SafeTrace Terms of Service

Version 0.1 (draft for legal review), 13 October 2026. Not yet in force.

These Terms are an agreement between [MEDICORE LEGAL ENTITY NAME] Limited, trading as Medicore, a company registered in Ireland under number [CRO NUMBER] with its registered office at [REGISTERED ADDRESS] ("Medicore", "we", "us"), which provides SafeTrace, and the organisation that creates or uses a SafeTrace account (the "Customer", "you").

By creating an account or organisation, or by accepting these Terms on a Customer's behalf, the person doing so confirms that they are authorised to bind the Customer.

1. Definitions

Service: the SafeTrace software, websites, apps, APIs and related support we provide.
Billing Account: the account that holds the Customer's subscription and one or more Organisations.
Organisation: an area of the Service with its own clients, sites, equipment, procedures, records and settings.
User: any person the Customer allows to use the Service, including engineers, quality managers, engineering leads, auditors and client viewers.
Connected App: software the Customer connects to the Service through the API with a key it creates.
Customer Data: any data the Customer, its Users or its Connected Apps submit to the Service, including equipment records, procedures, test results, declarations, release and quarantine decisions, photos, documents and reports.
Personal Data, controller, processor and processing have the meanings given in Regulation (EU) 2016/679 (the "GDPR").
DPA: our Data Processing Agreement, which forms part of these Terms.
Order: any plan, subscription or order the Customer selects or signs, including through Stripe checkout.

2. The Service

2.1 We provide the Service as described in the Order and our current documentation. We may improve and change the Service. We will not materially reduce its core functionality during a paid subscription term without notice, unless we must do so for legal or security reasons. Features described on our website as "coming soon" are not part of the Service until we make them available.

2.2 The Service is a record-keeping tool, not engineering or regulatory advice. SafeTrace helps organisations record the inspection, testing, release and lifecycle of medical electrical equipment. It does not decide whether any equipment is safe to use, and it does not determine whether the Customer complies with any law, standard or guidance. In particular:

(a) Pass and fail results are calculated from the limits in procedures the Customer publishes. The Customer is responsible for those procedures and limits, including checking them against the applicable standards (such as IEC 62353 and IEC 60601-2-4) and the manufacturer's instructions.
(b) The Customer is responsible for the competence and supervision of the people who test equipment, the calibration of its test equipment, and every declaration, release, quarantine and override decision made by its Users.
(c) The Customer remains solely responsible for its regulatory obligations, including any report to the Health Products Regulatory Authority (HPRA), the Medicines and Healthcare products Regulatory Agency (MHRA), a manufacturer or any other body. This applies even where the Service prepares records or extracts that help with such a report.
(d) Statements that the Service "supports compliance" with a standard or guidance mean that it helps the Customer keep the records involved. SafeTrace is not certified by any standards body.

2.3 Optional AI assistance (planned). Where we make analyser photo capture available, it will be off until an owner turns it on. It proposes values read from a photo; nothing is saved until a User confirms or corrects each value, and pass and fail are always calculated from the procedure's limits, never by the AI model. When it is on, the photo and the relevant procedure steps are sent to our AI sub-processor as described in the DPA.

2.4 Out of scope. The Service is designed for equipment records. It is not designed for, and must not be used as, an electronic patient record or a clinical record, and the Customer must not enter patient information into it. The Service does not control, monitor or connect to medical equipment in clinical use.

3. Accounts and Users

3.1 The Customer is responsible for:

(a) who it invites, and the roles and client access it gives them;
(b) its Users' compliance with these Terms and the Acceptable Use Policy;
(c) keeping sign-in details, authenticator devices and API keys confidential;
(d) promptly removing access for people and Connected Apps that should no longer have it.

3.2 The Customer must keep at least one active owner for each Organisation and Billing Account. Some roles and actions, including release and overrides, require two-step sign-in; the Customer must not try to get around this.

3.3 The Customer must tell us promptly if it suspects unauthorised access to its account or an API key.

4. Customer Data

4.1 As between the parties, the Customer owns Customer Data. The Customer grants us a non-exclusive, worldwide, royalty-free licence to host, copy, process, transmit and display Customer Data only as needed to provide, secure and support the Service and to comply with law.

4.2 Data protection. Where Customer Data includes Personal Data, the DPA applies and forms part of these Terms. If these Terms and the DPA conflict on data protection matters, the DPA prevails.

4.3 Responsibility for content. The Customer is responsible for the accuracy, quality and legality of Customer Data, for having a lawful basis for the Personal Data it submits, and for giving any notices required to data subjects. The Customer should not submit more Personal Data than its purpose requires, and must not submit patient information or other special category data (clause 2.4).

4.4 Records that cannot be changed. Published procedure versions, released test runs and their reports are kept as versions and are not overwritten, and the audit trail is append-only. The Customer accepts that it cannot edit or delete these records in place; corrections are made by superseding records, which the Service keeps alongside the originals.

4.5 Export and deletion.

During the subscription, the Customer can export its data using the Service's export features and the API.
After termination, the Customer may request an export for 30 days.
We then delete Customer Data from the live Service within 90 days. Copies in backups are deleted on our normal backup cycle, which is no more than [35] days [CONFIRM].
Records we must keep by law, such as invoices, are kept for the period required.
The Customer is responsible for keeping its own copies of records it must retain for longer, for example for the life of the equipment.

5. API and Connected Apps

5.1 The Customer may connect its own or third-party software through the API, within its plan. Each Connected App acts only within the scopes and clients the Customer gives it, and can never declare, complete, release or override.

5.2 The Customer is responsible for what its Connected Apps do, and for the terms of any third-party software it connects. We may limit request rates and suspend a key that threatens the Service or other customers.

6. Acceptable use

The Customer and its Users must comply with our Acceptable Use Policy.

We may suspend access to the extent reasonably necessary to prevent harm or a breach of law or of the Acceptable Use Policy. Where practical, we will tell the Customer first and restore access as soon as the issue is resolved.

7. Plans, fees and payment

7.1 Plans and fees are set out in the Order and on our website. Plans are priced by the number of assets under management, with the users stated for the plan included. Fees exclude VAT and other taxes, which the Customer pays where applicable.

7.2 Trial. New Billing Accounts start with a 30-day trial. At the end of the trial the Customer must choose a paid plan to keep creating records; we will not delete Customer Data during the period in clause 4.5 because a trial has ended.

7.3 Limits. Asset and user limits count across all the Organisations on a Billing Account. When a limit is reached, the Service stops new assets or users from being added until the Customer moves to a larger plan or (on Professional) pays for extra assets. Viewing and exporting are never blocked by a limit.

7.4 Fees are payable in advance through our payment provider (Stripe) unless agreed otherwise. Subscriptions renew automatically for the same term unless the Customer cancels before renewal.

7.5 If payment fails and is not resolved within 14 days of our notice, we may suspend the account. Suspension does not delete Customer Data, and clause 4.5 continues to apply.

7.6 We may change fees for future terms on at least 30 days' notice. Fees are non-refundable except where these Terms or law require otherwise.

8. Intellectual property

8.1 We and our licensors own the Service and all related intellectual property. The Customer receives a non-exclusive, non-transferable right to use the Service for its internal purposes, and for providing services to its own clients, during the subscription.

8.2 Where we provide procedure templates or packs, they are starting points that the Customer must check and adapt before publishing. Procedures the Customer publishes are Customer Data.

8.3 If the Customer gives us feedback, we may use it without restriction or payment.

9. Confidentiality

9.1 Each party will keep the other's confidential information confidential. It will use that information only for this agreement, and disclose it only to people who need to know it and are bound by similar duties.

9.2 This does not apply to information that is public, already known, independently developed, or required to be disclosed by law. Where the law allows, the disclosing party must give the other notice of a legal requirement to disclose.

10. Security and availability

10.1 We maintain the technical and organisational measures described in DPA Annex 2.

10.2 We aim to keep the Service available but do not guarantee uninterrupted operation, unless a separate service level agreement is signed. We will try to schedule maintenance outside Irish business hours. The Customer should keep a way of identifying equipment status (such as labels) that does not depend on the Service being online.

11. Third-party services

The Service relies on the sub-processors in our Sub-processors list. Optional integrations with third parties are governed by those parties' terms, and the Customer enables them at its discretion.

12. Warranties and disclaimers

12.1 We warrant that we will provide the Service with reasonable skill and care.

12.2 Except as stated in these Terms, and to the extent permitted by law, the Service is provided "as is". We exclude all other warranties, conditions and terms implied by statute or common law, including those relating to fitness for purpose and to the Service ensuring that any equipment is safe or that the Customer complies with any law, standard or guidance.

13. Liability

13.1 Nothing in these Terms limits or excludes liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, or for any liability that cannot be limited or excluded by law.

13.2 Subject to clause 13.1, neither party is liable for any of the following, whether direct or indirect:

(a) loss of profits, revenue, business or goodwill;
(b) loss or corruption of data, where it could have been avoided by the Customer's own exports or backups;
(c) indirect or consequential loss.

13.3 Subject to clause 13.1, we are not liable for loss arising from the Customer's procedures, limits, test equipment or decisions, including a decision to release equipment for use [solicitor to confirm].

13.4 Subject to clauses 13.1 and 13.5, each party's total liability under or in connection with this agreement in any 12-month period is limited to the fees paid and payable by the Customer in that period. If no fees are payable, the limit is €[1,000].

13.5 The cap in clause 13.4 does not apply to:

(a) the Customer's obligation to pay fees;
(b) either party's breach of confidentiality;
(c) liability under the DPA, which is subject to a separate cap of [two times] the fees paid in the 12 months before the claim, or €[50,000], whichever is greater [solicitor to confirm].

13.6 We are not liable for fines, penalties or sanctions imposed on the Customer by a regulator for the Customer's own non-compliance.

14. Term and termination

14.1 These Terms apply while the Customer uses the Service.

14.2 Either party may terminate by notice if the other materially breaches these Terms and does not remedy the breach within 30 days of notice, or immediately if the other becomes insolvent.

14.3 The Customer may stop using the Service at any time. Prepaid fees are not refunded except where required by law.

14.4 On termination, access ends and clause 4.5 applies. Clauses that by their nature should survive will survive, including clauses 4.5, 8, 9, 12, 13, 16 and 17.

15. Changes to these Terms

We may update these Terms.

For material changes, we will give owners at least 30 days' notice in the Service or by email.
If the Customer does not agree, it may cancel before the change takes effect and receive a pro-rata refund of prepaid fees for the unused period.
Continued use after that date means acceptance.

16. General

16.1 Consumers. The Service is intended for organisations acting in the course of business. If a Customer is a consumer, nothing in these Terms affects their statutory rights.

16.2 Assignment. Neither party may assign this agreement without the other's consent. Consent is not needed for an assignment to an affiliate or on a sale of all or substantially all of the assigning party's business, provided notice is given.

16.3 Force majeure. Neither party is liable for failure or delay caused by events beyond its reasonable control.

16.4 Notices. We send notices to the owners' email addresses. The Customer sends notices to [LEGAL EMAIL].

16.5 Entire agreement. These Terms, the DPA, the Acceptable Use Policy and any Order form the entire agreement between the parties.

16.6 Severability and waiver. If any provision is invalid, the rest of these Terms remains in force. A failure to enforce a provision is not a waiver of it.

16.7 No third-party rights. No one other than the parties has any right to enforce these Terms. The Customer's own clients have no rights against us under these Terms.

17. Governing law and jurisdiction

These Terms, and any dispute arising from them, are governed by the laws of Ireland. The courts of Ireland have exclusive jurisdiction.