Terms of Use

2. Definitions and scope of services

• Service Description: The ERMA Platform provides AI-powered compliance assistance tools specifically designed for Medical, Legal, and Regulatory (MLR) review processes in the life sciences industry. The Platform includes custom AI models, document analysis capabilities, workflow management tools, and to support promotional material development and compliance review.
• AI-Powered Recommendations and Content Creation: ERMA utilizes proprietary AI models based on open source LLMs and customized AWS AI Services, trained on clinical studies, white papers, prescribing information, data on file, existing FDA regulations, and promotional and non-promotional content to provide compliance recommendations and content creation assistance. All AI-generated outputs are recommendations only and require human review and validation before implementation.
• Professional Services: In addition to Platform access, ERMA may provide implementation services, training, consulting, and technical support as separately agreed in writing.
• Statements of Work: The Parties may execute one or more statements of work that specify pricing, payment terms, implementation scope, service levels, project timelines, and other engagement-specific terms. Each statement of work shall incorporate the terms of this Agreement by reference and shall be governed by this Agreement except where expressly stated otherwise.

3. AI Services and limitations

ERMA uses artificial intelligence to generate recommendations, analyses, and content assistance. Important information about AI-generated outputs:

• AI recommendations are provided for informational and decision-support purposes only.
• AI-generated content may not always be accurate, complete, or up to date.
• All outputs require independent human review and validation.
• ERMA does not provide legal, medical, or regulatory advice.
• Qualified professionals must make all final compliance and regulatory decisions.

4. FDA Agent & Compliance Assistance

• AI Model Accuracy and Disclaimers: ERMA's AI-powered recommendations may not be 100% accurate at all times. Client acknowledges that AI-generated suggestions, compliance recommendations, and content analysis are provided for informational purposes only and must be independently verified by qualified professionals before relying on such outputs for regulatory compliance decisions.
• Human Review Requirement: All AI recommendations and compliance suggestions must be reviewed, validated, and approved by qualified human reviewers before implementation. Client is solely responsible for ensuring all content meets applicable regulatory requirements, including FDA regulations and industry standards.
• No Substitute for Professional Judgment: ERMA's AI tools are designed to assist, not replace, professional medical, legal, and regulatory expertise. Client must ensure that qualified professionals make all final compliance determinations and regulatory decisions.
• Regulatory Compliance Responsibility: Client remains solely responsible for compliance with all applicable laws and regulations related to their use of the Platform, their promotional content, and their regulatory submissions, including but not limited to promotional content requirements and life sciences regulatory frameworks.
• FDA Agent Feature and Regulatory Compliance: ERMA's Platform includes an FDA Agent feature that analyzes promotional materials against current FDA regulations and provides compliance recommendations prior to market release. Client acknowledges and agrees that: (i) the FDA Agent is a decision-support tool only and does not constitute legal, regulatory, or compliance advice; (ii) all FDA Agent outputs, flags, and recommendations require independent review and validation by Client's qualified regulatory, legal, and medical personnel before any compliance determination is made; (iii) Client's internal regulatory and legal team constitutes the final arbiter of all promotional materials and compliance decisions, and that responsibility cannot be delegated to the FDA Agent or any other AI-powered feature of the Platform; (iv) the FDA Agent's recommendations reflect regulatory information available at the time of analysis and may not account for the most current FDA guidance, warning letters, or enforcement priorities; and (v) Client's decision to proceed with promotional materials notwithstanding an FDA Agent flag or recommendation constitutes Client's independent regulatory judgment, and ERMA shall have no liability for any resulting regulatory action, FDA warning letter, enforcement proceeding, or other consequence arising from Client's decision to override or disregard an FDA Agent recommendation. Client's failure to implement the human review process described in this Section shall constitute a material breach of this Agreement and shall trigger Client's indemnification obligations under this Agreement.

5. Data processing and training

• Client Data Usage for AI Training: ERMA may use Client data, including reference documents, user analytics, and feedback, to train and improve AI models solely to enhance and optimize Client's own experience within the Platform. Client data is not used to train or improve models for the benefit of any other client. Private data such as internal comments will be redacted before use in training datasets.
• Opt-Out Rights: Client may opt out of having their data used for AI training purposes by providing written notice to ERMA. Upon such notice, ERMA will exclude Client's data from future training datasets while maintaining access to previously trained models.
• Data Anonymization: When Client data is used for AI training, ERMA will implement reasonable anonymization procedures to remove identifying information, though Client acknowledges that complete anonymization cannot be guaranteed due to the specialized nature of life sciences content.
• Client Data Segregation: Client data is logically segregated and used only in connection with Client's own use of the Platform. ERMA does not use Client data to train, improve, or benefit the experience of any other client.

6. Data security and segregation

• Multi-Tenant Architecture: Each Client receives a logically segregated database environment with dedicated datastore and encryption keys. Client data is encrypted both at rest and in transit using industry-standard encryption protocols.
• Geographic Data Storage: Client data is stored in AWS data centers located in either US East (N. Virginia) or US West (California) regions, as selected by Client during onboarding. ERMA Platform operations are conducted from US East region.
• Data Access Controls: Access to Client data is restricted to authorized ERMA personnel on a need-to-know basis for Platform operation, technical support, and service delivery purposes.
• No PHI Processing: ERMA does not process Protected Health Information (PHI) or other individually identifiable health information. Client is strictly prohibited from uploading any content containing PHI or other individually identifiable health information to the Platform. Client represents that uploaded content does not contain PHI or other regulated personal data types. Client's breach of this prohibition shall constitute a material breach of this Agreement and shall trigger Client's indemnification obligations under this Agreement.
• Privacy Policy: Client's use of the Platform is also governed by ERMA's Privacy Policy, which provides additional details regarding data collection, use, storage, and protection practices. The Privacy Policy is incorporated herein by reference and is available at https://www.ermasystems.com/privacy or upon request.

7. Regulatory compliance and adaptation

• FDA Compliance Framework: ERMA maintains compliance with FDA 21 CFR Part 11 requirements for electronic records and electronic signatures as applicable to the Platform's functionality.
• Compliance Assistance Only: ERMA provides tools to assist with compliance processes but does not provide legal, medical, or regulatory advice. Client must consult with qualified professionals for specific compliance guidance.
• Regulatory Responsibility Confirmation: Client expressly acknowledges and agrees that: (i) ERMA provides compliance assistance tools only, not legal, medical, or regulatory advice; (ii) Client bears sole responsibility for all regulatory compliance decisions and determinations; (iii) no warranty is provided that use of the Platform will result in regulatory approval or compliance; and (iv) Client must maintain independent compliance processes and professional expertise.

8. Service levels and maintenance

• Availability Target: ERMA targets 99% Platform uptime, calculated monthly and excluding scheduled maintenance windows and force majeure events. This target is a goal, not a guaranteed service level, and ERMA makes no warranties regarding uptime performance.
• Support Hours: Technical support is available during business hours (9:00 AM to 5:00 PM Eastern Time, Monday through Friday, excluding holidays).
• Blue-Green Deployment: Platform updates utilize staggered rollout procedures to minimize service disruption and ensure system stability.
• Maintenance Procedures: Planned maintenance will be communicated to Client with minimum two weeks advance notice via Platform banner notifications. Maintenance categories include: (i) patch updates with zero service interruption requiring no notice, (ii) minor functionality updates following two-week notice requirement, and (iii) major feature releases following two-week notice requirement. Emergency maintenance required for security vulnerabilities, critical system issues, or other urgent matters may be performed with such notice as is commercially reasonable under the circumstances.

9. Subscription terms and usage limits

• Subscription Model: ERMA services are provided on a per-user subscription basis generally with monthly or annual contract terms. Different service tiers may be available as specified in the applicable statement of work.
• User, Page, and Token Limitations: Client subscription includes access for a specified number of authorized users, an allocated page allowance, and token-based usage allowances as defined in the applicable statement of work. Additional users, pages, or tokens may be purchased separately in additional statements of work. Client may view its current token balance within the Platform.
• Content Volume Restrictions: Client usage is subject to applicable page, token, and content processing quotas as specified in the applicable statement of work.

10. Data breach notification

• Notification Procedure: In the event of a confirmed data security incident that may affect Client data, ERMA will contact Client directly with a summary of what data might have been compromised and the internal measures taken to address the issue.
• Response Timeline: ERMA will provide such notification without unreasonable delay following discovery of the incident and completion of initial assessment procedures.

11. Insurance and liability coverage

• Professional Liability Coverage: ERMA maintains professional liability and errors and omissions insurance coverage appropriate for the services provided.
• Cyber Liability Insurance: ERMA carries cyber liability insurance to cover certain risks associated with data security incidents and Platform operations.
• Insurance Verification: Upon Client's reasonable request, ERMA will provide certificates of insurance evidencing the coverage described herein.

12. Intellectual property and confidentiality

• Client Content Ownership and Representations: Client retains all ownership rights in content uploaded to or created using the ERMA Platform. Client represents and warrants that: (i) it owns or has all necessary rights to all content uploaded to the Platform; (ii) such content does not violate any third-party intellectual property rights; (iii) Client will not upload any content in violation of the data protection, confidentiality, or other provisions of this Agreement; and (iv) all uploaded content complies with applicable laws and regulations. Client shall indemnify ERMA pursuant the indemnity clause of this Agreement for any breach of these representations.
• ERMA License to Client Content: Provided that identifying client information is removed or anonymized, Client hereby grants ERMA a perpetual, irrevocable, worldwide, royalty-free license to use, copy, modify, create derivative works from, distribute, and incorporate Client's uploaded content into ERMA's AI models, training datasets, Platform improvements, and other proprietary technologies solely in connection with enhancing and optimizing Client's own experience within the Platform. This license shall survive termination of this Agreement.
• Platform License Grant: Client receives a non-exclusive, non-transferable license to use the ERMA Platform solely for internal MLR compliance processes during the subscription term. This license terminates immediately upon termination of this Agreement.
• Usage Restrictions on AI Outputs: Client may use AI-generated recommendations and analysis for internal compliance review purposes only. Client may not redistribute, commercialize, or otherwise exploit AI outputs outside of their organization without prior written consent.
• ERMA Intellectual Property: ERMA retains all rights, title, and interest in and to the Platform, all AI models, algorithms, software, methodologies, know-how, trade secrets, improvements, enhancements, and all other proprietary technologies and intellectual property. Client receives no rights to ERMA's underlying intellectual property except for the limited license set forth in subsection (c). All rights not expressly granted to Client are reserved by ERMA. Client's license to use the Platform terminates immediately upon termination of this Agreement, and Client shall cease all use of ERMA's intellectual property.
• Confidentiality: Client acknowledges that it may have access to ERMA's confidential and proprietary information, including but not limited to technical data, trade secrets, AI models, algorithms, software code, Platform functionality, business methods, pricing information, and any other non-public information ("Confidential Information"). Client agrees to: (i) hold all ERMA Confidential Information in strict confidence; (ii) not disclose such information to third parties without ERMA's prior written consent; (iii) limit access to employees and advisors with a legitimate need to know who are bound by confidentiality obligations; (iv) use such information solely for purposes of this Agreement; and (v) return or destroy such information upon termination. These obligations shall not apply to information that is publicly available, independently developed, or required to be disclosed by law, provided that Client gives ERMA prompt notice and cooperates in seeking protective orders at ERMA's expense. Confidentiality obligations shall survive termination for five (5) years, except for (i) trade secrets, which shall survive indefinitely and (ii) sensitive data requiring longer protection by law, but in no event less than five (5) years.

13. Termination and data handling

• Termination Notice: Either Party may terminate this Agreement with thirty (30) days written notice, provided that this Agreement shall remain in effect so long as any statements of work remain active. Statements of work may be terminated according to their individual terms. Additionally, ERMA may terminate this Agreement and all statements of work (or any subset thereof at ERMA's election) immediately upon written notice in the event of Client's material breach of this Agreement, including but not limited to breach of data obligations, intellectual property restrictions, confidentiality provisions, payment obligations, regulatory compliance requirements, Platform usage restrictions, or Client's failure to implement required human review of AI recommendations.
• Data Retention and Destruction: Client data is stored indefinitely during active subscription. Upon termination, ERMA will either: (i) provide data export via secure access link, or (ii) destroy Client data as requested, with confirmation provided upon completion.
• Post-Termination Access: Following termination, Client access to the Platform ceases immediately, though ERMA will provide reasonable assistance with data retrieval during a transition period not to exceed sixty (60) days.
• Survival of Obligations: Data protection, confidentiality, and intellectual property provisions survive termination of the agreement.

14. Business continuity and disaster recovery

• Disaster Recovery Procedures: ERMA maintains disaster recovery procedures including risk assessment protocols, critical asset identification, recovery objectives, backup strategies, and communication plans tailored to the specific nature of any service disruption.
• Acquisition or Business Transfer: In the event ERMA is acquired or undergoes significant business changes, Client data will remain in place with existing protections. Any acquiring entity must provide continuity of service and data protection standards equivalent to those specified herein.
• Business Closure: Should ERMA cease operations, Client will receive reasonable advance notice and assistance with data migration to alternative platforms or data export as requested.
• Backup and Recovery: ERMA maintains regular backup procedures and tested recovery protocols to ensure business continuity and data availability.

15. Integration and technical requirements

• System Requirements: Client requires only a compatible web browser to access the ERMA Platform. No additional client-side software installation is required.
• Third-Party Integrations: ERMA integrates with Veeva Vault REST API and other MLR platforms as specified in the service description, and utilizes AWS AI Services for Platform functionality. Client is responsible for maintaining valid licenses for integrated third-party platforms. ERMA's service availability and performance may be affected by third-party provider performance, changes, or outages beyond ERMA's control.
• Single Sign-On (SSO): Optional SSO integration may be available, at ERMA's discretion, and may require Client technical resources for configuration and testing.
• User Credential Security: Client is responsible for maintaining the confidentiality of all user credentials, passwords, and authentication tokens. Client must implement appropriate access controls and immediately notify ERMA of any suspected unauthorized access to user accounts or security breaches.

16. Warranties and disclaimers

• Limited Express Warranties: ERMA provides only the following limited warranties: (i) ERMA will use commercially reasonable efforts to provide the Platform services described in Section I and any applicable statements of work; (ii) ERMA will maintain compliance with FDA 21 CFR Part 11 requirements applicable to the Platform's functionality as described in Section V(a); (iii) ERMA will maintain industry-standard data security measures during the subscription term. These limited warranties constitute ERMA's entire warranty obligation.
• AI Model and Compliance Disclaimer: ERMA's AI-powered recommendations, compliance suggestions, content analysis, and all AI-generated outputs are provided solely as decision-support tools. ERMA makes no warranties regarding the accuracy, completeness, or regulatory sufficiency of AI recommendations. All AI outputs must be independently validated by qualified medical, legal, and regulatory professionals before implementation. ERMA disclaims any warranty that AI recommendations will ensure compliance with FDA regulations, promotional content requirements, or any other life sciences regulatory framework.
• Life Sciences Industry Acknowledgment: Given the heavily regulated nature of the life sciences industry, Client specifically acknowledges that ERMA cannot and does not warrant compliance with the constantly evolving landscape of FDA regulations, international regulatory requirements, promotional content standards, or other industry-specific compliance obligations.
• Warranty Disclaimer: Except for the limited express warranties set forth in subsection (a) above and warranties that cannot be excluded by law, ERMA disclaims all other warranties, express or implied, including without limitation implied warranties of merchantability and fitness for a particular purpose; any warranty that the Platform will meet Client's regulatory compliance requirements or business objectives; any warranty regarding the accuracy, reliability, or completeness of AI-generated content, recommendations, or analysis; any warranty that Platform functionality will be uninterrupted, error-free, or free from security vulnerabilities; and any warranty regarding third-party integrations, including Veeva Vault and AWS AI Services. The Platform and all related services are provided on an "as is" and "as available" basis. Client acknowledges that AI technology is inherently probabilistic and that perfect accuracy cannot be guaranteed in AI-powered compliance tools.
• Survival: This Section shall survive any termination of this Agreement.

17. Indemnity

• ERMA Indemnification Obligations: ERMA shall defend, indemnify, and hold harmless Client from and against any third-party claims, damages, losses, and expenses (including reasonable attorneys' fees) arising from: (i) ERMA's infringement of any third-party intellectual property rights in the provision of the Platform; and (ii) ERMA's material breach of the limited express warranties set forth in Section XIV(a). In the event of an intellectual property infringement claim under subsection (a)(i), ERMA may, at its option and expense: (i) obtain the right for Client to continue using the Platform; (ii) replace or modify the infringing components to make them non-infringing while maintaining substantially equivalent functionality; or (iii) if the foregoing remedies are not commercially reasonable, terminate the affected services and provide Client a pro-rated refund of prepaid fees for the terminated services.
• ERMA Indemnification Limitations: Notwithstanding the foregoing or anything to the contrary, ERMA's indemnification obligations under subsection (a) shall not apply to claims arising from: (i) modifications to the Platform made by Client or third parties; (ii) use of the Platform in combination with third-party products or services not provided by ERMA; (iii) Client's continued use of the Platform after notice of infringement and availability of a non-infringing alternative; (iv) AI-generated outputs or recommendations (which are explicitly disclaimed under Section XIV); or (v) compliance with Client's specific instructions or requirements that result in infringement. ERMA's indemnification obligation shall be limited to its proportion of fault and shall not apply in case of Client's sole fault, gross negligence, or willful misconduct. ERMA's obligations set forth in this section constitute the exclusive remedy for third-party intellectual property infringement claims and third-party claims arising from breach of the limited express warranties.
• Client Indemnification Obligations: Client shall defend, indemnify, and hold harmless ERMA and its members, officers, shareholders, employees, and agents from and against any third-party claims, damages, losses, and expenses (including reasonable attorneys' fees) arising from or relating to: (i) Client's breach of this Agreement; (ii) Client's use of the Platform in violation of applicable laws or regulations; (iii) Client's negligent or wrongful acts or omissions in connection with the Platform; (iv) claims that Client's content or data infringes third-party rights; (v) Client's failure to comply with regulatory requirements or obtain required regulatory approvals; (vi) any promotional materials, marketing content, or regulatory submissions created using the Platform or AI-generated outputs; (vii) Client's failure to implement required human review and validation of AI recommendations as specified in this Agreement; and (viii) any claims arising from Client's reliance on AI-generated outputs for regulatory compliance decisions.
• Survival: This provision shall survive the termination of this Agreement.

18. Limitation of liability

• Damages Cap: ERMA's total liability arising out of or related to this Agreement, whether in contract, tort, or under any other theory of liability, shall not exceed the total amount of fees paid by Client to ERMA in the twelve (12) months immediately preceding the event giving rise to the claim, except for (i) ERMA's indemnification obligations under Section XV; (ii) claims arising from ERMA's gross negligence, fraud, or willful misconduct; or (iii) other liability that cannot be limited or excluded by applicable law.
• Exclusion of Consequential Damages: In no event shall ERMA be liable for any indirect, incidental, special, consequential, or punitive damages, including without limitation lost profits, lost data, business interruption, or loss of business opportunities, even if ERMA has been advised of the possibility of such damages and regardless of the cause of action (whether in contract, tort, breach of warranty, indemnification, or otherwise), except for claims arising from ERMA's gross negligence, fraud, or willful misconduct, or other liability that cannot be limited or excluded by applicable law.
• Survival: This Section shall survive any termination of this Agreement.

19. Dispute resolution

This Agreement shall be governed by and construed in accordance with the laws of the State of Delaware, without regard to conflict of law principles. The Parties hereby consent to the exclusive jurisdiction and venue of the state and federal courts located in Delaware for all disputes arising under this Agreement. In any legal proceeding arising out of or relating to this Agreement, the prevailing Party shall be entitled to recover its reasonable attorneys' fees and costs from the non-prevailing Party.

20. Force majeure

ERMA shall not be liable for any failure or delay in performance under this Agreement that is due to causes beyond its reasonable control, including but not limited to acts of God, natural disasters, pandemics, government actions or regulations, cyber attacks on critical infrastructure, internet or telecommunications failures, third-party cloud service provider outages (including AWS), power failures, labor disputes, or other force majeure events. ERMA must promptly notify Client of such force majeure event and use commercially reasonable efforts to mitigate its effects and resume performance.

21. Assignability

This Agreement may not be assigned or transferred by either Party without the prior written consent of the other Party, except that ERMA may assign this Agreement without consent in connection with a merger, acquisition, corporate reorganization, or sale of all or substantially all of its assets. Any attempted assignment in violation of this Section shall be void and of no effect. This Agreement shall be binding upon and inure to the benefit of the Parties and their permitted successors and assigns.

22. Notice

All notices required or permitted under this Agreement shall be in writing and may be sent by certified mail or email to the addresses set forth below the Parties' signatures. Notices sent by certified mail shall be deemed delivered upon receipt. Notices sent by email shall be deemed delivered when sent, provided no bounce-back message is received. Either Party may change its notice address or email address at any time by providing written notice to the other Party.

23. Survival

Any provision of this Agreement that by its nature should survive termination or expiration shall survive, including without limitation those provisions expressly stated to survive elsewhere in this Agreement.

24. Severability

If any provision of this Agreement is determined by a court of competent jurisdiction to be illegal, invalid or unenforceable, that provision will be severed from this Agreement; all other provisions of this Agreement will remain in full force and effect. If any provision is so severed, a lawful provision that, to the greatest extent possible, gives effect to the Parties' intentions as expressed in the severed provision will replace it.

25. Waiver

No failure or delay by either Party in exercising any right, power, or privilege under this Agreement shall be considered a waiver. Additionally, a single or partial exercise of such right, power, or privilege will not prevent further exercise of the same or the exercise of any other right, power, or privilege.

26. Counterparts

This Agreement may be executed in any number of counterparts, each of which when executed and delivered is an original, but all the counterparts together constitute the same document. The Parties agree that this Agreement may be executed and delivered by electronic signature, and that such electronically signed documents shall be binding upon the Parties to the same extent as an originally signed document.

27. Entire agreement

This Agreement, together with any statements of work executed by the Parties, and the ERMA Data Processing Addendum executed by the parties, which is incorporated herein by reference and shall govern the processing of Personal Data in connection with the Services, constitute the sole and entire agreement between the Parties concerning the subject matter hereof and supersedes all prior understandings, agreements, representations, and warranties, both written and oral, with respect to such subject matter herein. In the event of any conflict between this Agreement and any statement of work, this Agreement shall take priority unless the statement of work expressly states that it overrules a specific provision of this Agreement. This Agreement may not be modified, changed, or discharged, in whole or in part, except by an agreement in writing signed by the Parties.

By signing below, the parties acknowledge that they have read, understood, and agree to be bound by the terms and conditions of this Agreement.