Terms of Service

About these terms

Who we are. OPRAFLOW is a product of AYB Solutions Ltd, a company registered in England and Wales under company number 14906901. Our registered office is 30 Cherwell Way, Ruislip, England, HA4 7BE. In these terms, “we”, “us” and “our” mean AYB Solutions Ltd trading as OPRAFLOW.

Who these terms are for. OPRAFLOW is a business platform. It is offered only to organisations, not to consumers. If you accept these terms on behalf of an organisation, you confirm you have authority to bind it. “You” and “Client” mean that organisation.

How these terms work.

• Part A sets out the core terms for using the platform.
• Part B covers OPRA AI, the optional AI add on module for OPRAFLOW.
• Part C covers MCP connections, which let you link your own third party AI tools to OPRAFLOW.
• Your Order Form sets out your modules, number of users and fees. If your Order Form and these terms conflict, the Order Form wins.
• If you have signed a separate written agreement with us, that agreement applies instead of these terms, to the extent it covers the same subject.

Accepting these terms. You accept these terms when you sign an Order Form, subscribe online, or start using the platform, whichever happens first.

1. Definitions

• Authorised User: a person employed or engaged by you, or an External User you invite under clause 3.4, who has a login to the platform.
• Client Data: any data, content or files you or your Authorised Users upload to, or create within, the platform. This includes inputs to and outputs from OPRA AI.
• Confidential Information: information one party shares with the other that is marked confidential or would reasonably be understood to be confidential. It excludes information that is public, already known or independently developed.
• Documentation: the user guides, help material and other supporting documents we make available for the platform.
• Fees: the fees set out in your Order Form or at online checkout.
• Modules: the individually licensable parts of OPRAFLOW. Current modules are listed on our website and may be added to over time.
• Order Form: the signed order, or online subscription, that lists your Modules, number of Authorised Users and Fees.
• Platform: the OPRAFLOW software as a service platform, including all Modules made available to you.

2. Licence

2.1 We grant you a non exclusive, non transferable licence to use the Modules in your Order Form for your own internal business purposes.

2.2 Access to OPRAFLOW does not, by itself, include any Module not listed in your Order Form. You can add Modules at any time by agreeing an updated Order Form.

2.3 Access within each Module is role based. You decide who has administrator rights. Pricing is per Authorised User, regardless of role.

2.4 You must not, and must not let anyone else:

• sub license, resell or rent the Platform, or make it available outside your organisation, except to External Users under clause 3.4;
• reverse engineer, decompile or try to extract the Platform’s source code, except where the law does not allow this restriction;
• use the Platform to build a competing product.

3. Authorised Users

3.1 Your Order Form sets the maximum number of Authorised Users.

3.2 To add users, ask us and we will issue an updated Order Form. Logins must not be shared between people. Each login identifies one individual, which your own audit trail and electronic signature records depend on.

3.3 You are responsible for all activity under your Authorised Users’ logins and for keeping credentials secure.

3.4 External Users. You may invite people from outside your organisation, such as suppliers, contract manufacturers or consultants, to work with you in OPRAFLOW (“External Users”). This is allowed only for collaborative working on your own products, projects and quality processes.

3.5 You add External Users at your own risk. You are responsible for:

• making sure they follow these terms;
• everything they do in the Platform, as if done by your own staff;
• limiting their access to what the collaboration needs;
• removing their access when the collaboration ends.

3.6 External Users count as Authorised Users for licensing, unless your Order Form states otherwise.

3.7 External User access must not be resold, sub licensed or charged for, or used to give another organisation its own use of OPRAFLOW. An organisation that wants to use OPRAFLOW for its own work needs its own subscription.

4. Term and renewal

4.1 Your subscription starts on the date in your Order Form and runs for 12 months, unless your Order Form states otherwise.

4.2 It then renews automatically for further 12 month periods, unless either party gives at least one month’s written notice before the end of the current term.

4.3 If you want to end your subscription part way through a term, we will agree the terms of early exit with you case by case.

4.4 Either party may end the agreement immediately by written notice if the other party:

• commits a material breach that is not fixed within 30 days of a written request; or
• becomes insolvent, enters administration or liquidation, or has a similar process started against it.

5. Fees and payment

5.1 You will pay the Fees in your Order Form, on the payment schedule stated there or at checkout.

5.2 Invoices are due within 30 days of the invoice date unless stated otherwise. Fees exclude VAT and other applicable taxes, which are added at the prevailing rate.

5.3 If a payment is more than 14 days overdue, we may charge interest under the Late Payment of Commercial Debts (Interest) Act 1998 and may suspend access under clause 15.

5.4 Users added part way through a term are charged pro rata for the rest of that term, then at the full rate from renewal.

5.5 We may increase Fees once a year in line with UK inflation (for example the Consumer Prices Index), effective from April. We will give at least one month’s written notice.

6. Your data and your security responsibilities

6.1 You own and are responsible for all Client Data, including its accuracy, legality and suitability.

6.2 You must keep the devices and systems your Authorised Users use to access the Platform reasonably secure and up to date, for example with current security patches, endpoint protection and access controls.

6.3 If a security incident affecting the Platform is traced to a root cause on your own systems or devices, such as a malicious file uploaded from a compromised device, you are responsible for the resulting damage. This includes costs we reasonably and demonstrably incur to investigate, contain and recover, in proportion to your contribution to the cause.

6.4 Patient identifiable information is not needed for normal use of OPRAFLOW and should be kept out of the Platform unless we have agreed otherwise with you in writing.

7. Data protection and security

7.1 Each party will comply with applicable data protection law, including the UK GDPR and, where relevant, the EU GDPR. Where we process personal data on your behalf, we do so as your processor under our Data Processing Agreement, available on request.

7.2 We do not access the content of Client Data, except where reasonably needed to give support you request, to keep the Platform secure and available, or where the law requires it.

7.3 Where Client Data is hosted, and how it is backed up and recovered, is set out in clause 8.

7.4 If we become aware of a personal data breach affecting Client Data, we will tell you without undue delay and give you the information you reasonably need to meet your own notification duties.

7.5 A current list of sub processors is available on request.

8. Hosting, backup and availability

8.1 EU hosting only. All Client Data, including backups, is hosted in the EU only. Our primary servers are in Frankfurt, Germany. OPRA AI models also run on our servers in the EU, so AI processing never leaves the EU. Client Data only leaves the EU if you choose to send it elsewhere, for example through an MCP connection under Part C.

8.2 Encryption. Client Data is stored encrypted, in live systems and in backups.

8.3 Geo redundant backup. We keep backups of Client Data in a second, geographically separate EU data centre in Stockholm, Sweden. If our primary site fails, your data can be restored from there.

8.4 GDPR compliant. Backups are stored in the EU only, protected by the same access controls as live data, and handled in line with the UK GDPR and EU GDPR.

8.5 Recovery. We regularly test that backups can be restored. If an incident affects the Platform, we will restore Client Data from the most recent backup and keep you informed until service is back to normal. Specific backup and recovery commitments, such as backup frequency and recovery times, can be agreed as a service level agreement in your Order Form.

8.6 We target 99.9% uptime each calendar month, excluding planned maintenance, unless a different service level is agreed in your Order Form.

8.7 Planned maintenance is scheduled at weekends. If it is ever needed on a weekday or during working hours, we will notify you in advance, in line with the notice period in your Order Form.

9. Your quality system and regulatory responsibility

9.1 OPRAFLOW supports you in implementing quality and regulatory standards and automating related workflows. It does not, by itself, guarantee regulatory approval, certification, audit outcomes or ongoing compliance.

9.2 You remain responsible for your regulatory strategy, decisions and compliance with applicable law, including validating the Platform for your intended use within your own quality management system.

9.3 OPRAFLOW is a compliance management and automation tool. It is not a medical device and is not a substitute for your own quality processes, clinical judgement or regulatory obligations. We are not liable for any patient harm or patient safety issue.

9.4 Validation support. On request, we can provide Installation Qualification (IQ) and Operational Qualification (OQ) documentation to support your validation of the Platform. This is priced separately and quoted at the time of need, depending on the nature of your organisation and the scope of your go live. Performance Qualification in your own processes remains your responsibility under clause 9.2.

10. Intellectual property

10.1 We and our licensors own all intellectual property in the Platform, the Documentation and the OPRAFLOW brand. Nothing in these terms transfers those rights to you, other than the licence in clause 2.

10.2 You own all intellectual property in your Client Data and in any templates, configurations or content you create in the Platform from your own inputs.

10.3 If you give us feedback or suggestions, we may use them to improve the Platform without any obligation to you.

11. Confidentiality

11.1 Each party will keep the other’s Confidential Information confidential and use it only to perform these terms, unless disclosure is required by law or regulation.

11.2 This clause continues after the agreement ends.

12. Use of your contact details

12.1 We use your contact details, such as Authorised Users’ email addresses, only to provide the service, communicate about your account, and send product updates and newsletters about OPRAFLOW.

12.2 We never give your contact details to third parties for their own marketing.

12.3 Authorised Users can unsubscribe from newsletters at any time. Essential service messages will still be sent.

13. Acceptable use

13.1 You must not use the Platform to store or process:

• content that is unlawful, defamatory or infringes anyone’s rights;
• malware or other harmful code;
• special category or highly sensitive personal data beyond what the Platform is designed to hold, unless agreed with us first.

13.2 You must not try to disrupt the Platform or gain unauthorised access to it or to any other client’s data.

14. Warranties and liability

14.1 We will provide the Platform with reasonable skill and care and in line with these terms.

14.2 Except as stated in these terms, the Platform is provided “as is” and we exclude all other warranties to the fullest extent the law allows.

14.3 Nothing in these terms limits either party’s liability for death or personal injury caused by negligence, for fraud, or for any other liability that cannot be limited by law.

14.4 Subject to clause 14.3, our total liability in any 12 month period is limited to the Fees you paid in the previous 12 months.

14.5 Subject to clause 14.3, neither party is liable for indirect or consequential loss, or for loss of profits, revenue or anticipated savings.

14.6 Clause 14.4 does not limit your responsibility under clause 6.3.

15. Suspension

15.1 We may suspend access to all or part of the Platform if:

• Fees remain unpaid more than 14 days after the due date;
• you breach clause 13 or the acceptable use rules in Part B or Part C; or
• suspension is reasonably needed to protect the security or integrity of the Platform or other clients’ data.

15.2 We will give reasonable notice where practical and restore access promptly once the issue is resolved.

16. When the agreement ends

16.1 Your licence ends immediately on termination or expiry.

16.2 For 30 days after the end, you can request an export of your Client Data in a standard format. After that we may delete it, unless the law requires us to keep it. Deleted data is removed from backups as they expire in our normal backup cycle.

16.3 Ending the agreement does not affect Fees already due or clauses meant to continue, including clauses 10, 11, 14 and 17.6.

17. General

17.1 Force majeure. Neither party is liable for delay or failure caused by events outside its reasonable control.

17.2 Assignment. You may not transfer the agreement without our consent. We may transfer it as part of a merger, acquisition or sale of our business, with notice to you.

17.3 Notices. Formal notices must be in writing and sent to the addresses in your Order Form, or to contactus@opraflow.com for notices to us.

17.4 Entire agreement. These terms and your Order Form are the entire agreement on this subject and replace earlier discussions.

17.5 Changes to these terms. We may update these terms from time to time and will post the new version on our website with its effective date. Material changes will be notified to you at least 30 days in advance and apply from your next renewal, unless the law or a security need requires otherwise.

17.6 Governing law. These terms are governed by the law of England and Wales. The courts of England and Wales have exclusive jurisdiction.

17.7 Severability. If any part is found unenforceable, the rest remains in effect.

17.8 Waiver. Not enforcing a right does not waive it.

18. What OPRA AI does

18.1 OPRA AI helps your Authorised Users navigate the Platform and their own quality processes. It can draft content, summarise records and pull relevant information from across your OPRAFLOW workspace, for example while writing a report, a risk record or a requirement.

18.2 OPRA AI is an add on module. It is available only if listed in your Order Form, and is charged as set out there. Your administrator controls which Authorised Users can use it.

19. How we protect your data in OPRA AI

19.1 Your data stays in our environment. OPRA AI models run on our own servers in the EU, in the same environment as the rest of the Platform (clause 8.1). Prompts, Client Data and outputs are not sent to any AI service outside that environment.

19.2 No training on your data. Your Client Data, prompts and outputs are never used to train or improve AI models, ours or anyone else’s.

19.3 Same permissions as the user. OPRA AI can only see what the individual Authorised User using it is allowed to see. It does not widen anyone’s access.

19.4 Suggestions, never silent changes. OPRA AI never changes a record on its own. Every suggestion must be reviewed and accepted by an Authorised User, and suggestions are recorded so your audit trail stays complete.

19.5 OPRA AI inputs and outputs are Client Data. Part A, including clauses 7 (data protection) and 11 (confidentiality), applies to them in full.

20. Your responsibilities when using OPRA AI

20.1 AI can be wrong. Outputs may be inaccurate, incomplete or unsuitable for your purpose, even when they read convincingly.

20.2 A qualified person in your organisation must review every OPRA AI output before relying on it, accepting it into a controlled record, or using it in a regulatory submission or decision.

20.3 OPRA AI does not give legal, regulatory, clinical or medical advice. Clause 9 applies to OPRA AI outputs in the same way as to the rest of the Platform.

20.4 You are responsible for deciding whether, and how, OPRA AI is used within your quality management system, including any validation your procedures require.

21. Acceptable use of OPRA AI

In addition to clause 13, you must not:

• enter patient identifiable information into OPRA AI unless agreed with us in writing;
• try to bypass OPRA AI’s safeguards or permission controls, including through prompt injection;
• try to extract or reproduce the underlying model, its instructions or its configuration;
• use OPRA AI to create content that is unlawful, misleading or harmful.

22. Ownership of outputs

22.1 As between you and us, you own the outputs OPRA AI generates from your inputs, in line with clause 10.2.

22.2 Because of how AI works, similar outputs may be generated for other users from similar inputs. Those outputs belong to them.

23. Changes to OPRA AI

23.1 We may update or replace the AI model behind OPRA AI to improve quality, security or performance. Any change will keep the commitments in clause 19.

23.2 We will tell you in advance of any change that materially affects how OPRA AI handles your data.

24. Liability for OPRA AI

OPRA AI is part of the Platform. Clause 14 applies to it, and our liability for OPRA AI falls within the limit in clause 14.4.

25. What MCP connections are

25.1 An MCP connection lets a third party AI tool chosen by you (a Third Party AI Tool) read from, and where you allow it, act within, your OPRAFLOW workspace. Examples include raising a CAPA, drafting a linked change request or preparing a document revision for review.

25.2 MCP connections are optional and off by default. Your administrator decides whether to enable them and for which Authorised Users.

26. Your agreement with your AI supplier

26.1 Your use of any Third Party AI Tool is governed by your own agreement with its supplier, not by these terms. We are not a party to that agreement.

26.2 When you connect a Third Party AI Tool, Client Data that the tool requests through the connection leaves OPRAFLOW and is processed by your supplier. You decide to make that transfer, and you are responsible for it.

26.3 Before connecting a tool, you are responsible for checking your supplier’s terms, including:

• where your data is processed and stored;
• whether your data is used to train their models;
• how long they keep your data;
• whether their terms meet your data protection, confidentiality and quality system requirements.

26.4 Our commitments in Part B (OPRA AI) do not apply to Third Party AI Tools. Our commitments in clauses 7 and 8 apply to Client Data while it is in OPRAFLOW, not after it has passed to your supplier.

27. How OPRAFLOW keeps control

27.1 Each MCP connection works under the permissions of the Authorised User who set it up. It cannot see or do anything that user could not see or do in OPRAFLOW.

27.2 Every action taken through an MCP connection is recorded in your OPRAFLOW audit trail and attributed to that Authorised User.

27.3 OPRAFLOW’s workflow rules continue to apply. A Third Party AI Tool cannot bypass required reviews, approvals or electronic signatures. These must be completed by an Authorised User in OPRAFLOW.

27.4 You can revoke an MCP connection at any time. We may suspend or revoke a connection if it threatens the security or integrity of the Platform, or breaches these terms.

28. Your responsibilities for MCP connections

28.1 You are responsible for every action taken through an MCP connection, in the same way as for actions taken directly by the Authorised User it belongs to (clause 3.3).

28.2 You must keep connection credentials secure and revoke connections that are no longer needed or may be compromised.

28.3 Outputs from a Third Party AI Tool must be reviewed by a qualified person before they are relied on, in the same way as clause 20.2.

28.4 You must not use an MCP connection to extract data at a volume or frequency that degrades the Platform for others, or to get around any limit or control in these terms.

29. Our liability for MCP connections

29.1 We provide the MCP server as part of the Platform, and clause 14 applies to it.

29.2 We are not responsible for any Third Party AI Tool, its outputs, its availability, or how your supplier handles your data. Any claim about those matters lies with your supplier under your agreement with them.

29.3 We may change or withdraw MCP features as the protocol and supported tools evolve. We will give you reasonable notice of any change that materially reduces what you can do.

Contact us

Questions about these terms, our Data Processing Agreement or our sub processor list: contactus@opraflow.com.

AYB Solutions Ltd, trading as OPRAFLOW. 30 Cherwell Way, Ruislip, England, HA4 7BE. Company number 14906901. www.opraflow.com