce; and if still unresolved, to the competent ordinary courts in Medellín.

10. Acceptance of Terms and Conditions

By acquiring any Plan, the User is deemed to accept these Terms and Conditions and agrees to be bound by them, which are published at www.cocotech.ai. If the User does not agree with these Terms and Conditions, they must refrain from acquiring or using the services.

11. Declarations

The User commits that: (i) they have not been and will not be included in the "Office of Foreign Assets Control" (OFAC) lists of the United States of America, or any other similar, related, complementary, or substitute list; and (ii) they have not participated and will not participate in the future in money laundering activities, smuggling, counterfeiting of products of any kind, or any other intentional crime classified as such in the Colombian Penal Code. The User understands and accepts that compliance with this policy constitutes an essential requirement for maintaining the contractual relationship with COCO and that, should any of these grounds be verified, COCO may immediately terminate the contractual relationship, without generating any right to payment, refund, or indemnification in favor of the User.

12. Severability clause

All clauses of these Terms and Conditions shall be interpreted independently and autonomously. If any clause is declared null by judicial ruling, the affected clause(s) shall be replaced by another or others that preserve the effects pursued by the Terms and Conditions.

13. Contact

Our Customer Service department handles requests, complaints, claims, and inquiries at 322 495 6991 or hola@cocotech.ai, Monday to Friday, 8:00 a.m. to 6:00 p.m. (continuous schedule).