sycana AI Logosycana AI

Terms of Service

Last Updated: July 3, 2026

Effective Date: July 3, 2026

Please read these Terms of Service (“Terms”) carefully before using any sycana AI product or service. These Terms apply to three categories of users:

Receiving Clinics

Healthcare organisations that subscribe to the Platform to process inbound referrals.

Referring Clinics

Physician practices that access the Referring Portal (at no charge) via invitation from a Receiving Clinic.

Patients

Individuals who access the Patient Portal via an invitation sent by a Receiving Clinic.

By accessing or using the Platform, you confirm that you have read, understood, and agree to be bound by these Terms and our Privacy Policy. If you are accepting on behalf of an organisation, you represent that you have the authority to bind that organisation to these Terms.

1. Definitions

  • “Platform” means the sycana AI SaaS application, including all portals (Receiving Clinic, Referring Clinic, Patient), APIs, and background services.
  • “DeID Tool” means the Sycana DeID desktop application, which is licensed separately under Section 14.
  • “PHI” has the meaning given in HIPAA (45 CFR §160.103).
  • “BAA” means the Business Associate Agreement executed between sycana AI and your organisation, which governs all PHI handling.
  • “Customer Data” means all data submitted to or generated within the Platform by or on behalf of a Receiving Clinic, including PHI.
  • “AI Features” means any functionality powered by large language models or machine learning, including clinical extraction, urgency scoring, summarisation, and document classification.

2. HIPAA Compliance & Business Associate Agreement

Processing PHI through the Platform requires a valid Enterprise Subscription and an executed BAA between sycana AI and the Receiving Clinic (as Covered Entity or Business Associate). The BAA is incorporated into and made part of these Terms. In the event of a conflict between these Terms and the BAA regarding PHI handling, the BAA governs.

Referring Clinics accessing the Platform via invitation operate as downstream Business Associates. The Receiving Clinic is responsible for ensuring that Referring Clinic access is consistent with its own HIPAA obligations. sycana AI will execute a BAA directly with Referring Clinics upon request.

3. License to Use

3.1 Grant

Subject to your compliance with these Terms and payment of applicable fees, sycana AI grants you a limited, non-exclusive, non-transferable, non-sublicensable licence to access and use the Platform solely for:

  • Receiving Clinics: management of inbound medical referrals, scheduling, patient coordination, and clinical triage.
  • Referring Clinics: submission and tracking of outbound referrals to participating Receiving Clinics.
  • Patients: accessing referral status, appointment information, and secure messages through the Patient Portal.

3.2 Restrictions

You agree not to:

  • Reverse engineer, decompile, disassemble, or attempt to derive the source code of the Platform.
  • Use the Platform to build, assist in building, or benchmark a competitive product or service.
  • Share login credentials or allow unauthorised users to access your account.
  • Upload data that you do not have the legal authority to process (including PHI without appropriate HIPAA authority).
  • Attempt to circumvent any access control, rate limit, or security measure.
  • Use automated scripts, bots, or scrapers on the Platform.
  • Remove or obscure any proprietary notices within the Platform.

4. User Responsibilities

4.1 Receiving Clinics

  • Maintain an executed BAA with sycana AI before any PHI is uploaded or processed.
  • Ensure that all staff accounts are provisioned with the minimum necessary access (principle of least privilege).
  • Promptly deactivate accounts of departing employees.
  • Designate a primary contact responsible for security and compliance queries.
  • Notify sycana AI within 48 hours of any suspected security incident or unauthorised access.
  • Obtain all necessary patient consents for SMS outreach before enabling SMS notifications.

4.2 Referring Clinics

  • Access the Platform only via official invitations from Receiving Clinics.
  • Use the Platform only to track and communicate about referrals you have legitimately sent.
  • Not attempt to access data belonging to patients not associated with your referrals.
  • Promptly notify your Receiving Clinic contact if you suspect any data error or unauthorised access.

4.3 Patients

  • Access the Patient Portal only via the secure link provided by your clinic via SMS or email.
  • Not share your portal access link with any third party (except designated caregivers via the Caregiver Access feature).
  • Notify your clinic promptly if you believe an unauthorised party has accessed your portal.
  • Understand that the Patient Portal is for informational access only and does not constitute a direct medical communication channel with your physician.

5. AI-Assisted Features

The Platform uses large language model (LLM) technology — specifically Google Gemini 2.0 Flash — to extract structured clinical data from referral documents, score urgency, suggest provider matches, and generate summaries.

Important: AI-generated outputs (urgency scores, clinical summaries, extracted data, scheduling suggestions) are decision-support tools only. They are not diagnostic, not a substitute for clinical judgement, and not FDA-cleared medical devices. All clinical decisions remain the sole responsibility of qualified healthcare professionals at your organisation. sycana AI assumes no liability for clinical decisions made based on AI outputs.

PHI is transmitted to Google's Gemini API under a signed Business Associate Agreement. PHI is never used to train Google's or sycana AI's shared models.

6. EHR Integrations

The Platform supports integration with Epic (via SMART on FHIR R4) and additional EHR systems via vendor-specific OAuth adapters (AdvancedMD, eClinicalWorks, Greenway, NextGen, Kareo, ModMed, Veradigm).

  • EHR integration is configured by your organisation and requires provision of valid OAuth credentials or FHIR endpoint details.
  • sycana AI writes structured referral and appointment data to your EHR solely as directed by your configuration.
  • You are responsible for ensuring that your EHR vendor's terms of service permit this type of integration.
  • sycana AI is not responsible for data integrity issues arising from your EHR vendor's API behaviour.

7. SMS Communications & TCPA Compliance

The Platform sends SMS messages to patients on behalf of Receiving Clinics for referral status updates, appointment scheduling, and reminders.

  • Receiving Clinics are responsible for obtaining all legally required patient consents (including under the Telephone Consumer Protection Act, TCPA) before enabling SMS outreach.
  • sycana AI provides the technical SMS infrastructure (via Telnyx) but acts as a Service Provider for TCPA purposes. The Receiving Clinic is the “caller” or “sender” as defined under TCPA.
  • Patients may opt out at any time by replying STOP. sycana AI will immediately suppress further messages to that number.
  • Message frequency varies based on referral and appointment activity. Standard message and data rates may apply.

8. Fees & Payment

8.1 Receiving Clinics

Receiving Clinic subscriptions are billed on a recurring basis (monthly or annually) as specified in your Order Form. Fees are processed via Stripe and are non-refundable except as required by law or as specified in the Order Form.

  • Failed payments will result in a 7-day grace period before service suspension.
  • Price changes will be communicated at least 30 days before taking effect.
  • Disputed charges must be raised within 30 days of the invoice date.

8.2 Referring Clinics & Patients

Access to the Referring Clinic Portal and the Patient Portal is provided at no charge. These users do not have a direct billing relationship with sycana AI.

9. Service Availability

sycana AI targets 99.5% monthly uptime for the Platform, excluding scheduled maintenance windows (communicated at least 24 hours in advance) and events beyond our reasonable control (see Section 16).

Uptime metrics are measured at the API and web application layer. Service credits for downtime below the target, if applicable, are specified in the Order Form or Enterprise Agreement.

10. Customer Data & Ownership

10.1 Your Data

You retain all ownership rights to Customer Data. sycana AI does not claim any intellectual property rights over PHI or other Customer Data.

10.2 Data Export

Receiving Clinics may request a full export of their Customer Data at any time. sycana AI will provide the export within 10 business days in a standard machine-readable format (JSON or CSV). Upon termination, data export and deletion are governed by Section 6.3 of the Privacy Policy and the BAA.

10.3 Aggregate Data

sycana AI may use de-identified, aggregated data (from which no individual or organisation can be identified) to generate platform-level statistics for product improvement, research, and marketing purposes. No PHI is included in any aggregate dataset.

11. Intellectual Property

The Platform and its underlying technology, content, design, trademarks, and trade secrets (excluding Customer Data) are and will remain the exclusive property of sycana AI and its licensors. These Terms do not grant you any right to use our name, logo, or trademarks without prior written consent.

Feedback or suggestions you provide about the Platform (“Feedback”) may be used by sycana AI freely without compensation or attribution. You grant us a perpetual, royalty-free licence to use Feedback for any purpose.

12. Pilot & Beta Features

sycana AI may make certain features available in “pilot” or “beta” status. Such features are provided AS IS without warranty, may be changed or discontinued at any time, and are excluded from any SLA commitments. Use of pilot features for processing PHI requires explicit written approval from sycana AI.

13. Disclaimer of Warranties

Read carefully

EXCEPT AS EXPRESSLY SET FORTH IN THE BAA OR AN ENTERPRISE AGREEMENT, THE PLATFORM IS PROVIDED “AS IS” AND “AS AVAILABLE.” SYCANA AI DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, AND NON-INFRINGEMENT. SYCANA AI DOES NOT WARRANT THAT THE PLATFORM WILL BE ERROR-FREE, THAT DEFECTS WILL BE CORRECTED, OR THAT THE AI OUTPUTS WILL BE ACCURATE, COMPLETE, OR CLINICALLY APPROPRIATE.

14. Sycana DeID Desktop Application

The Sycana DeID application is a standalone desktop tool provided under a separate end-user licence agreement (EULA) presented at installation. Key terms:

  • DeID runs entirely locally on your device. No document content is transmitted to sycana AI.
  • DeID is provided for de-identification purposes only. You remain responsible for verifying the output before using de-identified data for research or secondary purposes.
  • The DeID licence is per-user and non-transferable.
  • sycana AI provides no warranty that DeID output meets the HIPAA Safe Harbour or Expert Determination standards for de-identification. Independent validation is your responsibility.

15. Limitation of Liability

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, SYCANA AI'S TOTAL LIABILITY FOR ANY CLAIM ARISING OUT OF OR RELATED TO THESE TERMS OR THE PLATFORM IS LIMITED TO THE FEES PAID BY YOU IN THE TWELVE (12) MONTHS PRECEDING THE CLAIM.

IN NO EVENT SHALL SYCANA AI BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES — INCLUDING LOST PROFITS, LOSS OF DATA (EXCEPT TO THE EXTENT REQUIRED BY THE BAA), LOSS OF GOODWILL, OR BUSINESS INTERRUPTION — EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

Some jurisdictions do not allow limitation of certain warranties or liability. The above limitations may not apply to you to the extent prohibited by law.

16. Force Majeure

Neither party shall be liable for any failure or delay in performance under these Terms to the extent caused by circumstances beyond that party's reasonable control, including acts of God, natural disasters, pandemic, war, governmental action, internet outages, or failure of third-party infrastructure providers. The affected party shall promptly notify the other and use reasonable efforts to resume performance.

17. Termination

17.1 By You

Receiving Clinics may terminate their subscription by providing 30 days' written notice before the next billing cycle. Termination does not entitle you to a refund of prepaid fees.

17.2 By sycana AI

sycana AI may suspend or terminate access immediately if you: (a) breach these Terms or the BAA and fail to cure within 10 days of notice; (b) fail to pay fees after the grace period; (c) use the Platform in a manner that creates legal or security risk.

17.3 Effect of Termination

Upon termination, your right to access the Platform ceases immediately. Customer Data handling follows the BAA and Section 10.2 above. Sections 5, 10, 11, 13, 15, 18, and 19 survive termination.

18. Governing Law & Dispute Resolution

These Terms are governed by the laws of the State of Arkansas, United States, without regard to conflict-of-law principles.

Before initiating formal proceedings, each party agrees to attempt to resolve disputes informally by providing written notice and engaging in good-faith negotiation for 30 days. If unresolved, disputes shall be settled by binding arbitration administered by the American Arbitration Association (AAA) under its Commercial Arbitration Rules, with proceedings in Little Rock, Arkansas. Class action waiver: you waive the right to participate in a class action lawsuit or class-wide arbitration against sycana AI.

Either party may seek injunctive or equitable relief in a court of competent jurisdiction to prevent irreparable harm without first going through arbitration.

19. Changes to These Terms

sycana AI may update these Terms from time to time. Material changes will be communicated to Receiving Clinic admins via email at least 30 days before taking effect. Continued use of the Platform after the effective date constitutes acceptance of the revised Terms. For Referring Clinics and Patients, continued use after the effective date constitutes acceptance. We recommend checking this page periodically.

20. Contact Us

For legal queries or notices under these Terms:

Email: legal@sycana.com

Address: Legal Dept, Sycana Health AI LLC, Little Rock, Arkansas, United States

Response time: We aim to respond to legal inquiries within 5 business days.