TERMS OF SERVICE

Core Innovation Corp. (operating as Bridgit, askbridgit.ai)

Effective Date: October 16, 2026
Version: 1.1
Last Reviewed: October 16, 2026
Next Review Date: October 16, 2027

TABLE OF CONTENTS

1. Introduction and Acceptance of Terms
2. Definitions
3. Description of the Service
4. Eligibility and Account Terms
5. Acceptable Use Policy
6. AI-Assisted Features — Disclaimer and Terms
7. Intellectual Property Rights
8. User Content and Licensing
9. Data Handling and Privacy
10. Subscription, Billing, and Payment
11. Service Levels and Availability
12. Limitation of Liability and Warranty Disclaimer
13. Indemnification
14. Term, Termination, and Suspension
15. Governing Law and Dispute Resolution
16. General Provisions
17. Contact Information

1. INTRODUCTION AND ACCEPTANCE OF TERMS

1.1 Agreement to Terms

These Terms of Service (the "Terms" or "Agreement") constitute a legally binding agreement between you (the "User," "you," or "your") and Core Innovation Corp. (operating as Bridgit, askbridgit.ai) (the "Company," "Bridgit," "we," "us," or "our"), governing your access to and use of the Bridgit Platform (the "Service" or "Platform") accessible at https://askbridgit.ai and any associated mobile applications, APIs, or related services.

By creating an account, accessing the Service, or using any feature of the Platform, you acknowledge that you have read, understood, and agree to be bound by these Terms, including all policies incorporated by reference, including but not limited to the Privacy Policy and Data Retention Policy. If you do not agree to these Terms, you must immediately cease all use of the Service and may not create or maintain an account.

1.2 Modifications to Terms

The Company reserves the right to modify, amend, or update these Terms at any time in its sole discretion. Material changes to these Terms will be communicated by email to active users and a notice in the platform, at least 30 days before they take effect, except where changes are required by law, in which case they may take effect immediately. This version (1.1) was notified to users by email and with a notice in the platform when it was published.

Continued use of the Service following the effective date of amended Terms constitutes acceptance of such amendments. Users who do not agree to the amended Terms must discontinue use of the Service and may terminate their account in accordance with Section 14 (Term, Termination, and Suspension) prior to the effective date of the amendments.

1.3 Additional Terms and Policies

These Terms incorporate by reference the following policies and agreements, which are binding upon all Users:

• Privacy Policy (available at https://askbridgit.ai/api/v1/legal/privacy-policy)
• Data Retention Policy (available at https://askbridgit.ai/api/v1/legal/policies/data-retention-policy)
• Information Security Policy (available at https://askbridgit.ai/api/v1/legal/policies/information-security-policy)
• Any Data Processing Agreement or privacy schedule entered into with an Organization under Section 9.2 (where applicable)

In the event of a conflict between these Terms and any incorporated policy, these Terms shall prevail unless the specific policy expressly states otherwise. A Data Processing Agreement, privacy schedule or institutional agreement prevails over these Terms as set out in Sections 9.2 and 16.2.

1.4 Organizational Accounts

Where the User is accessing the Service on behalf of an organization, company, institution, or other legal entity (an "Organization"), the User represents and warrants that:

(a) The User is an authorized representative of the Organization with the legal authority to bind the Organization to these Terms;

(b) The Organization accepts and agrees to be bound by these Terms; and

(c) All references to "User" or "you" in these Terms shall be deemed to include both the individual user and the Organization, jointly and severally.

Organizations are responsible for the actions of all individuals who access the Service using credentials associated with the Organization's account, including employees, contractors, affiliates, and authorized third parties.

2. DEFINITIONS

For purposes of this Agreement, the following terms shall have the meanings set forth below. Additional defined terms may appear elsewhere in this Agreement and shall have the meanings ascribed to them in their respective sections.

"Account" means the user account created by or on behalf of a User to access and use the Service, including all associated credentials, settings, and data.

"Activity" or "Activity Instance" means a structured workflow unit within the Service consisting of a form-based data collection process, which may include multiple question types, conditional logic, file attachments, and AI-assisted content generation. Activities serve as the primary mechanism for capturing and managing innovation-related information within the hierarchical structure of Organizations, Innovations, and Projects.

"AI Features" or "AI-Assisted Features" means the artificial intelligence capabilities integrated into the Service, including but not limited to content generation, research summarization, context-aware drafting, and retrieval-augmented generation (RAG), powered by third-party large language model providers as specified in Section 6.

"AI Provider" means a third-party provider of large language model services used by the Service. The AI Providers currently used are Anthropic (Claude) and OpenAI, as described in Section 6.4.

"Authorized User" means an individual who is authorized to access and use the Service on behalf of a subscribing Organization, including employees, contractors, affiliates, or other persons granted access by an Organization Administrator.

"Bridgit Platform" or "Platform" means the innovation management software-as-a-service platform provided by the Company, including all associated websites, applications, APIs, documentation, and related services, accessible at https://askbridgit.ai.

"Business Day" means any day other than a Saturday, Sunday, or statutory holiday in the Province of Ontario, Canada.

"Confidential Information" means all non-public information disclosed by one party to the other, whether orally, in writing, or by inspection of tangible objects, that is designated as confidential or that reasonably should be understood to be confidential given the nature of the information and the circumstances of disclosure.

"Content" means any text, data, information, software, graphics, photographs, videos, audio, or other materials, whether provided by the Company, Users, or third parties.

"Controller" and "Processor" have the meanings ascribed to them under applicable data protection legislation, including the Personal Information Protection and Electronic Documents Act (PIPEDA) and the General Data Protection Regulation (GDPR), where applicable. In the context of this Agreement, subscribing Organizations typically function as Controllers with respect to personal data of their end users, and the Company functions as a Processor acting on behalf of such Controllers.

"Data Processing Agreement" or "DPA" means a written agreement or privacy schedule governing the processing of personal data by the Company on behalf of an Organization, entered into under Section 9.2.

"Effective Date" means October 16, 2026, the date on which this version of the Terms becomes effective.

"Innovation" means a user-defined innovation initiative tracked within the Service, representing a research project, product development effort, process improvement, or other innovation-related endeavor managed through the Platform's hierarchical structure.

"Institutional Agreement" means a separate written agreement between the Company and an Organization (for example, a SaaS subscription agreement, order form, or privacy schedule) governing that Organization's use of the Service.

"Intellectual Property Rights" means all intellectual property rights worldwide, whether registered or unregistered, including but not limited to patents, copyrights, trademarks, service marks, trade names, trade secrets, database rights, design rights, moral rights, and all applications, renewals, extensions, and restorations thereof.

"Organization" means a legal entity (including but not limited to corporations, partnerships, universities, hospitals, research institutions, or government agencies) that subscribes to the Service and under which individual Users are granted access. Organizations function as independent tenants within the Platform's multi-tenant architecture.

"Organization Administrator" means a User who has been granted administrative privileges for a specific Organization, including the authority to manage membership, assign roles, configure organizational settings, and control access to organizational data.

"Personal Data" or "Personal Information" means any information relating to an identified or identifiable natural person, as defined under applicable privacy legislation, including PIPEDA and GDPR.

"Personal Health Information" or "PHI" means personal health information as defined under Ontario's Personal Health Information Protection Act, 2004 ("PHIPA"), protected health information as defined under the U.S. Health Insurance Portability and Accountability Act ("HIPAA"), and equivalent health information under other applicable law.

"Platform IP" means all Intellectual Property Rights in and to the Service, including all software, source code, object code, algorithms, databases, user interfaces, visual designs, documentation, trademarks, service marks, trade names, logos, and other intellectual property owned by or licensed to the Company.

"Project" means a user-defined project managed within the Service, representing a discrete body of work associated with an Innovation or Organization, and serving as a container for related Activities.

"Reference Document" or "Reference Library" means the document management system within the Service that enables Organizations to upload, categorize, search, and curate documents with configurable access controls, expert verification flags, community voting, and expiration management.

"Service" means the Bridgit Platform and all associated services, features, functionality, content, and materials provided by the Company, as described in Section 3.

"Subscription" means the User's or Organization's paid or trial access to the Service for a specified term and subscription tier, as governed by Section 10.

"Terms" or "Agreement" means these Terms of Service, including all schedules, exhibits, and policies incorporated by reference.

"User" or "you" means any individual or entity that creates an account, accesses, or uses the Service, including both individual subscribers and Authorized Users acting on behalf of Organizations.

"User Content" means all data, documents, text, images, files, innovations, projects, activities, form responses, reference materials, and other content created, uploaded, submitted, or transmitted by Users through the Service, as further described in Section 8.

3. DESCRIPTION OF THE SERVICE

3.1 Overview

The Bridgit Platform ("Service") is a business-to-business software-as-a-service ("SaaS") innovation management platform designed to assist organizations in managing healthcare and research innovation processes from ideation through commercialization. The Service is provided exclusively for business, research, and institutional purposes and is not intended for personal, consumer, or household use.

3.2 Core Functionality

The Service provides the following capabilities:

3.2.1 Innovation Tracking and Workflow Management

The Service enables organizations to create, track, and manage innovation initiatives through a structured hierarchy of organizations, innovations, projects, and activities. Users design and execute structured workflows using a configurable form builder supporting multiple question types, conditional logic, variable substitution, and version-controlled form templates. Activity instances serve as the primary unit of data collection and workflow completion across all entity types.

3.2.2 Multi-Organization Support and Role-Based Access Control

The Service operates on a multi-tenant architecture in which each subscribing organization functions as an independent tenant. Access is membership-based and denied by default. It is governed by platform-level roles (system administrator and regular user) and by scoped memberships. There are three membership roles (administrator, member, and lead), each of which can be granted at the organization, project, innovation, or activity level. Memberships may be given an expiry date. Membership, permissions, and visibility rules are enforced at each organizational level.

3.2.3 AI-Assisted Features

The Service incorporates artificial intelligence capabilities provided by third-party large language model providers (currently Anthropic and OpenAI, as described in Section 6.4) to assist users with form field content generation, research summarization, and context-aware content drafting. AI features include retrieval-augmented generation from uploaded reference documents and optional web and literature search integration. AI features are assistive; users are responsible for reviewing outputs. AI-generated content is not intended to constitute professional, medical, legal, or regulatory advice. AI-Assisted Features are subject to the specific terms and limitations set forth in Section 6.

3.2.4 Document Management and Reference Library

The Service includes a reference document library enabling organizations to upload, categorize, search, and curate documents with configurable access controls (private, internal, public, curated), expert verification flags, community voting, feedback mechanisms, and expiration management. Evidence and file attachments may be associated with projects, innovations, and activity instances.

3.2.5 Compliance and Policy Management

The Service provides tools for managing compliance controls mapped to recognized frameworks (including ISO 27001, SOC 2, GDPR, and PIPEDA), data retention policies with configurable schedules per data category, legal hold management to suspend automated data deletion during litigation or regulatory proceedings, consent management (consent withdrawal by email to the Privacy Officer; in-app withdrawal is planned), and audit logging of data changes, permission changes, security events, and privileged access.

The Company's infrastructure and security practices are designed to align with ISO 27001 and SOC 2 Trust Services Criteria. However, Bridgit is not currently certified under ISO 27001 or SOC 2 unless otherwise expressly stated in writing. References to these frameworks indicate design intent and best-practice alignment, not formal certification status.

3.2.6 Embedded Forms for Public Data Collection

The Service permits authorized users to publish activities as embeddable forms accessible without authentication, subject to configurable domain restrictions and the Service's rate limiting. Public submissions may be anonymous, identified by email, or named, and are tracked through session tokens.

3.2.7 Collaboration

The Service supports collaborative editing of activities, invitation and join-request workflows, a communications center aggregating organizational interactions, and notification delivery.

3.3 Limitations and Disclaimers

3.3.1 Not a Medical Device or Clinical Tool

THE SERVICE IS AN INNOVATION MANAGEMENT AND WORKFLOW TOOL. IT IS NOT A MEDICAL DEVICE, CLINICAL DECISION SUPPORT SYSTEM, DIAGNOSTIC TOOL, ELECTRONIC HEALTH RECORD SYSTEM, OR TELEHEALTH PLATFORM.

The Service does not provide clinical recommendations, treatment planning, patient care coordination, or any functionality subject to regulation as a medical device under the Medical Devices Regulations (SOR/98-282) or equivalent legislation in any jurisdiction. The Service is not designed to process personal health information, including personal health information as defined under Ontario's Personal Health Information Protection Act, 2004 ("PHIPA") and protected health information under HIPAA. Customers must not submit such information unless a written agreement with the Company expressly permits it.

Users are solely responsible for ensuring that their use of the Service complies with all applicable healthcare regulations, professional standards, and ethical guidelines. The Service must not be used for direct patient care, clinical diagnosis, treatment decisions, or any purpose requiring regulatory approval as a medical device.

3.3.2 AI-Generated Content Disclaimer

AI-generated content provided through the Service is produced by third-party models and is furnished on an "as-is" basis. AI output may contain inaccuracies, omissions, or content that is incomplete, outdated, or unsuitable for the User's specific circumstances. Users are solely responsible for reviewing, validating, and assuming responsibility for any AI-generated content prior to reliance, publication, or use in decision-making processes. The Company makes no representations or warranties regarding the accuracy, completeness, reliability, or suitability of AI-generated content for any particular purpose.

3.4 Service Modifications

The Company reserves the right to modify, suspend, or discontinue any aspect of the Service, including features, functionality, integrations, or supported AI providers and models, at any time. Adding a sub-processor that processes customer content, including a new AI provider, requires at least 30 days' notice as set out in the Vendor Management Policy. The Company will make commercially reasonable efforts to provide advance notice of material changes that adversely affect core functionality, but is under no obligation to do so where changes are necessary for security, legal compliance, or operational reasons.

4. ELIGIBILITY AND ACCOUNT TERMS

4.1 Eligibility Requirements

4.1.1 Age Requirement

You must be at least eighteen (18) years of age to register for or use the Service. The Service is not directed to, and may not be used by, any individual under the age of eighteen (18). By creating an account, you represent and warrant that you meet this minimum age requirement.

4.1.2 Organizational Authorization

The Service is provided on a business-to-business basis to organizations that subscribe to the Bridgit Platform. Individual user accounts may only be created by persons who are authorized representatives, employees, contractors, or affiliates of a subscribing organization ("Authorized Users"). By registering for an account, you represent and warrant that:

(a) You are authorized by your organization to create an account and access the Service on behalf of that organization;

(b) You have the legal capacity and authority to bind your organization to these Terms of Service;

(c) Your use of the Service is within the scope of your employment, engagement, or affiliation with the subscribing organization; and

(d) Your organization has entered into a valid subscription agreement with Core Innovation Corp. or is otherwise authorized to use the Service.

4.1.3 Prohibited Users

You may not create an account or use the Service if:

(a) You are under the age of eighteen (18);

(b) You have been previously suspended or terminated from the Service for violation of these Terms or any applicable policy;

(c) You are prohibited from accessing or using the Service under applicable law or regulation;

(d) You are located in, or are a resident or national of, any jurisdiction subject to comprehensive sanctions administered by the Office of Foreign Assets Control of the United States Department of the Treasury, the Canadian Special Economic Measures Act, or equivalent sanctions regimes; or

(e) Your registration or use would violate any applicable law, regulation, or legal obligation.

4.2 Account Registration

4.2.1 Registration Methods

You may register for an account through one of the following methods:

(a) Google OAuth Authentication. You may authenticate using your existing Google account credentials through OAuth 2.0 protocol. By selecting this method, you authorize Core Innovation Corp. to access your Google account profile information (including name and email address) solely for the purpose of account creation and authentication. Your use of Google OAuth is subject to Google's terms of service and privacy policy.

(b) Email and Password Registration. You may register by providing a valid email address and creating a password that meets the Service's security requirements. Password requirements are established to protect account security and may be updated from time to time at Core Innovation Corp.'s discretion.

4.2.2 Registration Information Accuracy

You agree to provide accurate, current, and complete information during the registration process and to maintain and promptly update your account information to keep it accurate, current, and complete. You represent and warrant that:

(a) All registration information you submit is truthful, accurate, and complete;

(b) The email address you provide is valid, actively monitored by you, and under your exclusive control;

(c) You will maintain the accuracy of such information throughout the term of your account; and

(d) You will promptly notify Core Innovation Corp. of any changes to your registration information through the account settings interface or by contacting support.

Failure to provide or maintain accurate registration information may result in suspension or termination of your account and may constitute a material breach of these Terms.

4.2.3 One Account Per Person

Each individual user may maintain only one (1) active account on the Service. You may not:

(a) Create multiple accounts for the same individual;

(b) Share your account credentials with any other person;

(c) Allow any other person to access the Service using your account;

(d) Create an account on behalf of another individual without express authorization; or

(e) Transfer, sell, or assign your account to any other person without the prior written consent of Core Innovation Corp.

Shared accounts, duplicate accounts, and unauthorized account transfers are prohibited and may result in immediate suspension or termination of all associated accounts without notice.

4.3 Organizational Access Control

4.3.1 Organization Administrator Authority

Each subscribing organization designates one or more Organization Administrators who have authority to control membership, assign roles, and manage access permissions for that organization's tenant within the Service. Organization Administrators have primary authority to:

(a) Approve or deny requests to join the organization;

(b) Invite new users to create accounts and join the organization;

(c) Assign, modify, or revoke user roles and permissions within the organization;

(d) Remove users from the organization;

(e) Establish organizational policies governing user conduct and data management; and

(f) Configure organizational settings, including security controls and data retention policies.

Bridgit system administrators can also change memberships, subject to the "Require explicit access" setting, which an Organization Administrator can turn on to block Bridgit system administrator access to the organization's data at the organization level unless a system administrator is explicitly granted access; extending the block to every access path is being verified.

4.3.2 Subordinate Administrator Roles

Organization Administrators may delegate administrative authority for specific entities within the organizational hierarchy by granting a membership with the administrator role at that entity's scope. The Service has three membership roles (administrator, member, and lead); the administrators below are administrator-role memberships at a narrower scope, not separate roles:

(a) Project Administrators: Users with an administrator-role membership in a designated project, who exercise administrative control over that project and its associated activities;

(b) Innovation Administrators: Users with an administrator-role membership in a designated innovation, who exercise administrative control over that innovation and its associated activities; and

(c) Activity Administrators: Users with an administrator-role membership in a specific activity instance, who exercise administrative control over that activity instance.

Each such membership is scoped to the specific entity for which authority has been delegated and does not extend to organization-wide administration.

4.3.3 Membership Compliance

You acknowledge and agree that your access to the Service is contingent upon your continued membership in good standing within your organization. Your organization, through its Organization Administrator, may terminate your membership at any time for any reason or no reason. Upon termination of your organizational membership:

(a) Your access to the Service will be immediately suspended or revoked;

(b) You will lose access to all organizational data, projects, innovations, and activities;

(c) Your account may be deactivated or deleted in accordance with the organization's data retention policies; and

(d) You will have no claim against Core Innovation Corp. arising from such termination of organizational membership.

4.4 Waitlist and Approval Process

4.4.1 Waitlist Registration

New users seeking to join an existing organization may submit a request to join through the Service's waitlist functionality. Waitlist requests require:

(a) Submission of required registration information;

(b) Specification of the organization the user seeks to join; and

(c) Any additional information requested by the organization or required by organizational policy.

4.4.2 Administrator Approval Requirement

All waitlist requests are subject to approval by an Organization Administrator of the target organization. Organization Administrators have sole discretion to approve or deny waitlist requests and are under no obligation to approve any particular request or provide reasons for denial. Core Innovation Corp. exercises no control over organizational membership decisions and assumes no responsibility for approval or denial of waitlist requests.

4.4.3 Provisional Access

In certain cases, Organization Administrators may grant provisional or limited access to users pending full membership approval. Provisional access is subject to:

(a) Restrictions on permissions, roles, and data access as determined by the Organization Administrator;

(b) Time limitations established by the organization;

(c) Revocation at any time without notice; and

(d) Conversion to full membership or termination at the Organization Administrator's discretion.

4.4.4 Invitation-Based Registration

Organization Administrators may invite prospective users to join the organization by sending email invitations through the Service. Invited users may register by:

(a) Following the unique registration link provided in the invitation email;

(b) Completing the registration process within the validity period of the invitation; and

(c) Accepting these Terms of Service and any additional organizational policies.

Invitation links are unique, non-transferable, and may be used only by the intended recipient. Expired invitations may be reissued at the Organization Administrator's discretion.

4.5 Account Security

4.5.1 Credential Security Obligations

You are solely responsible for maintaining the confidentiality and security of your account credentials, including your password and any authentication tokens. You agree to:

(a) Create a strong password that meets or exceeds the Service's minimum security requirements;

(b) Not disclose your password to any third party;

(c) Not use the same password for the Service that you use for any other online service or account;

(d) Store your credentials securely and protect them from unauthorized access;

(e) Immediately notify Core Innovation Corp. of any unauthorized use of your account or any other breach of security; and

(f) Take all reasonable steps to prevent unauthorized access to your account.

4.5.2 Multi-Factor Authentication

Core Innovation Corp. strongly recommends that all users enable multi-factor authentication ("MFA") for their accounts. MFA is available to all users using a standard authenticator app (TOTP) with one-time backup codes, and is enabled by each user. Organization-level enforcement of MFA is not currently available. You acknowledge that failure to enable MFA may increase the risk of unauthorized access to your account.

4.5.3 Liability for Account Activity

You are responsible for all activities that occur under your account, whether or not authorized by you. You agree to immediately notify Core Innovation Corp. of any unauthorized use of your account or any other security breach. Core Innovation Corp. will not be liable for any loss or damage arising from your failure to maintain the security of your account credentials.

5. ACCEPTABLE USE POLICY

5.1 Permitted Uses

You may use the Bridgit Platform for the following purposes:

(a) Innovation Management: Creating, tracking, and managing healthcare and research innovation initiatives, projects, and activities through the platform's workflow management capabilities;

(b) Form Creation and Completion: Designing structured forms using the form builder, completing activity instances, and managing data collection workflows;

(c) Collaboration: Inviting team members, sharing projects and innovations within your organization, participating in collaborative editing, and communicating through the platform's collaboration features;

(d) AI-Assisted Content Generation: Using AI features to draft form field content, summarize research materials, and generate context-aware suggestions, provided you review and validate all AI-generated content before relying upon it;

(e) Document Management: Uploading, organizing, categorizing, and sharing reference documents, research materials, and supporting evidence within the reference library, subject to applicable access controls;

(f) Public Data Collection: Publishing embeddable forms for external data collection, subject to appropriate domain restrictions;

(g) Compliance Tracking: Using compliance management tools to map controls to recognized frameworks and manage organizational policies; and

(h) Policy Documentation: Generating and publishing completed policy documents through the platform's workflow features.

5.2 Prohibited Uses

You may not use the Bridgit Platform for any of the following purposes:

5.2.1 Clinical and Medical Misuse

(a) Clinical Decision Support: Using the platform as a clinical decision support system, diagnostic tool, treatment planning system, or for any direct patient care activities;

(b) Medical Device Functionality: Attempting to use the platform as a medical device, electronic health record system, telehealth platform, or patient care coordination tool;

(c) Health Information: Uploading, storing, or transmitting personal health information (as defined under PHIPA or other applicable law) or patient identifiers, unless a written agreement with the Company expressly permits it.

5.2.2 Security and System Integrity

(a) Malicious Code: Uploading, transmitting, or introducing viruses, malware, ransomware, trojans, worms, logic bombs, or any other harmful or malicious code;

(b) Unauthorized Access: Attempting to bypass, circumvent, disable, or interfere with security features, access controls, authentication mechanisms, or role-based permissions;

(c) System Exploitation: Probing, scanning, or testing the vulnerability of the platform or any related systems without prior written authorization;

(d) Credential Sharing: Sharing login credentials, using shared accounts, or allowing unauthorized individuals to access the platform using your credentials;

(e) Reverse Engineering: Reverse engineering, decompiling, disassembling, or attempting to derive source code from the platform or its AI features.

5.2.3 Data Extraction and Automation

(a) Automated Access: Using robots, spiders, scrapers, crawlers, or other automated means to access, extract, or download data from the platform without express written permission;

(b) Excessive Usage: Engaging in usage patterns that place unreasonable or disproportionately large loads on the platform infrastructure;

(c) Data Mining: Systematically extracting or harvesting data for purposes unrelated to legitimate innovation management activities.

5.2.4 Content and Intellectual Property

(a) False Information: Submitting false, misleading, inaccurate, or intentionally deceptive information through forms, activities, or any platform feature;

(b) Defamatory Content: Publishing defamatory, libelous, slanderous, or otherwise unlawful content about individuals, organizations, or entities;

(c) Intellectual Property Infringement: Using AI features or any platform functionality to generate, reproduce, or distribute content that infringes upon third-party copyrights, trademarks, patents, trade secrets, or other intellectual property rights;

(d) Plagiarism: Submitting content generated by AI or other sources as original work without appropriate attribution or disclosure.

5.2.5 Legal and Regulatory Violations

(a) Unlawful Activity: Using the platform to violate any applicable federal, provincial, state, or local law, regulation, or ordinance;

(b) Export Control Violations: Using the platform in violation of Canadian or international export control laws or economic sanctions;

(c) Privacy Violations: Collecting, using, or disclosing personal information in violation of applicable privacy laws, including PIPEDA, PHIPA, GDPR, or provincial privacy legislation;

(d) Unauthorized Research: Conducting research involving human subjects without appropriate ethics board approval, informed consent, or institutional authorization.

5.2.6 Harmful Conduct

(a) Harassment: Harassing, threatening, intimidating, or abusing other users or platform administrators;

(b) Impersonation: Impersonating another person, organization, or entity, or falsely representing your affiliation with any person or organization;

(c) Interference: Interfering with or disrupting the platform's operation, servers, networks, or other users' access to and use of the platform.

5.3 Consequences of Violation

Violation of this Acceptable Use Policy may result in:

(a) Immediate suspension or termination of your account and access to the platform;

(b) Removal of content that violates this policy;

(c) Notification to your organization's administrator;

(d) Referral to law enforcement authorities where conduct may constitute a criminal offense;

(e) Legal action to recover damages and obtain injunctive relief.

Core Innovation Corp. reserves the right to investigate suspected violations of this policy and to cooperate with law enforcement authorities in prosecuting users who violate the law.

5.4 Reporting Violations

If you become aware of any violation of this Acceptable Use Policy, please report it immediately to: info@askbridgit.ai. Security vulnerabilities should be reported to info@askbridgit.ai.

6. AI-ASSISTED FEATURES — DISCLAIMER AND TERMS

6.1 Nature of AI Features

The Service integrates artificial intelligence capabilities provided by third-party large language model providers, currently Anthropic (Claude) and OpenAI (collectively, "AI Providers"), as described in Section 6.4. AI-assisted features are available for form field content generation, research summarization, context-aware drafting, and general workflow assistance.

AI features are assistive; users are responsible for reviewing outputs. AI features run when a user initiates them, for example by selecting an AI action or by submitting a form whose template has been configured by an administrator to generate AI content on submission. The Service does not use AI output to make automated decisions about individuals.

Human review. In most AI features, the AI output is shown as a draft that the user can apply or discard, and applied text remains editable. A form template can also be set up to run AI when the form is submitted. That output is saved to the form without a preview step, so each organization decides whether its templates use this feature and should review that output. Decisions, and any content submitted outside the Service, remain the responsibility of the user and the user's organization.

Pausing AI. Organization administrators can disable AI providers for their organization (section 6.7). On request from an organization administrator or the organization's designated contact, Bridgit will disable AI features for that organization.

6.2 No Professional Advice

AI-generated content does not constitute, and shall not be construed as, professional, legal, medical, clinical, regulatory, financial, or any other form of expert advice. AI output is furnished on an "as-is" basis and may contain inaccuracies, omissions, or content that is incomplete, outdated, or unsuitable for the User's specific circumstances.

Known limitations. AI models can produce text that is wrong, out of date or made up, including references and citations that do not exist. The models are general-purpose models trained by their providers. Bridgit does not train or tune them, and they are not designed or validated for any particular patient or research population, including children. Their output can reflect biases in the data they were trained on. Bridgit has not carried out its own evaluation of the accuracy or bias of its AI drafting features. Literature search results come from PubMed itself, not from the model; any AI summary of those results is AI output and has the same limitations. The providers publish information about their models' known limitations.

6.3 User Responsibility

Users are solely responsible for reviewing, verifying, and validating the accuracy, completeness, and suitability of all AI-generated content prior to reliance, publication, or incorporation into any decision-making process. The User assumes all risk associated with the use of AI-generated content.

When using AI features, users must:

(a) check every fact, reference and citation in AI output against the original source before relying on it or submitting it anywhere, because AI can invent references;

(b) not enter personal health information, patient identifiers or other restricted data (section 6.5);

(c) follow their organization's own rules on the use of AI, including any requirement to disclose AI assistance to an ethics board, journal, funder or other recipient.

6.4 Data Processing by AI Providers

To deliver AI-assisted functionality, the Service transmits contextual data to the AI Provider's application programming interface. This data may include the content of the user's prompt, form field values relevant to the current workflow, entity metadata (such as project, organization, and innovation context), the user's name and role, the content of uploaded or reference documents used for retrieval-augmented generation, and web or literature search results where those features are enabled.

The AI Providers and search services currently used, and where they process data, are:

Each provider's commercial / API terms apply, including no training on API data and retention as published by that provider (currently up to 30 days by default). The Company does not currently hold signed data processing agreements with the AI Providers. However, Users acknowledge that data processing by AI Providers is subject to such providers' respective terms of service and data processing terms, which Bridgit does not control. Users should review the applicable AI Provider's terms for their specific data handling practices.

Other AI providers. Anthropic (Claude) and OpenAI are the AI providers configured in production and used routinely. The platform also supports Google (Gemini), Cohere, Mistral, Perplexity, DeepSeek and Microsoft Azure OpenAI; these are available but are not currently enabled in production. Enabling one, platform-wide or for an organization that selects it, would add a sub-processor that processes the request content (in the United States, or the location stated in the notice) under that provider's commercial / API terms, and we would give customers at least 30 days' notice first.

6.5 Sensitive Data Restrictions

The Service is not designed to hold personal health information. Users must not enter personal health information (as defined under PHIPA or other applicable law) or patient identifiers anywhere in the Service, including AI-assisted features, unless a written agreement with the Company expressly permits it. Patient identifiers include, for example, patient or family names, medical record numbers, health card numbers, dates of birth, addresses, photographs, scans, and free-text case details that could identify a patient.

Users must also not input other sensitive personal data, such as social insurance numbers, financial account numbers, or other categories of data subject to heightened regulatory protection, into AI-assisted features, unless such use is expressly authorized by the User's organization under its own data governance policies and a written agreement with Bridgit permits it.

The Service has no automated filter that detects or blocks personal health information or other sensitive data. Compliance with this Section is the responsibility of the User and the User's Organization. Bridgit disclaims all liability for any sensitive data submitted to the Service or to AI Providers through the Service in violation of this Section.

6.6 AI Feature Availability

AI-assisted features depend on the availability and performance of third-party AI Providers. Such features may be temporarily unavailable, degraded, or discontinued due to AI Provider outages, rate limits, API changes, or other circumstances beyond Bridgit's reasonable control. Any such interruption does not constitute a breach of this Agreement or entitle the User to service credits unless otherwise specified in an applicable Institutional Agreement.

6.7 Administrative Controls

Organization administrators may enable, disable, or configure AI Providers and AI-assisted features at the organization level through the Service's administrative settings. The selection of AI Provider and model is configurable. The optional web search feature (powered by Tavily) may be independently enabled or disabled through the AI Services settings.

6.8 AI Interaction Data

Bridgit records metadata about AI requests (time, user, organization, AI provider and model, token counts, cost, IP address and browser; not the text of prompts or responses) for billing, security and troubleshooting, retained per the Data Retention Policy. The AI assistant's conversation history is saved to your account so you can continue it across devices, and you can clear it at any time. AI-generated text you apply to a form is stored as part of that form. Bridgit does not use your prompts or content to train AI models, and does not use customer content for product development beyond aggregated usage metrics.

Bridgit reserves the right to retain anonymized, aggregated usage metrics (such as request volume, error rates, and feature adoption statistics) indefinitely for service monitoring and improvement purposes, provided such metrics cannot be used to identify individual users or reconstruct specific AI interactions.

7. INTELLECTUAL PROPERTY RIGHTS

7.1 Platform Ownership

The Service, including all software, source code, object code, algorithms, databases, user interfaces, visual designs, documentation, trademarks, service marks, trade names, logos, and all other intellectual property embodied in or associated with the platform (collectively, "Platform IP"), is and shall remain the exclusive property of Core Innovation Corp. and its licensors.

All rights, title, and interest in and to the Platform IP, including all patents, copyrights, trade secrets, and other intellectual property rights, are owned by or licensed to the Company. No rights are transferred to the User except as expressly set forth in this Agreement.

7.2 License to Use the Service

Subject to the User's compliance with this Agreement, the Company grants the User a limited, non-exclusive, non-transferable, non-sublicensable, revocable license to access and use the Service during the subscription term solely for the User's internal business purposes.

This license does not permit the User to:

(a) Reverse engineer, decompile, disassemble, or otherwise attempt to derive the source code of the Service;

(b) Copy, modify, adapt, translate, or create derivative works based on the Service;

(c) Remove, alter, or obscure any proprietary notices (including copyright and trademark notices) on the Service;

(d) Rent, lease, sell, sublicense, distribute, or otherwise transfer rights to the Service;

(e) Use the Service to develop a competing product or service; or

(f) Access the Service for benchmarking or competitive analysis purposes.

7.3 User Content Ownership

Users and their subscribing organizations retain all ownership rights in and to any data, documents, text, images, files, innovations, projects, activities, form responses, reference materials, and other content created, uploaded, or submitted through the Service (collectively, "User Content").

The Company claims no ownership interest in User Content. Users are solely responsible for the accuracy, legality, and appropriateness of all User Content.

7.4 License to Process User Content

To operate the Service and provide the functionality described in Section 3, Users grant the Company a worldwide, non-exclusive, royalty-free license to host, store, reproduce, display, transmit, process, and perform User Content solely to the extent necessary to:

(a) Deliver the Service to the User and authorized members of the User's organization;

(b) Maintain, support, and improve the Service;

(c) Enforce this Agreement and respond to legal obligations; and

(d) Generate anonymized, aggregated analytics that do not identify the User or any individual.

This license includes the right to make archival or backup copies of User Content for disaster recovery and business continuity purposes.

7.5 Termination of Content License

The license granted in Section 7.4 terminates when the User deletes User Content from the Service or when the User's account is closed, except that:

(a) The Company may retain User Content for the duration of any applicable data retention period set forth in the User's organization's data retention policies or as required by law;

(b) User Content subject to a legal hold will be retained until the hold is lifted;

(c) Anonymized, aggregated data derived from User Content may be retained indefinitely; and

(d) Backup copies may persist in the Company's disaster recovery systems after deletion. Automated daily database backups age out within seven (7) days. Full database exports taken before each production release are stored in Montréal and are kept with no automatic expiry today.

Upon expiration of all applicable retention periods, the Company will delete or anonymize User Content in accordance with the Data Retention Policy referenced in Section 9.

7.6 AI-Generated Content

Content generated through the Service's AI-assisted features (as described in Section 6) is produced by third-party AI Providers using large language models. The Company makes no claim of ownership or authorship over AI-generated content.

Users acknowledge that:

(a) AI-generated content may not be eligible for copyright protection under applicable law;

(b) AI-generated content may inadvertently resemble or incorporate third-party works, and Users assume sole responsibility for ensuring that any AI-generated content they choose to use does not infringe third-party intellectual property rights;

(c) The User is solely responsible for reviewing, validating, and assuming liability for any AI-generated content prior to publication, reliance, or distribution; and

(d) The Company provides AI-generated content on an "as-is" basis without warranty of originality, accuracy, or non-infringement.

7.7 Template Library and Compliance Frameworks

The Service includes pre-built activity templates, form structures, compliance control mappings (including ISO 27001, SOC 2, GDPR, and PIPEDA frameworks), and other reference materials provided by the Company (collectively, "Templates").

Templates are licensed to Users for use exclusively within the Service. Users may customize, duplicate, and deploy Templates within their organization's workspace on the platform.

Users may not:

(a) Extract Templates from the Service for use in external systems;

(b) Redistribute, resell, or sublicense Templates to third parties; or

(c) Claim ownership or authorship of Templates provided by the Company.

Customizations and derivative works created by Users based on Templates are considered User Content and are subject to Section 7.3.

7.8 Feedback and Suggestions

If a User provides the Company with feedback, suggestions, enhancement requests, or recommendations regarding the Service ("Feedback"), the Company may use such Feedback without restriction or obligation to the User. The User hereby assigns to the Company all rights, title, and interest in and to any Feedback and waives any claims based on intellectual property rights, confidentiality, or compensation related to the Company's use of Feedback.

7.9 Third-Party Components

The Service may incorporate or depend upon third-party software components, libraries, and services, each of which is subject to its own license terms. The Company's use of such components does not transfer ownership or additional rights to Users. A list of material third-party components and their licenses is available upon request.

7.10 Trademark Usage

"Bridgit," "askBridgit," and associated logos are trademarks of Core Innovation Corp. Users may not use the Company's trademarks without prior written consent, except as necessary to identify the Service in factual references (e.g., "powered by Bridgit" in embedded forms, if permitted under the embedding configuration).

8. USER CONTENT AND LICENSING

8.1 User Content Defined

"User Content" means all data, documents, text, images, files, innovations, projects, activities, form responses, reference materials, and other content created, uploaded, submitted, or transmitted by Users through the Service. User Content includes, but is not limited to:

(a) Form submissions and activity completions;

(b) Reference documents uploaded to the reference library;

(c) Project and innovation descriptions;

(d) Communications and messages transmitted through the Service;

(e) Comments, annotations, and feedback; and

(f) Any other content provided by Users or generated through User interaction with the Service.

User Content does not include AI-generated content, which is addressed separately in Section 7.6.

8.2 User Responsibility for User Content

Users are solely responsible for all User Content. Users represent and warrant that:

(a) They have all necessary rights, licenses, consents, and permissions to submit User Content to the Service;

(b) User Content does not infringe or misappropriate any third-party intellectual property rights, privacy rights, publicity rights, or other proprietary rights;

(c) User Content does not violate any applicable law, regulation, or contractual obligation;

(d) User Content does not contain any viruses, malware, or other harmful code;

(e) User Content does not contain any defamatory, obscene, abusive, or otherwise objectionable material; and

(f) User Content complies with this Agreement, including the Acceptable Use Policy set forth in Section 5 and the health information restrictions in Sections 5.2.1(c) and 6.5.

8.3 Monitoring and Removal

The Company has no obligation to monitor User Content but reserves the right to review, monitor, and remove User Content that, in the Company's sole discretion:

(a) Violates this Agreement or any applicable law;

(b) Infringes third-party intellectual property rights;

(c) Contains malicious code or poses a security threat;

(d) Is the subject of a valid takedown notice or legal demand; or

(e) Otherwise poses a risk to the Service, other users, or the Company.

The Company will make reasonable efforts to notify Users before removing User Content, except where immediate removal is necessary to address security threats, legal obligations, or violations of this Agreement.

8.4 Backup and Retention

The Company performs automated backups of User Content as part of its disaster recovery procedures, as described in Section 11.5. However, Users are solely responsible for maintaining their own backup copies of User Content. The Company is not liable for any loss, corruption, or deletion of User Content, whether caused by User action, system failure, or any other cause.

Upon termination of a User's account or subscription, User Content will be retained or deleted in accordance with the Data Retention Policy referenced in Section 9 and with Section 14.6.

8.5 Public Submissions via Embedded Forms

Users may publish activities as embeddable forms accessible to the public without authentication. Content submitted through such embedded forms ("Public Submissions") is subject to the following:

(a) Public Submissions are considered User Content of the Organization that published the embedded form;

(b) The publishing Organization is responsible for ensuring that the embedded form complies with applicable privacy laws and includes appropriate notices regarding data collection and use;

(c) Public Submissions may be anonymous, identified by email, or named, as configured by the publishing Organization;

(d) The Company processes Public Submissions on behalf of the publishing Organization as a Data Processor; and

(e) The publishing Organization must configure appropriate domain restrictions to prevent abuse, and must not use embedded forms to collect personal health information except as permitted under Section 6.5.

9. DATA HANDLING AND PRIVACY

9.1 Data Processing Roles

The Company acts as a Data Processor with respect to personal data submitted to the Service by organizational customers. Each subscribing organization functions as the Data Controller for personal data relating to its end users, project participants, and innovation stakeholders. The organization determines the purposes and means of processing such personal data through its use of the Service.

The Company processes personal data solely on behalf of and in accordance with documented instructions from the Data Controller, as set forth in this Agreement and any applicable Data Processing Agreement ("DPA").

9.2 Data Processing Agreement

Where a customer organization requires it, the Company will enter into a Data Processing Agreement (including, for Ontario health-sector customers, a privacy schedule addressing PHIPA electronic service provider obligations). Any such agreement takes precedence over these Terms to the extent of any conflict.

Organizations requiring a DPA or privacy schedule to satisfy regulatory or contractual requirements may request one by contacting the Company at the address in Section 17.

9.3 Applicable Privacy Laws

The Company processes personal data in accordance with the Personal Information Protection and Electronic Documents Act ("PIPEDA") and applicable provincial privacy legislation in Canada. Where the Service processes personal data of individuals located in the European Economic Area, the United Kingdom, or other jurisdictions subject to the General Data Protection Regulation ("GDPR"), the Company processes it in accordance with the GDPR requirements that apply to it as a Data Processor.

9.4 Data Residency

Data stored by the Service, including the application database, uploaded files, and application logs, is stored in Google Cloud's Montréal region (northamerica-northeast1), Québec, Canada. Full database exports taken before each production release are also stored in the Montréal region. Automated database backups are stored in the Montréal region. Other hosting regions are not currently offered.

Personal information leaves Canada in the following cases:

(a) When a user invokes an AI feature or an optional web or literature search, the data described in Section 6.4 is processed by the listed providers in the United States;

(b) Transactional email is sent through Google's Gmail API, and optional Google sign-in uses Google OAuth, which process the user's email address, name and message content in the United States or globally; and

(c) Billing is processed by Stripe, which processes billing contact and subscription information in the United States or globally. Payment card details are collected and held by Stripe and are not stored by Bridgit.

9.5 Security Measures

The Company implements technical and organizational security measures designed to protect personal data against unauthorized access, disclosure, alteration, and destruction. Such measures include, but are not limited to:

(a) Encryption of data in transit using Transport Layer Security (TLS). A minimum of TLS 1.2 is enforced.;

(b) Encryption of data at rest by Google Cloud using AES-256 with Google-managed keys, and additional application-level AES-256-GCM encryption of stored integration credentials;

(c) Membership-based, default-deny role-based access controls and least-privilege access principles;

(d) Multi-factor authentication (MFA) available to all users;

(e) Audit logging of data changes, permission and role changes, security events (including account lockouts, sign-ins, sign-outs and failed sign-ins, MFA changes and consent changes) and privileged access, plus infrastructure access logs;

(f) Security review of changes; and

(g) Incident response and breach notification procedures, including notice to the affected customer organization's designated contact without undue delay, and at the first reasonable opportunity after confirming a security incident involving that customer's data.

A detailed description of the Company's security controls is available in the Information Security Policy, accessible at https://askbridgit.ai/api/v1/legal/policies/information-security-policy.

9.6 Data Subject Rights

Users may exercise rights under applicable privacy laws, including the right to access, rectify, erase, restrict processing of, object to processing of, and request portability of their personal data. Requests to exercise such rights should be submitted through the mechanisms described in the Privacy Policy or by contacting the Company's Privacy Officer at the contact information provided in Section 17 (Contact Information).

The Company will respond to verified requests within thirty (30) days, extendable by up to thirty (30) more days with written notice. Where the Company acts as Data Processor, certain requests may be redirected to the relevant Data Controller for fulfillment.

9.7 Data Retention and Deletion

Personal data is retained in accordance with the Company's Data Retention Policy, available at https://askbridgit.ai/api/v1/legal/policies/data-retention-policy. Retention periods vary by data category and are determined based on legal, regulatory, operational, and business requirements. Retention periods are configured in the platform; automated enforcement is not yet in place, and expired records are deleted or anonymized (audit logs: flagged for review) when the retention job is run.

Upon a request to delete a User account, personal data associated with the account is subject to a thirty (30) day grace period, during which the deletion may be cancelled. Following expiration of the grace period, the account and its personal data are deleted by a weekly deletion job, run on Sundays, within 7 days after the grace period ends, except as described in the Data Retention Policy. Data may also be kept where retention is required by law or a valid legal hold is in effect. Copies in backups age out as described in Section 7.5(d). The treatment of an Organization's data at the end of its subscription is described in Section 14.6.

9.8 Legal Holds

The Company may temporarily suspend automated data deletion where required to comply with a legal hold, litigation hold, regulatory investigation, court order, or other legal obligation. During the pendency of a legal hold, affected data will be preserved and will not be subject to routine deletion schedules. Users will be notified of legal holds to the extent permitted by law.

9.9 Cross-References

For complete information regarding the Company's data handling practices, Users should consult:

(a) The Privacy Policy, which describes how personal data is collected, used, disclosed, and protected;

(b) The Data Retention Policy, which specifies retention periods and deletion procedures for each category of data; and

(c) The Information Security Policy, which details technical and organizational security controls.

These policies are accessible through the Service or at the URLs specified herein and are incorporated into this Agreement by reference.

10. SUBSCRIPTION, BILLING, AND PAYMENT

10.1 Subscription Access

Access to the Service is provided on a subscription basis as specified in the applicable order form, purchase agreement, or as displayed during the subscription activation process. Subscription tiers, features, and limitations are defined at the time of purchase and may be modified by the Company with advance notice as provided herein.

10.2 Fees and Pricing

10.2.1 Quoted Fees

Fees for the Service are those quoted in the applicable order form or Institutional Agreement or, for self-serve subscriptions, those displayed in the Service at the time of purchase. Unless stated otherwise, fees are quoted in Canadian dollars.

10.2.2 Taxes

Fees are exclusive of applicable taxes, including GST/HST and any other sales, use, or value-added taxes, which will be added where required by law. Each party is responsible for its own income taxes.

10.3 Billing and Payment Processing

Self-serve subscriptions are billed through the Company's payment processor, Stripe. Payment card details are collected and held by Stripe and are not stored by the Company. Organizations on an Institutional Agreement may be invoiced, with payment due within thirty (30) days of the invoice date unless the Institutional Agreement states otherwise.

10.4 Trials, Renewal, and Cancellation

Trial access, where offered, is provided for the period and with the features displayed at sign-up. Paid subscriptions continue for the subscription term, and on the renewal terms, shown at purchase. A User may cancel a self-serve subscription through the Service's billing settings; cancellation takes effect at the end of the current paid term. Except where required by law or stated in an Institutional Agreement, fees already paid are non-refundable.

10.5 Changes to Fees

The Company may change its fees for future subscription terms by giving at least thirty (30) days' notice, consistent with Section 1.2. Fee changes do not apply to a term already paid for, or to fees fixed in an Institutional Agreement.

10.6 Late Payment

If fees are not paid when due, the Company may, after giving notice and a reasonable opportunity to pay, restrict paid features or suspend access to the Service until payment is received. Suspension for non-payment does not delete User Content; Section 14.6 applies if the subscription is terminated.

10.7 Institutional Agreements

Where an Organization has an Institutional Agreement, its fees, invoicing, payment terms, renewal, and refund provisions prevail over this Section 10.

11. SERVICE LEVELS AND AVAILABILITY

11.1 Support

Bridgit does not offer a standard published service level agreement. Support hours, response targets, escalation and any availability commitments for institutional customers are set out in the customer's institutional agreement, agreed during onboarding. Absent such an agreement, support is provided on a commercially reasonable efforts basis via support@askbridgit.ai. Routine support and privacy questions are answered within 14 days.

Users may also report problems through the "Report a Problem" link in the Service.

Onboarding, guidance and accessibility. Institutional customers receive onboarding sessions and a user guide at no extra cost, including guidance on the safe use of AI features (sections 6.3 and 6.5). Bridgit's policies are published as web pages at https://askbridgit.ai/api/v1/legal/policies. Bridgit has not assessed the Service or its documentation against an accessibility standard such as WCAG 2.1. On request, Bridgit will provide its policies and onboarding materials in an alternative format.

11.2 Availability

The Company will use commercially reasonable efforts to make the Service available, but does not guarantee any particular level of availability or that the Service will be uninterrupted or error-free. The Service may be unavailable from time to time because of maintenance, updates, security measures, or events outside the Company's reasonable control.

11.3 Third-Party Dependencies

The Service relies on third-party infrastructure and services, including Google Cloud for hosting and the AI Providers and search services described in Section 6.4. Outages or changes affecting those providers may affect the Service. Section 6.6 applies to AI features.

11.4 No Service Credits

Unless an Institutional Agreement provides otherwise, unavailability of the Service does not entitle the User to service credits, refunds, or other compensation.

11.5 Backups and Recovery

The Company keeps automated daily backups of the production database (the seven (7) most recent are retained) and takes a full database export before each production release. Point-in-time recovery is not enabled, so in the event of a failure, data entered after the most recent backup or export (up to twenty-four (24) hours) may not be recoverable. Bridgit has not tested or committed to a recovery time objective.

12. LIMITATION OF LIABILITY AND WARRANTY DISCLAIMER

12.1 Warranty Disclaimer

EXCEPT AS EXPRESSLY SET OUT IN THESE TERMS OR IN AN INSTITUTIONAL AGREEMENT, THE SERVICE, INCLUDING AI-GENERATED CONTENT AND TEMPLATES, IS PROVIDED "AS IS" AND "AS AVAILABLE". TO THE MAXIMUM EXTENT PERMITTED BY LAW, THE COMPANY DISCLAIMS ALL OTHER WARRANTIES AND CONDITIONS, WHETHER EXPRESS, IMPLIED, OR STATUTORY, INCLUDING ANY IMPLIED WARRANTIES OR CONDITIONS OF MERCHANTABILITY, MERCHANTABLE QUALITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, AND NON-INFRINGEMENT, AND ANY WARRANTY THAT THE SERVICE WILL BE UNINTERRUPTED, ERROR-FREE, OR SECURE AGAINST ALL THREATS.

12.2 Exclusion of Indirect Damages

TO THE MAXIMUM EXTENT PERMITTED BY LAW, NEITHER PARTY WILL BE LIABLE TO THE OTHER FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, OR PUNITIVE DAMAGES, OR FOR ANY LOSS OF PROFITS, REVENUE, GOODWILL, OR ANTICIPATED SAVINGS, ARISING OUT OF OR RELATING TO THIS AGREEMENT, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

12.3 Limitation of Liability

TO THE MAXIMUM EXTENT PERMITTED BY LAW, EACH PARTY'S TOTAL AGGREGATE LIABILITY ARISING OUT OF OR RELATING TO THIS AGREEMENT WILL NOT EXCEED THE FEES PAID OR PAYABLE BY THE ORGANIZATION FOR THE SERVICE IN THE TWELVE (12) MONTHS BEFORE THE EVENT GIVING RISE TO THE CLAIM.

12.4 Exceptions

The limitations in Sections 12.2 and 12.3 do not apply to: (a) a party's indemnification obligations under Section 13; (b) a party's gross negligence, fraud, or wilful misconduct; (c) the User's obligation to pay fees; or (d) liability that cannot be limited or excluded under applicable law.

12.5 Basis of the Bargain

The parties agree that the limitations in this Section 12 reflect a reasonable allocation of risk and apply even if a limited remedy fails of its essential purpose. Where an Institutional Agreement sets different limitations, the Institutional Agreement prevails.

13. INDEMNIFICATION

13.1 Indemnification by the User

The User (and, where the User acts for an Organization, the Organization) will defend, indemnify, and hold harmless the Company and its directors, officers, and employees from third-party claims, and the resulting losses, damages, and reasonable costs (including reasonable legal fees), to the extent arising from: (a) User Content; (b) the User's breach of Section 5 (Acceptable Use Policy) or Section 6.5 (Sensitive Data Restrictions), including the submission of personal health information or patient identifiers in breach of these Terms; or (c) the User's violation of applicable law.

13.2 Indemnification by the Company

The Company will defend, indemnify, and hold harmless the User's Organization and its directors, officers, and employees from third-party claims, and the resulting losses, damages, and reasonable costs (including reasonable legal fees), to the extent arising from: (a) a claim that the Service, as provided by the Company and used in accordance with these Terms, infringes a third party's Canadian intellectual property rights; or (b) the Company's breach of its data protection obligations under Section 9 or an applicable Data Processing Agreement.

Section 13.2(a) does not apply to claims arising from User Content, AI-generated content, Templates as modified by the User, combinations with items not provided by the Company, or use of the Service in breach of these Terms. If the Service is, or in the Company's opinion is likely to be, the subject of an infringement claim, the Company may modify the Service to be non-infringing, obtain a licence for continued use, or terminate the affected Subscription and refund prepaid fees for the unused term.

13.3 Procedure

The indemnified party must promptly notify the indemnifying party of the claim, give the indemnifying party sole control of the defence and settlement (provided that no settlement may impose an obligation or admission on the indemnified party without its consent, not to be unreasonably withheld), and provide reasonable cooperation at the indemnifying party's expense.

14. TERM, TERMINATION, AND SUSPENSION

14.1 Term

These Terms apply from the date the User first accepts them or uses the Service and continue until the User's account is closed and any Subscription has ended.

14.2 Termination by the User

A User may stop using the Service at any time and may request deletion of their account through the Service's account settings. Account deletion is subject to the thirty (30) day grace period described in Section 9.7. An Organization may terminate its Subscription in accordance with Section 10.4 or its Institutional Agreement.

14.3 Termination by the Organization

An Organization Administrator may remove a User from the Organization at any time, as described in Section 4.3.3.

14.4 Termination by the Company

The Company may terminate these Terms or a Subscription: (a) if the User or Organization materially breaches these Terms and does not cure the breach within thirty (30) days of written notice; (b) immediately, on notice, for a breach that cannot be cured or that threatens the security or integrity of the Service; or (c) for convenience, on at least ninety (90) days' notice, with a pro-rata refund of prepaid fees for the unused term.

14.5 Suspension

The Company may suspend access to the Service, in whole or in part, where reasonably necessary to: (a) prevent or respond to a security threat or incident; (b) stop use that breaches Section 5 or Section 6.5; (c) comply with law or a legal order; or (d) address non-payment under Section 10.6. The Company will give notice of suspension where practicable, limit the suspension to what is reasonably necessary, and restore access once the cause is resolved.

14.6 Effect of Termination; Data Export and Deletion

On termination, the User's licence to use the Service ends. User Content is handled as follows:

(a) Individual Users can export their own personal data, including their own audit trail, through the Service's personal data export before their account is deleted.

(b) Organizations: For 30 days after a subscription ends, the customer can export its data or request a copy (provided within 14 days of the request); after that period the data is deleted. Exports are provided in a commonly used format. Deletion does not apply where retention is required by law or a legal hold applies.

(c) Copies held in backups age out as described in Section 7.5(d).

(d) Anonymized, aggregated data may be retained as described in Sections 6.8 and 7.5(c).

Where an Institutional Agreement or Data Processing Agreement sets different return or deletion terms, that agreement prevails.

14.7 Survival

Sections 6.3, 6.5, 7, 8.2, 9.7, 9.8, 12, 13, 14.6, 15 and 16, and any other provisions that by their nature are intended to survive, survive termination of these Terms.

15. GOVERNING LAW AND DISPUTE RESOLUTION

15.1 Governing Law

These Terms are governed by the laws of the Province of Ontario and the federal laws of Canada applicable there, without regard to conflict-of-laws principles. The United Nations Convention on Contracts for the International Sale of Goods does not apply.

15.2 Forum

Subject to Section 15.3, the parties submit to the exclusive jurisdiction of the courts located at Ottawa, Ontario, for any dispute arising out of or relating to these Terms or the Service.

15.3 Informal Resolution

Before starting court proceedings, a party will give the other written notice of the dispute, and the parties will try in good faith to resolve it for thirty (30) days. Either party may seek urgent injunctive or other equitable relief at any time to protect its Confidential Information, Intellectual Property Rights, or the security of the Service.

16. GENERAL PROVISIONS

16.1 Entire Agreement

These Terms, together with the policies incorporated by reference and any Institutional Agreement or Data Processing Agreement, are the entire agreement between the parties regarding the Service, and supersede all prior or contemporaneous agreements, proposals, and representations on that subject.

16.2 Order of Precedence

If an Organization has an Institutional Agreement or Data Processing Agreement with the Company, that agreement prevails over these Terms to the extent of any conflict. Otherwise, these Terms prevail over the incorporated policies, as set out in Section 1.3.

16.3 Severability

If any provision of these Terms is held invalid or unenforceable, it will be enforced to the maximum extent permissible and the remaining provisions will remain in full force and effect.

16.4 Assignment

The User may not assign or transfer these Terms without the Company's prior written consent. The Company may assign these Terms, on notice, to an affiliate or to a successor in connection with a merger, acquisition, or sale of all or substantially all of its relevant assets, provided the successor assumes the Company's obligations. Any other purported assignment is void.

16.5 Force Majeure

Neither party is liable for a delay or failure to perform (other than payment obligations) caused by events beyond its reasonable control, including natural disasters, pandemics, war, terrorism, civil unrest, labour disputes, government action, and failures of utilities, networks, or third-party hosting or AI providers. The affected party will notify the other promptly and use reasonable efforts to resume performance.

16.6 Notices

Notices to the Company must be sent by email to info@askbridgit.ai or to any other address the Company designates in Section 17. Notices to a User may be sent to the email address associated with the User's account or through a prominent notice in the Service. Notices to an Organization under an Institutional Agreement are given as set out in that agreement. Email notices are effective when sent, unless the sender receives notice of non-delivery.

16.7 Waiver

A failure or delay in exercising any right under these Terms is not a waiver of that right.

16.8 Relationship of the Parties

The parties are independent contractors. Nothing in these Terms creates a partnership, joint venture, agency, fiduciary, or employment relationship between them, except to the extent a Data Processing Agreement appoints the Company to act on an Organization's behalf in processing personal information.

16.9 No Third-Party Beneficiaries

These Terms do not confer any rights on any third party, except as expressly stated in Section 13.

16.10 Language

The parties have required that these Terms and all related documents be drawn up in English. Les parties ont exigé que la présente convention et tous les documents connexes soient rédigés en anglais.

16.11 Headings

Headings are for convenience only and do not affect interpretation. The word "including" means "including without limitation".

17. CONTACT INFORMATION

Core Innovation Corp. (operating as Bridgit, askbridgit.ai)
Ottawa, Ontario, Canada
Website: https://askbridgit.ai