1. Agreement
1.1 Parties
These Terms of Service (the "Terms") are a legal agreement between 16 Bit Inc., a corporation incorporated under the laws of Canada with its principal office in Toronto, Ontario ("16 Bit", "we", or "us"), and you. If you access or use a Service on behalf of a clinic, practice, hospital, or other organization, "you" means that organization, you confirm that you are authorized to bind it, and the members of its personnel who use the Service under its account are "Authorized Users".
1.2 Scope and Order of Precedence
The Terms govern your access to and use of the Services however you access them: through a web application, through an API, or through an Installed Component. The Terms include the Product Terms in the Schedules for each Service you use, any order or quotation we agree with you in writing (an "Order"), and the Documentation. If they conflict, the order of precedence is: Order, then Product Terms, then these Terms, then Documentation.
1.3 Acceptance
You accept the Terms by clicking to accept them, creating an account, purchasing Credits, requesting or using API Credentials, installing an Installed Component, or otherwise using a Service. If you do not agree to the Terms, do not use the Services.
1.4 Eligibility
The Services are intended for licensed healthcare professionals and healthcare organizations, and for people and organizations acting under their direction (for example, an IT integrator engaged by a healthcare organization to connect its systems to the API). You must be at least 18 years old. The Services are not intended for patients or consumers and do not provide medical advice to individuals. Each Service is offered only in the jurisdictions in which 16 Bit makes it available. Availability is controlled within the Service and may change from time to time.
1.5 Privacy Policy
Our Privacy Policy, available at 16bit.ai/privacy, describes how we handle personal information about you and your Authorized Users. It does not govern patient information that you process with the Services; Section 6 does.
2. Definitions
"API" means an application programming interface that 16 Bit makes available for a Service, as described in the API Documentation.
"API Credentials" means the keys, tokens, or other credentials issued to you to authenticate calls to an API.
"Authorized Jurisdiction" means, for a Service, a jurisdiction in which 16 Bit holds the medical device authorization required to supply that Service for its Intended Use, as identified in the Documentation.
"Credits" means the prepaid units that you purchase and that are consumed when a Service produces a result, as described in Section 7 and the Product Terms.
"Documentation" means the user guides, instructions for use, API documentation, installation guides, in-product help, and release notes for a Service, as published by 16 Bit for the jurisdiction in which the Service is used and updated from time to time.
"Installed Component" means software that 16 Bit provides for installation on systems that you control, as part of or to connect to a Service (for example, an on-premises gateway), as identified in the Product Terms.
"Intended Use" means the specific clinical or technical purpose, indications, target patient population, contraindications, and operational limitations of a Service as set forth in the applicable Documentation for the jurisdiction in which the Service is provided.
"Non-Clinical Use" means use of a Service solely for research, evaluation, validation, education, or other purposes in which no Output is used to inform the diagnosis, management, or care of any patient.
"Output" means any score, classification, measurement, report, or other result produced by a Service.
"Prepaid Amounts" means the value of your unused Credits and, for a Subscription, the prepaid fees for the unexpired part of your current billing period.
"Product Terms" means the Schedule to these Terms that applies to a particular Service.
"Region" means the jurisdiction assigned to your account as described in Section 5.3.
"Subscription" means a recurring plan for a Service with a fee and usage limits, as described on the product web page for that Service.
"Service" means each 16 Bit cloud-delivered product described in a Product Terms schedule, including its web application, any API, any Installed Component, and its Documentation.
"Usage Data" means operational, technical, and usage information generated by or collected from the Services, their user interfaces, APIs, and Installed Components, including product events, feature usage, performance metrics, analysis counts, result distributions, error logs, and software version. Usage Data is designed to exclude patient identifiers and is not Your Content.
"Your Content" means all images, data, and other content that you or your Authorized Users upload to, submit to, or input into a Service, whether through a web application, an API, or an Installed Component, together with the Outputs derived from them. Your Content does not include Usage Data.
3. Your Account
3.1 Registration
You will provide accurate and current information when you register and will keep it updated. We may verify your professional status or organization and may decline or close accounts that do not meet Section 1.4 or that we reasonably believe are held by or on behalf of a developer or seller of a competing product (Section 8(j)).
3.2 Credentials
Keep your login credentials and API Credentials confidential, and use multi-factor authentication where we offer it. Do not share accounts or API Credentials. You are responsible for all activity under your account and for all calls made with your API Credentials, and must notify us promptly, using the support contact shown in the Service, of any suspected unauthorized use or compromise. We may rotate or revoke API Credentials where we reasonably believe they are compromised.
3.3 Organization Accounts
Where a Service offers organization accounts, your administrator may manage Authorized Users, API Credentials, Installed Components, Credits, and settings, and may access account-level information and case history within the organization's account.
3.4 Encryption Secrets
Some Services protect patient identifiers with a passphrase or key that only you hold (see the Product Terms). We cannot recover it. If you lose it, you permanently lose access to any content encrypted with it, and we are not responsible for that loss.
4. Access to the Services
4.1 Web Application
Subject to the Terms, we grant you a non-exclusive, non-transferable right, for as long as your account is in good standing, to access and use each Service through its web application for your internal professional purposes and in accordance with the Documentation.
4.2 API Access
Where a Service offers an API, and subject to the Terms, we grant you a non-exclusive, non-transferable right, for as long as your account is in good standing, to access that API using your API Credentials, solely to submit Your Content and retrieve Outputs for your internal professional purposes, in accordance with the API Documentation. You are responsible for any application or system you build or operate that calls the API, including its de-identification of patient data before submission (Section 6.3), its handling of Outputs, and its compliance with the Terms. Calls must stay within the rate and volume limits in the API Documentation, if applicable. We may monitor API use for security, billing, and reliability.
4.3 API Versions
We may release new versions of an API and make backwards-compatible changes at any time without notice. Where a change is not backwards compatible, or we retire a version that you are actively using, we will attempt to give at least six months' notice, except where a shorter period is needed to address a security or regulatory issue.
4.4 Installed Components
Where a Service includes an Installed Component, and subject to the Terms, we grant you a non-exclusive, non-transferable, non-sublicensable license, for as long as your account is in good standing, to install and use that Installed Component in object code form on systems you control at your own facilities, solely to access and use the Service in accordance with the Documentation. Installed Components form part of the Service and are subject to the restrictions in Section 8. You agree to install updates, in particular security-related updates, within a reasonable time after they are made available (or to allow automatic updates where the Installed Component supports them), and you acknowledge that continued support and regulatory compliance may depend on your running a supported version. You are responsible for the hardware, operating environment, network, and security of the systems on which an Installed Component runs. On termination, you will uninstall and delete all copies.
4.5 Changes
We improve the Services continuously and may add, change, or remove features. If a change materially reduces the core functionality of a Service for which you hold unused Credits, we will give you reasonable advance notice where practical. Section 14.4 applies if we discontinue a Service.
4.6 Beta Features
Features identified as beta, preview, or similar are provided as is, may be changed or withdrawn at any time, and are not covered by the warranty in Section 15.1.
4.7 Support
We provide support by email, using the support contact shown in the Service you are using, from 9 am to 5 pm Eastern Time on business days, and through in-product help. We will use reasonable efforts to respond promptly. No service level commitment applies unless stated in an Order.
5. Permitted Use, Regulatory Status, and Clinical Responsibility
5.1 Clinical Use in Authorized Jurisdictions
In an Authorized Jurisdiction, you may use a Service for its Intended Use as stated in the Documentation for that jurisdiction. The Intended Use, indications, and excluded patient populations differ between jurisdictions. You must follow the Documentation that applies where you use the Service.
5.2 Non-Clinical Use Elsewhere
In a jurisdiction that is not an Authorized Jurisdiction for a Service, you may use that Service for Non-Clinical Use only. In that case:
you must not use any Output to inform the diagnosis, management, or care of any patient;
you are responsible for complying with the laws, professional standards, and institutional requirements that apply to your Non-Clinical Use, including any ethics or regulatory approvals your activity requires;
16 Bit makes no representation that the Service is authorized, registered, or lawful to use in that jurisdiction for any purpose; and
you attest that your use will be Non-Clinical Use only when you accept the Terms, when you confirm this in your account, and each time you submit a study through the web application, the API, or an Installed Component from a Non-Clinical Use account.
Outputs produced for Non-Clinical Use are marked accordingly.
5.3 Your Region
Your account is assigned a Region based on your billing location as described in the Product Terms, and the Region is fixed once assigned. Your Region determines whether your account is a clinical account (Region is an Authorized Jurisdiction) or a Non-Clinical Use account, which instance of a Service processes your submissions, and your pricing. You must not misrepresent your location or use a payment method issued outside the jurisdiction in which you practise in order to obtain a different Region. If your Region is not an Authorized Jurisdiction, every submission from your account, by any access method, is Non-Clinical Use.
5.4 Screening and Assessment Aids
Outputs are an aid to, and not a substitute for, the professional judgment of a qualified healthcare professional. The Services do not establish a diagnosis or recommend treatment. Any Output may be incorrect for an individual patient. You are solely responsible for all clinical decisions and for verifying Outputs before acting on them.
5.5 Eligible Patients and Image Quality
You will use each Service only for patients who meet the eligibility criteria in the Documentation, and will ensure that images meet the quality and acquisition requirements described there. Where you submit through the API or an Installed Component, you are responsible for applying these criteria before submission.
5.6 Not for Emergency Use
The Services are not designed for, and must not be relied upon in, emergency or time-critical clinical situations.
5.7 Complaints and Safety Reporting
Report suspected malfunctions, unexpected results, safety issues, or adverse events to us promptly, using the support contact shown in the Service. We are subject to medical device post-market surveillance obligations and may need your reasonable cooperation, which you agree to provide.
6. Your Content and Patient Information
6.1 Ownership
As between you and 16 Bit, you own Your Content, including Outputs. We claim no rights in it except the limited license in Section 6.4.
6.2 Your Responsibilities
You confirm that you have all rights, consents, and legal authority required to submit and process Your Content with the Services, and that your use complies with the privacy, health information, and professional laws that apply to you. Those laws vary by country and, in Canada, by province. You are responsible for knowing and meeting the requirements that apply to you.
6.3 Privacy by Design
The Services are designed so that identifiable patient information does not reach 16 Bit. How this is achieved depends on the access method and is described in the Product Terms:
(a) Web Application Identifiers are removed, and where applicable encrypted, in your browser before upload; where an image format carries no patient metadata, you enter only the non-identifying values the Service needs (such as age and sex); or the Service stores only non-identifying values. You must follow the in-product steps that make this work, including attesting that images contain no burned-in identifying text where the Service asks you to.
(b) API The API accepts only de-identified submissions in the form specified in the API Documentation. You must de-identify each study within your own systems before submission, must not submit patient identifiers, free-text fields, or images containing burned-in identifying text, and must keep any mapping between our correlation tokens and your patients within your own systems. We validate submissions against the API Documentation and reject non-conforming ones. That validation is an additional safeguard and does not relieve you of this responsibility.
(c) Installed Components An Installed Component receives patient data from your systems and de-identifies it within your environment before anything is submitted to 16 Bit. Identifiers and the mapping to correlation tokens remain on the Installed Component, within your environment. You remain responsible for the security of that environment.
6.4 License to Us
You grant us a non-exclusive, worldwide, royalty-free license to host, store, process, transmit, and display Your Content solely as needed to provide, secure, and support the Services, to prevent or address technical problems, and to comply with law.
6.5 Our Role
Because of the design described in Section 6.3, in the normal operation of the Services 16 Bit does not receive identifiable patient information and does not act as your business associate (under HIPAA), agent or electronic service provider (under Canadian health privacy law), or data processor for patient information. No business associate agreement or data processing agreement is required to use the Services. If you believe your circumstances require one, contact us before submitting any study; we may be able to offer an alternative deployment.
6.6 If Identifiers Reach Us
If identifiable patient information nonetheless reaches us, for example because an image contained burned-in text that was not removed or because an API submission was not properly de-identified, tell us promptly at our contact form. We will delete it in accordance with our internal procedures. You are responsible for identifying information that reaches us because the in-product steps or the API Documentation were not followed.
6.7 Usage Data
The Services generate Usage Data, which is transmitted to 16 Bit and may be processed using third-party analytics services engaged by 16 Bit. Usage Data is designed to exclude patient identifiers. 16 Bit uses Usage Data to provide support, monitor the safety and performance of the Services, improve the Services, conduct post-market surveillance, meet its regulatory obligations, and administer billing. Nothing in the Terms restricts 16 Bit's collection or use of Usage Data.
6.8 De-identified Data
We may retain and use data that does not identify any individual, including de-identified images and analysis results, to operate, secure, support, validate, and improve the Services, to meet regulatory and quality obligations, and for research and development, in each case in accordance with applicable law. We will not attempt to re-identify any individual from such data and will not permit others to do so.
6.9 Retention and Deletion
The Product Terms describe what each Service retains and for how long. You may export Outputs while your account is active. After your account closes, we will delete Your Content within 60 days, except de-identified data under Section 6.8 and records we are required to keep by law.
7. Credits, Subscriptions, Fees, and Payment
7.1 Prepaid Credits
Where a Service is sold on Credits, you purchase Credits in advance. One Credit is consumed for each completed analysis as described in the Product Terms, whether the study was submitted through the web application, the API, or an Installed Component. A Credit is not consumed when a Service declines to analyze a study (for example, because the image fails a quality check) or does not produce a result.
7.2 Subscriptions
Where a Service is sold by Subscription, the available plans, their fees, billing periods, and usage limits are described on the product web page for that Service and may change from time to time. A Subscription renews automatically at the end of each billing period until you cancel it in your account settings; cancellation takes effect at the end of the current billing period, and fees for the current period are not refunded except as stated in the Terms or required by law. If you reach your plan's usage limit, the Service may decline further analyses until the next billing period or until you change plan. Plan changes take effect as described on the product web page. We will give you at least 30 days' notice of a fee increase before it applies to your Subscription.
7.3 Pricing
Prices are shown at the time of purchase and depend on your Region, including whether it is an Authorized Jurisdiction. We may change prices for future purchases at any time; Credits you have already purchased are unaffected. Pricing for API or Installed Component use may be set out in an Order.
7.4 Payment
Payments are processed by a third-party payment processor. You authorize us and the processor to charge your chosen payment method for the purchases you make, for Subscription renewals, and, if you enable automatic reload, for reloads up to the threshold you set. We do not store full payment card numbers. The processor's terms apply to its handling of your payment details.
7.5 Taxes
Prices exclude taxes unless stated otherwise. You are responsible for any sales, use, value-added, goods and services, or similar taxes on your purchases, other than taxes on our income.
7.6 Expiry, Transfer, and Refunds
Credits expire 24 months after purchase unless applicable law prohibits expiry. Credits have no cash value and may not be transferred outside your account. Purchases are final, except that we will refund your unused Prepaid Amounts if (a) we discontinue a Service or terminate your account other than for your breach, (b) you decline a material change to the Terms under Section 19, or (c) applicable law requires a refund. Promotional or free Credits and trial periods are not refundable and may carry their own expiry.
7.7 Disputes
Contact us before disputing a charge with your card issuer. If you initiate a chargeback for a valid charge, we may suspend your account until the matter is resolved.
8. Acceptable Use
You will not, and will not allow anyone to:
(a) use a Service other than as permitted by Section 5, including using any Output obtained through Non-Clinical Use to inform the care of a patient, or using a Service for patients outside its eligibility criteria;
(b) submit content that you do not have the right to submit, or submit identifiable patient information other than as a Service is designed to handle it (Section 6.3);
(c) misrepresent your location, circumvent Region assignment or other geographic or access controls, or use a Service from or on behalf of a person or facility in a jurisdiction where the Service is not offered;
(d) share login credentials or API Credentials, or allow anyone other than an Authorized User (or a system you operate) to use your account or API Credentials;
(e) copy, modify, translate, or create derivative works of a Service or an Installed Component, or reverse engineer, decompile, or attempt to extract source code, models, model weights, or algorithms;
(f) use a Service or Outputs to develop, train, validate, or improve any software,
algorithm, or machine learning model that performs a function similar to or competitive with the Service (your use of Outputs in patient care, in internal quality assurance, and in clinical research that does not involve training such a model is permitted);
(g) resell, sublicense, or provide a Service or API access to third parties on a service-bureau or similar basis (processing images of patients under your care, including patients referred to you, is permitted);
(h) exceed the rate or volume limits in the API Documentation (if applicable), access a Service by automated means other than through its documented API, interfere with its operation, probe or test its security without our written
consent, or attempt to gain unauthorized access; or
(i) use a Service in violation of law or to infringe anyone's rights; or
(j) access or use a Service if you are, or are acting on behalf of, a developer or seller of a product that competes with the Service, or use a Service or Outputs to benchmark, compare, or promote a competing product, without our prior written consent (independent clinical research, including research that compares the Service with other tools, remains permitted under (f) provided its purpose is not the development or marketing of a competing product).
9. Intellectual property
9.1 Ownership of the Services
We own the Services, including the APIs and Installed Components, the Documentation, and all intellectual property rights in them. The Terms grant you a right to use the Services, not ownership.
9.2 Outputs
You own the Outputs for your patients. We retain all rights in the models, technology, report templates, and formats used to produce them.
9.3 Feedback
We may use feedback you provide about the Services without restriction or obligation.
9.4 Trademarks
Rho, Physis, and the 16 Bit name and logos are trademarks of 16 Bit Inc. You may refer to the Services by name to describe your use of them; any other use requires our written permission.
9.5 Third-Party Components
The Services and Installed Components may include open-source components subject to their own licenses, which are identified in the Documentation. Nothing in the Terms restricts any rights you have under those licenses.
10. Third-Party Services
The Services rely on third-party providers, including cloud hosting and payment processing. Your use of a third-party service (for example, the payment processor) is subject to that provider's terms. We select and manage our providers with care and remain responsible for the Services themselves, but we are not responsible for third-party services that we do not control, or for your own systems and applications that connect to the Services.
11. Confidentiality
Each party will keep confidential the other party's non-public information received in connection with the Terms, use it only for the purposes of the Terms, and protect it with at least reasonable care. Our confidential information includes non-public information about the Services, the APIs, Installed Components, security, and pricing. Your confidential information includes Your Content. These obligations do not apply to information that is public through no fault of the recipient, was already lawfully known to the recipient, was independently developed, or must be disclosed by law (with notice to the other party where lawful).
12. Personal Information About You
We handle personal information about you and your Authorized Users (such as names, email addresses, and account activity) as described in our Privacy Policy. If you are an organization, you are responsible for informing your Authorized Users about that processing.
13. Availability and security
13.1 Availability
We will use commercially reasonable efforts to make the Services, including the APIs, available, but we do not guarantee uninterrupted or error-free operation. We may suspend a Service temporarily for maintenance, to address a security risk, or where required by law, and will minimize disruption where practical. Your applications and Installed Components should tolerate transient unavailability and follow the retry guidance in the API Documentation.
13.2 Security Safeguards
We maintain administrative, technical, and physical safeguards appropriate to the Services, including encryption in transit and at rest, access controls, monitoring, and a documented incident response process. Product-specific security design is described in the Product Terms and Documentation.
13.3 Your Responsibility
You are responsible for the security of your own devices, networks, browsers, credentials, API Credentials, applications, and the systems on which Installed Components run, and for using supported browsers, versions, and configurations.
14. Suspension and Termination
14.1 By You
You may stop using the Services and close your account at any time through your account settings.
14.2 Suspension by Us
We may suspend your access, revoke API Credentials, or disable an Installed Component's connection, in whole or in part, if we reasonably believe that your use breaches Section 5, 6, or 8, that your account or credentials present a security risk, that a payment has failed or is disputed, or that suspension is required by law or a regulator. We will tell you why, where lawful, and will restore access when the issue is resolved.
14.3 Termination by Us
We may terminate the Terms and your account if you materially breach them and do not cure the breach within 30 days after notice, or immediately for a serious breach that cannot be cured or that presents a risk to patients, other users, or the Services.
14.4 Discontinuation
We may discontinue a Service on at least 90 days' notice and will refund your unused Prepaid Amounts for that Service.
14.5 Effect
On termination, your right to use the Services ends, API Credentials are revoked, and you will uninstall and delete all copies of any Installed Component within 30 days. We will delete Your Content in accordance with Section 6.9. Sections 2, 6.1, 6.2, 6.6 to 6.9, 7.5 to 7.7, 9, 11, 12, 15.3, 15.4, 16, 17, 18, and 20 survive.
15. Warranties and Disclaimers
15.1 Limited Warranty
We warrant that we will provide the Services with reasonable skill and care and that each Service will perform materially in accordance with its Documentation when used as permitted by Section 5. If a Service does not, tell us and we will use commercially reasonable efforts to correct the problem. If we cannot do so within a reasonable time, you may close your account and receive a refund of your unused Prepaid Amounts for that Service. This is your sole and exclusive remedy for breach of this warranty.
15.2 Exclusions
The warranty in Section 15.1 does not cover problems caused by your devices, network, browser, applications, or the systems on which an Installed Component runs; by image acquisition and quality; by use outside the Intended Use or Documentation; by third-party services; or by beta features.
15.3 Disclaimer
Except as expressly stated in Section 15.1, and to the maximum extent permitted by law, the Services and Outputs are provided "as is" and "as available", and we disclaim all other warranties, conditions, and representations, express or implied, including implied warranties of merchantability, fitness for a particular purpose, and non-infringement. We do not warrant that any individual Output will be accurate, that a Service will identify every patient with the condition it screens for or assesses, that it will not produce false positive or false negative results, or that the Services will be uninterrupted or error-free. Screening and assessment tools have inherent limitations, and the Services do not establish a diagnosis.
15.4 Statutory Rights
Some jurisdictions do not allow certain exclusions or limitations. Where that is the case, the exclusions and limitations in the Terms apply to the maximum extent permitted, and nothing in the Terms limits rights you have under mandatory law that cannot be excluded by agreement.
16. Liability
16.1 Excluded Damages
To the maximum extent permitted by law, we will not be liable for any indirect, incidental, special, consequential, or punitive damages, or for any loss of profits, revenue, business, goodwill, or data, however caused and under any theory of liability, even if advised of the possibility.
16.2 Liability Cap
To the maximum extent permitted by law, our total aggregate liability arising out of or relating to the Terms or the Services, in any 12-month period, will not exceed the greater of (a) the amounts you paid us for the Services in the 12 months immediately before the event giving rise to the claim, and (b) CAD $1,000.
16.3 Liability Carve-Outs
Sections 16.1 and 16.2 do not exclude or limit liability that cannot be excluded or limited under applicable law, liability for death or personal injury caused by negligence where applicable law does not permit its exclusion, or liability for fraud, fraudulent misrepresentation, gross negligence, or wilful misconduct.
16.4 Risk Allocation
The prices for the Services reflect the allocation of risk in this Section 16.
17. Indemnity
17.1 By You
You will defend and indemnify 16 Bit, its affiliates, and their personnel against third-party claims, and the resulting losses and reasonable legal costs, to the extent arising from Your Content (including any lack of rights, consents, or authority to process it, and any identifiable patient information submitted in breach of Section 6.3), from your breach of Section 5, 6, or 8, from applications or systems you operate that call the API, or from your violation of law, except to the extent caused by our breach or negligence.
17.2 Infringement Claims
If a Service is, or in our reasonable opinion is likely to become, the subject of a claim that it infringes a third party's intellectual property rights, we may modify it, replace it with a non-infringing equivalent, or, if neither is commercially reasonable, discontinue it and refund your unused Prepaid Amounts. This is your sole remedy for such claims.
18. Governing Law and Disputes
18.1 Governing Law
The Terms are governed by the laws of the Province of Ontario and the federal laws of Canada applicable in Ontario, without regard to conflict-of-laws rules. The United Nations Convention on Contracts for the International Sale of Goods does not apply.
18.2 Informal Resolution
Before starting formal proceedings, each party will notify the other in writing of the dispute, and the parties will attempt in good faith to resolve it within 30 days.
18.3 Jurisdiction
The courts of Ontario, sitting in Toronto, have exclusive jurisdiction over disputes arising from the Terms, except that either party may seek injunctive or other urgent relief in any court of competent jurisdiction. Nothing in this Section deprives you of the protection of mandatory laws of your jurisdiction that cannot be excluded by agreement.
19. Changes to the Terms
We may update the Terms from time to time. We will post the updated version with a new effective date and, for material changes, will notify you by email or in-product. If you do not agree to a material change, you may close your account and receive a refund of your unused Prepaid Amounts. Your continued use after the effective date, including continued API calls or Installed Component connections, constitutes acceptance of the updated Terms.
20. General
20.1 Notices
Notices to us must be sent to our contact form or to 16 Bit Inc., 20 Bay St, 11th Floor, Toronto, Ontario, M5J 2N8, Canada. Notices to you will be sent to the email address on your account.
20.2 Assignment
You may not assign the Terms without our written consent, except to a successor of your practice or organization that agrees in writing to be bound by them. We may assign the Terms to an affiliate or to a successor of our business.
20.3 Export and Sanctions
You will comply with applicable export control and sanctions laws and will not use or transfer the Services or any Installed Component in violation of them.
20.4 Force Majeure
Neither party is liable for delay or failure caused by events beyond its reasonable control, other than payment obligations.
20.5 Entire Agreement, Severability, and Waiver
The Terms are the entire agreement between you and 16 Bit regarding the Services and supersede all prior understandings. If any provision is held unenforceable, it will be enforced to the maximum extent permitted and the remainder continues in effect. A failure to enforce any provision is not a waiver.
20.6 Relationship and Third Parties
The parties are independent contractors. The Terms create no rights for third parties.
20.7 Language
The Terms are written in English. Any translation is for convenience only, and the English version prevails. The parties confirm their express wish that the Terms and all related documents be drawn up in English.
Schedule A: Rho Direct Product Terms (Web Application and API)
Service: Rho Direct, 16 Bit's self-serve cloud service that gives clinicians and healthcare organizations access to Rho, 16 Bit's artificial intelligence software for the opportunistic identification of adults who may have low bone mineral density from routine radiographs. Rho Direct is accessed through its web application or, for accounts enabled for it, through the Rho Direct API.
Intended Use: As stated in the Rho Instructions for Use and the Rho Direct User Guide for the jurisdiction in which the Service is used. The Documentation for your jurisdiction is available in the product and from 16 Bit on request.
Excluded populations: As stated in the Documentation for your jurisdiction.
Authorized Jurisdictions and Region: The jurisdictions in which Rho is authorized as a medical device, and the applicable authorization, are identified in the Documentation. Your Region is determined from the issuing country of the payment method used for your first purchase and is fixed thereafter. If your Region is an Authorized Jurisdiction, your account is a clinical account. Otherwise your account is a Non-Clinical Use account (Section 5.2), you confirm Non-Clinical Use in the product, and every Output is marked as produced for Non-Clinical Use.
Web application: how data is handled: Before upload, Rho Direct removes identifying information from each study in your browser. For DICOM studies, only the attributes the analysis needs (image pixel data, the patient's sex, and age in years) are retained, as defined by an allowlist. For any other image format the Service supports, only the image and the non-identifying values you enter (such as sex and age) are uploaded. The identifiers you may want to see later in your case history (patient name, medical record number, accession number, and study date) are encrypted in your browser with a key derived from a passphrase that only you hold. 16 Bit never receives your passphrase or key and cannot decrypt these identifiers. Each study is referenced on our servers only by a random correlation token that cannot be traced to a patient or derived from patient data. You must attest that images contain no burned-in identifying text (for example, a patient name or identifier rendered into the image). Rho Direct relies on your attestation, and you are responsible for it. Rho Direct is designed to meet the HIPAA de-identification standard. Identifiers are removed or encrypted so that they cannot reasonably be used to re-identify an individual. You are responsible for ensuring that anything you upload also meets any additional requirements that apply to you locally.
API: how data is handled: The Rho Direct API accepts only de-identified submissions in the form specified in the API Documentation: image pixel data, the patient's sex, age in years, and a correlation token that you generate. The exact API structure is described in the API Documentation and is subject to change. You must de-identify each study within your own systems before submission and must not submit patient identifiers, free-text fields, private tags, or images containing burned-in identifying text. The mapping between your correlation tokens and your patients stays in your systems; 16 Bit never holds it. 16 Bit validates each submission against the API Documentation and rejects non-conforming submissions. This validation is an additional safeguard and does not relieve you of responsibility for de-identification (Section 6.3(b)). Outputs are returned keyed by your correlation token. The Rho report contains no patient identifiers.
Your passphrase (web application): You choose and hold your passphrase. Choose a strong one, as guided in the product. If you lose it, the encrypted identifiers in your case history cannot be recovered by anyone, including 16 Bit; de-identified results and reports remain accessible.
API Credentials, limits, and versions: API Credentials are issued through your account and are confidential (Section 3.2). Rate and volume limits, retry guidance, and supported versions are stated in the API Documentation as applicable. Section 4.3 applies to version retirement.
Credits and pricing: One Credit is consumed each time Rho Direct produces a Rho Score for a study, whether submitted through the web application or the API. No Credit is consumed if the study fails the quality check or no score is produced. Credits are sold in packs with volume pricing shown at purchase. Prices depend on your Region. Credits expire 24 months after purchase (Section 7.6).
Retention: Uploaded study objects are deleted once analysis is complete. The Rho report and a reduced-size thumbnail of the analyzed image are retained in your case history for six months and then permanently deleted. Encrypted identifier records are retained with the case history.
Notifications: Notifications about batch processing (for example, that a batch has finished) contain no patient information.
Data received by 16 Bit: De-identified study data as described above, Outputs, encrypted identifier records that 16 Bit cannot read (web application), and Usage Data (Section 6.7). An Expert Determination under 45 CFR 164.514(b)(1) supports the de-identified status of data received through the web application.
Support and Documentation: Support: use the support contact shown in the Service (Section 4.7). Documentation: Rho Direct User Guide, Rho Instructions for Use for your jurisdiction, and the Rho Direct API Documentation, in their current versions.
Schedule B: Physis Product Terms
Service: Physis, 16 Bit's web application for automated bone age assessment from hand and wrist radiographs of paediatric patients.
Intended Use: As stated in the Physis Instructions for Use and User Guide for the jurisdiction in which the Service is used.
Eligible patients and exclusions: As stated in the Documentation for your jurisdiction.
Authorized Jurisdictions and Region: The jurisdictions in which Physis is authorized as a medical device, and the applicable authorization, are identified in the Documentation. Your Region is determined as described in Section 5.3. Outside Authorized Jurisdictions, Physis may be used for Non-Clinical Use only (Section 5.2).
How data is handled: Each image is processed to produce a result and is kept with that result so that you can view your history; images are deleted at your request.
Date of birth and study date are used only to calculate the patient's age at the time of the study, and only the image, age, sex, the result, and any notes you enter are stored.
16 Bit does not use Physis images, results, or notes to train its models. For Physis, this limits Section 6.8.
You must not upload identifiable patient information or enter it in free-text fields, including notes, and the product asks you to confirm this. Physis is designed so that 16 Bit does not receive identifiable patient information.
Subscription and pricing: Physis is sold by Subscription (Section 7.2). Available plans, monthly fees, and usage limits are described on the Physis product web page and may change from time to time.
Retention: The image, the result, age, sex, and any notes you enter are retained for as long as your account is active so that you can view your history, unless you ask us to delete them sooner. Section 6.9 applies when your account closes.
Data received by 16 Bit: The image, age, sex, the result, and any notes you enter for each analysis, and Usage Data (Section 6.7).
Support and Documentation: Support: use the support contact shown in the Service or on the Physis product web page (Section 4.7). Documentation: Physis User Guide and Instructions for Use for your jurisdiction, in their current versions.