Terms of Contract and SaaS Licence

1. General information and converging regulatory framework

1.1. Owner of the Service

These General Terms of Contract and Licence of Use (hereinafter, “the Terms”) govern, on a binding basis, access to and use of the clinical web platform and interactive clinical portal accessible at the URL https://portal.connectoma.com, the interfaces of the ConnectTarget_MDD analytical pipeline and the corporate website https://connectoma.com (hereinafter, “the Platform” or “the Portal”). The Platform is the exclusive property of Connectoma Neurotech, S.L. (hereinafter, “Connectoma”), with NIF B-70752795, registered office at Calle Padilla 26, 2.º, 28006 Madrid, Spain, contact email info@connectoma.com and external Data Protection Officer (DPO) at dpd@connectoma.com.

1.2. Converging Regulatory Framework

These Terms are governed by Regulation (EU) 2016/679 (GDPR), Spanish Organic Law 3/2018 (LOPDGDD), Regulation (EU) 2024/1689 (Artificial Intelligence Regulation / AI Act) applicable to clinical support systems, and Regulation (EU) 2017/745 on Medical Devices (MDR), under which the ConnectTarget_MDD software is classified as Class IIa Medical Device Software (MDSW) (in accordance with Rule 11 of Annex VIII of the MDR).

2. Definitions for the neuromodulation environment

• a) Connectoma: Technology developer and licensor of the modular neuroscientific predictive analysis software ConnectTarget_MDD.
• b) Purchaser / Medical Centre / Clinic: The legal entity (clinic, hospital or approved healthcare institution) that contracts SaaS access to the Platform for the planning of neuropsychiatric therapies.
• c) Professional User / Authorized Physician: Medical professional (psychiatrist, neurologist or registered treating physician) duly appointed by the Medical Centre, to whom individual credentials are granted to manage patients and calculate therapeutic coordinates.
• d) Computing Service (SaaS): Processing, in the secure Madrid cloud, of structural T1 files and resting-state functional magnetic resonance imaging (fMRI) in order to locate the optimal stimulation point in the left dorsolateral prefrontal cortex (DLPFC).
• e) Inference Credits: Processing units purchased by the Medical Centre. Each credit is consumed upon the complete execution of a pipeline and the issuance of a digital target coordinates report. They have no residual monetary value and are not transferable to third parties.

3. Medical software licence and means of payment

3.1. Scope of the Licence

Connectoma grants the Medical Centre a software licence in Software as a Service (SaaS) mode, of a limited, temporary, revocable, non-exclusive and non-transferable nature, for the sole purpose of planning personalized Transcranial Magnetic Stimulation (TMS) treatments for adult patients suffering from major depression or other indicated neuropsychiatric conditions.

3.2. Payment Methods and Secure Gateways

The purchase of Inference Credits or the payment of licences will be made through the secure gateways enabled on the Platform (corporate bank transfer, 3D Secure bank card or SEPA direct debit upon signature of the mandate). All prices will be expressed in Euros (€) and will include the corresponding VAT on an itemized basis.

3.3. Economic Transparency and Clinical Independence

The fees correspond exclusively to the remuneration of technological, computational and software licensing services. Connectoma does not manage, collect or receive commissions for patient referrals, nor does it take part in fee-splitting practices prohibited by healthcare codes of ethics.

4. Governance, pseudonymization and security obligations of the Medical Centre

4.1. Mandatory Pseudonymization Technique (sub-XX code)

The Medical Centre undertakes to ingest DICOM files having removed at source any nominal patient metadata, identifying the dataset solely under the dissociated alphanumeric code sub-XX. It is strictly prohibited to enter names, national ID numbers or medical record numbers visible on the Platform.

4.2. Automated 3D Defacing and Local Custody

The Platform runs a facial structure removal algorithm (defacing) on the T1 images before they are stored in the cloud, preventing three-dimensional reconstruction of the face. The key linking the sub-XX code to the patient’s real identity is kept exclusively on the Medical Centre’s local premises.

4.3. Technical Training and AI Literacy (art. 4 AI Act)

The Medical Centre guarantees that all of its user personnel have completed the technical training programme delivered by Connectoma on the correct use of Artificial Intelligence-based clinical support systems.

4.4. Credentials and Breach Notification

Access requires authentication via Firebase Authentication and two-factor authentication (MFA). The Medical Centre undertakes to notify Connectoma within a maximum of 24 hours of any suspected security breach or credential compromise.

5. Health data protection and algorithmic retraining

5.1. Processing Roles (GDPR / LOPDGDD)

The Medical Centre acts as Data Controller of the medical record and the patient’s health data. Connectoma acts as Data Processor (art. 28 GDPR) when processing the neuroimaging submitted for the sole purpose of executing the requested algorithmic calculation. The data is hosted on Google Cloud Platform in Madrid (europe-southwest1 region) with TLS 1.3 and AES-256 encryption.

5.2. Governance for the Retraining of AI Models

Connectoma will not use health data for the retraining or continued calibration of its deep learning models unless one of the following applies:

• a) Explicit and independent consent (opt-in) obtained from the patient at source by the Clinic (art. 9.2.a GDPR);
• b) Prior and irreversible anonymization; or
• c) Processing of pseudonymized data under the strict safeguards of the exception in art. 10.5 of Regulation (EU) 2024/1689 (AI Act), exclusively for the detection and correction of bias in high-risk AI systems.

6. Human-in-the-Loop oversight protocol and allocation of liability

6.1. Clinical Decision Support Nature

The connectivity maps and target coordinates calculated by the pipeline constitute a mathematical suggestion in support of the medical decision. The software has no autonomous diagnostic capabilities and does not execute binding automated decisions (art. 22 GDPR).

6.2. Mandatory Physician Validation

The review, validation, approval and calibration of the coordinates before they are imported into the physical neuronavigator is the personal and non-delegable responsibility of the prescribing physician. Connectoma declines any liability arising from the omission of human validation, malpractice in the application of the stimulation, or errors of judgement by the physician.

6.3. Encryption of Removable Devices

Where coordinates are exported via USB drives or other physical media in order to be loaded into the neuronavigator, the Medical Centre guarantees that such media have active encryption and undertakes to securely erase them after the download.

7. Intellectual property and non-circumvention

7.1. Ownership of the Software

Connectoma holds, on an exclusive basis, all intellectual and industrial property rights in the Platform, source code, algorithms and trademarks of the ConnectTarget_MDD software. Any reverse engineering, decompilation or data scraping is prohibited.

7.2. Loyalty and Commercial Non-Circumvention Clause

The Medical Centre and its Professional Users undertake not to establish commercial, clinical or referral circuits that entail the disintermediation or circumvention of Connectoma during the term of the service and for the twelve (12) months following its termination.

8. Availability, maintenance and applicable law

8.1. Continuity of the Service

Connectoma will make all reasonable technical efforts to guarantee the permanent availability of the Platform, without guaranteeing 100% uptime owing to scheduled maintenance windows of the cloud infrastructure.

8.2. Applicable Law and Competent Jurisdiction

These Terms are governed by Spanish law. For the resolution of any judicial dispute, the parties expressly agree to submit to the Courts and Tribunals of the city of Madrid (Spain).