1.1 License Grant

Cymbiose grants Customer a non-exclusive, non-transferable right to access and use its secure, AI-powered clinical documentation platform ("Services") solely for internal, professional use during the subscription term. Use is limited to Customer and authorized employees or contractors ("Authorized Users").

1.2 Account Credentials

Customer is responsible for maintaining the confidentiality of account credentials and for ensuring that all Authorized Users comply with this Agreement. Customer is responsible for any activity under their login credentials.

1.3 Restrictions

Customer shall not:

• sublicense or resell the Services;
• reverse engineer or decompile the platform;
• build a competing service;
• interfere with security or service operation;
• access the Services in violation of any applicable law;
• Publicly share, publish, or disclose performance metrics, benchmarking results, or evaluations of the Services without prior written consent from Cymbiose;
• Interfere with or disrupt the operation of the Services, or misuse, exploit, or attempt to bypass any security or access control features;
• Upload or transmit any viruses, malicious code, or other harmful content through the Services;
• Engage in any activity that could harm others or compromise the security, reliability, or availability of the Services or data processed by the platform;
• Use the Services in a way that violates any applicable local, state, federal, or international laws or regulations, including those related to healthcare, data privacy, and cross-border data transfers ("Laws").

Customer also agrees to comply with any additional use limitations communicated by Cymbiose or its trusted partners (such as transcription or AI vendors), as long as those limitations are clearly communicated through the platform interface or by written notice.

1.4 Support

Cymbiose will provide support in accordance with its standard practices, subject to Customer's ongoing compliance and active subscription.

2.1 Use of Customer Data

As part of using Cymbiose, you may upload or input materials such as session recordings, transcripts, clinical notes, or other documentation ("Customer Data"). This may also include content submitted through third-party integrations ("Inputs") and any notes, summaries, or insights generated through Cymbiose's AI tools ("Output"). By using the platform, you grant Cymbiose a non-exclusive, worldwide license to securely process this data for the following purposes: (a) while your account is active, to provide core platform functionality including transcription, documentation support, insight generation, and note customization; and (b) on an ongoing basis, to use fully de-identified and non-attributable Inputs to improve platform features and system performance, such as refining note templates, enhancing accuracy, and developing culturally responsive tools. Cymbiose will not share raw session content or identifiable clinical data with any third party except (i) when explicitly requested by you; (ii) when a trusted vendor is performing services on Cymbiose's behalf under a signed HIPAA-compliant agreement; or (iii) when required to comply with a valid legal obligation such as a subpoena or court order.

2.2 Usage & Aggregated Data

Cymbiose may also collect de-identified, aggregated data based on your interaction with the platform, including technical metadata such as feature usage frequency, documentation preferences, and system performance logs ("Usage Data"). This data is used for internal purposes only, including (a) monitoring platform performance and availability, (b) diagnosing and resolving technical issues, (c) improving the overall functionality and clinician experience, and (d) informing ethically grounded design, research, and product development. No protected health information (PHI) is included in this data, and Cymbiose does not sell, rent, or use any of it for advertising. All usage data practices are governed by a commitment to privacy, transparency, and trust.

3.1 Definition

"Confidential Information" refers to any nonpublic, sensitive, or proprietary information disclosed by one party ("Discloser") to the other ("Recipient") that is either marked as confidential or would reasonably be understood as confidential based on its nature or context. This includes, but is not limited to: clinical data, session recordings, client documentation, product infrastructure, research models, AI outputs, feedback, and business operations. For Cymbiose, Confidential Information includes all underlying technology, security protocols, usage patterns, and internal processes. For Customer, it includes all Customer Data, including PHI, transcripts, notes, and any other identifiable or protected information.

3.2 Mutual Obligations

Each party agrees to treat the other's Confidential Information with the highest level of care, consistent with professional and regulatory standards (including HIPAA, where applicable). The Recipient will only use Confidential Information as needed to deliver or receive the Services under this Agreement, and will not disclose it to third parties except as explicitly permitted herein or with prior written consent.

The Recipient may share Confidential Information internally with employees, clinicians under supervision, contractors, legal advisors, or affiliates—only if they have a clear business or clinical need to know, and are bound by written confidentiality obligations at least as protective as those in this Agreement. Each party remains fully responsible for how their representatives handle the information.

3.3 Exclusions

Confidentiality obligations do not apply to information that the Recipient can prove:

• was publicly known at the time of disclosure or becomes public through no fault of the Recipient;
• was lawfully in the Recipient's possession without restriction prior to receipt;
• was disclosed to the Recipient without obligation of confidentiality by a third party legally permitted to make such disclosure; or
• was independently developed by the Recipient without reference to the Discloser's Confidential Information.

3.4 Data Stewardship and Clinical Responsibility

Because Cymbiose supports mental health professionals who work with highly sensitive data, both parties agree to uphold best practices in data privacy, ethical handling, and digital stewardship. This includes not only maintaining secure storage and transmission protocols but also ensuring that AI-generated content or user activity tied to PHI is never inappropriately accessed, disclosed, or reused.

3.5 Remedies

Each party agrees that unauthorized use or disclosure of Confidential Information may cause irreparable harm for which monetary damages may be inadequate. Accordingly, in addition to any other legal remedies, either party may seek equitable or injunctive relief to prevent unauthorized disclosure or use, without the need to prove actual damages or post a bond.

3.6 Duration

The confidentiality obligations outlined in this section will survive termination of the Agreement for as long as the information remains confidential or proprietary. Customer Data containing PHI will continue to be protected in accordance with applicable laws and the terms of the Business Associate Agreement.

4.1 Anonymized Client Identifiers

Customer agrees to use client initials, ID codes, or other anonymized identifiers in place of full names whenever feasible, particularly in case notes, supervision documentation, and any exported content. This practice enhances confidentiality and aligns with ethical standards for privacy-preserving documentation.

4.2 Informed Consent for Recording

Customer must obtain documented, written informed consent from clients prior to using any audio recording functionality provided by Cymbiose. This consent must clearly explain the purpose of the recording (e.g., transcription, clinical supervision), how the data will be processed, and that the client may withdraw consent at any time without impact on services.

4.3 Secure Storage of Consent Forms

Cymbiose does not retain signed consent forms. It is the Customer's responsibility to store signed forms in a HIPAA-compliant system of their choosing (e.g., encrypted EHR, secure cloud storage, or physical files), in accordance with their state regulations and licensing board requirements.

4.4 Clinical Review of AI-Generated Content

All AI-generated notes, summaries, or insights produced by Cymbiose are intended as support tools and must be reviewed by the Customer before use in any clinical, supervisory, or billing context. Cymbiose does not assume responsibility for the accuracy or appropriateness of any content that has not been clinician-verified.

4.5 Culturally-Aware and Ethical Documentation

Customer agrees to use the Services in a manner that reflects thoughtful, non-pathologizing, and culturally informed documentation practices. Cymbiose provides note format customization and client-sensitive features to support equitable and respectful recordkeeping.

4.6 Ongoing Responsibility

Use of Cymbiose does not exempt the Customer from their ethical, legal, or licensing obligations. Customer is solely responsible for ensuring that their use of the Services complies with applicable clinical, regulatory, and professional standards.