Terms of Service

Version 1.4 · Effective September 30, 2026

These Terms of Service (the "Terms") are a contract between Coralis Bio, Inc. ("Coralis," "we," or "us") and the organization that uses the Coralis platform ("Customer" or "you"). They cover the Coralis web application, AI features, APIs, and documentation (together, the "Service"). Separate Website Terms of Use govern the public Coralis website. These Terms apply only to Coralis's invitation-only beta program described in Section 2.2.

You accept these Terms by checking the acceptance box and clicking "Agree and continue" when you create or first sign in to an account, by signing a Beta Addendum that references them, or by using the Service. The first administrator who accepts these Terms for an organization accepts on its behalf and confirms that they have authority to bind it; "you" and "Customer" then mean that organization. Other Users accept these Terms only as Users of the Customer whose workspace they join (see Section 1.2) and do not become a separate Customer. If you do not have authority, or do not agree, do not use the Service.

1. The Agreement and Who It Covers

1.1 Business use only. The Service is for organizations, not consumers. You may use it only for your organization's business purposes.

1.2 Users. Customer may allow its employees, individual contractors, and personnel of its service providers (such as regulatory consultants and CROs) acting on its behalf to use the Service ("Users"). Each User must be at least 18 years old and, before first use, must accept these Terms and agree to comply with Sections 2.3, 3, 4, 5.3, and 9. Customer is responsible for its Users' compliance with these Terms and for activity under its accounts, except activity caused by Coralis's breach of these Terms.

1.3 Administrators. Customer's designated administrators may add and remove Users, set permissions, make elections on Customer's behalf (including granting access under Section 6.5), and access, export, and delete Customer Data.

1.4 Beta Addendum. Customer and Coralis may sign a short written addendum that expressly states it supplements these Terms (a "Beta Addendum"), for example to cover a specific Customer's requirements. If a Beta Addendum conflicts with these Terms, the Beta Addendum controls for that Customer, except that it cannot change Section 6.4.

2. Using the Service

2.1 Access right. Subject to these Terms, Coralis grants Customer a limited, non-exclusive, non-transferable, non-sublicensable right during the Term for its Users to access and use the Service for Customer's internal business purposes.

2.2 Invitation-only beta. The Service is available only by invitation as part of Coralis's beta program (the "Beta Program"). Coralis decides which organizations and Users to invite and may limit the number of Users. The entire Service is pre-release during the Beta Program and is provided free of charge, and Coralis may label individual features "beta," "preview," "early access," or similar. The Service and those features (together, "Beta Features") are provided "as is" as described in Section 14, with no service-level or support commitment, and may change at any time or be discontinued, subject to Sections 8 and 13. Sections 6 through 9 apply to them in full.

2.3 Accounts and credentials. Each account is for one named individual. Users must keep their credentials confidential, use any multi-factor authentication or single sign-on that Customer or Coralis requires, and notify Coralis at security@coralis.bio promptly of any suspected unauthorized access.

2.4 Changes to the Service. Coralis continually improves the Service and may add, change, or remove features.

3. Acceptable Use

Customer will not, and will ensure its Users do not:

(a) use any Output as the sole basis for a clinical, regulatory, or business-critical decision, or use the Service as a validated or production system of record;

(b) probe, scan, or test the vulnerability of the Service, or circumvent any security measure, usage limit, or human-approval step, except with Coralis's prior written permission (please report suspected vulnerabilities to security@coralis.bio);

(c) use the Service to build, train, or benchmark a competing product or service;

(d) copy, modify, or create derivative works of the Service, or reverse engineer it or attempt to extract its underlying models, system prompts, or model weights (including through prompt injection or other adversarial inputs), except to the extent applicable law permits reverse engineering despite this restriction, and then only after written notice to Coralis;

(e) access the Service through automated means other than interfaces Coralis provides, or exceed documented usage limits;

(f) resell, sublicense, rent, or lease the Service, or use it on behalf of anyone other than Customer;

(g) submit content that Customer lacks the right to submit, or that infringes, misappropriates, or violates anyone's intellectual property, privacy, or other rights;

(h) upload malware or content designed to disrupt or damage the Service;

(i) remove or obscure any proprietary notice in the Service;

(j) use the Service in a way that would violate the AWS Responsible AI Policy or other AWS policies that apply to Amazon Bedrock, or Anthropic's Usage Policy; or

(k) use the Service in violation of applicable law, including U.S. export control and sanctions laws.

4. Restricted Data

4.1 What not to upload. Customer will not submit any of the following (together, "Restricted Data"):

(a) information that directly identifies a patient, donor, or study subject, such as names, initials, dates of birth, contact details, or medical record numbers, and any protected health information as defined under HIPAA;

(b) subject-level clinical data, such as the medical history, adverse events, or efficacy and safety outcomes of individual patients or study subjects;

(c) other sensitive personal information, such as government identifiers, financial account numbers, or genetic or biometric data about identifiable individuals; or

(d) classified information, technical data on the U.S. Munitions List (ITAR), or technology classified under an Export Control Classification Number other than EAR99.

4.2 What is permitted. Customer may submit coded manufacturing and donor identifiers, such as chain-of-identity numbers and donor codes, and coded genomic or characterization data about donor material or cell lines, if only Customer or its partners (not Coralis) hold any key linking them to an individual and they are not combined with information described in Section 4.1(a) or 4.1(b). Names, titles, and work contact details of people who appear in regulatory or business documents are also permitted.

4.3 Mistakes and responsibility. If Restricted Data is submitted by mistake, Customer will tell Coralis promptly at privacy@coralis.bio so it can be removed. Coralis is not a business associate under HIPAA and takes on no obligations under laws that specifically govern Restricted Data.

4.4 Customer is responsible for what it uploads. Customer is solely responsible for all Customer Content that it and its Users submit, including its accuracy and legality, having the rights and consents needed to submit it, and making sure no Restricted Data is submitted. Coralis is not required to review submissions for Restricted Data and makes no representation that the Service is suitable for it. To the maximum extent permitted by law, Coralis assumes no responsibility or liability for Restricted Data submitted in breach of this Section 4, including any claim that storing or processing it violated a law or anyone's rights. While Coralis holds Restricted Data, it will still protect it under Section 7 and remove it under Section 4.3.

5. AI Features and Human Review

5.1 What Outputs are. The Service uses AI models to query, summarize, analyze, and draft content, including regulatory strategy analyses, risk assessments, precedent analyses, predicted outcomes, draft correspondence, citations, and confidence indicators ("Outputs"). Outputs are generated by probabilistic models. They may be incomplete, outdated, or wrong, may miss relevant risks, precedents, or requirements, and may sound more certain than they are.

5.2 Not professional advice. Outputs are not legal, regulatory, medical, or scientific advice and do not replace the judgment of qualified professionals. Coralis does not provide legal advice and is not Customer's regulatory consultant. Coralis does not provide consulting or professional services under these Terms; any such services require a separate written agreement. Communications from Coralis personnel during support or onboarding are not regulatory, legal, or scientific advice.

5.3 Human review is required. Before Customer relies on, submits, files, or otherwise acts on any Output, including in any submission to or communication with the U.S. Food and Drug Administration or another regulatory authority, a qualified person with relevant scientific, clinical, or regulatory expertise must review and approve it and independently verify its citations, precedents, and factual statements.

5.4 Confidence indicators and citations. Confidence levels, scores, and citations are aids to human review. They are not certifications of accuracy, completeness, or regulatory compliance.

5.5 No guarantee of regulatory outcomes. Some features estimate the likelihood of regulatory outcomes or characterize how regulators have acted before. These are estimates. Regulators make their own decisions, and Coralis does not guarantee any approval, outcome, timeline, or response.

5.6 No autonomous submissions. The Service does not send Outputs to regulatory authorities on its own. Customer will ensure that a qualified person approves any Output before Customer sends it to a regulatory authority or other outside party, and will not bypass any human-approval step the Service provides.

5.7 Validation status. Unless a Beta Addendum expressly states otherwise, the Service has not been validated as a GxP computerized system or as a system of record under 21 CFR Part 11, and Customer will not use it as one.

5.8 Evolving rules. Laws and guidance on AI in drug development and regulatory submissions are still developing. Customer is responsible for making sure its use of the Service and Outputs meets the requirements that apply to it. Customers can report problematic Outputs through the in-app feedback tools or at support@coralis.bio.

6. Customer Data

6.1 Definitions. "Customer Content" means the data, documents, prompts, files, and other material that Customer or its Users submit to the Service, other than Feedback. "Customer Data" means Customer Content and Outputs, including search indexes, embeddings, and other data derived from them.

6.2 Customer owns its data. As between the parties, Customer owns Customer Data. Coralis assigns to Customer any rights it may have in Outputs, excluding Coralis's underlying Service, models, templates, and system prompts. Outputs may not be unique, and the Service may generate similar Outputs for others.

6.3 Coralis's limited license. Customer grants Coralis a non-exclusive, worldwide, royalty-free license to host, copy, process, transmit, and display Customer Data solely as needed to provide, secure, and support the Service for Customer, to perform Section 8, to comply with law, and as Customer directs or elects. This license ends when all copies of the Customer Data, including backups, have been deleted, except data retained as required by law under Section 13.6.

6.4 No AI training on Customer Data. Coralis will not use Customer Data to train, fine-tune, evaluate, or otherwise improve any AI model, including in de-identified or aggregated form, and will not permit its Subprocessors to do so. This does not prevent Coralis from using Customer Data to provide, support, and troubleshoot the Service for Customer, including investigating Outputs that Customer reports. Coralis will not add Customer Data, or information derived from it, to any knowledge base, index, or dataset available to other customers. No Beta Addendum, account setting, or other agreement changes this Section 6.4.

6.5 Private workspaces and staff access. Within the Service, Customer Data is kept in private workspaces that only Users whom Customer invites can access. Coralis personnel view Customer Data only (a) with Customer's permission, including to provide support that Customer requests or to perform Section 8; or (b) as strictly necessary to respond to a Security Incident or an active threat to the security or integrity of the Service, to investigate a suspected breach of Section 3 or Section 4, or to comply with law. Customer's administrators grant and revoke permission in the Service. Access is limited to authorized personnel and is logged. Automated processing by the Service, and infrastructure operations that do not expose the content of Customer Data to personnel, are not access for this purpose. Subprocessors access Customer Data only as described in Section 7.2.

6.6 Usage Data. Coralis collects metadata and telemetry about use of the Service that does not include Customer Content or the substance of any Output, such as feature usage, performance metrics, error logs, and ratings Users give to Outputs ("Usage Data"). Coralis may use Usage Data to operate, secure, and support the Service, and may use it in de-identified and aggregated form to improve and develop Coralis's products and services. Coralis keeps Usage Data for no more than twelve (12) months.

6.7 Activity logs. Coralis keeps logs of prompts, Outputs, and related activity, including timestamps and the User associated with each entry, for the Term and the export period in Section 13.6, and includes them in exports under Section 8.2. Activity logs are stored with Customer's other Customer Data and are not sent to application logs or third-party monitoring tools. These logs are not audit trails under 21 CFR Part 11 and do not replace Customer's own records (see Section 6.8).

6.8 Customer's responsibilities. Section 4.4 sets out Customer's responsibility for what it submits. The Service is not a records-retention system. Customer is responsible for keeping any copies of Customer Data that it must retain for regulatory or other recordkeeping purposes.

6.9 Privacy. Coralis's Privacy Policy at coralis.bio/privacy describes how Coralis handles personal information about Users. For any personal data in Customer Data, Coralis acts as Customer's service provider. Coralis processes that data only to provide the Service under these Terms and Customer's instructions; does not sell or share it; does not retain, use, or disclose it for any other purpose or outside its relationship with Customer; and does not combine it with personal data from other sources except as needed to provide the Service.

7. Security

7.1 Safeguards. Coralis will maintain a written information security program with administrative, technical, and physical safeguards designed to protect the security, confidentiality, and integrity of Customer Data. These include:

(a) encryption of Customer Data in transit (TLS 1.2 or higher) and at rest (AES-256);

(b) a separate database schema for each Customer, and encryption keys specific to each Customer for uploaded files;

(c) role-based, least-privilege access for Coralis personnel, protected by multi-factor authentication;

(d) logging and monitoring of access to production systems;

(e) vulnerability management, including regular patching; and

(f) confidentiality obligations and security training for personnel with access to Customer Data.

Coralis will not materially reduce the overall protection of Customer Data during the Term.

7.2 Hosting, AI processing, and Subprocessors. Coralis stores Customer Data in the Amazon Web Services us-east-1 region in the United States and processes it only in AWS regions in the United States. Coralis processes Customer Data with AI models only through the AI service named on the Subprocessor list (currently Amazon Bedrock), within Coralis's own AWS environment, and never through public AI APIs. Coralis personnel who access Customer Data under Section 6.5 may be located in the United States or the United Kingdom. Coralis may use third-party service providers to process data on its behalf ("Subprocessors"), listed in Section 7 of the Privacy Policy. Within the Service, only Amazon Web Services processes Customer Content. Coralis's other Subprocessors (currently Clerk, PostHog, and Google Workspace) process only account information and Usage Data and, for Google Workspace, any Customer Content that Customer chooses to email to Coralis. Coralis will bind each Subprocessor to written obligations that protect Customer Data at a level appropriate to its services and consistent with Section 7.1, and that prohibit it from using Customer Data to train its own models. The Subprocessor list states each Subprocessor's location. Coralis remains responsible for its Subprocessors. Coralis will give at least thirty (30) days' notice before adding or replacing a Subprocessor that processes Customer Data, including the AI service. If Customer reasonably objects on data-protection grounds and the parties cannot resolve the objection, Customer may end its participation under Section 13.2 before the change takes effect.

7.3 Backups. Coralis maintains encrypted backups of Customer Data for disaster recovery in a separate AWS region in the United States and keeps them for no more than thirty-five (35) days on a rolling basis.

7.4 Security incidents. If Coralis confirms unauthorized access to, or acquisition, disclosure, or loss of, Customer Data (a "Security Incident"), Coralis will notify Customer's administrators without undue delay and in any event within seventy-two (72) hours. Coralis will describe what is known, take reasonable steps to contain and remediate the incident, and provide updates and reasonable cooperation. Notice of a Security Incident is not an admission of fault.

7.5 Security information. Coralis will provide a summary of its security practices on request and will respond to reasonable security questionnaires up to once per year.

7.6 Customer's part. Customer is responsible for managing its Users and permissions, protecting credentials, using the security settings available to it, and securing its own systems and connections to the Service.

8. Data Portability and Business Continuity

8.1 Your data is not our asset. Coralis holds Customer Data as custodian and bailee for Customer, only to provide the Service. Customer Data is not Coralis's property, and the parties intend that it not become property of Coralis's estate in any bankruptcy or insolvency proceeding. Coralis will not sell, license, or transfer Customer Data as an asset, including in any insolvency proceeding, except to a transferee that agrees to be bound by these Terms under Section 8.5.

8.2 Export at any time. Customer's administrators may export all Customer Data, including activity logs, at any time during the Term and the export period in Section 13.6, at no additional charge. Exports use standard, non-proprietary formats, such as the original format for uploaded files and common document and data formats (for example, PDF, DOCX, JSON, or CSV) for generated content and logs. If self-service export is unavailable, Coralis will provide a complete export within ten (10) business days of a written request.

8.3 If Coralis stops offering the Service. If Coralis decides to discontinue the Service or cease operations, or becomes subject to bankruptcy, receivership, or an assignment for the benefit of creditors and does not continue to provide the Service in the ordinary course, or otherwise stops providing the Service in the ordinary course (in each case other than through a transfer under Section 8.5), Coralis will:

(a) give Customer's administrators at least ninety (90) days' written notice;

(b) keep the Service available at least in read-only and export mode until the notice period ends;

(c) provide a complete export of Customer Data on request during the notice period; and

(d) after the notice period ends and the Service has ended, delete Customer Data as described in Section 13.6 and confirm deletion in writing on request.

Coralis will not delete Customer Data before the notice period ends except at Customer's request.

8.4 Keeping your own copy. Regular exports under Section 8.2 are the most reliable way for Customer to keep a current copy of its Customer Data.

8.5 Acquisition or transfer. If Coralis transfers the Service or Customer Data to another entity, including by merger or asset sale, the transferee must agree in writing to be bound by these Terms, including this Section 8. Coralis will notify Customer at least thirty (30) days before the transfer or, if confidentiality obligations prevent that, promptly after it. Within sixty (60) days after that notice, Customer may export its Customer Data, have it deleted, and end its participation.

8.6 Survival. This Section 8 survives termination of these Terms and binds Coralis's successors and assigns.

9. Confidentiality

9.1 What is confidential. "Confidential Information" means non-public information that one party (the "Discloser") discloses to the other (the "Recipient") that is marked confidential or that a reasonable person would understand to be confidential. Customer Data is Customer's Confidential Information whether or not it is marked. During the Beta Program the Service is pre-release, and its non-public features, functionality, and performance, along with Coralis's product plans and non-public benchmark results, are Coralis's Confidential Information. Customer may nonetheless disclose that it uses the Service, and how it used the Service and Outputs, to regulatory authorities and auditors, and under confidentiality to its investors and potential acquirers. Confidential Information does not include information that the Recipient can show (a) is or becomes public through no fault of the Recipient, (b) the Recipient already knew without restriction, (c) the Recipient rightfully received from a third party without a duty of confidentiality, or (d) the Recipient independently developed without using the Discloser's Confidential Information.

9.2 Protection. The Recipient will protect the Discloser's Confidential Information with at least reasonable care, use it only to perform its obligations and exercise its rights under these Terms, and disclose it only to its and its Affiliates' employees, contractors, and professional advisors and, for Coralis, its Subprocessors, in each case with a need to know and bound by confidentiality obligations at least as protective as these. Coralis will disclose Customer Data only as permitted by Sections 6.3, 6.5, 7.2, 8, and 9.3. "Affiliate" means an entity that controls, is controlled by, or is under common control with a party, where control means owning more than 50% of the voting interests.

9.3 Legally required disclosure. If the Recipient is required by law, regulation, subpoena, or court order to disclose the Discloser's Confidential Information, it will (where legally permitted) give the Discloser prompt written notice and reasonable cooperation, at the Discloser's expense, to seek a protective order or contest the demand, and will disclose only what is legally required.

9.4 Duration. These obligations apply during the Term and for three (3) years afterward. For trade secrets, they last as long as the information remains a trade secret, and for Customer Data, as long as Coralis holds it.

9.5 Injunctive relief. A breach of this Section 9 may cause irreparable harm, and the Discloser may seek injunctive relief in addition to any other remedy.

10. Feedback

If Customer or its Users give Coralis suggestions, comments, error reports, or other feedback about the Service ("Feedback"), Customer grants Coralis a perpetual, irrevocable, worldwide, royalty-free, transferable, and sublicensable license to use, disclose, and otherwise exploit that Feedback for any purpose, without obligation or attribution. Coralis will not identify Customer as the source of Feedback. To the extent Feedback quotes or attaches Customer Data, that material remains Customer Data, is not licensed under this Section 10, and will be deleted under Section 13.6.

11. Coralis's Property and Third-Party Sources

11.1 Coralis's property. Coralis and its licensors own the Service, including its software, AI features, models, system prompts, templates, and documentation, and all related intellectual property. These Terms grant a right to use the Service, not a license to any underlying software or any ownership interest. "Coralis" and related names and logos are Coralis trademarks.

11.2 Third-party sources and services. The Service draws on third-party sources, such as regulatory agency databases, published guidance, and scientific literature, and uses third-party AI models. Coralis is not responsible for the accuracy or availability of third-party sources, and a citation is not an endorsement. Customer's use of any third-party service it connects to the Service is governed by Customer's agreement with that provider.

12. No Fees; Future Commercial Terms

12.1 No fees. Coralis provides the Service free of charge during the Beta Program, and Customer owes no fees under these Terms.

12.2 Future commercial terms. Coralis may offer a commercial version of the Service after the Beta Program. Any pricing, fees, or other commercial terms will be agreed separately in writing and are not part of these Terms, and neither party is obligated to enter into them. Coralis will not charge Customer anything unless Customer signs or accepts those separate terms.

13. Term, Suspension, and Termination

13.1 Term. These Terms start when Customer first accepts them and continue until the Beta Program ends or Customer's participation ends under this Section 13 (the "Term").

13.2 Ending participation by Customer. Customer may end its participation at any time by closing its account or notifying Coralis.

13.3 Ending participation or the Beta Program by Coralis. Coralis may end Customer's participation, or end the Beta Program for all participants, on at least thirty (30) days' notice. If Coralis is discontinuing the Service or ceasing operations, Section 8.3 applies instead.

13.4 Termination for cause. Either party may terminate these Terms on written notice if the other party materially breaches them and fails to cure within thirty (30) days after notice, or immediately if the other party becomes insolvent or subject to bankruptcy or similar proceedings. Coralis may also end Customer's participation immediately on written notice if Customer or its Users breach Section 3 or Section 4.

13.5 Suspension. Coralis may suspend a User's or Customer's access, to the extent and for the time reasonably necessary, to address a security threat to the Service, stop a violation of Section 3 or Section 4, or comply with law. Coralis will notify Customer promptly and will not delete Customer Data because of a suspension. Except while needed to address an active security threat, Customer's administrators may continue to export Customer Data during any suspension.

13.6 Effect of termination; deletion. When the Term ends, Customer's access ends, except that Customer may export Customer Data under Section 8.2 for twenty-one (21) days (the "export period"). If the Term ends because of an event under Section 8.3, the export period is instead the notice period under Section 8.3(a), and it ends when that notice period ends. If Customer and Coralis sign commercial terms for the Service before the export period ends, Customer Data carries over under those terms and is not deleted under this Section 13.6. At the end of the export period, Coralis will schedule deletion of the encryption keys specific to Customer, with a waiting period of no more than seven (7) days, which makes uploaded files encrypted under them unreadable wherever they are stored, and will delete Customer Data from its active systems, so that deletion is complete within thirty (30) days after the Term ends (or after the notice period, where Section 8.3 applies). Backups expire under Section 7.3. If an export request made during the export period is still pending, Coralis will fulfill it within ten (10) business days and will delay deletion only until it does. On request, Coralis will confirm deletion in writing. Coralis may keep Usage Data as described in Section 6.6, and limited data only as required by law, which remains subject to Sections 7 and 9.

13.7 Survival. Sections 3, 4, 5, 6, 7 (for as long as Coralis or its Subprocessors hold any Customer Data), 8, 9, 10, 11, 13.6, 13.7, 14 through 17, and 19, and any other provision that by its nature should survive, survive the end of the Term.

14. Disclaimers

14.1 General. EXCEPT AS EXPRESSLY STATED IN THESE TERMS (INCLUDING SECTIONS 7 AND 8), THE SERVICE, ALL BETA FEATURES, AND ALL OUTPUTS ARE PROVIDED "AS IS" AND "AS AVAILABLE." TO THE MAXIMUM EXTENT PERMITTED BY LAW, CORALIS DISCLAIMS ALL OTHER WARRANTIES, EXPRESS, IMPLIED, OR STATUTORY, INCLUDING WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, NON-INFRINGEMENT, ACCURACY, AND QUIET ENJOYMENT. CORALIS DOES NOT WARRANT THAT THE SERVICE WILL BE UNINTERRUPTED, ERROR-FREE, OR FREE OF ALL SECURITY VULNERABILITIES.

14.2 Risks Customer accepts. Customer understands that AI-assisted regulatory analysis has inherent limits and that qualified human judgment is essential. Subject only to Coralis's express commitments in Sections 7 and 8, Coralis is not responsible for:

(a) errors, omissions, or inaccuracies in Outputs, including missed risks, precedents, or requirements, incorrect citations, or miscalibrated confidence levels;

(b) changes in laws, regulations, guidance, or agency practice after the information the Service relies on was collected or its models were trained;

(c) decisions or actions of the FDA or any other regulator;

(d) reliance on Outputs without the human review required by Section 5.3;

(e) interruptions, delays, or data loss caused by Customer's systems, third-party networks, or other events outside Coralis's reasonable control; or

(f) Restricted Data submitted in breach of Section 4.

15. Limitation of Liability

15.1 Excluded damages. TO THE MAXIMUM EXTENT PERMITTED BY LAW, NEITHER PARTY WILL BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, OR PUNITIVE DAMAGES, OR FOR LOST PROFITS, REVENUE, GOODWILL, OR BUSINESS OPPORTUNITIES, OR REGULATORY DELAY, HOWEVER CAUSED AND UNDER ANY THEORY OF LIABILITY, EVEN IF ADVISED OF THEIR POSSIBILITY.

15.2 General cap. TO THE MAXIMUM EXTENT PERMITTED BY LAW, CORALIS'S TOTAL AGGREGATE LIABILITY FOR ALL CLAIMS ARISING OUT OF OR RELATING TO THESE TERMS OR THE SERVICE WILL NOT EXCEED ONE THOUSAND U.S. DOLLARS (US$1,000).

15.3 Exceptions. Section 15.1 does not limit Customer's liability for breach of Sections 3(b) through 3(k) or Section 4, or Customer's obligations under Section 16.1. Nothing in this Section 15 limits liability that cannot be limited under applicable law, such as liability for fraud.

15.4 Basis of the bargain. The parties agree that these limits are an essential part of the bargain, reflect a reasonable allocation of risk, and allow Coralis to offer the Service free of charge during the Beta Program.

15.5 Time to bring claims. To the extent permitted by law, any claim against Coralis must be brought within one (1) year after it arises. This period is extended by the length of any Section 17.2 process.

16. Indemnification

16.1 By Customer. Customer will defend Coralis against third-party claims arising from (a) Customer Content, including claims that it infringes or was submitted without necessary rights or consents; (b) Customer's or its Users' breach of Section 3 or Section 4; or (c) use of or reliance on Outputs without the human review required by Section 5.3, including in any regulatory submission. Customer will pay the resulting damages finally awarded or agreed in settlement.

16.2 No indemnity by Coralis. Because the Service is provided free of charge during the Beta Program, Coralis provides no indemnity under these Terms.

16.3 Process. The party seeking defense must notify the other promptly (a delay excuses the defending party only to the extent it is prejudiced), give it sole control of the defense and settlement, and reasonably cooperate at the defending party's expense. The defending party will not agree to any settlement that admits fault by, or imposes obligations on, the other party without that party's consent.

17. Disputes and Governing Law

17.1 Governing law. These Terms are governed by the laws of the State of Utah, without regard to its conflict-of-laws rules. The Federal Arbitration Act governs Section 17.3.

17.2 Try to resolve it first. Before starting any formal proceeding, a party must send the other a written description of the dispute. Senior representatives of both parties will then meet (in person or virtually) within ten (10) business days and try in good faith to resolve it. Either party may begin a proceeding if the dispute is not resolved within thirty (30) days after the notice. This Section 17.2 does not apply to actions under Section 17.5.

17.3 Binding arbitration. Any unresolved dispute arising out of or relating to these Terms or the Service will be resolved by binding arbitration administered by the American Arbitration Association under its Commercial Arbitration Rules, before a single arbitrator, seated in Salt Lake City, Utah. Hearings may be held virtually. Judgment on the award may be entered in any court with jurisdiction.

17.4 Individual claims only. Each party may bring claims against the other only individually, not as a plaintiff or class member in any class, consolidated, or representative proceeding, and the arbitrator may not consolidate claims of more than one customer.

17.5 Exceptions. Either party may bring an individual claim in small-claims court, or seek injunctive or other equitable relief in court to protect its intellectual property or Confidential Information, to stop a violation of Section 3, or to compel performance of Section 8 or the return of Customer Data. Those actions will be brought exclusively in the state or federal courts in Salt Lake County, Utah, and EACH PARTY WAIVES ITS RIGHT TO A JURY TRIAL in them.

18. Changes to These Terms

18.1 Updates. Coralis may update these Terms by posting a new version at coralis.bio/terms with a new effective date. For material changes, Coralis will notify Customer's administrators by email or in the Service at least thirty (30) days before they take effect, unless a change is needed sooner to comply with law or address a security risk. Coralis will notify Customer's administrators of every update by email or in the Service. Coralis may require an administrator to accept updated Terms before continuing, and continued use after the effective date means acceptance. Updates do not apply to any dispute that arose, or of which either party had notice, before the update's effective date.

18.2 Protected commitments. No update under this Section 18 will (a) reduce Coralis's obligations under Sections 6.4, 7, 8, or 13.6, or Customer's rights or remedies for them under Sections 17.5 or 19.4, for Customer Data submitted before the update takes effect, or (b) take effect after Coralis has given notice under Section 8.3 that has not been withdrawn.

18.3 Other amendments. Except for updates under this Section 18, these Terms may be amended only by a Beta Addendum or other writing signed by both parties.

19. General

19.1 Entire agreement. These Terms and any Beta Addendum are the entire agreement between the parties about the Beta Program and replace any earlier agreements about it. The Privacy Policy and security summary are informational, except that Section 7.2 applies to the Subprocessor list in the Privacy Policy, and the AI-provider usage policies are incorporated only for Section 3(j). If a Beta Addendum conflicts with these Terms, the Beta Addendum controls for that Customer, subject to Section 6.4. Terms in any purchase order or other Customer document that is not a Beta Addendum do not apply, even if Coralis accepts or signs it. Customer's participation is not based on any future functionality or on any commitment to release a commercial version.

19.2 Assignment. Customer may not assign these Terms without Coralis's consent, except to a successor in a merger, acquisition, or sale of substantially all of its assets that is not a Coralis competitor, with notice to Coralis. Coralis may assign these Terms, on notice to Customer, to an Affiliate or successor that agrees in writing to be bound by them, and any such assignment is a transfer under Section 8.5.

19.3 Notices and electronic communications. Coralis may send notices to the email address of Customer's administrators or through the Service, and Customer agrees to receive communications electronically. Customer must send legal notices to legal@coralis.bio. Email notices are effective on receipt. Customer is responsible for keeping administrator contact details current.

19.4 Force majeure. Neither party is liable for delay or failure to perform caused by events beyond its reasonable control, such as natural disasters, war, pandemics, government action, or widespread internet or utility outages, provided it uses reasonable efforts to mitigate the effects. This Section 19.4 does not excuse Coralis's obligations under Sections 7.3, 7.4, or 8. A party's insolvency or lack of funds, or a failure of its Subprocessors (other than as part of a widespread outage), is not a force majeure event.

19.5 Publicity. Coralis will not use Customer's name or logo in marketing without Customer's prior written consent.

19.6 Relationship; no third-party beneficiaries. The parties are independent contractors. These Terms create no partnership, joint venture, agency, or employment relationship, and there are no third-party beneficiaries.

19.7 Export and compliance. Each party will comply with laws that apply to it in connection with the Service. Customer represents that it is not located in, or owned or controlled by a person located in, a country or region subject to comprehensive U.S. sanctions, and is not on any U.S. government restricted-party list.

19.8 Contract for services. These Terms are a contract for services. The Uniform Commercial Code, the Uniform Computer Information Transactions Act, and the U.N. Convention on Contracts for the International Sale of Goods do not apply.

19.9 Interpretation. If any provision is found unenforceable, it will be enforced to the maximum extent possible and the rest of these Terms remain in effect. A failure or delay in enforcing a provision is not a waiver. Headings are for convenience, and "including" means "including without limitation."

20. Contact Us

Coralis Bio, Inc., 5251 South 2100 East, Salt Lake City, UT 84117

Legal and notices: legal@coralis.bio · Support: support@coralis.bio · Security: security@coralis.bio · Privacy: privacy@coralis.bio