Courtesy translation. In case of any discrepancy, the Italian version of this document prevails.

Terms of Service

General SaaS Contract Conditions - Fibonacci Software

{DRAFT_NOTICE}

Provider (hereinafter, the "Provider"):

Client: the licensed healthcare professional or the authorised healthcare facility that subscribes to the Service as indicated in the following Art. 3 (hereinafter, the "Client").

These General Conditions govern the access to and use of the "Fibonacci" SaaS software in a business-to-business regime among professionals. The Client declares to act in the exercise of their professional or business activity; therefore, the protections provided by Legislative Decree 206/2005 (Consumer Code) do not apply.

Art. 1 - Definitions

For the purposes of these General Conditions, the following terms shall mean:

1.1 Provider: ⟨to be specified⟩, with registered office in ⟨to be specified⟩, VAT number ⟨to be specified⟩.

1.2 Client: the healthcare professional licensed to practice (medical doctor, dentist, or other healthcare professional registered with the respective professional board) or the authorised healthcare facility that subscribes to this contract.

1.3 Authorised User: the natural person (doctor, secretary, assistant, collaborator) to whom the Client assigns access credentials to the Service within the limits of the subscribed Plan.

1.4 Service: the "Fibonacci" SaaS software, delivered in cloud mode and accessible via web browser at https://app.fibonaccimedica.it, including the modules, functionalities, documentation, and ancillary services specified in the subscribed Plan.

1.5 Plan: the subscription level chosen by the Client from those described in Art. 5, with related operational limits, functionalities, and consideration.

1.6 Client Data: the identification, tax, and configuration data provided by the Client during subscription and account management (company name, VAT number, contact details, branding, application preferences).

1.7 Patient Data: personal data, including special categories of data pursuant to Art. 9 GDPR, relating to the Client’s patients, entered, generated, processed, or stored through the Service.

1.8 Trial Period: the 14 (fourteen) consecutive days of free access to the Service as described in Art. 4.

1.9 Subscription Period: the calendar month of Service provision starting from the activation date and automatically renewed as set forth in Art. 7.

1.10 Force Majeure: unforeseeable events beyond the parties' control as defined in Art. 16.

1.11 DPA: the Data Processing Agreement published at https://fibonaccimedica.it/dpa, governing the roles and obligations of the parties regarding the processing of personal data under Regulation (EU) 2016/679.

Art. 2 - Subject matter of the contract

2.1 The Provider grants the Client, on a Software-as-a-Service (SaaS) basis, a non-exclusive, non-transferable, and limited right of access and use of the Fibonacci Service within the operational and functional limits of the subscribed Plan for the duration of this contract.

2.2 The Service is accessible via web browser at https://app.fibonaccimedica.it and is hosted exclusively on infrastructure under the Provider’s responsibility. This contract does not include an on-premise installation license or delivery of the source code.

2.3 The right of access is granted to the Authorised Users designated by the Client, within the numerical limits of the Plan, exclusively for professional purposes internal to the Client’s activity.

2.4 The Provider delivers the Service through continuous updates in line with industry standards. Functionalities may evolve over time as set forth in Art. 15.

Art. 3 - Acceptance and subscription methods

3.1 The contract is concluded upon the Client’s electronic acceptance of these General Conditions by ticking the appropriate box during registration at https://app.fibonaccimedica.it, simultaneously entering identification and payment details, or, in the case of Trial Period activation, at its commencement.

3.2 Upon subscription, the Client declares and warrants:

(a) to be a healthcare professional licensed to practice and registered with the respective professional board, or an authorised healthcare facility under applicable national and regional regulations;

(b) to be a natural person of full age and legal capacity or the legal representative of the indicated legal entity;

(c) to subscribe to the contract in the exercise of their professional or business activity;

(d) that the identification and tax data provided are truthful, complete, and up to date.

3.3 The Client must promptly notify the Provider of any changes to identification or tax data, updating them via the "Account" panel of the Service.

3.4 Technical steps of conclusion. Pursuant to art. 12 of Legislative Decree 70/2003, the contract is concluded through the following steps: (a) completion of the registration form at https://app.fibonaccimedica.it with personal, professional and tax data; (b) consultation of these General Conditions and of the privacy notice, reachable from the links in the form; (c) approval of the General Conditions by means of a first tick and specific, separate approval of the clauses listed in art. 20.1 by means of a second tick; (d) submission of the form; (e) sending by the Supplier of a confirmation message to the e-mail address provided, containing a summary of the order.

3.5 Correction of input errors. Before submitting the form the Client may freely amend any data entered. After submission, personal and tax data remain correctable from the "Account" panel of the Service, as set out in point 3.3.

3.6 Language of the contract. The contract is concluded in Italian. Translations of these Conditions into other languages are provided as a courtesy to make them easier to read: in case of any discrepancy the Italian text prevails, as stated at the top of each translation.

3.7 Retention of and access to the contractual text. These General Conditions are published at a stable and permanent address at https://fibonaccimedica.it/termini, in a form that allows them to be consulted, stored and reproduced on a durable medium at any time, including by printing or saving the page. The Supplier recommends that the Client keep a copy at the time of subscription. The Supplier also retains evidence of the acceptance given, indicating the version of the Conditions accepted and the date, and provides the Client with a copy upon written request.

Art. 4 - Trial Period

4.1 The Provider grants the Client a free Trial Period of 14 (fourteen) consecutive days, activatable during sign-up, with access to the selected Plan without the obligation to enter credit card details.

4.2 At the end of the Trial Period:

(a) if the Client completes the subscription by entering payment details, the account continues into the Subscription Period as per Art. 7;

(b) if the Client does not complete the subscription, the account is placed in read-only mode for 30 (thirty) days, during which the Client may export their data as per Art. 14;

(c) after 30 (thirty) days in read-only mode without subscription completion, the account is deactivated, and data are erased as per DPA Art. 12.

4.3 During the Trial Period, the Client may only enter test data. To enter real patient data, the Client must have accepted the DPA during subscription.

4.4 The Trial Period is granted only once per Client; multiple sign-ups to extend the trial are not permitted.

Art. 5 - Plans, fees, and payment methods

5.1 The Client subscribes to one of the following Plans:

All amounts are in Euros and exclude VAT, which will be applied at the statutory rate.

5.2 Payment is made via monthly recurring charge through the Stripe payment processor on the day of the month corresponding to the subscription activation date.

5.3 The Provider automatically issues an electronic invoice to Clients with an Italian VAT number via the Exchange System (SDI), using the Recipient Code or, if absent, the PEC provided by the Client.

5.4 In case of payment failure, the Provider notifies the Client via email of the negative outcome and automatically retries up to 3 (three) further charges in the following days. After 7 (seven) days from the first missed payment, the account is suspended as per Art. 13. After an additional 30 (thirty) days of suspension without regularisation, the account is deactivated with data erasure as per DPA Art. 12.

5.5 The Client is responsible for the validity and updating of the provided payment details. Any bank or chargeback fees remain the Client’s responsibility.

Art. 6 - Fee modifications

6.1 The Provider may modify the fees indicated in Art. 5 with at least 60 (sixty) days’ written notice, communicated via email to the Client’s address.

6.2 The modification takes effect from the first renewal of the Subscription Period following the notice period.

6.3 Within 30 (thirty) days of receiving the modification notice, the Client may terminate the contract without costs or penalties by notifying info@fibonaccimedica.it via email or through the "Subscription" panel of the application. Failure to notify termination within this period constitutes tacit acceptance of the modification.

Art. 7 - Duration, renewal, and termination

7.1 The Subscription Period lasts one calendar month from the activation date and automatically renews monthly unless terminated as per the following paragraph 7.2.

7.2 The Client may terminate the contract at any time via the "Subscription" panel of the application. Termination takes effect at the end of the current Subscription Period. No pro-rata refunds for the ongoing Subscription Period are due to the Client.

7.3 Until the end of the current Subscription Period, the Client retains full access to the Service. Upon termination, the data portability provisions under Art. 14 apply.

Art. 8 - Service Levels (SLA)

8.1 The Provider guarantees the following Service availability level, calculated monthly:

(a) 99.5% uptime for Solo and Studio Plans.

8.2 Excluded from uptime calculation:

(a) scheduled maintenance windows, limited to a total of 4 (four) hours per month, announced via email with at least 48 (forty-eight) hours’ notice;

(b) Force Majeure events as per Art. 16;

(c) cyberattacks, including DDoS attacks, exceeding the protective capacity of the CDN provider used by the Provider;

(d) errors, misconfigurations, or actions by the Client or Authorised Users;

(e) unavailability of third-party services integrated at the Client’s discretion.

8.3 In case of failure to meet the guaranteed uptime level, the Client is entitled, as the sole remedy, to a service credit equal to one day of subscription for each 1% of uptime missing below the threshold, up to a maximum of 50% (fifty percent) of the monthly fee for the affected month.

8.4 The service credit is applied to the next available invoice upon written request from the Client to be sent to info@fibonaccimedica.it within 30 (thirty) days from the end of the reference month, under penalty of forfeiture. The credit is not cumulative with other remedies and is the Client’s sole compensation for SLA non-compliance.

Art. 9 - Client’s obligations

9.1 The Client guarantees, for themselves and for Authorised Users, to be licensed to practice healthcare and to operate in compliance with applicable regulations, including GDPR, Legislative Decree 196/2003 (Privacy Code), and professional deontological rules.

9.2 The Client acts as Data Controller pursuant to Art. 4 GDPR with respect to Patient Data stored in the Service.

9.3 The Client undertakes in particular to:

(a) not use the Service for unlawful purposes, contrary to public order, morality, or applicable regulations;

(b) not attempt to compromise the security, integrity, or availability of the Service or access third-party data;

(c) assign individual and nominative credentials to each Authorised User, not share credentials among multiple users, and safeguard credentials with due diligence;

(d) not perform reverse engineering, decompilation, disassembly of the software, mass scraping, stress tests, penetration tests, or other invasive activities without the Provider’s prior written authorisation;

(e) not resell, sublicense, or transfer access to the Service to third parties except as provided in Art. 17;

(f) make payments within the prescribed terms;

(g) keep identification data and email contacts updated.

9.4 Any security audits requested by the Client on the Provider’s infrastructure are governed by DPA Art. 11 and require written notice.

9.5 The Client is responsible for the content, data, and actions performed using the credentials assigned to them or their Authorised Users.

Art. 10 - Processing of personal data and DPA

10.1 The processing of personal data, including Patient Data, stored, processed, or transmitted through the Service is governed by the Data Processing Agreement (DPA) published at https://fibonaccimedica.it/dpa, an integral part of this contract, which the Client declares to know and accept upon subscription.

10.2 In case of conflict between the DPA provisions and those of these General Conditions regarding personal data processing, the DPA provisions prevail.

10.3 For GDPR purposes, the Client is the Data Controller of Patient Data, and the Provider is the Data Processor. The Provider operates exclusively based on the Client’s documented instructions.

10.4 The Provider’s Privacy Policy regarding processing as Data Controller (e.g., for Client Data, cookies, commercial communications) is published at https://fibonaccimedica.it/privacy.

Art. 11 - Intellectual property

11.1 The Fibonacci software, source code, algorithms, user interfaces, graphics, trademarks (including "Fibonacci"), domain names, documentation, training materials, and all other elements of the Service remain the exclusive property of Fibonacci or its licensors.

11.2 By subscribing to the contract, the Client acquires only a non-exclusive, non-transferable right of use, limited to the contract’s duration and the subscribed Plan’s limits. No provision of these General Conditions may be interpreted as transferring, assigning, or licensing additional intellectual property rights beyond those expressly provided.

11.3 Client Data and Patient Data remain the property of the Client and the respective patient. The Provider holds no intellectual property rights over such data and processes them exclusively within the DPA’s limits.

11.4 The Provider may process aggregated and anonymised statistical data (devoid of any possibility of direct or indirect re-identification of the data subject) derived from Service use for improvement, product development, internal benchmarking, and general reporting purposes.

11.5 Any feedback, suggestions, or improvement proposals voluntarily communicated by the Client to the Provider may be freely used by the Provider without remuneration or confidentiality obligations, unless otherwise agreed in writing.

Art. 12 - Limitation of liability

12.1 The Fibonacci Service is a tool supporting the clinical, administrative, and documentary management of the medical practice or healthcare facility. The Service is not a medical device under Regulation (EU) 2017/745 (MDR) nor does it perform automated functions of diagnosis, prevention, monitoring, prediction, prognosis, treatment, or alleviation of diseases.

12.2 Any artificial intelligence functionalities included in the Service (e.g., voice dictation, structured information extraction from free text, completion suggestions) produce assistive outputs that must be evaluated, validated, and, if necessary, corrected by the Client physician before any clinical use, before document signing, and before communication to the patient.

12.3 Clinical, diagnostic, therapeutic, and deontological responsibility remains exclusively with the Client physician, who must verify every data point, content, and suggestion from the Service in the exercise of their autonomous professional judgment. The Provider is not liable for medical errors, diagnostic omissions, clinical inaccuracies, or health consequences arising from the use of the Service by the Client or Authorised Users.

12.4 Subject to mandatory legal limits in cases of the Provider’s wilful misconduct or gross negligence, the Provider’s total liability towards the Client, for any reason (contractual, non-contractual, breach, improper performance, delay), is cumulatively limited, for each calendar year, to the amount of net fees actually paid by the Client to the Provider in the 12 (twelve) months preceding the event giving rise to the claim.

12.5 In any case, the following are excluded from compensation, subject to mandatory legal limits: lost profits, loss of clientele, reputational damage or loss of opportunity, indirect, consequential, punitive, or exemplary damages, data loss where the Client has not exported data within the terms set forth in Art. 14.

12.6 Mandatory legal limits regarding personal injury, wilful misconduct, gross negligence, as prescribed by Art. 1229 of the Italian Civil Code, remain unaffected.

Art. 13 - Suspension and termination for breach

13.1 The Provider may suspend access to the Service, in whole or in part, even without notice, in the following cases:

(a) non-payment of fees after 7 (seven) days from formal email notice as per Art. 5;

(b) use of the Service in an unlawful manner, harmful to the security, availability, or integrity of the Service or third parties;

(c) serious breach of the Client’s obligations under Art. 9;

(d) order from a judicial or public security authority.

13.2 Suspension is communicated to the Client via email and ceases upon removal of the cause.

13.3 The Provider may terminate the contract pursuant to Art. 1456 of the Italian Civil Code (express termination clause), with immediate effect upon written notice, in case of:

(a) repeated Client breaches persisting beyond 30 (thirty) days from formal notice;

(b) use of the Service for seriously unlawful purposes;

(c) false declarations by the Client during subscription that vitiate the Provider’s consent;

(d) commencement of insolvency or liquidation proceedings against the Client that prejudice the contract’s regular execution.

13.4 The Client may terminate the contract pursuant to Art. 1456 of the Italian Civil Code, with 30 (thirty) days’ written notice, in case of serious Provider breaches, including by way of example:

(a) data breach caused by the Provider’s wilful misconduct or gross negligence with substantial impact on the Client’s Patient Data;

(b) substantial non-compliance with the SLAs under Art. 8 for 3 (three) consecutive months;

(c) structural cessation of Service provision for over 30 (thirty) consecutive days not attributable to Force Majeure.

13.5 In case of termination, the following remain unaffected: the Provider’s right to payment of fees accrued until the termination date, obligations regarding data return and erasure under DPA Art. 12, data portability obligations under Art. 14, and clauses naturally surviving termination (intellectual property, confidentiality, limitation of liability, competent jurisdiction).

Art. 14 - Data portability upon contract termination

14.1 Upon contract termination, for any reason, the Client is entitled to receive a complete export of Client Data and Patient Data stored in the Service.

14.2 The export request must be sent to the Provider via email at info@fibonaccimedica.it within 30 (thirty) days from the contract termination date.

14.3 The Provider delivers the export in ZIP format structured according to the HL7 FHIR R4 standard within 15 (fifteen) working days from the request, via a download link protected by credentials with a time limit.

14.4 After 30 (thirty) days from contract termination without an export request, and in any case after 90 (ninety) days from termination, data are erased from the Provider’s production systems as per DPA Art. 12. Any data present in backups are erased according to the backup rotation cycles described in the DPA.

14.5 The Provider undertakes not to condition the export’s provision on the payment of additional fees beyond those set forth in the subscribed Plan.

Art. 15 - Service modifications

15.1 The Provider may modify the Service’s functionalities, technical characteristics, architecture, and interface at any time for improvement, technological evolution, security, regulatory compliance, or commercial reasons.

15.2 Non-substantial modifications (bug fixes, interface optimisations, incremental improvements) are implemented without notice.

15.3 Substantial modifications (reorganisation of relevant functionalities, module discontinuation, technical architecture changes with operational impact for the Client) are communicated to the Client with at least 30 (thirty) days’ notice via email.

15.4 If a modification significantly reduces the essential functionalities of the Client’s subscribed Plan, the Client may terminate the contract without costs or penalties within 30 (thirty) days from the communication, by notifying info@fibonaccimedica.it via email.

Art. 16 - Force Majeure

16.1 Neither party is liable for non-performance, delay, or unavailability of services caused by Force Majeure events, meaning unforeseeable, unavoidable events beyond the parties’ control, including by way of example: natural disasters, acts of public authority, armed conflicts, terrorist acts, general strikes, extraordinary cyberattacks exceeding ordinary sector security measures, blackouts, or prolonged unavailability of essential providers (telecommunications, electricity, cloud infrastructure).

16.2 The party affected by the Force Majeure event promptly informs the other party via email, indicating the event’s nature, expected impact, and mitigation measures adopted.

16.3 If the Force Majeure event persists for over 60 (sixty) consecutive days, either party may terminate the contract with written notice, without liability for compensation.

Art. 17 - Contract assignment

17.1 The Client may not assign this contract, in whole or in part, nor the rights and obligations arising therefrom, to third parties without the Provider’s prior written consent.

17.2 The Provider may assign the contract to third parties in extraordinary operations (merger, demerger, business or branch transfer, contribution) with at least 30 (thirty) days’ written notice to the Client. In case of assignment, the assignee assumes all the assignor’s rights and obligations.

17.3 The Provider may use subcontractors to deliver the Service as set forth in DPA Art. 7 (sub-processors).

Art. 18 - Communications

18.1 All communications between the parties regarding this contract occur via email to the addresses provided during subscription, except where the law or these General Conditions prescribe a different written form.

18.2 The Client must keep their email address updated via the "Account" panel of the application. Any communications sent by the Provider to the last email address provided by the Client are deemed duly received.

18.3 The Provider’s email addresses are: info@fibonaccimedica.it for commercial and contractual communications, info@fibonaccimedica.it for technical support requests.

Art. 19 - Applicable law and jurisdiction

19.1 This contract is governed by Italian law.

19.2 Before resorting to judicial authorities, the parties undertake to attempt amicable resolution of any dispute arising from or related to the contract through direct negotiation initiated by written notice outlining the dispute’s subject. The amicable resolution phase concludes within 30 (thirty) days from receipt of the notice, unless otherwise agreed by the parties.

19.3 Having unsuccessfully attempted amicable resolution, the exclusive jurisdiction for any dispute arising from or related to this contract lies with the Court of Genoa, expressly excluding any other alternative or concurrent jurisdiction.

Art. 20 - Specific approval of onerous clauses pursuant to Arts. 1341 and 1342 of the Italian Civil Code

20.1 The Client, pursuant to and for the effects of Articles 1341 and 1342 of the Italian Civil Code, declares to have read, understood, and specifically and in writing approved the following clauses:

• Art. 6 (Fee modifications);
• Art. 8 (Service Levels (SLA) - limitation of remedies and service credit as sole compensation);
• Art. 12 (Limitation of liability - exclusion of medical device nature, exclusion of clinical responsibility, quantitative limit to 12 months’ fees, exclusion of indirect damages);
• Art. 13 (Suspension and termination for breach - express termination clause pursuant to Art. 1456 of the Italian Civil Code and Provider’s suspension right);
• Art. 15 (Service modifications);
• Art. 17 (Contract assignment - Provider’s unilateral assignment right);
• Art. 19 (Applicable law and jurisdiction - exclusive jurisdiction of Genoa).

20.2 The electronic acceptance of these General Conditions during sign-up, by double-ticking the dedicated box for this clause, constitutes specific approval of the above-listed onerous clauses.

Art. 21 - Final provisions

21.1 The possible invalidity, nullity, or unenforceability of one or more clauses of this contract does not affect the entire contract’s validity. Invalid clauses are deemed replaced by operation of law with applicable legal provisions, without prejudice to the remaining clauses’ effectiveness.

21.2 A party’s tolerance of the other party’s conduct inconsistent with the contract does not constitute waiver of rights arising from the contract or acquiescence to similar future conduct.

21.3 This document, together with the Data Processing Agreement published at https://fibonaccimedica.it/dpa and the Privacy Policy published at https://fibonaccimedica.it/privacy, constitutes the entire agreement between the parties regarding the contract’s subject matter and supersedes any prior written or oral understanding on the same subject.

21.4 Any modifications to this contract must be communicated in writing via email to the Client with at least 30 (thirty) days’ notice and are deemed accepted in the absence of termination exercised within this period, according to the methods set forth in Art. 7.

Last revision: 7 agosto 2026

Disclaimer: This document is a template draft adapted for Fibonacci’s Fibonacci Service and requires legal review by a licensed professional before publication and client subscription. Version 0.1 - internal draft.