General terms and conditions of sale

Preamble: Definitions

In these General Terms and Conditions of Sale, the capitalized terms below have the following meaning:

• “Provider”: Sycomia SARL, whose details appear above.
• “Client”: any natural or legal person, governed by private or public law, acting for professional purposes, who orders a Service from the Provider.
• “Parties”: the Provider and the Client, together.
• “Terms”: these General Terms and Conditions of Sale.
• “Quote”: the commercial and technical proposal drawn up by the Provider, including, where applicable, an analysis plan and a description of phases and milestones.
• “Order”: the Quote accepted by the Client under the conditions of article 3.
• “Analysis Plan”: the technical document describing in detail the chosen analysis strategy, drawn up under the conditions of article 3.6.
• “Services”: the services performed by the Provider under an Order.
• “Deliverables”: the reports, result tables, figures, scripts, pipelines, models and any other item delivered to the Client under an Order.
• “Client Data”: all data, files, metadata, digital samples and information sent by the Client, or collected on its behalf, for the performance of the Services.
• “Personal Data”: data within the meaning of article 4 of Regulation (EU) 2016/679 (hereinafter “GDPR”).
• “Acceptance”: the acceptance of the Deliverables by the Client under the conditions of article 5.5.
• “Generic Tools”: the methods, algorithms, pipelines, workflows, scripts, libraries, models and know-how pre-existing at the Provider, or developed by it in a way that is not specific to a Client.
• “Specific Tools”: the developments made specifically for the Client under an Order, excluding the Generic Tools they incorporate.
• “Business Day”: any day other than Saturday, Sunday and public holidays in mainland France.

Article 1: Scope

1.1 Purpose

These Terms govern all contractual relations between the Provider and the Client relating to bioinformatics Services.

1.2 Acceptance of the Terms

The signature of a Quote, the issue of a purchase order referring to a Quote, or the start of performance of the Services at the Client's request constitutes full and unreserved acceptance of the Terms in force on the date of the Order.

The Client acknowledges having read them beforehand, the Terms being attached to each Quote and available online.

1.3 Order of precedence

In the event of conflict between contractual documents, the following order of precedence applies, in decreasing order:

• 1. any framework agreement, specific agreement or amendment signed by both Parties;
• 2. the approved Analysis Plan, for the technical description of the Services only;
• 3. the accepted Quote and its other appendices;
• 4. Annex 1 (Personal data processing agreement);
• 5. these Terms.

The Client's general terms of purchase, and any statement appearing on its purchase orders, supplier portals or correspondence, are expressly excluded, unless accepted in writing and signed by a person authorized to represent the Provider. The mere fact that the Provider registers on a Client's supplier portal or submits an invoice there does not constitute acceptance of the Client's terms.

Any derogation from these Terms must appear expressly in the Quote or in a document signed by the Provider.

1.4 Professional clients

The Services are intended exclusively for professional clients: companies, public institutions, higher education and research institutions, local authorities, foundations and associations. They are not offered to consumers within the meaning of the French Consumer Code.

Article 2: Services

2.1 Nature of the Services

The Provider offers, by way of indication and without limitation:

Biological data analysis

• Genomic analyses (WGS, WES, targeted panels)
• Transcriptomic analyses (RNA-seq, single-cell RNA-seq, spatial transcriptomics)
• Proteomic and metabolomic analyses
• Metagenomic and microbiome analyses
• Epigenetic analyses (ChIP-seq, ATAC-seq, methylation)
• Advanced statistical analyses and modeling

Development and tools

• Development of custom analysis pipelines
• Creation of custom bioinformatics scripts and tools
• Optimization of existing workflows
• Multi-omics data integration
• Modeling using artificial intelligence and machine learning approaches
• Design, development and operation of AI algorithms

Additional services

• Bioinformatics training
• Consulting and methodological support

The precise terms of each Service (scope, methods, duration, format, Deliverables, milestones) are defined in the Quote and, for analysis Services, in the Analysis Plan drawn up in accordance with article 3.6. Any service not described in these documents is the subject of a separate Quote.

2.2 Nature of the commitment

The Provider is bound by an obligation of means (best efforts). It undertakes to apply skills, methods and diligence in line with the state of the art and good professional practice in bioinformatics.

The Provider does not guarantee any specific scientific result, discovery, statistically significant signal, acceptance for publication, experimental success or funding.

2.3 Intended use of the results: research use only

Unless expressly stated otherwise in the Quote, the Deliverables are provided for research purposes only (Research Use Only).

They do not constitute a medical device or an in vitro diagnostic medical device within the meaning of Regulation (EU) 2017/745 and Regulation (EU) 2017/746, have not received any CE marking, and must in no case be used:

• to establish a diagnosis, a prognosis or genetic counseling;
• to guide a care, treatment or screening decision concerning an identified or identifiable person;
• as evidence in a regulatory marketing authorization file, unless the Provider has given its prior written agreement expressly governing such use.

The Client is solely responsible for any use of the Deliverables outside this framework.

2.4 Dependence on Client Data

The Services are performed exclusively on the basis of the Client Data and of the information, biological hypotheses and objectives communicated by the Client. The quality, completeness, consistency and traceability of the Client Data directly determine the quality of the Deliverables.

Article 3: Quote and order

3.1 Quote

All Quotes are free of charge and non-binding. These Terms are attached to them.

A Quote is valid for 30 calendar days from its issue, unless otherwise stated in the Quote itself. After this period, the Provider may revise its terms, in particular if the data volume, the schedule or the scope has changed.

3.2 Information to be provided by the Client

The information to be communicated depends on the nature of the Service. In all cases, the Client provides the common core information, supplemented by the information corresponding to the type of Service considered.

a) Common core: all Services

• a description of the need and of the objective;
• the desired timeframe and any scheduling constraints;
• the identity of the contact person and, where applicable, of the budget holder;
• the applicable regulatory or contractual constraints (funder, consortium, collaboration agreement, publication embargo, open science obligations).

b) Data analysis

• the biological questions to be addressed;
• the type, format and volume of the data and the number of samples;
• the experimental design (replicates, groups, conditions, known covariates, randomization plan);
• the technology and protocol used to generate the data (platform, kit, read length, depth);
• the reference genome, transcriptome or annotation databases to be used;
• the analyses already performed and their results, if any.

c) Development of tools, pipelines and models

• the expected features and the criteria for assessing their compliance;
• the target technical environment (operating system, scheduler, computing and storage resources, containerization, constraints for integration into the information system);
• any required languages, formats or frameworks;
• a representative dataset for development and testing;
• the existing material to be taken over or developed further (code, documentation, applicable licenses) and the rights the Client holds over it;
• the expected level of documentation, handover and maintenance.

d) Training

• the number, profile and initial technical level of the participants;
• the learning objectives and target skills;
• the format (on site or remote), duration, dates and location envisaged;
• the technical environment made available (workstations, installation rights, network access, computing resources) and the language of the training.

e) Consulting and methodological support

• the context, the question raised and the decision to be informed;
• the existing documents and data that can be shared;
• the stakeholders to be involved and the desired frequency of exchanges.

f) Data protection: where applicable

Where the Service involves the processing of personal data, even on an ancillary basis or solely for testing or training exercises, the Client also specifies:

• the nature of the data concerned (personal data, health data, genetic data);
• the legal basis for the processing and the existence of the required authorizations, opinions and consents;
• the name and contact details of the data protection officer, if any;
• any applicable hosting or location constraints.

This section does not apply where the Service concerns only non-personal, anonymous, simulated or public data. The Client then confirms this in writing.

The Provider may request any additional information needed for pricing. The Quote is drawn up solely on the basis of the information communicated: any substantial inaccuracy or omission entitles the Provider to revise it or, if performance has already started, to propose an amendment in accordance with article 3.5.

3.3 Formation of the Order

The Order becomes firm and final on the earliest of the following dates:

• signature of the Quote by an authorized person of the Client;
• receipt by the Provider of a purchase order referring to the Quote without reservation;
• written approval of the Quote by any traceable means (explicit acceptance email from a named person).

Depending on the amount or nature of the Service, the Provider may make the start of work conditional on receipt of an additional purchase order, in particular where the Client is a public entity.

No Service starts before the Order is formed and, where applicable, before the down payment provided for in article 4.2 has been received.

3.4 Multi-phase Quotes: GO/NOGO procedure

Some Quotes are structured in several phases: a preliminary study, feasibility or quality control phase, followed by one or more additional phases subject to approval.

At the end of each phase, the Provider sends a report or an interim Deliverable together with a “GO / NOGO” confirmation request. The Client has 10 Business Days to reply, unless a different period is stated in the Quote.

• GO: the Provider continues the assignment; the Quote becomes firm and final for the next phase.
• NOGO: the assignment ends at the end of the completed phase. The Client remains liable for the work performed up to that date and for the costs incurred that cannot be recovered. The part of the down payment exceeding these amounts is refunded to the Client within 30 days.
• No reply: the project is automatically suspended when the period expires. The Provider sends a written reminder. Failing a reply within a further period of 20 Business Days, silence is deemed a NOGO and has the effects described above.

Any resumption of the project after a suspension of more than 60 days may give rise to an update of the Quote (remobilization of resources, reinstallation of the computing environment, update of software versions and reference databases).

3.5 Changes to the Order

Any change to the scope, data volume, experimental design or schedule is the subject of a written amendment accepted by both Parties, which may lead to a revision of the price and timeframe.

Any request for an additional service gives rise to a new Quote constituting a new Order.

The replacement, addition or reprocessing of data already processed at the Client's request, and any reanalysis following a change of hypotheses or design, constitute an additional service.

3.6 Analysis Plan and methodological adaptations

Drafting. For analysis Services, the Provider draws up an Analysis Plan, a technical document more detailed than the Quote, describing in particular:

• the biological questions addressed and the hypotheses tested;
• the samples selected, the groups and the planned comparisons;
• the quality control criteria and the thresholds for sample inclusion or exclusion;
• the planned processing steps (preprocessing, alignment or quantification, normalization, batch effect correction);
• the statistical methods, significance thresholds and multiple testing corrections;
• the tools, versions and reference databases envisaged;
• the expected Deliverables.

The Analysis Plan is sent to the Client for written approval before the analyses start or, for multi-phase Quotes, at the end of the preliminary phase. Once approved, it forms an integral part of the contract and prevails over the Quote for the technical description of the Services, the Quote alone governing the price, schedule and commercial terms.

Evolving nature. The Parties expressly acknowledge that the analysis of biological data is iterative: the actual quality of the data, the results of quality controls and interim results may make it necessary to adapt the Analysis Plan. Such an adaptation constitutes neither a breach nor a non-conformity.

a) Methodological adaptations. The Provider implements, without prior amendment, adaptations that affect neither the agreed scope, nor the price, nor the timeframe, in particular: change of tool or version, adjustment of filtering or normalization parameters, choice of a statistical method better suited to the observed distribution, exclusion of samples that do not meet the quality criteria, addition of a correction step made necessary by the data.

These adaptations are documented and justified in the analysis report or, where significant, notified to the Client in writing as soon as they are implemented.

b) Substantial adaptations. Adaptations that change the scope, add or remove analyses or comparisons, require complete reprocessing of steps already performed, or affect the price or timeframe require the Client's prior written agreement and are the subject of an amendment in accordance with article 3.5.

c) Objectives that cannot be achieved. If quality controls or interim results show that the data do not allow the set objectives to be achieved (insufficient quality, residual sample size too small after exclusion, confounding between factors of interest and technical effects, no usable signal), the Provider informs the Client without delay, documents its findings and proposes either an adaptation of the Analysis Plan or the termination of the Service. The GO/NOGO procedure of article 3.4 then applies.

In all cases, the work actually performed up to that finding remains payable, the Provider's obligation being an obligation of means within the meaning of article 2.2.

d) Exclusion of samples. Unless otherwise stated in the Quote, the exclusion of samples following quality control does not give rise to any price reduction, as the reception, control and preprocessing operations have actually been performed on these samples. Replacing excluded samples with new samples constitutes an additional service within the meaning of article 3.5.

Article 4: Prices and payment terms

4.1 Pricing

Prices are expressed in euros excluding taxes. VAT at the applicable legal rate is added, unless an exemption or reverse charge applies.

Services are invoiced at a fixed price or on the basis of a daily or hourly rate, as stated in the Quote. The price takes into account in particular:

• the scientific and technical complexity;
• the biological question to be addressed;
• the volume, nature and condition of the data to be analyzed;
• the human, software and computing resources involved;
• the estimated duration.

Unless otherwise stated, the price does not include: sequencing or data generation costs, proprietary software licenses required by the Client, long-term hosting costs beyond the duration of the project, or travel expenses, which are invoiced in addition on the basis of receipts.

4.2 Invoicing schedule and down payments

Principle. The invoicing and payment terms applicable to each Order, including the amount of the down payment, are set out in the Quote. Unless otherwise stipulated, a down payment is invoiced on Order then, for multi-phase Quotes, invoicing takes place pro rata at each approved milestone, the balance being invoiced on Acceptance.

Adjustments. This schedule does not apply systematically. The Quote may provide for a reduced or no down payment, a different schedule or invoicing as work progresses, in particular depending on the nature, duration or amount of the Service, the external costs to be incurred or the status of the Client. Only the terms set out in the accepted Quote are binding.

Where performance requires the Provider to incur non-recoverable external costs (reservation of computing or storage resources, software licenses, purchase of or access to datasets, subcontracting, travel) exceeding the amount of the down payment, the Quote may provide for a down payment equal to the amount of these costs.

The down payment is deducted from the final invoice.

4.3 Payment terms

• Payment exclusively by bank transfer, to the account stated on the invoice. The Provider never notifies a change of bank details by simple email: any such request must be verified by telephone with the Client's usual contact.
• Payment period: 30 net days from the invoice issue date, unless otherwise stated in the Quote or purchase order.
• For Clients subject to the French public procurement code, the payment period is the one set by the applicable regulations (in particular 30 days for the State, local authorities and their public institutions, and 50 days for public health institutions), and late payment interest is that provided for by these texts.
• Electronic invoicing: the Provider and the Client comply with the regulations on electronic invoicing and e-reporting, according to the legal timetable applicable to each. For public sector Clients, invoices are submitted on the Chorus Pro portal; for this purpose, the Client provides, upon Order, its SIRET number, service code, legal commitment or purchase order number. Any late payment resulting from the late or incorrect communication of these references is not attributable to the Provider.
• If the invoice is issued in a currency other than the euro, payment is made for an equivalent amount in euros at the exchange rate in force on the payment date, unless otherwise agreed in writing beforehand. Bank conversion fees are borne by the payer.
• No discount is granted for early payment.
• Payments are made in a single instalment per due date, unless otherwise agreed in writing beforehand.

4.4 Invoice disputes

Any dispute concerning an invoice must be notified to the Provider in writing, with acknowledgment of receipt, within 30 days of its receipt, stating the reasons and the amounts disputed. Failing this, the invoice is deemed accepted.

A dispute concerning part of an invoice does not release the Client from paying the undisputed portion when due.

4.5 Late payment

Any late payment automatically entails, without prior formal notice:

• late payment penalties at three times the French statutory interest rate in force, applied to the unpaid amount including taxes, accruing from the day following the due date;
• a fixed indemnity for recovery costs of €40 per unpaid invoice, the Provider being entitled to claim additional compensation on the basis of receipts where the costs incurred exceed this amount.

In addition, after a formal notice that has remained unanswered for 15 days, the Provider may suspend the performance of all Services in progress, including under other Orders of the same Client, as well as the delivery of Deliverables not yet sent, without such suspension being held against it or giving rise to any compensation.

4.6 Price revision

Default nature. This article applies only in the absence of any contrary provision in a framework agreement, specific agreement or amendment signed by the Parties, which prevail in accordance with article 1.3. Where such an agreement contains its own clauses on revision, indexation formula, notice or termination in the event of refusal, those clauses alone apply, to the exclusion of this article.

Likewise, where the Order is placed under a public contract or framework agreement, the price variation clauses set out in the contract documents alone apply.

Default regime. The prices set out in an accepted Quote are firm and not subject to revision for the duration of performance of the Order concerned, subject to articles 3.4 and 3.5.

For recurring or successive services lasting more than 12 months and not governed by a framework agreement, unit prices and daily rates may be revised once a year, on January 1, according to the following formula:

P₁ = P₀ × (I₁ / I₀)

where P₀ is the price in force, P₁ the revised price, I₀ the last index published at the date of the initial Quote and I₁ the last index published at the revision date, the index used being the Syntec index or, if it is no longer published, the harmonized consumer price index published by INSEE. The variation applied is capped at ± 8% per year.

In the event of a substantial and lasting change in costs (increase in social security charges of more than 5%, increase in computing, storage or software license costs of more than 15%, or regulatory change significantly affecting operating costs), the Provider may carry out an exceptional revision subject to 60 days' written notice.

Any revision is notified in writing. The Client has 30 days to accept or refuse it. In the event of refusal, either Party may end the business relationship without penalty subject to 30 days' notice. Orders already accepted continue until completion at the initial price conditions.

Article 5: Performance, delivery and acceptance

5.1 Timeframes

The timeframes stated in the Quote are given for information only and constitute a firm commitment only if they are expressly designated as mandatory in the Quote.

Where performance requires the transmission of tangible or intangible items held by the Client, timeframes start to run only from the complete, readable and usable receipt of these items, and, where a down payment is provided for in the Quote, after it has been received.

Timeframes are automatically extended, without compensation, by a period at least equal to the delay, in the event of:

• force majeure;
• delay by the Client in transmitting data, access, approvals or replies to requests for clarification;
• suspension under articles 3.4, 4.5 or 12.1;
• change of scope at the Client's request.

The Provider informs the Client without delay of any foreseeable or actual delay and of its causes.

5.2 Contact persons and follow-up

Each Party designates in the Quote a contact person, who alone is authorized to approve interim steps and to make change requests. Any instruction from another person may be disregarded by the Provider until confirmed by the contact person.

The Provider informs the Client of the progress of the work at the agreed frequency and, in any event, in the event of any technical or scientific difficulty likely to affect the result, timeframe or cost.

5.3 Standard Deliverables

The Deliverables are sent by secure electronic means to the persons designated by the Client. Unless otherwise stated in the Quote, each analysis Service includes:

• a detailed analysis report in HTML format (or any other format at the Client's express request, provided the content lends itself to it), including a description of the methods used, the main parameters selected and the versions of the tools and reference databases used;
• result tables in standard formats (CSV, TSV, XLSX);
• the associated graphs and visualizations;
• an oral presentation of the results with supporting slides, held remotely.

5.4 Optional Deliverables

On request and subject to pricing in the Quote:

• supply of intermediate processing files;
• record of the checksums of the files received and delivered, certifying the integrity of the transfers;
• scripts and source code of the analyses performed, provided under the license conditions of article 9.3;
• containerized execution environment and reproducibility documentation;
• any other document or information agreed between the Parties.

5.5 Acceptance of the Deliverables

From the time the Deliverables are made available, the Client has 10 Business Days to check them and to notify its acceptance or reservations in writing.

• Reservations must be reasoned, specific and in writing, and relate exclusively to a non-conformity of the Deliverables with the scope defined in the Quote and, where applicable, in the approved Analysis Plan, taking into account the adaptations documented under article 3.6. A scientific result that does not meet the Client's expectations or hypotheses does not constitute a non-conformity.
• The Provider then has a reasonable period, and at most 15 Business Days or any other period agreed in writing in view of the nature of the corrections, to remedy well-founded reservations and resubmit the Deliverables. A new verification period of 5 Business Days runs from this new delivery.
• Failing written notification within the allotted period, the Deliverables are deemed accepted without reservation. The same applies in the event of use, exploitation or dissemination of the Deliverables by the Client.

Acceptance, whether express or tacit, marks the starting point of the warranties of article 10, of the support period of article 14 and of the due date of the balance.

Special cases. For training Services, the Service is deemed performed at the end of the last session, as evidenced by the attendance sheet or connection log. Any training materials provided follow the acceptance regime above. For consulting and support Services invoiced on a time basis, the Service is deemed performed as it progresses, Acceptance relating only to the formalized Deliverables expressly provided for in the Quote.

5.6 Delivery environment

The Deliverables are guaranteed to be functional only in the technical environment described in the Quote (operating system, dependency versions, computing and memory resources). Porting, adaptation or integration into another environment constitutes an additional service.

Article 6: Obligations of the parties

6.1 Obligations of the Provider

The Provider undertakes to:

• perform the Services in accordance with the state of the art, good professional practice and the scientific standards in force in bioinformatics;
• assign to the assignment staff with the required skills;
• respect the confidentiality and security of the Client Data under the conditions of articles 7 and 8;
• inform the Client of the progress of the work, the difficulties encountered and any foreseeable delay;
• document the methods, software versions and reference databases used, to ensure the traceability and reproducibility of the analyses;
• provide the warranty and support set out in articles 10 and 14.

6.2 Obligations of the Client

The Client undertakes to:

• send all the data, metadata, information and access required, in the formats, naming conventions and standards required by the Provider, together with the complete experimental design;
• designate an available and competent contact person;
• approve interim steps and reply to requests for clarification within 5 Business Days, unless a different period is stated in the Quote;
• send Client Data files exclusively through the secure channel indicated by the Provider; only pseudonymized metadata may be exchanged by email or through the collaboration tools listed in Annex 1;
• keep a backup copy of all the data it sends, the Provider not being required to retain it for archiving purposes;
• inform the Provider without delay of any change in its needs, regulatory context or project likely to affect performance;
• pay invoices under the conditions of article 4;
• use the Deliverables only under the conditions of articles 2.3 and 9.

6.3 Client warranties regarding data

The Client warrants, for all Client Data it sends or has sent:

• that it holds all the rights, titles and authorizations necessary to communicate them to the Provider and allow it to process them for the purposes of the Services, including where they come from a third party, a consortium, a biobank or a public database subject to access conditions;
• that the Client Data are free of viruses and malicious code and do not infringe any third-party intellectual property right.

Where the Client Data relate to natural persons, the Client further warrants:

• that their collection and processing are based on a valid legal basis within the meaning of the GDPR and comply, where applicable, with the provisions of the French Public Health Code and Research Code;
• that the required consents, information of data subjects, opinions or regulatory authorizations (in particular ethics committee, committee for the protection of persons, CNIL authorization or declaration of compliance, authorization to access public data) have been obtained and expressly cover the use of an external provider for the analysis;
• that the data sent are pseudonymized prior to any transmission, the Client alone retaining the correspondence table;
• that no directly identifying data is sent, in particular: surname, first name, initials, address, contact details, social security number, institution file number or patient identifier, full date of birth, non-anonymized images or recordings. This prohibition is absolute and applies whatever the purpose invoked;
• that the combination of the metadata sent does not allow the re-identification of the data subjects.

The Provider refrains from any attempt to re-identify the data subjects.

If the Provider finds directly identifying data or a manifest lack of legal basis, it informs the Client without delay and suspends processing until a compliant dataset is sent, in accordance with the procedure described in point A.2 of Annex 1, without such delay being attributable to it.

The Client indemnifies the Provider against any claim, action or penalty from a third party or an authority based on a breach of the warranties of this article.

6.4 Cooperation

The Parties undertake to cooperate in good faith and to respond diligently to requests for information, approval or clarification, so as not to delay the performance of the Services.

Article 7: Protection of personal data

7.1 Roles of the Parties

Where performance of the Services involves the processing of Personal Data on behalf of the Client, the Client acts as controller and the Provider as processor within the meaning of the GDPR.

The conditions of this processing are set out in Annex 1 to these Terms, which constitutes a data processing agreement within the meaning of article 28 of the GDPR. If the Parties enter into a separate processing agreement, it prevails over Annex 1.

The Provider acts as controller only for its own processing (sales management, invoicing, customer relations).

7.2 General principles

• The Client Data remain the exclusive property of the Client.
• They are processed only on the Client's documented instructions and solely for the purpose of performing the Services. Any other use requires the Client's prior written agreement.
• The Provider implements the technical and organizational measures described in point A.6 of Annex 1, in particular encryption of transfers, named accounts, restriction of access to what is strictly necessary, separation of projects, regular backups and application of security updates.
• The Provider's staff and contributors are bound by a confidentiality obligation.
• The Provider notifies the Client of any personal data breach within 48 hours of its discovery, with the information the Client needs to meet its own notification obligations.
• The Provider assists the Client, within the limits of its means, in responding to requests from data subjects exercising their rights and in carrying out impact assessments.

7.3 Location and transfers

The Client Data are hosted and processed on infrastructure located in France. This commitment covers working data, intermediate processing data and technical logs. For the messaging and collaboration tools listed in Annex 1, this commitment covers storage at rest. Their processing takes place within the European Union, subject to the limited transfers documented by the provider, which the Client accepts by authorizing this sub-processor.

Any change of location, including to another Member State of the European Union, is notified to the Client in accordance with the procedure applicable to sub-processors set out in article 7.5.

Subject to the limited transfers mentioned in the first paragraph, no transfer to a third country takes place without the Client's prior written authorization and without the appropriate safeguards provided for in Chapter V of the GDPR.

The Provider refrains from sending Client Data to any third-party artificial intelligence, analysis or automated processing service not expressly mentioned in the list in Annex 1.

Development assistance tools. The Provider may use artificial intelligence based assistance tools for the design, writing, review, debugging and documentation of code, scripts and pipelines. These tools are used under conditions ensuring that no Client Data is sent to them, in particular:

• separation of code directories and data directories, the tool having access only to the former;
• exclusive use of synthetic, public or anonymous datasets for development and testing;
• configuration of the service excluding the use of submitted content for model training, and use of a professional offering with contractual guarantees of confidentiality and limited retention.

These tools are not processors within the meaning of article 28 of the GDPR as long as no personal data is sent to them.

Where development requires such a tool to access real Client Data, such access is subject to the Client's prior written agreement and to the addition of the provider concerned to the list in Annex 1.

Locally run artificial intelligence models. The Provider may also use artificial intelligence models, in particular large language models (LLMs), installed and run on its own servers, without any connection to an external service. The data processed by these models do not leave the Provider's infrastructure and remain subject to the measures of article 7.2 and Annex 1. These models are not sub-processors.

7.4 Health data and hosting

Where the Client Data are data concerning health or genetic data, the Parties agree in the Quote on the enhanced measures applicable (encryption, separation, access restriction, retention periods).

Default hosting provider. Where performance of the Services requires the use of external computing or storage infrastructure, the Provider uses OVHcloud, on infrastructure located in France, unless otherwise agreed in the Quote.

Health data hosting. Where the Client Data fall within the scope of personal health data hosting, the Provider uses an offering expressly covered by the “Health Data Host” (HDS) certification issued under the framework of the French Digital Health Agency, the corresponding option being enabled on the services concerned and the contractual addendum required by the host being signed. The Provider provides the Client, on request, with the certification reference and the exact scope of the services covered.

Hosting provider imposed by the Client. The Client may require the use of another certified hosting provider or of its own infrastructure. This requirement is stated when the Quote is drawn up and may affect the price, timeframes and technical feasibility of the Service. The Provider then assumes no liability for the security, availability, compliance or performance of the infrastructure so imposed.

7.5 Sub-processors

The Provider is authorized to use sub-processors (in particular providers of computing and storage infrastructure) under the conditions of Annex 1 and article 13.

The list of sub-processors in force appears in Annex 1 and is communicated to the Client when the Quote is drawn up. Any addition or replacement is notified to the Client in writing with 30 days' notice, during which the Client may object on legitimate and documented grounds relating to data protection.

The Provider remains fully liable to the Client for the performance by its sub-processors of their obligations.

7.6 Retention, return and destruction

• The Client Data and intermediate processing data are kept for the duration of performance of the Order, then destroyed within 30 days of Acceptance or, failing that, of the end of the Order for any reason whatsoever, unless there is a legal retention obligation or archiving provided for in the Quote, whose duration and conditions are then specified there and which is invoiced where applicable.
• During the warranty and support periods provided for in articles 10 and 14, any correction requiring all or part of the analyses to be reproduced requires the Client to send the relevant Client Data again, of which it keeps a copy in accordance with article 6.2; the correction period runs from their receipt.
• The Client may at any time request the return of the data in their original format, or their early destruction.
• On request, the Provider issues a certificate of destruction.
• The Provider may retain, solely for the purposes of proving performance, defending its rights and complying with its legal obligations, the contract documents, technical logs, methodological documentation and non-identifying metadata of the project, as well as the pseudonymized analysis report, kept for 5 years from the end of the Order with restricted access. With the exception of this report, no individual data (genetic data, data files, per-sample result tables) is kept beyond the destruction period.

Article 8: Confidentiality

Each Party undertakes to keep strictly confidential the technical, scientific, commercial, financial or strategic information of which it becomes aware in the course of the contractual relationship, including the Client Data, the analysis reports, and the composition, architecture and operation of the Provider's tools and software.

Information is not considered confidential if it was already lawfully known to the receiving Party without any confidentiality obligation, is or becomes public through no fault of its own, was developed independently, or was lawfully obtained from a third party not bound by secrecy.

Confidential information may be disclosed:

• to employees, contributors and subcontractors who need to know it, themselves bound by an equivalent confidentiality obligation;
• to the extent strictly necessary to establish the performance of the Services and obtain payment for them;
• at the request of a competent administrative or judicial authority, the Party concerned informing the other Party without delay, unless legally prohibited.

This undertaking applies for the entire duration of the contractual relationship and for 5 years after its end. The Parties may enter into a separate confidentiality agreement, which then prevails over this article within the limits of its provisions.

Article 9: Intellectual property

9.1 Data and results

The Client Data remain the exclusive property of the Client.

The Provider assigns to the Client, on an exclusive basis and from full payment of the price, the rights of reproduction, representation and adaptation of the results arising from the analysis of the Client Data (result tables, figures, analysis report), for any publication, scientific communication, filing or presentation, on any medium, worldwide and for the legal duration of the rights, so that the Client may freely exploit them in the context of its research or development activity, subject to article 2.3.

This assignment covers neither the Generic Tools nor the generic methodological descriptions contained in the report, which the Provider may reuse provided they contain no Client Data and no confidential information of the Client. It does not prevent the retention of the report provided for in article 7.6.

9.2 Generic Tools

The Provider's Generic Tools (methods, algorithms, pipelines, workflows, scripts, libraries, models, know-how) remain its exclusive property, whatever their date of creation.

Nothing in these Terms entails the assignment of these items to the Client.

Any generic improvement, correction, optimization or development made in the course of an Order remains the property of the Provider, provided it incorporates neither Client Data nor confidential information of the Client.

9.3 Specific Tools and license

Ownership. The Provider remains the sole holder of the intellectual property rights in the Specific Tools and in the source code it writes, including where this code is delivered to the Client. The delivery of a Deliverable or of its source code does not entail any assignment of rights to the Client.

License. The Specific Tools developed for the Client are delivered to it, upon full payment of the price, under a non-exclusive, non-transferable, worldwide license of use for the legal duration of the intellectual property rights.

This license authorizes the Client to use, run, adapt and further develop the Specific Tools for its own internal needs, including through providers acting on its behalf and bound by confidentiality.

It does not authorize assignment, sublicensing, redistribution, provision to third parties whether for a fee or free of charge, or commercialization, without the Provider's prior written agreement.

Any modification of the Specific Tools by the Client or a third party ends the warranties of article 10 for the modified items.

Assignment of rights. The Client may acquire ownership of the economic rights in the Specific Tools and their source code for a specific price, separate from the price of the Service. Such assignment takes place only by virtue of an express provision of the Quote or a separate written deed specifying, in accordance with article L. 131-3 of the French Intellectual Property Code, the rights assigned (reproduction, representation, adaptation, distribution, commercialization), their extent, their purpose, the territory and the duration. It takes effect upon full payment of the assignment price. Even after assignment, the Client may not sell, rent or otherwise commercialize the Specific Tools, unless the Provider gives its express written consent in the deed of assignment. The Client may, however, use, modify and distribute them free of charge. The Generic Tools incorporated in the Specific Tools remain in all cases the property of the Provider and are licensed under the conditions above.

9.4 Source code and third-party components

The source code of the Specific Tools, that is to say the tools, scripts, pipelines and models developed specifically for the Client under a development Service, is delivered to the Client under the license conditions of article 9.3, unless otherwise stated in the Quote.

The scripts and code used to perform an analysis Service are not delivered to the Client, unless they are the subject of an option provided for in the Quote in accordance with article 5.4.

By way of exception to article 9.3, the Client may make public, in support of a scientific publication and under a free license agreed between the Parties, the analysis scripts delivered under article 5.4, excluding the Generic Tools.

The Deliverables may incorporate open source or third-party components, whose use remains subject to their respective licenses. The Provider provides the list of these components and the applicable licenses on request. The Client undertakes to comply with their terms and is responsible for any resulting obligation in the event of redistribution.

9.5 Artificial intelligence and models

• The Provider's pre-existing or generic models, architectures, weights and parameter sets constitute Generic Tools within the meaning of article 9.2.
• Models trained specifically on the Client Data under an Order are delivered to the Client under the conditions of article 9.3.
• The Provider refrains from any use, on its own behalf or on behalf of third parties, of models trained on the Client Data.
• The Provider refrains from using the Client Data to train, fine-tune or evaluate models intended for other clients or for generic use, except with the Client's prior and express written agreement, which may give rise to negotiated consideration.
• The Provider refrains from sending Client Data to any third-party artificial intelligence service other than the sub-processors listed in Annex 1, under the conditions of article 7.3.
• The Client is informed that the results produced by machine learning approaches are probabilistic in nature, depend on the training data and may contain biases; their interpretation and experimental validation are the responsibility of the Client.

9.6 Scientific publication and communication

The Provider supports the publication of its Clients' work while respecting their schedule and embargoes.

• The Client is invited, if it so wishes, to acknowledge the Provider's contribution in publications, communications or filings arising from the Services, for example in the acknowledgments section. This acknowledgment is optional.
• Where the Provider's contribution meets the usual authorship criteria in the discipline (design of the method, analysis and interpretation of the data, writing), the Parties discuss co-authorship in good faith. This point may be settled in the Quote.
• No publication may disclose the proprietary methods, source code or architecture of the Provider's Generic Tools without its written agreement. The methodological description required for scientific reproducibility (versions, parameters, bibliographic references) is not covered by this restriction.
• On request, the Provider reviews the methodological sections within 10 Business Days, solely to check their technical accuracy and compliance with this clause.

Article 10: Warranties and liability

10.1 Warranty of conformity

The Provider warrants that the Deliverables conform to their description in the Quote and, where applicable, in the approved Analysis Plan as adapted in accordance with article 3.6, in the delivery environment specified in article 5.6.

For a period of 90 days from Acceptance, the Provider corrects free of charge any proven error, any non-conformity and any reproducible malfunction of the Deliverables, scripts and tools supplied, reported in writing by the Client.

This warranty is the only warranty granted by the Provider. It absorbs and replaces any other warranty, express or implied.

10.2 Warranty exclusions

The warranty does not cover:

• defects resulting from incomplete, erroneous, poorly annotated or poor quality data, or from an unsuitable experimental design;
• modifications, alterations, updates or integrations made by the Client or an unauthorized third party;
• execution in a technical environment, software version or infrastructure not specified in the Quote;
• changes to reference databases, public annotations or third-party tools after delivery;
• the unavailability or modification of an external service or resource;
• use of the Deliverables outside the agreed framework, in particular in breach of article 2.3.

10.3 Liability of the Client

The Client remains solely responsible for:

• the quality, integrity, lawfulness and regulatory compliance of the Client Data;
• their proper transmission to the Provider;
• the scientific interpretation of the results and the conclusions it draws from them;
• the use, dissemination, publication and external exploitation of the Deliverables;
• decisions taken on the basis of the Deliverables.

10.4 Limitation of liability

The Provider is liable only for direct and foreseeable damage resulting from a proven breach of its obligations.

The Provider's total liability, for all causes combined, is limited to the total amount excluding taxes actually invoiced under the Order giving rise to the damage, all phases combined.

Indirect or consequential damage is expressly excluded, in particular: operating loss, loss of revenue, loss of opportunity, loss of Client data of which the Client otherwise holds a copy, delay or refusal of publication, delay or loss of funding, damage to reputation, commercial or financial loss, and third-party claims.

These limitations do not apply in the event of fraud, gross negligence, bodily injury, or where the law prohibits such limitation.

10.5 Claims

The Client informs the Provider in writing of any claim as soon as possible, and if possible within 30 days of discovering the triggering event, with a precise description of the problem and the information needed to reproduce it.

In any event, no claim relating to the Order concerned is admissible after a period of 12 months from Acceptance.

10.6 Insurance

The Provider declares that it holds a professional liability insurance policy covering the financial consequences of bodily injury, property damage and financial loss caused in the course of its Services, taken out with ACM IARD SA (Crédit Mutuel) under policy no. I8 1041049.

A certificate is provided on request. This insurance does not transfer to the Provider any liability incumbent on the Client under article 10.3.

Article 11: Force majeure

Neither Party may be held liable for any failure or delay in performing its obligations where it results from a case of force majeure within the meaning of article 1218 of the French Civil Code.

The following are considered as such, without this list being exhaustive: epidemic or pandemic and associated administrative measures, natural disaster, fire, flood, war, act of terrorism, riot, general or transport strike, major cyberattack, widespread failure of telecommunications, internet or electricity networks, or failure of a computing infrastructure provider where it itself results from an event having the characteristics of force majeure.

The affected Party must:

• inform the other Party without delay, in writing, of the nature of the event and its foreseeable duration;
• make all reasonable efforts to limit its consequences.

Performance timeframes are extended by a period equivalent to that of the event. If the event lasts more than 30 days, either Party may terminate the Order automatically, in writing, without compensation on either side, the Client remaining liable for the Services performed and non-recoverable costs incurred.

The obligation to pay a sum of money that has fallen due is never suspended by a case of force majeure.

Article 12: Suspension and termination

12.1 Suspension

The Provider may suspend performance of the Services, after informing the Client in writing, in the event of:

• non-payment under the conditions of article 4.5;
• failure to send the necessary data, access, approvals or replies, persisting for more than 15 Business Days after a reminder;
• no reply to a GO/NOGO request under the conditions of article 3.4;
• serious and documented doubt as to the lawfulness of the Client Data with regard to article 6.3.

Suspension extends performance timeframes accordingly and does not give rise to any compensation for the Client. If it lasts more than 60 days due to the Client, the Provider may terminate the Order under the conditions of article 12.2.

12.2 Termination for breach

Either Party may terminate the Order in the event of a serious breach by the other Party of its essential obligations, in particular:

• non-payment of sums due;
• breach of the confidentiality obligations of article 8 or the intellectual property obligations of article 9;
• breach of the warranties of article 6.3 relating to the lawfulness of the data;
• serious breach of data protection obligations.

Termination takes effect automatically 15 days after a written formal notice that has remained without effect, specifying the alleged breach and the corrective measures expected, except in the case of a breach that cannot be remedied, which allows immediate termination.

12.3 Termination for convenience

Either Party may terminate an Order without cause, subject to 30 days' written notice sent by registered letter with acknowledgment of receipt or by any means providing a certain date.

In the event of termination for convenience by the Client, the Client pays:

• all the Services performed, pro rata to the progress recorded at the effective date;
• the costs incurred that cannot be recovered (licenses, reserved computing resources, subcontracting committed);
• a fixed indemnity equal to 20% of the amount excluding taxes remaining to be invoiced for the phase in progress at the date of notification, as compensation for the resources set aside.

Any down payment made remains with the Provider up to these amounts. Any excess is refunded to the Client.

In the event of termination for convenience by the Provider, the Provider:

• hands over to the Client, at the effective date, all the work and results produced, as they stand, together with the documentation allowing them to be taken over;
• invoices only the Services actually performed, pro rata to the progress recorded;
• refunds to the Client, within 30 days, the sums paid for the part not performed;
• may not claim any indemnity from the Client.

12.4 Consequences of termination

• Sums due for Services performed or in progress become immediately payable.
• Each Party returns or destroys, at the other Party's choice, the confidential information and items belonging to the other Party.
• The Provider returns or destroys the Client Data under the conditions of article 7.6.
• Deliverables already paid for remain acquired by the Client under the license conditions of article 9.
• Unpaid Deliverables may not be used by the Client, the license of use being conditional on full payment of the price.

12.5 Survival

The following articles survive expiry or termination, for their own duration: 2.3 (research use), 4 (sums due), 6.3 (Client warranties regarding data), 7 (personal data), 8 (confidentiality), 9 (intellectual property), 10 (warranties and liability), 15 (non-solicitation), 16 (commercial references) and 19 (general provisions).

Article 13: Subcontracting

The Provider may entrust all or part of the performance of the Services to specialized subcontractors, subject to the following conditions:

• Infrastructure subcontracting (computing, storage, hosting, software tools): the Client is informed when the Quote is drawn up; the list appears in Annex 1 and changes to it follow the procedure of article 7.5.
• Scientific or technical subcontracting covering all or part of the analyses or developments: it is subject to the Client's prior written agreement, requested at the latest when the Quote is drawn up, stating the identity of the subcontractor and its role. The Client may not refuse its agreement without legitimate grounds.
• Subcontractors are contractually bound by confidentiality, security and data protection obligations at least equivalent to those of these Terms.
• The Provider remains fully liable to the Client for the performance of the subcontracted Services, the quality of the Deliverables and compliance with timeframes.

Article 14: Support and additional services

14.1 Included support

For 90 days from Acceptance, the Provider provides support covering:

• the correction of proven errors, under the conditions of article 10.1;
• the explanations and clarifications needed for a proper understanding of the Deliverables and the methods used.

This support is provided electronically, Monday to Friday from 9 am to 5 pm (excluding public holidays), with an indicative first response time of 3 Business Days, unless otherwise stated in the Quote.

14.2 Chargeable additional services

The following are excluded from the included support and are the subject of a separate Quote:

• in-depth training on the tools, pipelines or methods supplied;
• support beyond the 90-day period or the included volume of hours;
• reanalyses, additional exploratory analyses or parameter changes after Acceptance;
• adaptation of the Deliverables to a new environment, new software versions or new data;
• assistance with writing publications, responding to reviewers and additional analyses requested during the revision of an article;
• any development not provided for in the initial Quote.

Article 15: Non-solicitation of staff

Each Party refrains, for the duration of the contractual relationship and for 12 months after its end, from soliciting or hiring, directly or indirectly, any employee of the other Party who took part in the performance of the Services, except with prior written agreement.

In the event of breach, the defaulting Party pays the other a fixed indemnity equal to six months of the gross remuneration of the employee concerned, calculated on the employee's last twelve months of activity.

This clause does not prevent a spontaneous application resulting from a public job offer not specifically addressed to the other Party's employees.

Article 16: Commercial references

The Provider mentions the Client's name or the nature of the Services performed on its behalf, or reproduces its logo or any other distinctive sign, on its website, presentation materials or any other medium, only with the Client's prior and express written agreement, which specifies its content and scope.

The Client may withdraw this agreement at any time by simple written notice.

Article 17: Changes to the terms

The Provider may modify, supplement or update these Terms at any time.

The Terms applicable to an Order are those in force on the date of its acceptance. Orders in progress and Quotes accepted before a modification remain governed by the previous version, unless otherwise agreed in writing.

The Provider informs the Client of any update by email or by any other appropriate means, and makes the version in force available on its website.

Article 18: No right of withdrawal

As the Services are intended exclusively for professional clients within the meaning of article 1.4, the provisions of the French Consumer Code relating to the consumer right of withdrawal (articles L. 221-18 et seq.) do not apply.

Article 19: General provisions

19.1 Governing law

These Terms are governed by French law.

19.2 Language

In the event of translation, only the French version is authoritative.

19.3 Dispute resolution

The Parties endeavor to settle amicably any dispute relating to the interpretation, performance or validity of these Terms, within 30 days of written notification of the dispute.

Failing an amicable settlement, and where the Client is a private law entity, exclusive jurisdiction is conferred on the competent courts of Mulhouse (France), including in the event of multiple defendants, third-party proceedings or summary proceedings.

Where the Client is a public entity or the contract is administrative in nature, jurisdiction is determined by the applicable legal rules, the above jurisdiction clause then being deemed unwritten.

19.4 Assignment

Neither Party may assign or transfer all or part of its rights and obligations without the prior written agreement of the other Party. The Provider may, however, assign the contract to a company in its group or in the context of a merger, contribution or transfer of business, provided it informs the Client.

19.5 Notices

Any notice is validly given by registered letter with acknowledgment of receipt or by email with acknowledgment of receipt, to the addresses stated in the Quote, each Party being responsible for reporting any change.

19.6 Independence of the Parties

The Provider performs the Services with full independence, without any relationship of subordination. These Terms create neither a de facto partnership, nor an agency, nor an employment relationship between the Parties.

19.7 Severability

If one or more provisions are declared void or unenforceable, the others retain their full effect. The Parties endeavor to replace the invalid clause with a valid provision that best reflects their original intention.

19.8 Waiver

The fact that a Party does not rely on a provision does not constitute a waiver of its right to rely on it subsequently.

19.9 Entire agreement

These Terms, the accepted Quote, the approved Analysis Plan and their appendices constitute the entire agreement between the Parties and supersede any prior agreement, oral or written, relating to the Services.

Annex 1: Personal data processing agreement

Entered into pursuant to article 28 of Regulation (EU) 2016/679

This annex applies where performance of the Services involves the processing of Personal Data on behalf of the Client.

A.1 Subject matter, nature and purpose of the processing

Subject matter: performance, on behalf of the Client, of the bioinformatics analyses, developments and services described in the Quote.

Nature of the operations: receipt, transfer, storage, quality control, alignment, quantification, annotation, statistical analysis, modeling, visualization, temporary retention, return and deletion.

Purpose: performance of the Services ordered, to the exclusion of any other purpose.

Duration: duration of the Order, plus the retention period provided for in article 7.6 of the Terms.

A.2 Categories of data and data subjects

Principle: mandatory prior pseudonymization. The Provider processes only pseudonymized data. The Client carries out the pseudonymization before any transmission and alone keeps the correspondence table, to which the Provider never has access.

No directly identifying data may be sent to the Provider, whatever the purpose invoked. This prohibition admits no exception and cannot be lifted by agreement between the Parties.

The precise categories are set in the Quote for each Order, within the following limits:

Limiting the risk of re-identification. The Client ensures that the combination of the metadata sent does not allow a person to be re-identified, in particular where it combines a rare disease, an investigating center, a precise sampling date and an exact age. Age is sent by age group and the sampling date by month where the purpose of the analysis allows.

Procedure in the event of non-compliant transmission. If the Provider finds prohibited data in a file received, it:

• 1. immediately stops processing the file concerned;
• 2. informs the Client without delay, and at the latest within 48 hours;
• 3. refrains from any further copying, extraction or dissemination;
• 4. securely deletes the file or places it in quarantine on the Client's written instruction.

Processing resumes only after the Client has sent a compliant dataset. Performance timeframes are extended accordingly, without compensation, and the work already performed remains payable.

Scope. Pseudonymized data remain personal data within the meaning of the GDPR. Genetic and genomic data are moreover intrinsically re-identifying and cannot be regarded as anonymous. All the obligations and measures of this annex fully apply to them.

A.3 Obligations of the Provider

The Provider undertakes to:

• 1. process the data only on the Client's documented instructions, including with regard to transfers outside the European Union, and inform the Client if an instruction appears to it to infringe the GDPR;
• 2. guarantee the confidentiality of the data and ensure that the persons authorized to process them are contractually bound to confidentiality;
• 3. implement the technical and organizational measures described in A.6;
• 4. comply with the conditions for engaging a sub-processor (A.5);
• 5. assist the Client in responding to requests from data subjects exercising their rights, by forwarding to it without delay any request received directly and providing the necessary technical means;
• 6. assist the Client with the security of processing, breach notification, impact assessments and prior consultation of the supervisory authority, taking into account the nature of the processing and the information available to it;
• 7. notify the Client of any data breach within 48 hours of its discovery, specifying the nature of the breach, the categories and approximate volume of data concerned, the likely consequences and the measures taken;
• 8. delete or return the data at the end of the Service, under the conditions of article 7.6 of the Terms, and destroy existing copies unless there is a legal retention obligation;
• 9. make available to the Client the documentation needed to demonstrate compliance with its obligations and allow audits to be carried out under the conditions of A.7;
• 10. keep a record of the categories of processing activities carried out on behalf of the Client;
• 11. designate a data protection contact: the data protection officer (DPO), who can be reached at dpo@sycomia.com.

A.4 Obligations of the Client

The Client undertakes to:

• 1. provide the Provider with lawfully collected data, under the conditions of article 6.3 of the Terms;
• 2. document in writing any instruction relating to the processing;
• 3. ensure compliance with GDPR obligations, in particular the existence of a legal basis, information of data subjects and, where applicable, the performance of an impact assessment;
• 4. supervise the processing and respond to requests from data subjects exercising their rights.

A.5 Sub-processors

The Client authorizes the Provider to use the sub-processors listed below. Any change is notified with 30 days' notice, the Client being able to object on legitimate and documented grounds.

External infrastructure is used only where the Service requires it. Where the data processed fall within the scope of health data hosting, the services used are covered by the HDS certification under the conditions of article 7.4.

The development assistance tools referred to in article 7.3 do not appear in this table as long as no Client Data is sent to them. Otherwise, they are added to it and subject to the sub-processor regime.

The Provider imposes on each sub-processor, by contract, the same data protection obligations as those set out in this annex, and remains fully liable to the Client for their performance.

A.6 Technical and organizational measures

• Encryption of data transfers (HTTPS, SFTP).
• Named accounts for all contributors.
• Restriction of access to what is strictly necessary and separation of projects.
• Separation of code directories and data directories; the AI-based development assistance tools mentioned in article 7.3 have access only to the code directories.
• Regular backups of tools and systems, stored in France. Client Data are excluded from backups, the Client keeping a copy in accordance with article 6.2.
• Application of security updates to systems and software.
• Deletion of data at the end of the project, in accordance with article 7.6.
• Data breach management procedure.

These measures may be strengthened in the Quote for health or genetic data.

A.7 Audit

The Client may, at most once a year and subject to 30 days' written notice, have compliance with this annex verified, on documents or on site, by itself or by an independent auditor who is not a competitor of the Provider and is bound by confidentiality.

The audit takes place during business hours, without disproportionate disruption to the Provider's activity, and may not cover information relating to its other clients. The costs are borne by the Client, unless the audit reveals a significant breach by the Provider.