Terms and Conditions of Use of Breez AI

Version 2.0 · Last updated 20 October 2026 · Applies from 20 October 2026

PLEASE READ THESE TERMS AND CONDITIONS CAREFULLY

This agreement (“Agreement”) is a legal agreement between you (“Customer” or “You”) and Bosco AI LTD, a company registered in Scotland under company number SC822121, with its registered address at Silver Moon, Clora Brae, Oxton, Lauder, TD2 6AE, United Kingdom (“Breez AI” or “we”) and governs your access to and use of the Breez software, documentation, and any related services. Each of Breez AI and You are a “party” and together the “parties.”

If you accept these Terms for a dental practice, “you” and “Customer” mean that practice, and you confirm that you may accept them on its behalf.

By signing up for Breez, installing, accessing, or otherwise using Breez, you agree to be bound by the terms of this Agreement. If you do not agree to these terms, you must not use the Breez software or services.

1. Definitions

The definitions in Schedule 1 (Definitions and Interpretation) apply to this Agreement.

2. Rights of Use

2.1 Subject to this Agreement, Breez AI grants you a non-exclusive, non-transferable, non-sublicensable licence to access and use Breez and its documentation for your internal dental practice purposes only.

2.2 Access is permitted for authorised users only, and you shall not permit any user account to be shared.

3. Operating System Requirements

3.1 In order to use Breez, you must meet the following system requirements:

• Supported operating system as listed in our documentation;
• Active internet connection;
• Any browser or software dependencies required by Breez, which may change from time to time.

4. Authorised Users and Use Restrictions

4.1 Each authorised user must be an individual who has been issued unique login credentials. Accounts may not be shared or used by more than one individual.

4.2 You shall not:

• Decompile, reverse engineer, disassemble, or otherwise reduce Breez to a human-perceivable form;
• Create derivative works based on Breez;
• Use Breez for any unlawful or unethical purpose;
• Sell, rent, sublicense, or distribute Breez to any third party.

4.3 You shall ensure that all authorised users comply with these terms and promptly notify us of any unauthorised access or security breaches.

4.4 Fair use. These rules apply to everyone who records with Breez:

• (a) Use your own login. Each login is for one named person.
• (b) Use Breez for your own patient appointments.
• (c) Record through the Breez app only, not through automated tools, scripts or bulk uploads.
• (d) If your use suggests that a login is shared or misused, we contact you first. If it continues, we may suspend the account. Clause 5.2 still applies where there is a security risk.

4.5 Each clinician confirms these fair use terms, and the duties in clauses 9.6 and 9.7, once a day in the Breez app.

5. Our Obligations

5.1 Breez AI shall provide Breez and associated documentation to you and use commercially reasonable efforts to support and maintain the service.

5.2 Breez AI may suspend your access if we suspect misuse, security issues, or payment failures.

6. Hardware (Microphones)

6.1 Each device on your subscription comes with one microphone set. The microphone is included in your subscription and stays the property of Bosco AI LTD. It has a one-year limited warranty covering manufacturing defects.

6.2 If the microphone arrives damaged, tell us within 48 hours of delivery and we will send a free replacement.

6.3 If you cancel, return the microphone within thirty (30) days of the Cancellation Date, using the prepaid return label we send you. If it is not returned, or is returned damaged, a fee of £100 may apply. We waive this fee where the damage was caused in transit or by a verified fault.

6.4 Replacement units for accidental damage cost £75. You can buy additional microphones separately.

7. Subscription and Payment

7.1 Subscription pricing and payment terms are specified on our website at the time of sign-up.

7.2 Card details must be submitted before the Trial Period begins. Monthly billing will start automatically after the 30-day trial, unless the subscription is cancelled.

7.3 Subscription fees are exclusive of VAT unless otherwise stated.

7.4 All charges are billed in full for each Billing Cycle. Bosco AI LTD does not apply pro-rata charges.

7.5 Bosco AI LTD reserves the right to increase Subscription Fees with 30 days’ notice. Customers may cancel before the new fee takes effect.

8. Cancellation and Termination

8.1 You may cancel your subscription at any time by providing 30 days’ notice. Cancellation takes effect at the end of the next Billing Cycle.

8.2 No refunds or pro-rata credits are issued for partial Billing Cycles.

8.3 Bosco AI LTD may terminate the Agreement for material breach, including non-payment, misuse, or legal violations. Immediate termination applies in cases of fraud or unlawful activity.

9. Data Protection and Security

9.1 We use service providers (Sub-Processors) to run Breez. Schedule 2, sections 5 and 7, set out how we engage them and where your data is stored and processed.

9.2 How long we keep recordings, transcripts and notes is set out in Schedule 2, section 8. We keep billing records for 6 years, as UK tax law requires, and support messages and leads for 2 years after our last contact.

9.3 What happens to your data after you cancel is set out in Schedule 2, section 8.3.

9.4 Schedule 2 is our data processing agreement with you for patient information. It forms part of these Terms.

9.5 When you report a problem, our support team may review the note to fix it and improve your templates. Schedule 2, section 2 sets out every way we may use patient information.

9.6 Telling patients and asking permission

• (a) Your practice tells each patient, at the start of the appointment, that an AI note-taker will record it and how their information is used. Your practice privacy notice should also cover Breez.
• (b) Before you record, ask the patient’s permission, as the General Dental Council requires. If the patient says no, do not record. If they change their mind, stop the recording.
• (c) For a child, explain the note-taker in words they understand, and also tell their parent or guardian before you record. If either of them says no, do not record.
• (d) As controller, your practice chooses the legal basis for using patient information. For clinical records this is normally the provision of health care (UK GDPR Article 9(2)(h)). Asking permission to record is a separate professional duty.
• (e) You confirm that, for every recording, the patient has been told and has given permission, and that you hold any other permission the law or your professional rules require.
• (f) You will cover (indemnify us against) any loss, cost or claim we face because a recording was made without telling the patient or without their permission.

9.7 Breez drafts notes from what is said in the appointment and gives no clinical advice. The clinician checks and corrects every note before it goes into the patient’s record, and remains responsible for that record.

9.8 We protect your data with the security measures in Schedule 2, section 4.

10. Liability and Indemnity

10.1 Apart from the hardware warranty in clause 6.1, Breez is provided “as is.” Breez AI disclaims all warranties to the extent permitted by law.

10.2 The Customer indemnifies Breez AI for any misuse or legal violations.

10.3 Breez AI’s liability is limited to the amount paid by the Customer in the previous 12 months.

11. Governing Law and Jurisdiction

This Agreement shall be governed by the laws of Scotland. All disputes shall be resolved in the Scottish courts. These Terms apply in the same way to every customer, including practices outside the UK.

12. Changes to These Terms

12.1 We may update these Terms. The version number and date at the top show the latest version.

13. Contact Information

For questions or support, please contact:

📍 Bosco AI LTD, Silver Moon, Clora Brae, Oxton, Lauder, TD2 6AE, United Kingdom
📧 support@bree-z.com

This is also our contact for data protection questions.

Schedule 1: Definitions and Interpretation

“Authorised User”

means an individual who has been granted access to Breez by the Customer and who has been assigned unique login credentials. Authorised Users must not share their credentials with others, and each account must be used only by the individual to whom it is issued.

“Confidential Information”

means any non-public information, whether oral, written, visual, electronic, or in any other form, disclosed by one party to the other that is marked or otherwise identified as confidential, or which ought reasonably to be understood to be confidential given the nature of the information and the circumstances of disclosure. This includes but is not limited to business plans, strategies, data, financial information, technical information, trade secrets, customer and supplier lists, operational processes, proprietary technology, software source code, patient-related data, and any information relating to either party’s operations, affairs, or business.

“Customer Data”

Any information, content, or data input into, generated by, or transmitted through the Software or Services by or on behalf of the Customer or its Authorised Users. This includes, but is not limited to: audio recordings, transcripts, patient-related information, dental notes, support messages, account registration details, billing information, and usage logs. Customer Data may contain personal data and is subject to applicable data protection laws. Unless otherwise stated, the Customer retains ownership of their Customer Data. How Bosco AI LTD may use Customer Data is set out in clause 9, Schedule 2 and our Privacy Policy.

“Effective Date”

means the date shown at the top of these Terms from which this version applies. For a new Customer, these Terms apply from the date the Customer first accepts them by completing the sign-up process, installing, or first using the Breez software, whichever occurs earliest.

“Intellectual Property Rights”

All patents, rights to inventions, copyright and related rights, trademarks, trade names, domain names, rights in computer software (including source code and object code), database rights, moral rights, know-how, and any other intellectual property rights, whether registered or unregistered, and including all applications and rights to apply for and be granted such rights, anywhere in the world.

“Software”

The Breez desktop application and any associated components provided by Bosco AI LTD, including tools used for account management via the Breez website. This includes all related software, updates, upgrades, interfaces, and documentation, whether accessed locally or via an internet connection. The Software does not include any third-party services integrated into the platform.

“Subscription”

A paid licence granted to the Customer to access and use the Software and related services on a recurring basis, subject to payment of the applicable fees. Subscriptions may be offered on a monthly, annual, or other basis, as specified at the time of purchase. Bosco AI LTD may, at its discretion, offer a free trial period. Subscriptions will automatically renew unless cancelled with a minimum of one (1) month’s notice prior to the next billing cycle. Access will continue through the paid billing period following cancellation.

“Trial Period”

A limited period of time, as specified by Bosco AI LTD at the time of account activation, during which the Customer may use the Software and any accompanying Hardware on a trial basis without paying a Subscription fee. The Trial Period is offered at Bosco AI LTD’s sole discretion and may be withdrawn or modified at any time. During the Trial Period, certain features or services may be limited, and the Customer may cancel at any time without incurring charges, subject to the return of any Hardware provided.

“Third-Party Services”

Any products or services provided by others that the Customer chooses to use with the Software, such as its practice management system. Bosco AI LTD is not responsible for their performance, availability or data handling practices. Sub-Processors are not Third-Party Services; Schedule 2 covers them.

“Hardware”

The physical equipment provided by Bosco AI LTD for use with the Software, including but not limited to the microphone issued to the Customer. Hardware is included in the Customer’s Subscription and stays the property of Bosco AI LTD. The Customer returns the Hardware after cancellation, as set out in clause 6 and under “Returns”. Additional or replacement Hardware may be offered for purchase under separate terms. Hardware use is subject to the warranty, usage, and return conditions set out in this Agreement.

“Account”

The Customer’s registered profile within the Breez platform, created upon acceptance of this Agreement. The Account contains subscription details, user credentials, authorised user management settings, and contact and billing information. The Customer is responsible for maintaining the accuracy of the Account data and ensuring that login credentials are kept secure and used only by assigned individuals. Bosco AI LTD may support multi-user setups under a single Account, subject to applicable subscription terms. Payment processing and billing services may be handled by our payment provider, as further described in this Agreement.

“Documentation”

The user-facing materials provided by Bosco AI LTD to support the use of the Software. This includes written guides, setup instructions, frequently asked questions (FAQs), technical specifications, and getting-started or training content, whether provided within the Software, on the official Breez website, or through Bosco AI LTD’s verified social media channels. Documentation also includes support services made available via email, live chat, or messaging platforms such as WhatsApp, as may be offered from time to time. Documentation is provided for informational purposes only and does not form part of the Software or carry any warranty.

“Payment Method”

The valid credit card, debit card, bank account, or other approved method of payment provided by the Customer and held on file by Bosco AI LTD or its authorised payment processor. The Payment Method must be submitted and successfully authorised before the commencement of any Trial Period or the dispatch of any Hardware. It will be used to initiate billing for the Subscription following the expiry of any applicable Trial Period, and for any additional charges incurred under this Agreement, including charges for unreturned or damaged Hardware. The Customer is responsible for ensuring that their Payment Method remains current, valid, and capable of processing charges.

“Billing Cycle”

The recurring monthly period for which Subscription Fees are charged and payable by the Customer. The Billing Cycle begins immediately after the conclusion of any applicable Trial Period and repeats on the same calendar day each month (e.g., if billing begins on the 20th, future charges will occur on the 20th of each subsequent month). Bosco AI LTD does not apply pro-rata charges. All Subscription Fees are charged in full for each Billing Cycle. The Customer is responsible for ensuring their Payment Method is active on their billing date. Charges for additional services or non-returned or damaged Hardware may be applied separately.

“Price Changes”

Bosco AI LTD reserves the right to change its pricing at any time. In the event of a Subscription Fee increase, the Customer will be notified at least thirty (30) days in advance via email or through the Breez platform. The new pricing will take effect from the Customer’s next Billing Cycle following the end of the notice period. If the Customer does not agree to the updated pricing, they may cancel their Subscription in accordance with the cancellation terms of this Agreement before the new pricing takes effect.

“Cancellation and Notice Period”

The Customer may cancel their Subscription at any time by providing Bosco AI LTD with a minimum of thirty (30) days’ written notice via email or through the Breez platform. Cancellation will take effect at the end of the Customer’s next Billing Cycle following the completion of the notice period. No refunds or pro-rata credits will be provided for any partial Billing Cycle. The Customer remains responsible for all charges incurred up to the effective cancellation date, including any applicable charges for non-returned or damaged Hardware.

“Cancellation Date”

The date on which the Customer’s Subscription is scheduled to terminate, following the completion of the required thirty (30) day notice period. The Cancellation Date will coincide with the end of the Customer’s final Billing Cycle, unless otherwise agreed in writing with Bosco AI LTD.

“Returns”

The process by which the Customer sends back Hardware to Bosco AI LTD following cancellation of their Subscription, or in the event of receiving faulty or damaged Hardware. Returned Hardware must be sent back within thirty (30) days of the Cancellation Date. The Hardware must be in good working condition, subject to inspection. Failure to return the Hardware within the specified timeframe, or returning Hardware that is materially damaged or unusable (excluding transit-related issues reported upon delivery), may result in a charge of £100. Faulty or damaged Hardware received at the outset of service must be reported within forty-eight (48) hours of delivery to qualify for a free replacement.

“Warranty”

A limited assurance provided by Bosco AI LTD that the Hardware supplied to the Customer will be free from material defects in workmanship and functionality under normal use for a period of twelve (12) months from the date of dispatch. This Warranty covers repair or replacement of defective Hardware at no cost to the Customer, provided the issue is not caused by misuse, unauthorised modification, neglect, or accidental damage. Claims under this Warranty must be submitted to Bosco AI LTD in writing with supporting evidence (e.g., photos, descriptions of the issue). Replacement Hardware may be subject to availability and will be provided at Bosco AI LTD’s discretion. Returned or defective Hardware may be recycled or refurbished by Bosco AI LTD in line with its circular economy principles. Accidental damage is covered by the replacement offer in clause 6.4.

“Termination for Breach”

The right of either party to terminate this Agreement with immediate effect in the event that the other party commits a material breach of its obligations under the Agreement, and (where the breach is capable of remedy) fails to remedy that breach within thirty (30) days of receiving written notice to do so. Material breaches include, but are not limited to: (i) repeated or intentional non-payment of Subscription Fees; (ii) unauthorised sharing, sublicensing, or tampering with the Software or Hardware; (iii) use of the Software or Hardware with unauthorised third-party tools or platforms; (iv) violation of applicable data protection or privacy laws; or (v) use of the Software in a manner that may cause reputational or legal harm to Bosco AI LTD or others. Bosco AI LTD reserves the right to terminate this Agreement immediately and without notice in the event of fraud, gross negligence, or illegal activity by the Customer. Upon termination for breach, the Customer shall immediately cease all use of the Software and return any applicable Hardware within the specified timeframe. Any outstanding amounts, including charges for unreturned or damaged Hardware, shall remain due.

“Force Majeure”

An event or circumstance beyond the reasonable control of either party which prevents or delays the performance of any obligation under this Agreement. This includes, but is not limited to: natural disasters, war, civil unrest, terrorist acts, strikes, labour disputes, epidemics or pandemics, acts of government, power or internet outages, or failures in third-party infrastructure. Neither party shall be liable for any failure or delay in performing its obligations (except payment obligations) where such failure or delay results from a Force Majeure event. The affected party shall use reasonable efforts to mitigate the impact and must notify the other party in writing (including by email) without undue delay.

“Support”

Assistance provided by Bosco AI LTD to the Customer in connection with the use of the Software and Hardware. Support is available during normal UK business hours (Monday to Friday, 9:00am to 5:00pm, excluding public holidays). Customers may initiate support via WhatsApp messaging, including text and photo submissions. If required, Bosco AI LTD may follow up by phone; however, inbound calls from Customers are not supported. Support covers guidance with installation, troubleshooting Software or Hardware issues, and general usage enquiries. Bosco AI LTD does not guarantee specific response times and is not responsible for resolving issues related to third-party software, internet connectivity, or hardware not supplied by Bosco AI LTD. Support may be limited during peak periods or system outages, and is provided at Bosco AI LTD’s discretion.

“Data Retention”

The periods for which Bosco AI LTD keeps Customer Data, as set out in clause 9.2 and Schedule 2, section 8.

“Data Deletion”

The process by which Bosco AI LTD permanently removes Customer Data from its systems. Customers may request deletion of their personal data in accordance with their rights under applicable data protection laws, including the UK GDPR. Bosco AI LTD will honour such requests unless retention is required for legal, regulatory, or contractual reasons (such as audit logs or financial reporting). How deletion works during the Subscription and after cancellation is set out in Schedule 2, section 8. Deleted data cannot be recovered.

“Third-Party Tools”

Any products or services provided by others that the Customer chooses to use with the Software, such as its practice management system. Bosco AI LTD is not responsible for their performance, availability or data handling practices. Sub-Processors are not Third-Party Tools; Schedule 2 covers them.

“Analytics Data”

Data collected by Bosco AI LTD about how the Software and Services are used, to monitor performance, fix errors, improve functionality and support internal business decisions. Analytics Data may include usage patterns, feature interaction logs, performance metrics and system events. The desktop app’s usage and error reports are linked to an account number and a device number only. On the website, optional analytics run only after the visitor allows them, as described in our Privacy Policy.

“User Responsibilities”

The obligations of the Customer and their Authorised Users when using the Software, Hardware, or Services. These include, but are not limited to: (i) ensuring that login credentials are kept secure and not shared; (ii) using the Software only for lawful, professional purposes within a dental practice environment; (iii) maintaining the condition of any Hardware provided and returning it where required; (iv) complying with all applicable laws, regulations, and data protection standards; and (v) not using the Software or Services to upload, store, or transmit any unlawful, defamatory, or harmful content. The Customer is also responsible for telling patients about recording and asking their permission, as set out in clause 9.6, and for checking every note before it goes into the patient’s record, as set out in clause 9.7.

“Licence”

The limited, non-exclusive, non-transferable, and revocable right granted by Bosco AI LTD to the Customer to access and use the Software and associated Services during the Term of the Subscription, strictly for internal use within the Customer’s dental practice. The Licence is subject to the terms of this Agreement and does not include any right to sublicense, distribute, resell, or make the Software available to third parties. All rights not expressly granted under this Licence are reserved by Bosco AI LTD.

“Security Measures”

The technical and organisational measures Bosco AI LTD uses to protect Customer Data against unauthorised access, disclosure, alteration, or destruction, as described in Schedule 2, section 4.

“Intellectual Property”

All intellectual property rights, including but not limited to copyrights, trademarks, patents, design rights, trade secrets, know-how, and all related goodwill, whether registered or unregistered, in and to the Software, Documentation, Services, branding, and any other materials provided by Bosco AI LTD. All such rights shall remain the exclusive property of Bosco AI LTD or its licensors. This Agreement does not grant the Customer any rights, title, or interest in or to any Intellectual Property, except for the limited Licence expressly granted under this Agreement.

“Operating System Requirements”

The minimum technical conditions required to install and operate the Breez Software. These currently include a supported version of the Windows operating system, a stable internet connection, and an up-to-date web browser. Bosco AI LTD may update these requirements from time to time to reflect technological advancements or security considerations. It is the Customer’s responsibility to ensure their systems meet these requirements to access and use the Services effectively.

Schedule 2: Data Processing Agreement

This Schedule is the data processing agreement between the Customer, as controller, and Bosco AI LTD, as processor, that Article 28 of the UK GDPR requires. It forms part of these Terms, and the Customer accepts it when it accepts these Terms. If the Customer would like a copy signed by both parties, it can ask at support@bree-z.com.

1. Roles and Responsibilities

1.1 For the purposes of applicable data protection legislation, including the UK GDPR and Data Protection Act 2018:

• The Customer is the Data Controller for all patient information and clinical records processed through Breez.
• Bosco AI LTD acts as the Data Processor, processing such personal data solely on behalf of the Customer and in accordance with its documented instructions (section 3.1(a)).

1.2 Bosco AI LTD is a controller only for its own records about its customers and the people who contact it, such as accounts, billing, support and marketing, as described in its Privacy Policy.

1.3 Details of the processing:

• Subject matter: recording dental appointments, turning speech into text and drafting clinical notes for the Customer’s clinicians, keeping them for the Customer, and giving support.
• Duration: for the term of this Agreement, and then until deletion under section 8.
• Nature of the processing: collection, speech-to-text, AI note drafting, organising and storing notes, retrieval, support review and deletion.
• Purpose: to give the Customer’s clinicians draft clinical notes of their appointments, to keep those notes for the Customer, and to support the Customer.
• Types of personal data: audio recordings, transcripts and notes; the names of the clinician and assistant shown on the note; appointment details such as times and durations; and anything said in the appointment, including health information, which is special category data.
• Data subjects: patients, including children, their parents or guardians and anyone else present at the appointment, and the Customer’s clinicians and staff.

2. Customer Personal Data

2.1 “Customer Personal Data” means any personal data processed by Bosco AI LTD on behalf of the Customer in connection with their use of the Breez Software. This includes, without limitation:

• Audio recordings of dental consultations,
• Speech-to-text transcripts,
• Patient names or identifiers said during the appointment,
• Appointment metadata (e.g. timestamps, durations),
• Names of the clinician and assistant shown on the note,
• Any other clinical information disclosed during recordings,
• Information input or generated through the Breez Software as part of the note generation process, and support messages about a recording.

2.2 Bosco AI LTD uses Customer Personal Data only to provide the Services, to review a note when the Customer reports a problem (clause 9.5), and to comply with the law. We test improvements on demo and synthetic recordings. In this section, “we” means Bosco AI LTD and “your data” means Customer Personal Data. We never use your data for marketing, profiling or training AI models.

2.3 We remove patients’ names and other details that identify them from transcripts and notes. Transcripts and notes are still Customer Personal Data, and we protect them as patient records.

3. Processor Obligations

3.1 Bosco AI LTD shall:

• (a) Only process Customer Personal Data on documented instructions from the Customer, including for any transfer outside the UK, unless required to do so by applicable law. In such a case, Bosco AI LTD shall (unless legally prohibited) inform the Customer before processing. These Terms, the settings the Customer chooses in Breez, and any problem report the Customer sends are the Customer’s documented instructions;
• (b) Tell the Customer straight away if one of its instructions seems to break data protection law;
• (c) Ensure confidentiality by requiring that any personnel authorised to process Customer Personal Data are bound by confidentiality obligations;
• (d) Assist the Customer, at the Customer’s cost, in responding to data subject rights requests under Chapter III of UK GDPR, including access, rectification, erasure, and objection requests, to the extent applicable;
• (e) Provide reasonable assistance, at the Customer’s cost, to ensure compliance with the Customer’s obligations under Articles 32 to 36 of the UK GDPR (e.g. security, data breach notification, DPIAs);
• (f) Make available information as reasonably required to demonstrate compliance with the obligations set out in this Schedule and permit audits by the Customer, as set out in section 10;
• (g) Keep a written record of the processing it carries out for the Customer, as Article 30(2) of the UK GDPR requires.

4. Security Measures

4.1 Bosco AI LTD shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risks associated with processing Customer Personal Data. These measures include, but are not limited to:

• Data is encrypted in transit and at rest.
• Our cloud infrastructure is secure and access-controlled.
• Only authorised personnel can access live patient data.
• Test systems are kept separate from live data.
• Staff access to recordings, transcripts and notes is logged.
• Passwords are stored in scrambled (hashed) form so they can’t be read.
• We test our security regularly.

4.2 Bosco AI LTD shall ensure that any person acting under its authority who has access to Customer Personal Data does not process such data except on the Customer’s instructions, unless required to do so by law.

5. Sub-Processors

5.1 The Customer gives Bosco AI LTD general authorisation to engage Sub-Processors. The full list of current Sub-Processors is available to the Customer on request at support@bree-z.com.

5.2 Before adding or replacing a Sub-Processor that handles Customer Personal Data, Bosco AI LTD tells the Customer. The Customer may object on reasonable data protection grounds before that Sub-Processor starts. In the event of a justified objection, the parties shall work in good faith to find a mutually acceptable resolution.

5.3 Bosco AI LTD shall ensure that any Sub-Processor is subject to a written agreement imposing data protection obligations that are no less protective than those set out in this Agreement.

5.4 Bosco AI LTD shall remain responsible for ensuring that any Sub-Processor processes Customer Personal Data in accordance with this Agreement and applicable data protection laws.

6. Data Breach Notification

6.1 In the event of a personal data breach affecting Customer Personal Data, Bosco AI LTD shall notify the Customer without undue delay after becoming aware of the breach.

6.2 Such notification shall include, to the extent known at the time:

• A description of the nature of the breach (including, where possible, the categories and approximate number of affected data subjects and data records);
• The likely consequences of the breach;
• The measures taken or proposed to address the breach and mitigate its effects;
• Contact details for further information.

6.3 Bosco AI LTD shall promptly investigate the breach and take reasonable steps to mitigate any harmful effects, and shall cooperate in good faith with the Customer to support any required notifications to supervisory authorities or data subjects.

7. Where Data Is Stored and International Transfers

7.1 Customer Personal Data is stored by Cloudflare, in the UK and the EU, and processed in the UK and the EU.

7.2 Any transfer outside the UK uses the safeguards UK law provides (UK adequacy, the UK International Data Transfer Agreement or the UK Addendum).

7.3 The Customer can ask for a copy of these safeguards at support@bree-z.com. Bosco AI LTD may redact commercial or security details.

8. Data Retention and Deletion

8.1 Bosco AI LTD shall retain Customer Personal Data only for as long as necessary to provide the Services and to comply with applicable legal and regulatory obligations.

8.2 Specifically:

• Audio recordings are deleted 30 days after the recording.
• Transcripts and clinical notes are kept while the Customer’s account is active. The Customer, as data controller, decides how long clinical records are kept. NHS guidance is 11 years for adults and until age 25 for children. Bosco AI LTD deletes or returns them when the Customer asks.

8.3 Upon termination of the Customer’s Subscription, Bosco AI LTD shall:

• For 30 days after the Cancellation Date, let the Customer download its notes and transcripts;
• Then delete the Customer Personal Data within a further 30 days, including copies held by its Sub-Processors, except where the law requires it to be kept;
• Confirm the deletion in writing if the Customer asks.

8.4 The Customer may request early deletion of their Customer Personal Data at any time by contacting support, provided this does not interfere with Bosco AI LTD’s legal obligations.

9. Data Subject Rights Assistance

9.1 To the extent required by applicable data protection laws, Bosco AI LTD shall provide reasonable assistance to the Customer, at the Customer’s cost, in responding to requests from data subjects exercising their rights under UK GDPR, including:

• The right of access,
• Rectification or erasure of personal data,
• Restriction of processing,
• Data portability, and
• Objection to processing.

9.2 If a patient or other data subject contacts Bosco AI LTD directly about Customer Personal Data, Bosco AI LTD passes the request to the Customer without undue delay and tells the person that their practice handles it. Bosco AI LTD does not otherwise respond without the Customer’s authorisation, unless the law requires it.

10. Audit Rights

10.1 Bosco AI LTD shall, upon reasonable written request from the Customer and no more than once in any twelve (12) month period, make available such information as is reasonably necessary to demonstrate its compliance with this Schedule and applicable data protection laws.

10.2 If, after reviewing the information provided, the Customer reasonably believes that further assurances are required, the Customer may request to carry out an audit of Bosco AI LTD’s relevant data processing activities. The Customer may appoint an independent auditor, bound by confidentiality, to carry out an audit on its behalf.

10.3 Any such audit shall:

• Be conducted on at least thirty (30) days’ notice;
• Be limited in scope to the processing of Customer Personal Data under this Agreement;
• Not unreasonably interfere with Bosco AI LTD’s normal business operations;
• Be subject to appropriate confidentiality obligations.

10.4 The Customer shall bear all costs of any audit unless the audit identifies a material breach by Bosco AI LTD of its obligations under this Agreement.