Terms of Service — Spread Public Portal

Effective date: June 1, 2026

These Terms of Service ("Terms") govern your use of the Spread public portal, accessible at https://spread.apphero.tech, the https://spread.vercel.app preview domain, and any other domain operated by apphero on behalf of a public-health authority (collectively, the "Portal"), operated by apphero Tech LLC, a Nevada limited liability company based in Las Vegas, Nevada, USA ("apphero", "we", "us", "our").

These Terms apply to citizens, health professionals, and any member of the public using the Portal to:

• declare a health concern, symptom set, or potential exposure;
• track the status of a previous declaration;
• subscribe to or unsubscribe from disease-alert notifications;
• consult vaccination centers, public bulletins, exposure-site maps, or other public-health information.

The Spread managed package installed in a public-health authority's, hospital's, or school district's Salesforce org is governed by the separate End User License Agreement (EULA) and Data Processing Agreement (DPA) between apphero and that authority (the "Subscriber"). Personal data is handled per our Privacy Policy and, where applicable, our Business Associate Agreement (BAA).

By creating an account, submitting a declaration, or otherwise using the Portal, you accept these Terms. If you are seeking emergency medical care, do not use the Portal — call your local emergency number immediately (911 in the US, 112 in Belgium and most of the EU).

1. Eligibility

You must be at least 16 years old to use the Portal in your own name. A parent or legal guardian may use the Portal on behalf of a minor.

Health professionals using the professional flow must be lawfully entitled to practice in the jurisdiction of declaration (e.g., licensed physician, nurse, lab technician, school nurse).

2. Account and authentication

The Portal supports three modes of access:

• Anonymous citizen declaration — no account required. We collect only the information you provide in the declaration form and return a capability token (HC-XXXX) for you to track the status later.
• Authenticated citizen access — via Itsme (Belgium) or Supabase email magic-link (US), to consult previous declarations or manage alert subscriptions.
• Authenticated health-professional access — via Itsme (Belgium) or Supabase + admin approval (US), to declare cases on behalf of patients.

You are responsible for maintaining the confidentiality of your credentials, capability tokens, and access codes, and for all activities under your account or token. Notify us immediately at support@apphero.tech if you suspect unauthorized access. We may suspend or terminate accounts and tokens that violate these Terms or applicable law.

3. Permitted use

You may use the Portal solely for lawful purposes consistent with notifiable-disease surveillance and public-health communication. This includes:

• declaring your own (or your dependant's, with appropriate authority) suspected symptoms or exposure;
• on the professional flow: declaring a patient case in accordance with your professional duty of confidentiality and applicable notifiable-disease law;
• consulting public bulletins, exposure maps, and vaccination centers;
• subscribing to (and unsubscribing from) alert notifications.

4. Prohibited conduct

You shall not:

(a) submit knowingly false, misleading, or fraudulent health declarations — this may constitute a criminal offense under public-health law in many jurisdictions; (b) impersonate another person or submit a declaration on behalf of someone else without lawful authority; (c) use the Portal in violation of applicable law (including HIPAA, GDPR, Quebec's Law 25, Belgium's data protection law, and notifiable-disease regulation); (d) infringe the intellectual property, privacy, or other rights of any person, including by submitting another person's identifiable health information without lawful basis; (e) upload malicious code, attempt to gain unauthorized access, or interfere with the Portal; (f) scrape, mine, harvest, or extract data from the Portal except through the documented public APIs and within the documented rate limits; (g) use the Portal to harass, defame, stigmatize, or harm any person, group, or community on the basis of disease status, suspected exposure, ethnicity, immigration status, or any other attribute; (h) circumvent any access controls, rate limits, capability-token verification, or technical protections; (i) submit personal data of third parties (including minors) unless you have lawful authority to do so and have informed those persons of this Portal; (j) use the Portal to disseminate misinformation or disinformation about diseases, public-health measures, or vaccines.

5. No medical advice

The Portal is a declaration, tracking, and information channel operated on behalf of public-health authorities. The Portal does not provide medical advice, diagnosis, or treatment. Information displayed on the Portal (including bulletins, vaccination-center listings, and AI-generated content from the Jean-Claude chatbot) is for general informational purposes and is not a substitute for professional medical judgment. Always consult a qualified healthcare professional for medical decisions.

In a medical emergency, contact your local emergency number immediately.

6. AI chatbot (Jean-Claude)

The Portal embeds the Jean-Claude AI assistant in the bottom-right corner. Jean-Claude is intended to help you navigate the Portal, understand the declaration process, and obtain general public-health information. You acknowledge that:

(a) Jean-Claude's responses are generated by a large language model and may be inaccurate, incomplete, or unsuitable for a particular purpose; (b) Jean-Claude is not a clinician and does not provide medical advice, diagnosis, or treatment; (c) Jean-Claude is not an emergency-response service; (d) Do not submit identifying personal information of third parties (other patients, identifiable family members) to Jean-Claude unless you have lawful authority; (e) Conversation transcripts may be temporarily retained for safety, abuse-prevention, and service-improvement purposes, in accordance with our Privacy Policy.

7. Content you submit

You retain ownership of the personal information and content you submit. You grant apphero and the relevant Subscriber a non-exclusive, royalty-free, worldwide license to host, store, transmit, process, and display your content strictly as necessary to provide the Service — including transmitting declarations to the competent public-health authority, generating capability tokens, sending transactional emails, and performing cluster detection on anonymized aggregates.

You represent that:

(a) the information you submit is accurate to the best of your knowledge; (b) you have lawful authority to submit any third-party data included in your declaration; (c) your submission does not infringe any third-party right.

8. Subscriber-specific operation

When you use the Portal, your declaration is routed to the public-health authority responsible for the jurisdiction you selected (e.g., COCOM for Brussels-Capital, the relevant state Department of Public Health in the US, Sciensano for federal-level Belgian disease notification). That authority is the data controller for your declaration; apphero acts as data processor (and, under HIPAA, Business Associate) on the authority's behalf. The authority's notice of privacy practices applies in addition to ours.

9. Service availability

We strive for high availability but do not guarantee uninterrupted access. The Portal may be unavailable due to maintenance, updates, outage events, or actions beyond our control. We may modify, suspend, or discontinue features at any time. During a declared public-health emergency, priority may be given to authority-critical traffic.

10. Third-party services

The Portal may integrate with or link to third-party services, including:

• Itsme (Belgian Mobile ID NV) for Belgian identity verification;
• Supabase, Inc. for US email + magic-link authentication;
• Salesforce, Inc. as the platform of record;
• Vercel Inc. for portal hosting;
• Anthropic, PBC for the underlying Jean-Claude language model;
• the competent public-health authorities and Subscribers that operate Spread instances.

Your use of those third-party services is governed by their respective terms. We are not responsible for the practices, content, or terms of these third parties beyond the safeguards documented in our DPA.

11. Disclaimers

THE PORTAL IS PROVIDED "AS IS" AND "AS AVAILABLE", WITHOUT WARRANTIES OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT. WE DO NOT WARRANT THAT THE PORTAL WILL MEET YOUR REQUIREMENTS, BE ERROR-FREE, OR BE FREE OF HARMFUL COMPONENTS. THE PORTAL IS NOT A MEDICAL DEVICE.

12. Limitation of liability

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, APPHERO SHALL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, OR FOR LOSS OF PROFITS, REVENUE, OR DATA. OUR TOTAL AGGREGATE LIABILITY ARISING OUT OF OR RELATED TO THESE TERMS SHALL NOT EXCEED ONE HUNDRED U.S. DOLLARS ($100) OR THE AMOUNT YOU PAID TO US IN THE PRECEDING TWELVE (12) MONTHS, WHICHEVER IS GREATER.

Some jurisdictions do not allow the exclusion or limitation of certain warranties or liabilities; in such cases, the above limitations apply to the maximum extent permitted by law. Nothing in these Terms limits your statutory rights as a consumer under your home jurisdiction's mandatory law.

13. Indemnification

You agree to indemnify and hold apphero harmless from any claims, damages, liabilities, costs, and expenses (including reasonable attorneys' fees) arising out of or related to your use of the Portal, your submissions, or your violation of these Terms or applicable law.

14. Termination

You may terminate your relationship with the Portal at any time by ceasing use and, if you have an authenticated account, requesting account closure at privacy@apphero.tech. Capability tokens (HC-XXXX, UN-XXXX) remain bound to the underlying declaration and continue to be valid for the duration of the Subscriber's retention obligation.

We may terminate or suspend your access in the event of material breach of these Terms, suspected fraud, or as required by law. Sections 4, 5, 6, 7, 11, 12, 13, 14, and 15 survive termination.

15. Governing law and jurisdiction

These Terms are governed by the laws of the State of Nevada, USA, without regard to its conflict of laws principles. Any dispute arising out of or related to these Terms shall be resolved exclusively by the state and federal courts located in Clark County, Nevada, and you consent to the personal jurisdiction of such courts.

For consumers in jurisdictions where mandatory consumer-protection laws apply (notably the European Union, the United Kingdom, Switzerland, Quebec, and Belgium), nothing in these Terms limits the rights granted to you under those laws, and you may bring claims before the courts of your home jurisdiction where mandatory law so requires.

16. Changes

We may update these Terms. Material changes will be communicated via in-Portal notice or, for authenticated users, by email, and take effect on the date posted. Continued use after the effective date constitutes acceptance.

17. Contact

apphero Tech LLC Las Vegas, Nevada, USA General support: support@apphero.tech Privacy inquiries: privacy@apphero.tech Abuse / unauthorized access: security@apphero.tech

A French version of these Terms is available at https://apphero.tech/spread/fr/legal/terms. In case of conflict between the two versions, the English version prevails.