Terms of Service

Aleras, Inc.
Effective date: November 6, 2026
Last updated: November 6, 2026

These Terms of Service (the “Terms”) are a binding agreement between Aleras, Inc., a Delaware corporation (“Aleras,” “we,” “us,” or “our”), and the business or other legal entity accepting these Terms (“Customer,” “you,” or “your”). They govern Customer's access to and use of Aleras's AI voice-agent platform, associated software, interfaces, support, and any related services that Aleras makes available (the “Services”). These Terms are intended for business and professional use, not personal, family, or household use.

PLEASE READ THESE TERMS CAREFULLY. Section 21 limits liability, Section 20 disclaims certain warranties, and Section 23 specifies governing law and how disputes are resolved. AI-generated communications can make mistakes. Customer remains responsible for the purposes for which it deploys an AI Agent and for its business dealings with callers, subject to Aleras's own duties under law and contract.

1. Acceptance, authority, and order of precedence

1.1 Business acceptance and authority. These Terms bind the business or other legal entity that affirmatively accepts them in an account registration or checkout flow, signs an Order referencing them, or otherwise accepts through a legally effective process ("Customer"). The accepting person represents that they are legally authorized to bind Customer. The Services are offered for business or professional use, not personal, family, or household use.

1.2 Orders. An "Order" is an accepted subscription checkout, order form, statement of work, or other written agreement identifying the purchased Services, fees, service term, or negotiated conditions. The Terms and Orders constitute the "Agreement." Customer purchase order terms do not amend the Agreement unless Aleras expressly signs a document accepting those terms. Any provision in an Order that changes these Terms must clearly identify the subject matter or provision superseded; a separately negotiated Order controls for that subject matter, whether commercial or technical, but cannot override mandatory law or a BAA or DPA within its expressly protected subject matter unless that agreement permits the change.

1.3 Privacy and healthcare agreements. An executed business associate agreement ("BAA") controls protected health information ("PHI") within its scope. An executed data processing agreement ("DPA") controls personal information within its scope. Where documents conflict, mandatory law controls first, followed by the executed BAA for PHI, the executed DPA for covered personal information, the executed Order for its identified deviations, then these Terms. Aleras's Privacy Policy at aleras.ai/privacy describes data practices but is not a substitute for a DPA or BAA. Separate service-level, information-security, data-residency, or audit commitments exist only to the extent included in an accepted Order or applicable addendum.

2. Definitions

“AI Agent” means an automated voice, speech, conversational, or related workflow function made available through the Services. “Authorized User” means a person whom Customer authorizes to use an account. “Caller” means a person who calls, receives a call from, or otherwise interacts with an AI Agent. “Customer Data” means data, materials, files, contact lists, prompts, scripts, business instructions, call content, recordings (if enabled), transcripts, personal data, and other information transmitted to or processed through the Services by or for Customer; it excludes Aleras Technology. “Output” means content or a result produced by the Services from Customer Data, including AI speech, transcripts, summaries, extracted fields, suggested actions, and workflow results. “Aleras Technology” means Aleras's software, documentation, models and orchestration, platform designs, methods, interfaces, know-how, and improvements, but not Customer Data. “Third-Party Service” means any external telephone carrier, model or speech provider, cloud service, API, database, EHR/RIS, CRM, calendar system, or other independently supplied service. “Applicable Law” includes binding laws and regulations applicable to the relevant actor, conduct, jurisdiction, and communication.

3. Access rights; accounts; acceptable users

3.1 License. Subject to payment and compliance with the Agreement, Aleras grants Customer a limited, nonexclusive, nontransferable, nonsublicensable right during the applicable term to access the Services for its authorized internal business purposes. Authorized Users may use the Services solely on Customer's behalf. No Aleras source code, model weights, or intellectual property is sold or licensed except as expressly provided.

3.2 Account responsibility. Customer is responsible for its Authorized Users, agent settings, configured workflows, connected systems, credentials, access permissions, and activity initiated under its account, including activities conducted negligently by its personnel or contractors. Customer will maintain appropriate access controls, promptly revoke unnecessary access, and promptly report compromised credentials. This responsibility does not excuse Aleras from liability for a security failure or other obligation independently attributable to Aleras under the Agreement or law.

3.3 Restrictions. Customer may not resell, sublicense, white-label, or make Services available to another legal entity without a written reseller, affiliate, or other applicable authorization. Documented rate limits, usage limits, and carrier restrictions apply. Customer must ensure that account administrators have authority to bind their organization to configurations and connected-system permissions.

4. What Aleras does—and does not do

4.1 Aleras supplies software and infrastructure that enables Customer to configure or deploy AI Agents to communicate, gather information, route requests, produce summaries, and interact with customer-approved systems as supported by the selected Services. Availability of individual functions depends on the applicable Order, integrations, configuration, and technical capabilities.

4.2 Customer controls its use case. Customer determines whom agents contact, why they communicate, their scripts, knowledge sources, business rules, business representations, escalation pathways, consent procedures, and connected-system permissions. Customer is responsible for its underlying goods and services, staffing, scheduling decisions, patient/provider relationship, and communications strategy, except to the extent expressly assumed by Aleras in a signed Order.

4.3 Aleras is not, merely by providing the Services, the healthcare provider, seller of Customer's products, regulated adviser, emergency-response provider, or principal to Customer's underlying business transaction. Nothing in this section disclaims Aleras's independent legal obligations, its own negligence or misconduct, or commitments expressly undertaken in the Agreement.

5. AI limitations; oversight; high-impact activity

5.1 AI systems may hallucinate, misunderstand speech, produce incomplete or inaccurate transcripts, identify the wrong caller, repeat sensitive information, make erroneous scheduling changes, or generate other unexpected Outputs. Customer must test its configurations before production and perform reasonable monitoring, quality assurance, and human review appropriate to the risk of the use case.

5.2 Customer may not rely on an AI Agent as the sole basis for medical diagnosis, treatment advice, emergency triage, prescribing, insurance or benefits eligibility, employment, credit, legal determinations, or other decisions with similarly significant consequences unless expressly authorized under a compliant, separately agreed deployment and Applicable Law. Customer must provide suitable human review and escalation when required or reasonable for patient safety or caller welfare.

5.3 No emergency service. The Services are not a substitute for 911, crisis services, or qualified emergency responders. Customer must not configure an agent to imply it provides emergency intervention. If Customer's workflow could receive emergencies or urgent medical complaints, Customer must design and test an appropriate referral and human escalation process before deployment.

6. Telephone, messaging, AI disclosures, and recording

6.1 Lawful communications. Customer is responsible for establishing a lawful basis and obtaining applicable consents for its communications, audiences, calling lists, scripts, call purposes, and recording settings. AI-generated human voices are artificial voices for purposes of the U.S. Telephone Consumer Protection Act ("TCPA") and FCC implementing rules; consent, exemption, and notice requirements vary with the communication and recipient. Customer must comply with applicable TCPA, FCC, FTC Telemarketing Sales Rule ("TSR"), do-not-call, carrier, anti-spoofing, state recording, and equivalent laws. A phone number, referral, or existing customer relationship does not automatically authorize automated or artificial-voice calls.

6.2 AI and healthcare disclosure. Customer must disclose that a caller is interacting with an AI or synthetic voice where required by law, and must not impersonate a human or licensed professional. Where California Health and Safety Code Section 1339.75 (AB 3030) applies to generative-AI communications pertaining to patient clinical information, Customer must ensure the legally required disclaimer and human-contact instructions, including timing appropriate for audio and other formats, unless a statutory exception applies. Administrative matters such as scheduling are excluded from that law's definition of patient clinical information, but other disclosure duties may still apply. Customer remains responsible for making any additional disclosures required by law, and Aleras will perform any express assistance obligations it assumes in an Order or BAA.

6.3 Recording and transcription. Customer is responsible for notices and lawful consent to record, monitor, transcribe, or analyze calls, including all-party consent where applicable, and for providing an appropriate alternative when required. If consent is absent or withdrawn, Customer must stop affected processing or route through a lawful alternative. Merely linking to a Privacy Policy does not establish call-time consent. Customer must implement controls for requests to speak to a person where legally required or appropriate to the deployment.

6.4 Outbound calling and records. When outbound campaigns are enabled, Customer must maintain lawful source and scope of consent, suppression and revocation lists, permissible calling times, identification, registrations, caller-ID accuracy, and legally mandated records. Covered TSR telemarketing records may require retention for five years; this does not mean every call recording must be kept for five years. Aleras may reasonably request consent or compliance documentation and may limit or suspend unlawful or high-risk activity. Customer may not conduct an activity for which required compliance controls are unavailable.

6.5 Independent duties. These clauses allocate obligations between the parties but do not extinguish either party's independent statutory duties or immunize Aleras from claims based on Aleras's own unlawful acts. Schedule A is incorporated into these Terms and supplies additional conditions.

7. Acceptable use and prohibited activity

Customer will not, and will not permit others to: (a) use the Services unlawfully, to facilitate fraud, phishing, stalking, harassment, threats, discrimination, impersonation, or unlawful surveillance; (b) make unlawful robocalls or robotexts, spoof caller identification, evade call blocking or opt-out requests, or use unlawfully sourced calling lists; (c) create or use voice clones, identities, signatures, or likenesses without the necessary valid permission; (d) collect credit-card credentials, account secrets, government identifiers, biometric identifiers, or other restricted information through an unapproved workflow; (e) submit PHI before the prerequisites in Section 8 are met; (f) interfere with security, rate limits, systems, or other customers; (g) scrape, reverse engineer, extract or reproduce underlying models, weights, or software except as nonwaivably permitted by law; (h) introduce malware or harmful code; (i) infringe intellectual-property, privacy, publicity, or other rights; (j) make agents appear to be government authorities, emergency workers, or other trusted officials to deceive; or (k) conduct uses prohibited by an applicable Order, documentation, or communicated carrier restriction. Aleras may take proportionate action to prevent or remediate misuse.

8. Patient information and other regulated data

8.1 Healthcare deployment. Customer may not knowingly configure or launch a workflow that creates, receives, maintains, transmits, or otherwise processes PHI through Aleras until the required BAA has been executed, Aleras has authorized that deployment, and the applicable downstream arrangements and safeguards are implemented. In healthcare settings, even routine appointment calls may disclose PHI. Customer must evaluate each workflow accordingly and must not rely on a label such as "administrative" to avoid applicable HIPAA requirements. Aleras will perform its independent business-associate duties where those duties apply.

8.2 Roles and safeguards. Customer determines the healthcare purpose, required patient and clinical notices, lawful permissions, agent instructions, escalation rules, and minimum-necessary access within its environment. Aleras will process PHI only as permitted by the executed BAA and applicable law. A BAA does not, by itself, certify a configuration as HIPAA compliant or authorize an unsupported use case. For purposes of the Agreement, PHI submitted contrary to this Section may be treated as Customer's unauthorized submission, without waiving Aleras's own applicable legal obligations.

8.3 Other restricted information. Financial account credentials, full payment-card numbers, security codes, government identifiers, biometric identifiers, or other restricted categories may not be collected through agent workflows without written authorization and appropriate controls. Aleras does not offer caller payment-card processing under these general Terms; Aleras's own subscription billing is separate.

9. Customer Data, permitted processing, and ownership

9.1 Ownership and license. As between Customer and Aleras, Customer retains its rights in Customer Data. Customer grants Aleras and its authorized providers a nonexclusive right to process Customer Data only as reasonably necessary to deliver, maintain, secure, operate, support, and troubleshoot the Services; follow Customer's documented instructions; meet legal obligations; investigate misuse; and perform expressly authorized processing under the Agreement. Customer warrants that it has sufficient authority, notices, permissions, and rights to provide the data and instructions.

9.2 Outputs. As between the parties, Customer may use its Outputs for lawful business purposes, subject to third-party rights and the Agreement. Aleras assigns any rights it owns in Customer-specific Outputs, excluding Aleras Technology, general tools, templates, preexisting content, and third-party components. AI-generated Outputs may not be unique or subject to exclusive intellectual-property rights. Aleras retains its technology and know-how.

9.3 Model training restrictions. Aleras will not use identifiable Customer Data, caller content, call recordings, transcripts, or PHI to train, retrain, or fine-tune any AI or machine-learning model, including Aleras-specific models, without a separate written authorization identifying the purpose, data categories, and permissions, and without any additional consent or legal authority required for that processing. Aleras will impose corresponding restrictions on providers acting as its subprocessors. Transient inference to complete a customer-authorized call is not model training. The parties may authorize additional processing only through a lawful, compatible written agreement; PHI remains subject to its BAA.

9.4 Metrics and improvements. Aleras may use non-content operational metrics (for example, uptime, error counts, resource consumption, routing latency, and aggregate billing usage) to secure, monitor, maintain, and improve the platform, provided it does not disclose Customer Confidential Information, identify callers, or use PHI contrary to the BAA. Aleras may use aggregated or de-identified information only where permitted by law and contract, after appropriate de-identification and controls against reidentification; de-identification alone does not authorize a use prohibited by a BAA or applicable law. Customer Data will not be repurposed for advertising.

9.5 Subprocessors and integrations. Aleras may use vendors under appropriate written confidentiality, data-use, security, and training restrictions. The DPA or BAA controls required subprocessor disclosures, notices, objections, and related rights. Customer-directed integrations operating under Customer's separate accounts are Customer's responsibility; Aleras is responsible for its own contractual and legal commitments regarding subprocessors it selects.

10. Security, privacy, and data protection

10.1 Aleras will implement and maintain reasonable administrative, technical, and organizational safeguards appropriate to the Services and the sensitivity of data that it is contractually authorized to process. Specific commitments, where agreed, are set out in the DPA, BAA, security schedule, or Order. No particular independent certification, audit, encryption standard, data-residency guarantee, or uninterrupted availability is represented unless expressly verified and included in a written agreement or current approved security documentation.

10.2 Customer will configure and use its account, agents, integrations, access controls, and business processes in accordance with Applicable Law and its own privacy notices. When Customer determines the purposes and means of processing personal data, it is generally the controller/business, and Aleras acts as a processor/service provider with respect to authorized Customer Data, subject to the terms of any required DPA and activities for which Aleras is independently responsible.

10.3 Aleras may process limited account, technical, security, and billing data for its own legitimate business operations as described in its Privacy Policy. The parties will notify each other of security incidents to the extent and within the time required by Applicable Law and the applicable DPA or BAA; neither party may rely on this clause to reduce nonwaivable breach-notification duties.

11. Third-party infrastructure and integrations

11.1 Services may rely on independent carriers, infrastructure, cloud, speech, inference, and integration providers. Aleras does not guarantee the performance or availability of an independent telecommunications network or customer-selected system, and will not be liable for a third party's independent acts outside Aleras's reasonable control except as required by law or an express contractual commitment. Aleras remains responsible for compliance with its own obligations regarding subprocessors it selects, including applicable DPA/BAA requirements.

11.2 Customer must obtain appropriate rights, credentials, and approvals for Customer-managed integrations and confirm the accuracy of connected-system instructions. Aleras may suspend integrations that pose a material security or legal risk. Required subprocessor notices and rights are set forth in the applicable DPA or BAA. Aleras will make the identity and role of subprocessors available by register or other agreed disclosure mechanism where required by applicable agreements or law.

12. Intellectual property and feedback

Aleras and its licensors own the Aleras Technology and all intellectual-property rights in it. Nothing grants Customer rights in underlying source code, models, carrier facilities, or other customers' information. Customer may provide suggestions and feedback, and grants Aleras a perpetual, worldwide, nonexclusive, royalty-free right to use nonconfidential feedback to improve its products, provided the use does not disclose Customer's Confidential Information, personal data, or PHI in violation of this Agreement. All ungranted rights are reserved.

13. Synthetic voices and personal likenesses

If a feature permits the use of a custom voice, sample, or likeness, Customer must obtain and retain any consent and intellectual-property or publicity permissions necessary for collection, generation, and use. Customer must remove or disable a voice or likeness promptly when its authority ends and Applicable Law requires removal. Aleras may request proof of authorization and disable voices used for deception, fraud, or high-risk impersonation. Rights in custom voice assets and portability are governed by the applicable Order, documentation, and third-party licenses.

14. Confidentiality

14.1 Protected information. "Confidential Information" means nonpublic business, pricing, technical, strategic, security, and customer information that is identified as confidential or reasonably should be understood as such, including Customer Data. The recipient will use it only for purposes authorized by the Agreement and protect it using at least reasonable care. Access is limited to personnel and providers with a need to know who are bound by confidentiality duties. Confidential Information excludes information lawfully public without breach, demonstrably known without restriction, lawfully received from an independent source, or independently developed without its use.

14.2 Legal disclosure; survival. If law requires disclosure, the recipient will, where legally permitted, provide prompt notice and reasonable assistance to seek protection. Return and deletion are subject to Section 19, applicable DPA/BAA terms, and lawful retention obligations. Confidentiality duties survive for five years following termination; trade-secret duties survive as long as trade-secret protection applies; PHI and statutory privacy obligations survive as required by applicable law and the applicable agreement.

15. Fees, metering, and taxes

15.1 Charges. Fees, included and metered usage, setup charges, overages, calling charges, minimums, and billing periods are established by the accepted checkout or Order. Unless an Order states otherwise, invoices are due 30 days after issue and paid in U.S. dollars. Customer will promptly raise good-faith billing disputes with adequate detail; undisputed amounts remain payable while the parties investigate contested amounts. Usage may be calculated from Aleras's metering systems subject to correction of demonstrable errors.

15.2 Late payment and taxes. Undisputed overdue amounts may accrue interest at the lesser of 1% per month and the maximum lawful rate, plus reasonable documented collection costs. Aleras will ordinarily give at least ten days' prior notice before suspending solely for nonpayment of undisputed fees, except where a material fraud or security risk requires faster action. Customer pays applicable sales, use, and similar taxes other than Aleras's net-income taxes. Unless an Order or applicable law provides otherwise, paid fees are nonrefundable except for the termination/refund right expressly stated in Section 19.1.

16. Term, renewal, and changes to pricing

16.1 Term and default renewal. Each Order begins on its stated start date and continues for the stated initial term. If neither the Order nor checkout states a term, the subscription is month-to-month. Unless an Order expressly provides otherwise, paid subscriptions automatically renew for successive periods equal to the initial term (capped at 12 months per renewal) at the then-applicable renewal price. Either party may prevent renewal by notice at least 30 days before a renewal of an annual or longer subscription, or seven days before renewal of a monthly subscription, subject to longer mandatory notice requirements where applicable. Aleras will provide any renewal notices required by law. A nonrenewal ends the subscription at the close of the current paid term; it does not terminate it immediately.

16.2 Pricing changes. Aleras will not change committed-term pricing except as the Order permits. Price increases for future renewals require at least 30 days' advance notice, or any longer notice required by law or an Order. If sufficient notice is not given, the increase will not take effect until a renewal for which the required notice has been given. An Order may override the default renewal scheme where expressly agreed. Trials and pilots may have separate stated termination and data-retention conditions.

17. Support; service changes; beta functionality

Unless an Order includes an express service-level agreement, Aleras does not guarantee a particular uptime percentage, response time, or support level. Aleras may carry out maintenance and modify or retire features, but will use commercially reasonable efforts to provide advance notice of a material reduction in core functionality during a paid committed term, except when urgent security, safety, carrier, or legal action is needed. Beta, preview, or evaluation features are provided for testing and may be changed or discontinued; they should not be used for production PHI or other regulated data unless expressly authorized in writing.

18. Suspension and misuse response

Aleras may suspend all or part of the Services to address reasonably suspected unlawful calling, fraud, abuse, material security risk, unauthorized disclosure, serious breach, carrier or provider enforcement, or overdue undisputed payment after appropriate notice. Aleras will, where feasible and lawful, provide notice, state the basis, and give a reasonable opportunity to cure; immediate suspension is permitted where necessary to prevent harm or meet law or carrier obligations. Suspensions will be proportionate, and Aleras will reasonably cooperate to restore access after remediation. This provision does not permit Aleras to deny legally required access to PHI or use suspension to evade its DPA/BAA duties.

19. Termination; data return; survival

19.1 Termination rights and refunds. Either party may terminate an Order if the other commits a material breach and fails to cure it within 30 days after reasonably specific written notice, or immediately for a breach incapable of cure or as required by law. Customer may terminate for convenience only if permitted by an Order or the default monthly nonrenewal procedure. If Customer terminates for Aleras's uncured material breach, Aleras will refund prepaid fees allocable to the unused portion of the terminated affected Services after the effective date, excluding fees already accrued for usage or completed professional services. If Aleras terminates for Customer's breach, accrued charges remain due and prepaid amounts are not refunded except as required by law.

19.2 Export and deletion. Unless a BAA, DPA, or signed Order requires a different process or shorter legally mandated action, Customer may request export of Customer Data that remains in Aleras's active, retrievable systems during the term and for 30 days after expiration or termination. During that 30-day period, Aleras will make available its then-supported, commercially reasonable export methods for such data in a commonly usable format, subject to identity verification, applicable law, and any restrictions necessary to protect third parties. This does not require creation of new export tools, recovery of already deleted records, or access to recordings that the service was not configured to retain. After the period, Aleras may delete or de-identify Customer Data under its retention schedule and the DPA/BAA, subject to legal holds, required records, and backup cycles. PHI return, deletion, and access obligations in the BAA control if inconsistent.

19.3 Effect and survival. Access rights end when the relevant service expires or terminates, subject to limited export access under Section 19.2. Payment, ownership, confidentiality, restrictions, warranty disclaimers, liability, indemnity, dispute-resolution, and required data-protection obligations survive as appropriate.

20. Disclaimer of warranties

EXCEPT FOR EXPRESS WARRANTIES IN A SIGNED ORDER, DPA, OR BAA AND TO THE MAXIMUM EXTENT PERMITTED BY LAW, THE SERVICES AND OUTPUTS ARE PROVIDED “AS IS” AND “AS AVAILABLE.” ALERAS DISCLAIMS IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, AND NON-INFRINGEMENT. ALERAS DOES NOT WARRANT THAT AN AI AGENT WILL BE ACCURATE, ERROR-FREE, UNINTERRUPTED, LEGALLY COMPLIANT IN EVERY CUSTOMER CONFIGURATION, OR CAPABLE OF REPLACING HUMAN SUPERVISION. THIS SECTION DOES NOT DISCLAIM NONWAIVABLE STATUTORY WARRANTIES OR ANY EXPRESS SECURITY OR DATA-PROTECTION OBLIGATION ALERAS HAS ASSUMED.

21. Limitation of liability

21.1 Excluded damages. TO THE MAXIMUM EXTENT PERMITTED BY LAW, NEITHER PARTY IS LIABLE FOR INDIRECT, INCIDENTAL, CONSEQUENTIAL, SPECIAL, EXEMPLARY, OR PUNITIVE DAMAGES OR LOST PROFITS, REVENUE, BUSINESS OPPORTUNITY, OR GOODWILL, EVEN IF ADVISED OF THE POSSIBILITY. THE FOREGOING EXCLUSION DOES NOT LIMIT AMOUNTS PAYABLE TO THIRD PARTIES UNDER A COVERED INDEMNITY, FEES OWED, OR LIABILITY THAT APPLICABLE LAW DOES NOT PERMIT EXCLUDING.

21.2 General cap. EXCEPT FOR THE MATTERS LISTED IN SECTION 21.4, EACH PARTY'S TOTAL AGGREGATE LIABILITY ARISING OUT OF OR RELATING TO THE AGREEMENT, WHETHER IN CONTRACT, TORT, STATUTE, OR OTHERWISE, IS LIMITED TO THE TOTAL FEES PAID OR PAYABLE UNDER THE AFFECTED ORDER FOR THE 12 MONTHS PRECEDING THE EVENT FIRST GIVING RISE TO THE CLAIM. FOR A NO-FEE SERVICE, THE CAP IS US$1,000.

21.3 Data-protection cap. A PARTY'S BREACH OF SECTION 14 (CONFIDENTIALITY), OR ALERAS'S BREACH OF AN EXPRESS CONTRACTUAL DATA-SECURITY OR DATA-PROTECTION OBLIGATION, IS SUBJECT TO A CAP EQUAL TO TWO TIMES THE CAP STATED IN SECTION 21.2, UNLESS A SIGNED ORDER, DPA, OR BAA EXPRESSLY ESTABLISHES A DIFFERENT CAP FOR THAT SUBJECT MATTER. THIS SECTION DOES NOT PURPORT TO LIMIT STATUTORY LIABILITY THAT MAY NOT LAWFULLY BE LIMITED.

21.4 Uncapped obligations. NO CAP IN THIS SECTION LIMITS (A) CUSTOMER'S PAYMENT OF FEES; (B) EITHER PARTY'S FRAUD, WILLFUL MISCONDUCT, OR LIABILITY THAT CANNOT LAWFULLY BE LIMITED; (C) MISAPPROPRIATION OF THE OTHER PARTY'S INTELLECTUAL PROPERTY; OR (D) CUSTOMER'S DEFENSE AND INDEMNITY OBLIGATIONS UNDER SECTIONS 22.1(A), (B), (C), AND (D), INCLUDING CUSTOMER CALLING-LAW VIOLATIONS REGARDLESS OF WHETHER CUSTOMER ACTED KNOWINGLY. THIS ALLOCATION DOES NOT RELIEVE ALERAS OF ITS INDEPENDENT LEGAL OBLIGATIONS OR REQUIRE INDEMNITY FOR ALERAS'S OWN INDEPENDENTLY UNLAWFUL CONDUCT.

22. Indemnification

22.1 Customer indemnity. Customer will defend, indemnify, and hold harmless Aleras, its affiliates, and their officers, directors, employees, and agents from third-party claims, proceedings, losses, judgments, settlements approved under Section 22.3, and reasonable defense costs arising out of or relating to: (a) Customer's communications, contact lists, calling consent, revocation, recording, telemarketing, AI disclosure, or similar violations of law; (b) Customer's unlawful, unauthorized, or deceptive use of synthetic voices, identity, likenesses, scripts, or agent configurations; (c) Customer Data, Customer's underlying products or services, or instructions supplied by or on behalf of Customer that violate third-party rights or applicable law; or (d) Customer's submission or direction to process PHI or other restricted information in violation of Section 8, including the absence of required patient permissions or customer-side controls. This indemnity includes reasonable costs of responding to third-party or governmental investigations and civil fines or penalties only to the extent legally indemnifiable, when arising from the covered Customer conduct. No indemnity is required to the extent a claim or penalty is attributable to Aleras's independently unlawful conduct or willful misconduct, as finally determined or agreed in settlement. Neither party may control a regulator's proceedings except as legally permitted.

22.2 Limited Aleras intellectual-property indemnity. Aleras will defend Customer against a third-party claim that unmodified, Aleras-owned software supplied as part of the Services, when used as authorized, directly infringes U.S. copyright or misappropriates U.S. trade-secret rights, and pay final damages or approved settlements attributable to that claim, subject to Section 21. Claims involving patents, third-party model outputs or generated content, Customer Data, customer-provided materials, unauthorized combinations, modified software, or use after notice of available noninfringing replacement are excluded unless expressly assumed in an Order. Aleras may procure continued rights, modify or replace the affected software with materially similar functionality, or terminate the affected service and refund prepaid unused fees. This clause provides Customer's exclusive contractual remedy for its specified infringement claim, except for nonwaivable rights.

22.3 Procedure. The indemnified party will give prompt notice (delays relieve the indemnifying party only to the extent materially prejudicial), permit defense by reasonably qualified counsel where legally permissible, and cooperate at the indemnifying party's reasonable expense. The indemnified party may participate at its own cost and retain control where a legal conflict or regulatory restriction requires. No settlement may admit the indemnified party's wrongdoing, impose nonmonetary obligations on it, disclose confidential data, or restrict its business without written consent, not unreasonably withheld. The indemnifying party may not agree to a settlement that imposes liability on an individual without that individual's consent. Sections 21.1 and 21.4 govern the treatment of covered indemnity amounts.

23. Governing law; dispute resolution

The parties will attempt in good faith to resolve any dispute arising out of or relating to the Agreement through written notice and discussions by authorized representatives for 30 days, except when immediate judicial relief is necessary. Delaware substantive law governs the Agreement, without its conflict-of-law principles, subject to nonwaivable law. Subject to the foregoing discussions, the state courts located in Los Angeles County, California, and the federal courts for the Central District of California have exclusive jurisdiction and venue for disputes arising out of or relating to the Agreement, including contract, tort, and statutory claims, except where a mandatory forum rule applies. Each party submits to those courts. Either party may seek temporary injunctive relief in any court with jurisdiction to prevent imminent misuse of confidential information, material security threats, or intellectual-property harm.

24. Updates to these Terms

Aleras may revise these Terms for legal, security, operational, or product reasons. Aleras will post the revised text and effective date and give reasonable advance notice of material changes through email or the customer account, where feasible and required. An update will not retroactively impose a new payment commitment or materially reduce express data-protection promises under an existing committed term without a lawful contractual basis. A legally effective amendment, renewed Order, or acceptance process may be required for a material change. Continued use after proper notice may constitute acceptance only where legally effective.

25. General terms

25.1 Relationship and assignment. The parties are independent contractors; neither may bind the other. Neither may assign the Agreement without the other's written consent, not unreasonably withheld, except in a merger, reorganization, financing, or sale of substantially all relevant business assets, provided the successor assumes the assigning party's obligations and the assignment is compatible with law and applicable DPA/BAA terms.

25.2 Force majeure; severability. Neither party is responsible for failure caused by events outside its reasonable control, other than payment obligations and nonwaivable duties, provided it uses reasonable mitigation measures. A provision found unenforceable is severed only to the minimum extent necessary. Failure to enforce is not waiver. No third party obtains enforcement rights except an expressly indemnified person.

25.3 Publicity. Neither party may use the other's name, logo, or trademarks in marketing, case studies, or customer lists without prior written approval, except for truthful statements required by law or consent otherwise expressly given in an Order. No right to publicly reference a healthcare customer's name is implied.

25.4 Notices; electronic execution. Account and operational notices may be given through the account or the Customer administrator's registered email. Formal legal notices to Aleras must be sent to legal@aleras.ai and, if specified in an Order, its mailing address. A notice is effective when actually received, or as expressly agreed in an Order. The Agreement and Orders may be signed electronically and in counterparts, each deemed an original and together one instrument, subject to applicable electronic-signature law.

25.5 Other provisions. Customer will comply with applicable export-control and sanctions laws. No terms in Customer purchase orders bind Aleras without affirmative written acceptance. The Agreement comprises these Terms, its incorporated schedules, and applicable Orders and addenda, and supersedes prior proposals regarding its subject matter. The English-language version governs to the extent permitted by law.

26. Contact

Aleras, Inc.
Legal notices: legal@aleras.ai
Business address: 2810 N Church St STE 89863, Wilmington, DE 19802
Website: aleras.ai

Schedule A — AI Calling, Recording, and Messaging Compliance

This Schedule is incorporated into the Terms and applies only to functions Aleras has actually enabled. It does not authorize any regulated activity absent the consents, notices, records, and controls required by law.

A1. Purpose, authority, and consent records. Before each outbound program, Customer must establish its lawful purpose, consent or exception, authorized seller or healthcare provider, permitted destinations, and lawful number sources. Where consent evidence is required, records should identify the person and number, consent language and scope, collection channel, date and time, relevant seller, and subsequent revocations, as required by applicable law.

A2. Revocation and suppression. Customer must implement and maintain do-not-call, opt-out, consent-revocation, and suppression procedures and honor applicable timing requirements. Customer must not deploy a campaign if the Services and its external processes together cannot satisfy legally required controls. Records must be retained for the period applicable to the specific record type. For covered TSR telemarketing activity, certain records are subject to five-year requirements; routine call audio is not automatically subject to the same duration.

A3. AI, clinical, and recording notices. Customer must identify the calling business, disclose AI involvement and recording or transcription where legally required, and provide required opt-out or human-contact instructions. For communications covered by California AB 3030 concerning patient clinical information, the required GenAI disclaimer for audio communications, including voicemails, generally must be given verbally at both the beginning and end unless a statutory exception applies. Customer must test notices and human-escalation pathways before enabling clinical-content workflows. Recording or monitoring may not begin before consent when law requires consent first.

A4. Identity and messaging. Customer must not spoof caller ID, conceal legally required sponsorship, evade carrier restrictions or call blocking, or use cloned voices without valid rights. For SMS or other messaging features, Customer must satisfy applicable consent, sender-identification, registration, and revocation rules. Customer may not initiate prohibited calls to emergency lines or other protected destinations.

A5. Oversight and investigations. Customer will monitor deployed agents, maintain a channel for complaints, promptly stop a campaign when law requires, and cooperate with appropriately scoped investigations. Aleras may request documentation, suspend suspected unlawful conduct, and respond to lawful process subject to data-protection requirements. Each party remains responsible for its independent acts and statutory duties.