Terms and Conditions of Service

Effective Date: 23 October 2026
Last Updated: 23 October 2026
Operating Entity: Patient Led Health Limited

PLEASE READ THESE TERMS AND CONDITIONS CAREFULLY BEFORE ACCESSING OR USING THE PLATFORM. BY CREATING AN ACCOUNT, PURCHASING A SUBSCRIPTION, SUBMITTING MEDICAL INFORMATION, OR ACCESSING ANY PRODUCT, YOU AGREE TO BE BOUND BY THESE TERMS AND CONDITIONS. IF YOU DO NOT AGREE, DO NOT USE THE PLATFORM.

1. Operating Entity and Contractual Scope

These Terms and Conditions of Service ("Terms") constitute a legally binding agreement between you ("User", "you", or "your") and Patient Led Health Limited ("Company", "we", "us", or "our"), a company incorporated in Hong Kong with Companies Registry Number 3219069, Business Registration Certificate Number 74712342-000-12-24-5, and registered office at Suite 1106-8, 11/F, Tai Yau Building, No. 181 Johnston Road, Wanchai, Hong Kong.

These Terms govern your access to and use of: 1. The website located at soraya.health and all associated subdomains (the "Website"). 2. The digital web-based book reader and curriculum known as "Hacking Cancer" (the "Book Reader"). 3. The automated conversational artificial intelligence research assistant known as "Soraya AI" (the "Chatbot"). 4. The multi-agent personalized oncology synthesis service and resulting digital document (the "Personalized Research Report"). 5. Any related software, data feeds, APIs, content, and customer support channels (collectively, the "Platform").

2. Definitions

• "Account" means a registered personal profile created by a User on the Platform using email authentication or third-party identity providers managed via Firebase Authentication.
• "Book Curriculum" means the proprietary written educational work "Hacking Cancer", including all modules, lessons, scientific literature reviews, curated research tables, and accompanying guides delivered through the Book Reader.
• "Chatbot" means the conversational retrieval-augmented generation (RAG) assistant deployed on the Platform.
• "Medical Information" means health status, histological diagnosis, cancer staging, biomarker data, genomic profiling, blood laboratory values, treatment histories, doctor notes, and medical records submitted by a User.
• "Personalized Research Report" means the bespoke, multi-section synthesis document generated by our automated analytical pipeline based upon User-submitted Medical Information.
• "Practitioner User" means a verified physician, oncologist, integrative medicine practitioner, nurse, or health coach accessing the Platform under a professional profile.
• "Special Category Data" has the meaning assigned under Article 9 of Regulation (EU) 2016/679 (GDPR), including data concerning health and genetic data.

3. Eligibility and Account Administration

1. Age Requirement: You must be at least 18 years of age (or the legal age of majority in your jurisdiction) to create an Account or use the Platform. Access by minors is prohibited.
2. Account Security: You are responsible for safeguarding your login credentials. You must immediately notify us at [email protected] of any unauthorized access or breach of security. You are solely responsible for all activities conducted under your Account.
3. Accuracy of Information: When submitting Medical Information for report generation or interactive chat, you agree to provide truthful, accurate, and current information. Submitting fraudulent, manipulated, or third-party records without legal authority is a material breach of these Terms.
4. Single-User Seat Restriction: Each Account and subscription is licensed strictly for one named individual. You may not share your login credentials, transfer account seats, or permit simultaneous access by third parties. Company reserves the right to implement technical concurrency controls, session limits, and verification requirements. Credential sharing or unauthorized multi-user access triggers immediate account suspension without refund.
5. Not a Primary Medical Archive (User Backup Responsibility): The Platform is an analytical educational research tool, not an electronic health record (EHR) system, clinical repository, or primary medical archive. You are solely responsible for maintaining and backing up your own original medical files, diagnostic scans, and clinical notes. To the maximum extent permitted by law, Company disclaims all liability for loss, deletion, or corruption of uploaded documents or generated reports.

4. Distinct Service Pillars and Usage Rules

4.1. The Digital Book Reader ("Hacking Cancer")

1. Access Tiers: Access to the Book Curriculum is tiered. Introductory and foundational modules are made available to registered free accounts. Advanced modules detailing scientific literature reviews, published metabolic research, and investigative research frameworks require an active paid subscription or one-time premium entitlement.
2. Personal License: Subject to continuous compliance with these Terms, Company grants you a personal, non-exclusive, non-transferable, non-sublicensable, revocable license to view the Book Curriculum through the Book Reader for your private educational use.
3. Anti-Scraping and Watermarking: The Book Reader includes technical deterrents against bulk extraction. Content displayed to logged-in users contains dynamic, user-specific visual and cryptographic watermarks displaying your email or user identifier. Tampering with, stripping, or obscuring watermarks is strictly prohibited.
4. Export Prohibitions: You may not download, scrape, mirror, systematically capture, screenshot for external distribution, or feed any part of the Book Curriculum into machine learning pipelines, large language models, or public repositories.

4.2. The Soraya AI Chatbot

1. Artificial Intelligence Disclosure: Pursuant to Article 50 of Regulation (EU) 2024/1689 (EU AI Act), you are explicitly notified that the Chatbot is an automated artificial intelligence system. You are interacting with software, not a human doctor or healthcare professional.
2. Educational Research Scope: The Chatbot retrieves literature, synthesizes scientific publications, and indexes the Book Curriculum. It does not provide medical consultations, diagnoses, or prescriptions.
3. Usage Quotas: Chatbot access is subject to rate limiting and fair-use quotas determined by your account tier. Free accounts receive limited introductory messages followed by monthly allowances. Premium accounts receive extended access subject to automated abuse filters.
4. Strict Safety Rules: You may not use prompt injection, adversarial prompting, jailbreaking techniques, or system-prompt extraction commands against the Chatbot. Any attempt to compromise backend instructions will result in immediate Account termination.
5. Conversation Review and Safety Inspection: Chatbot conversations may be reviewed for quality, safety, and compliance purposes. Wherever practicable, reviews use pseudonymised or anonymised records, access is restricted to authorised personnel, and access is logged. If a review identifies a material safety risk, for example a Chatbot response that could cause physical or psychological harm to a user, Company may re-identify the relevant conversation and contact that user directly to provide safety information or corrective guidance. Re-identification is limited to what is necessary for that purpose and is not used for any other purpose. Chatbot conversation records are deleted after fifteen (15) days.

4.3. The Personalized Research Report

1. Bespoke Generation: The Personalized Research Report is generated asynchronously upon your submission of the intake questionnaire and relevant medical files. The processing pipeline parses laboratory reports, applies evidence-tiered scientific literature searches, and compiles a multi-section educational overview.
2. No Practice of Medicine: The Personalized Research Report is an automated information retrieval and organizational document. It is not a clinical treatment plan, medical diagnosis, prognosis, or prescription.
3. Oncology Consultation Requirement: You agree that you will not implement, start, modify, or discontinue any cancer treatment, pharmaceutical drug, off-label medication, dietary regimen, or nutritional supplement based upon the Personalized Research Report without prior review and written supervision by your qualified oncologist or other qualified healthcare practitioner.
4. Third-Party Clinic Whitelist: Reports may reference reputable independent clinics, second-opinion centers, and testing laboratories. Company has no ownership or control over these third parties. Listings do not constitute an endorsement, referral, or guarantee of safety or outcomes.

4.4. Practitioner and Linked Accounts

1. Patient-Controlled Linking: Patients may link their Account to a designated Practitioner User. Linking grants the practitioner read-only access to view patient profiles, uploaded files, and generated reports.
2. Unlinking Rights: A patient may sever a link to any practitioner at any time via the Account settings, instantly revoking practitioner access to future records.
3. Independent Clinical Judgment: Practitioner Users acknowledge that Platform content, reports, and chatbot outputs represent supplementary scientific research summaries only. Full legal and professional responsibility for patient care, diagnosis, and prescription remains exclusively with the practitioner.

4.5. Beta Services and Experimental Features

From time to time, Company may offer early access features, experimental research algorithms, or pilot analytical modules designated as "Beta" or "Experimental". These features are provided "as is" and "as available" for testing and evaluation purposes, without warranties or service level commitments. Company may modify, throttle, or discontinue Beta features at any time without notice or liability.

5. Absolute Medical Disclaimer and Non-Reliance

1. NO MEDICAL ADVICE: THE PLATFORM, INCLUDING ALL WRITTEN CONTENT, CHATBOT OUTPUTS, SCIENTIFIC SYNTHESES, AND RESEARCH REPORTS, IS PROVIDED SOLELY FOR INFORMATIONAL, EDUCATIONAL, AND SCIENTIFIC RESEARCH PURPOSES. IT DOES NOT CONSTITUTE MEDICAL ADVICE, CLINICAL DIAGNOSIS, PROGNOSIS, OR MEDICAL TREATMENT.
2. NO DOCTOR-PATIENT RELATIONSHIP: USE OF THE PLATFORM DOES NOT CREATE A DOCTOR-PATIENT, CONFIDENTIAL HEALTHCARE, OR FIDUCIARY RELATIONSHIP BETWEEN YOU AND PATIENT LED HEALTH LIMITED OR ANY OF ITS DIRECTORS, RESEARCHERS, EMPLOYEES, OR AGENTS.
3. NO EMERGENCY USE: THE PLATFORM IS NOT AN EMERGENCY RESPONSE SYSTEM. IF YOU ARE EXPERIENCING A MEDICAL EMERGENCY, SEVERE SYMPTOMS, AN ADVERSE DRUG REACTION, OR ACUTE PAIN, CALL YOUR LOCAL EMERGENCY SERVICES IMMEDIATELY (112 IN EUROPE, 999 IN THE UNITED KINGDOM, 911 IN THE UNITED STATES) OR GO TO THE NEAREST HOSPITAL EMERGENCY DEPARTMENT.
4. EXPERIMENTAL AND OFF-LABEL DATA: THE PLATFORM MAY DISCUSS PRECLINICAL (ANIMAL OR CELL-LINE) STUDIES, EARLY-STAGE CLINICAL TRIALS, OR OFF-LABEL USES OF PHARMACEUTICAL DRUGS. OFF-LABEL USAGE CARRIES DOCUMENTED RISKS OF TOXICITY, CONTRAINDICATION, AND THERAPEUTIC FAILURE. YOU EXPRESSLY ACKNOWLEDGE AND ACCEPT THESE INHERENT SCIENTIFIC UNCERTAINTIES.

6. Financial Terms, Pricing, and Payments

1. Payment Processing: All payments on the Platform are processed through Stripe Inc., a third-party PCI-DSS compliant payment gateway. Company does not store, process, or view full credit or debit card numbers.
2. Pricing Structure: Current fees for Book subscriptions, premium Chatbot allowances, and Personalized Research Reports are stated on the checkout pages. Company reserves the right to modify prices upon 30 days prior notice to existing active subscribers.
3. Subscriptions and Auto-Renewal: Recurring subscriptions renew automatically at the end of each billing cycle (monthly or annually) unless canceled prior to the renewal date via your Account billing portal.
4. Taxes and Currency: All fees are exclusive of applicable value-added taxes (VAT), goods and services taxes (GST), sales taxes, or other statutory levies, which will be calculated and added at checkout where required by your jurisdiction.

7. Cancellation and Refund Policy

1. Personalized Research Reports (Bespoke Product): Pursuant to Article 16(c) of Directive 2011/83/EU of the European Parliament and of the Council and corresponding consumer protection statutes, the statutory right of withdrawal does not apply to goods or digital services made to the consumer's specifications or clearly personalized. Because generation of the Personalized Research Report involves immediate computational pipeline allocation, automated web searches, and document synthesis upon payment, ALL SALES OF PERSONALIZED RESEARCH REPORTS ARE FINAL AND NON-REFUNDABLE ONCE GENERATION HAS COMMENCED.
2. Defective Generation Remedy: If a technical failure prevents report generation or delivery due to our server error, and our support team is unable to deliver a completed report within 72 hours of written notification, Company will issue a full refund of the fee paid for that report.
3. Digital Content Subscriptions: For digital subscriptions providing immediate access to the Book Reader or Chatbot, you expressly request immediate performance of the digital contract and acknowledge that you lose your statutory 14-day right of withdrawal once you access premium content. You may cancel your subscription at any time to prevent future billing cycles.
4. Complete Policy: For comprehensive cancellation provisions, consult our dedicated Refund and Cancellation Policy located at soraya.health/legal/refunds, which is incorporated into these Terms by reference.

8. Intellectual Property and Proprietary Rights

1. Exclusive Ownership: Patient Led Health Limited and its licensors retain all right, title, and interest in and to the Platform, including the text of the Book Curriculum, algorithms, multi-agent prompt architectures, report layouts, curated databases, brand names, logos, and visual interfaces. All content is protected by international copyright, trademark, and trade secret laws.
2. No Derivative Works: You may not modify, publish, transmit, transfer, sell, reproduce, create derivative works from, distribute, perform, display, reverse engineer, decompile, or disassemble any portion of the Platform, software code, or documentation.
3. Feedback: If you submit feedback, suggestions, error reports, or research comments, you grant Company an unrestricted, perpetual, irrevocable, royalty-free, worldwide license to use, incorporate, and commercialize such feedback without attribution or compensation.

9. User Conduct and Acceptable Use

You agree that you will NOT: 1. Use the Platform for any purpose that is illegal, harmful, or prohibited by these Terms or our Acceptable Use Policy. 2. Upload, transmit, or store any file that contains viruses, corrupted data, trojan horses, or malicious code. 3. Upload medical documents that do not belong to you or for which you lack legal authority and informed consent from the patient. 4. Interfere with, circumvent, or disrupt platform security mechanisms, rate limiters, or server architecture. 5. Probe, scan, or test the vulnerability of any system or network associated with the Platform. 6. Systematically scrape, harvest, or index data or text from the Book Reader, Chatbot, or report generation engine using automated bots, crawlers, or scrapers. 7. Resell, syndicate, or commercially distribute reports or book lessons to third parties.

10. Privacy and Data Protection

1. Privacy Notice: Our collection, processing, and storage of your personal data and Special Category Data are governed by our Privacy Policy, available at soraya.health/legal/privacy.
2. Explicit Consent: By submitting Medical Information, you confirm that you have read our Privacy Policy and provide explicit, affirmative consent pursuant to Article 9(2)(a) of the GDPR for Company to process your health data for the sole purpose of delivering the contracted services.
3. Data Subject Rights: You may exercise statutory rights of data access (GDPR Article 15) and account erasure (GDPR Article 17) directly through your Account dashboard or by contacting [email protected].
4. AI Model Non-Training Guarantee (Google Cloud Standards): Pursuant to Google Cloud enterprise data governance commitments and Company data protection standards, all Medical Information, uploaded clinical files, biomarker profiles, questionnaire inputs, and Chatbot conversation histories processed through Google Cloud enterprise infrastructure (including Vertex AI and Discovery Engine) are processed in isolated enterprise environments. Under no circumstances will your personal data, medical inputs, or generated research reports be used by Company or by Google Cloud to train, retrain, fine-tune, evaluate, or improve foundation models, public large language models (LLMs), or commercial generative AI algorithms.

11. Disclaimers of Warranties

1. AS IS AND AS AVAILABLE: TO THE MAXIMUM EXTENT PERMITTED UNDER APPLICABLE LAW, THE PLATFORM, CONTENT, BOOK READER, CHATBOT, AND RESEARCH REPORTS ARE PROVIDED ON AN "AS IS" AND "AS AVAILABLE" BASIS, WITHOUT WARRANTIES OF ANY KIND, WHETHER EXPRESS, IMPLIED, STATUTORY, OR OTHERWISE.
2. EXCLUSION OF IMPLIED WARRANTIES: COMPANY EXPRESSLY DISCLAIMS ALL IMPLIED WARRANTIES, INCLUDING WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, ACCURACY, NON-INFRINGEMENT, AND FREEDOM FROM PROGRAM ERRORS OR INTERRUPTION.
3. AI ACCURACY LIMITATIONS: COMPANY DOES NOT WARRANT THAT RESEARCH REPORTS OR CHATBOT RESPONSES WILL BE ERROR-FREE, EXHAUSTIVE, OR REFLECT THE MOST RECENT MEDICAL DEVELOPMENTS. SCIENTIFIC RESEARCH EVOLVES RAPIDLY, AND AI MODELS CAN MISINTERPRET COMPLEX DATA. YOU ASSUME ALL RISK ARISING FROM RELIANCE ON ANY INFORMATION ACCESSED THROUGH THE PLATFORM.

12. Limitation of Liability

1. CONSEQUENTIAL DAMAGES EXCLUSION: TO THE FULLEST EXTENT PERMITTED BY LAW, IN NO EVENT SHALL PATIENT LED HEALTH LIMITED, ITS DIRECTORS, EMPLOYEES, AFFILIATES, AGENTS, OR LICENSORS BE LIABLE FOR ANY INDIRECT, INCIDENTAL, CONSEQUENTIAL, SPECIAL, PUNITIVE, OR EXEMPLARY DAMAGES, INCLUDING LOSS OF PROFITS, LOSS OF DATA, CLINICAL TREATMENT COMPLICATIONS, BODILY INJURY, PAIN AND SUFFERING, OR EMOTIONAL DISTRESS, ARISING OUT OF OR IN CONNECTION WITH YOUR USE OF OR INABILITY TO USE THE PLATFORM, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
2. AGGREGATE LIABILITY CAP: TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, THE TOTAL AGGREGATE LIABILITY OF PATIENT LED HEALTH LIMITED ARISING OUT OF OR RELATED TO THESE TERMS OR THE PLATFORM, WHETHER IN CONTRACT, TORT (INCLUDING NEGLIGENCE), STRICT LIABILITY, OR OTHERWISE, SHALL NOT EXCEED THE GREATER OF: (A) THE TOTAL AMOUNT ACTUALLY PAID BY YOU TO COMPANY FOR THE SPECIFIC PRODUCT OR SERVICE GIVING RISE TO THE CLAIM IN THE TWELVE (12) MONTHS PRECEDING THE CLAIM; OR (B) ONE HUNDRED UNITED STATES DOLLARS (USD $100.00).
3. CONSUMER RIGHTS RESERVATION: SOME JURISDICTIONS (INCLUDING CERTAIN MEMBER STATES OF THE EUROPEAN UNION) DO NOT ALLOW THE EXCLUSION OR LIMITATION OF CERTAIN WARRANTIES OR LIABILITY FOR GROSS NEGLIGENCE OR WILLFUL MISCONDUCT. IN SUCH JURISDICTIONS, COMPANY'S LIABILITY IS LIMITED TO THE MAXIMUM EXTENT PERMITTED BY LAW.

13. Indemnification

You agree to defend, indemnify, and hold harmless Patient Led Health Limited, its officers, directors, employees, contractors, agents, and licensors from and against any claims, liabilities, damages, judgments, awards, losses, costs, expenses, or legal fees arising out of or relating to: 1. Your violation of these Terms or our Acceptable Use Policy. 2. Your submission of fraudulent, unauthorized, or infringing Medical Information. 3. Your implementation of any research finding, published off-label study, or lifestyle modification without supervision from an oncologist or other qualified healthcare practitioner. 4. Your infringement of any intellectual property or privacy rights of a third party.

14. Term, Suspension, and Termination

1. Term: These Terms remain in full force and effect while you use the Platform or hold an active Account.
2. Termination by User: You may terminate your Account at any time through the Account settings or by requesting permanent erasure under GDPR Article 17 via DELETE /me/account. Termination does not entitle you to refunds for completed reports or accrued subscription periods.
3. Termination by Company: Company may suspend, restrict, or terminate your Account and access to the Platform immediately, without prior notice or liability, if you violate these Terms, engage in scraping or reverse engineering, abuse fair-use quotas, or engage in conduct detrimental to the Platform.
4. Survival: Sections 2, 5, 6, 8, 10, 11, 12, 13, 15, and 16 shall survive any termination of these Terms.

15. Governing Law and Dispute Resolution

1. Governing Law: These Terms and any dispute or claim arising out of or in connection with them shall be governed by and construed in accordance with the laws of the Hong Kong Special Administrative Region, without regard to conflict of law principles.
2. Mandatory Consumer Law Exception: If you are a consumer habitually resident in the European Union or the United Kingdom, you additionally enjoy the protection of mandatory provisions of the consumer protection laws of your country of residence.
3. Informal Resolution: Before initiating legal proceedings, you and Company agree to attempt in good faith to resolve any dispute informally. Written notice of dispute must be sent to [email protected] detailing the claim and requested relief.
4. Arbitration / Jurisdiction: If informal resolution fails within forty-five (45) days, the dispute shall be referred to and finally resolved by arbitration administered by the Hong Kong International Arbitration Centre (HKIAC) under the HKIAC Administered Arbitration Rules in force when the Notice of Arbitration is submitted. The seat of arbitration shall be Hong Kong. The language of arbitration shall be English.
5. EU Online Dispute Resolution: If you are resident in the European Union, the European Commission provides an online dispute resolution platform, accessible at https://ec.europa.eu/consumers/odr.
6. Class Action Waiver: To the fullest extent permitted by applicable law, you and Company agree that all disputes, claims, and controversies arising out of or relating to these Terms or the Platform will be resolved solely on an individual basis. You expressly agree not to initiate, join, or participate as a plaintiff or class member in any class, consolidated, representative, or private attorney general lawsuit or arbitration. If any portion of this class action waiver is found unenforceable as to a particular claim under mandatory consumer protection laws, that specific claim may proceed in court while all remaining individual claims remain subject to arbitration.

16. General Provisions

1. Entire Agreement: These Terms, together with our Privacy Policy, Medical Disclaimer, Refund Policy, and Acceptable Use Policy, constitute the entire agreement between you and Patient Led Health Limited regarding the Platform.
2. Severability: If any provision of these Terms is found to be unlawful, void, or unenforceable, that provision shall be deemed severable and shall not affect the validity and enforceability of any remaining provisions.
3. No Waiver: No waiver by Company of any term or condition set forth in these Terms shall be deemed a further or continuing waiver of such term or condition.
4. Assignment, Corporate Reorganization, and Jurisdiction Relocation: Patient Led Health Limited reserves the right to assign, novate, transfer, or redomicile its rights, obligations, assets, operational contracts, and intellectual property (in whole or in part) to an affiliated corporate entity, subsidiary, parent company, or corporate successor, or in connection with a corporate restructuring, merger, asset sale, or relocation of its primary operating jurisdiction to another country (including Singapore, a Member State of the European Union, the United Kingdom, or the United Arab Emirates), without requiring your prior affirmative consent. Company will provide at least thirty (30) days prior notice via email or a prominent announcement on the Platform before any formal jurisdiction redomiciliation or assignment takes effect. Any such corporate reorganization or relocation will not diminish your statutory consumer rights or weaken Company's data protection obligations under GDPR or applicable privacy legislation. You may not assign or transfer your Account or any rights or obligations under these Terms without our prior written consent.
5. Electronic Communications: By using the Platform, you consent to receive communications from us electronically, including notices, receipts, and policy updates sent to the email address associated with your Account.

17. Contact Information

For contractual, operational, or legal inquiries, contact:

Patient Led Health Limited
Suite 1106-8, 11/F, Tai Yau Building
No. 181 Johnston Road, Wanchai, Hong Kong
Email: [email protected]
Operational Support: [email protected]

Privacy Policy

Effective Date: 23 October 2026
Last Updated: 23 October 2026
Operating Entity: Patient Led Health Limited
Platform: soraya.health / Hacking Cancer

1. Introduction and Data Controller Identification

Patient Led Health Limited ("Company", "we", "us", or "our") respects your personal privacy and is committed to protecting your personal data. This Privacy Policy informs you how we collect, process, store, disclose, and protect your information when you visit the website located at soraya.health (the "Website"), access the "Hacking Cancer" digital reader (the "Book Reader"), converse with our automated research assistant (the "Chatbot"), or request a personalized research report (the "Personalized Research Report").

Under Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation or "GDPR"), the United Kingdom General Data Protection Regulation ("UK GDPR"), and the Hong Kong Personal Data (Privacy) Ordinance (Cap. 486 or "PDPO"), the Data Controller responsible for your personal data is:

Patient Led Health Limited
Companies Registry Number: 3219069
Suite 1106-8, 11/F, Tai Yau Building
No. 181 Johnston Road, Wanchai, Hong Kong
Data Protection and Privacy Contact: [email protected]

2. Categories of Personal Data We Collect

Depending on how you interact with the Platform, we collect and process several categories of information:

2.1. Standard Personal Data

• Identity Data: First name, last name, date of birth, age, sex, and account username.
• Contact Data: Email address, country of residence, city, and time zone.
• Account Credentials: Unique user identifiers (Firebase UID), authenticated tokens, role designations (patient, doctor, coach), and account creation timestamps.
• Financial and Transaction Data: Stripe customer identifiers, subscription identifiers, transaction reference IDs, payment status (unpaid, paid, refunded, failed), and order history. Note: We do not collect or store full credit or debit card numbers; all card processing is handled directly by Stripe Inc.
• Technical and Device Data: Internet Protocol (IP) address, browser type and version, device identifiers, operating system, and connection telemetry captured via Cloudflare.
• Usage Data: Book reading progression, module completion status, favorite lessons, search queries, and chatbot interaction transcripts.

2.2. Special Category Data (Health and Genetic Data)

To generate the Personalized Research Report and enable informed chatbot dialogue, we collect highly sensitive health data governed by Article 9 of the GDPR: - Clinical Oncology Profile: Primary cancer type, histological subtype, cancer stage, TNM classification, hormone receptor status, and disease history (e.g. active disease, stable disease, no evidence of disease / NED). - Genetic and Molecular Biomarkers: Genomic sequencing findings, NGS panels, liquid biopsy results, mutation statuses (including BRCA1/2, EGFR, KRAS, PIK3CA, HER2 amplification, microsatellite instability / MSI), and chemosensitivity culture data. - Laboratory Blood Markers: Complete blood count (CBC), comprehensive metabolic panel (CMP), inflammatory markers (CRP, ESR, ferritin), tumor markers (CEA, CA 19-9, CA 125, PSA), circulating tumor cell counts, and lipid profiles. - Treatment History and Intent: Past, current, and planned surgical procedures, radiation regimens, systemic chemotherapies, targeted therapies, immunotherapies, and off-label therapies. - Uploaded Medical Files: Diagnostic imaging reports (CT, MRI, PET scans), pathology reports, biopsy results, laboratory printouts, and clinical discharge summaries uploaded in PDF, DOCX, or image formats.

3. Legal Bases for Processing

We process your data strictly under recognized lawful bases under GDPR Article 6 and Article 9:

Notice of Explicit Consent: Because oncology data constitutes Special Category Data, we obtain your explicit, affirmative consent prior to processing your medical files or questionnaire answers. You may withdraw this consent at any time, but withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.

4. How We Use and Process Your Health Data

1. Analytical Parsing: Uploaded laboratory reports and doctor notes are parsed using automated document extraction models to extract quantitative lab markers, histological staging, and genetic mutations.
2. Multi-Agent Synthesis: Our backend invokes partitioned analytical tasks using Google Cloud Vertex AI (Gemini models) and Google Cloud Discovery Engine data stores. The pipeline correlates your biomarkers against peer-reviewed literature, clinical trial databases, and published study registries.
3. No Automated Clinical Decision-Making: Our pipeline produces an educational research synthesis. It does not perform autonomous diagnosis, clinical triage, or automated prescribing under GDPR Article 22.
4. Strict AI Non-Training Guarantee (Google Cloud Standards): In full alignment with Google Cloud enterprise commitments for Vertex AI and Discovery Engine, your uploaded medical files, questionnaire entries, biomarker extractions, Chatbot queries, and generated research reports are processed in isolated enterprise tenant environments. Under no circumstances is Customer Data, Medical Information, or output data used by Company, Google Cloud, or any third party to train, retrain, fine-tune, evaluate, or benchmark commercial foundation models, public large language models (LLMs), or commercial AI algorithms.
5. Conversation Review and Safety Inspection: Chatbot conversations may be reviewed for quality, safety, and compliance. Reviews use pseudonymised or anonymised records wherever practicable, access is restricted to authorised personnel and logged, and no review is used to train AI models (see item 4). If a review identifies a material safety risk, for example a Chatbot response that could cause harm to a user, Company may re-identify the relevant conversation and contact that user to provide safety information or corrective guidance. Quality and safety review relies on legitimate interests (GDPR Article 6(1)(f)). Where contacting the user is necessary to protect their life or health, vital interests apply (GDPR Articles 6(1)(d) and 9(2)(c)). Re-identification is limited to what is necessary for that purpose. Chatbot conversation records are deleted after fifteen (15) days.

5. Third-Party Subprocessors and Data Transfers

We share your data only with verified technical infrastructure providers necessary to operate the Platform:

5.1. International Data Transfers and Corporate Relocation

While Patient Led Health Limited is incorporated in Hong Kong, our primary cloud processing infrastructure for European users is deployed within the European Union (Google Cloud eu multi-region and Frankfurt europe-west3 data centers) in accordance with our data residency architecture.

Where data is accessed from or transferred to jurisdictions outside the European Economic Area (EEA) or the United Kingdom, transfers are protected by Standard Contractual Clauses (SCCs) approved by the European Commission, UK International Data Transfer Agreements (IDTAs), or applicable adequacy decisions. In the event that Patient Led Health Limited assigns operations or relocates its primary corporate jurisdiction to another international jurisdiction (such as Singapore, the European Union, the United Kingdom, or the United Arab Emirates), all personal data transfers will continue to be governed by valid Standard Contractual Clauses, maintaining strict GDPR and UK GDPR data protection standards.

6. Technical Security and Data Protection Safeguards

We implement defense-in-depth technical and organizational measures to protect health data: 1. Encryption in Transit: All traffic between your browser and our servers is encrypted using Transport Layer Security (TLS 1.3). 2. Encryption at Rest: Uploaded medical files stored in Google Cloud Storage and patient records in Firestore are encrypted at rest using AES-256 encryption. 3. Time-Limited Signed URLs: When you or your linked practitioner access uploaded medical files, the Platform generates time-limited cryptographically signed URLs that expire after 900 seconds (15 minutes). Unauthenticated public URLs do not exist. 4. Strict Access Controls: Backend microservices communicate over private cloud VPC networks using service-to-service service accounts with least-privilege identity and access management (IAM) policies. 5. Session Watermarking: Reading sessions on the digital book reader display subtle per-user visual identifiers to deter unauthorized dissemination.

7. Data Retention and Automatic Purging

We retain your personal data only as long as necessary to fulfill the purposes for which it was collected: - Active Accounts: User profiles, reading progress, and uploaded medical files remain accessible while your Account remains active. - Generated Reports: Final Personalized Research Reports are retained in your encrypted document repository so you can download or review them during your subscription. - Inactive Accounts: If an account exhibits no login activity for two (2) continuous years, we will issue email notifications prior to permanently archiving or purging associated health records. - Chatbot Conversations: Chatbot conversation records are deleted after fifteen (15) days. - Accounting Records: Transaction and payment histories are retained for seven (7) years to comply with statutory taxation and corporate auditing requirements in Hong Kong and relevant consumer jurisdictions.

8. Your Statutory Rights as a Data Subject

Under GDPR, UK GDPR, and Hong Kong PDPO, you possess comprehensive rights regarding your personal data:

1. Right of Access (GDPR Article 15): You have the right to obtain confirmation as to whether your personal data is being processed, and to receive a complete export of that data. You can execute this right immediately at any time by calling our automated export endpoint via your account dashboard or calling GET /me/data-export, which outputs your complete profile, file inventory, chat history, and linked accounts in machine-readable JSON format.
2. Right to Erasure / Right to be Forgotten (GDPR Article 17): You have the right to request the permanent deletion of your personal data. You can execute this right directly by clicking "Delete Account" in your profile or invoking the DELETE /me/account endpoint. This triggers an irreversible, cascading deletion that purges your Firestore records, removes uploaded medical files from storage buckets, deletes chat histories, and unlinks connected practitioners.
3. Right to Rectification (GDPR Article 16): You have the right to correct inaccurate or incomplete profile data directly through your dashboard.
4. Right to Restriction of Processing (GDPR Article 18): You may request that we suspend processing your medical data while contesting its accuracy or our legitimate grounds.
5. Right to Data Portability (GDPR Article 20): You may receive your personal data in a structured, commonly used, machine-readable format and transmit it to another controller.
6. Right to Object (GDPR Article 21): You have the right to object at any time to processing based on legitimate interests.
7. Right to Withdraw Consent: Where processing is based on explicit consent (GDPR Article 9(2)(a)), you may withdraw consent at any time without penalty.

To exercise any statutory right not handled automatically through your dashboard, contact our privacy team at [email protected]. We will respond within thirty (30) days.

9. Supervisory Authorities and Complaints

If you believe our processing of your personal data infringes applicable data protection law, you have the right to lodge a complaint with a supervisory authority: - In Belgium: Autorite de protection des donnees (APD) / Gegevensbeschermingsautoriteit (GBA), Rue de la Presse 35, 1000 Brussels, https://www.autoriteprotectiondonnees.be. - In the United Kingdom: Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, https://ico.org.uk. - In Hong Kong: Office of the Privacy Commissioner for Personal Data (PCPD), Sunlight Tower, 248 Queen's Road East, Wanchai, Hong Kong, https://www.pcpd.org.hk. - Other EU Member States: You may lodge a complaint with the data protection authority in your habitual residence or workplace.

10. Children and Minors

The Platform is not directed to individuals under 18 years of age. We do not knowingly collect or solicit personal data from children. If we discover that an account has been registered by a minor without verified legal parental or guardian authority, we will immediately delete the account and all associated health records.

11. Amendments to This Privacy Policy

We may update this Privacy Policy from time to time to reflect operational, regulatory, or technical changes. Material modifications will be notified to you by email or via a prominent banner on the Website at least fourteen (14) days before taking effect. The "Last Updated" date at the top of this document indicates the effective date of the latest revision.

12. Privacy Contact

For questions, data subject requests, or security disclosures, please contact:

Data Protection Team
Patient Led Health Limited
Suite 1106-8, 11/F, Tai Yau Building
No. 181 Johnston Road, Wanchai, Hong Kong
Email: [email protected]

Medical and Research Disclaimer

Effective Date: 23 October 2026
Last Updated: 23 October 2026
Operating Entity: Patient Led Health Limited
Platform: soraya.health / Hacking Cancer

IMPORTANT: READ THIS MEDICAL AND RESEARCH DISCLAIMER CAREFULLY BEFORE ACCESSING THE PLATFORM, READING THE "HACKING CANCER" BOOK, ENGAGING WITH THE SORAYA AI CHATBOT, OR GENERATING A PERSONALIZED RESEARCH REPORT. BY USING ANY PART OF THE PLATFORM, YOU ACKNOWLEDGE AND AGREE TO ALL PROVISIONS CONTAINED HEREIN.

1. Educational and Scientific Research Purpose Only

The website soraya.health, the "Hacking Cancer" curriculum and digital reader, the Soraya AI conversational assistant, and the Personalized Research Report (collectively, the "Platform") are developed and operated by Patient Led Health Limited solely for informational, educational, and scientific research purposes.

The Platform provides an automated research, coaching, and health-navigation reference. It compiles, indexes, and synthesizes publicly available peer-reviewed oncology literature, published clinical trial data, biological pathway mechanisms, and empirical patient methodologies.

NOTHING CONTAINED ON THE PLATFORM OR PRODUCED BY OUR SOFTWARE CONSTITUTES MEDICAL ADVICE, CLINICAL DIAGNOSIS, PROGNOSIS, OR INDIVIDUALIZED TREATMENT RECOMMENDATIONS.

2. No Doctor-Patient Relationship

Patient Led Health Limited is a research, consultancy, and technology publisher, not a licensed medical clinic, hospital, or healthcare provider.

Neither your access to the Website, your interactions with the automated Chatbot, nor your receipt of a Personalized Research Report creates a doctor-patient, nurse-patient, clinical psychologist, or other regulated healthcare professional relationship between you and Patient Led Health Limited, its directors, developers, researchers, or agents.

3. Mandatory Requirement for Oncology Consultation

CANCER IS A COMPLEX, LIFE-THREATENING DISEASE REQUIRING EXPERT ONCOLOGICAL SUPERVISION.

You must never use information obtained from the Platform to self-diagnose, self-treat, or modify your medical care.

Prior to adopting, altering, starting, or discontinuing any: - Conventional standard of care therapy (chemotherapy, radiation therapy, surgery, hormonal therapy, immunotherapy); - Targeted therapy or tyrosine kinase inhibitor (TKI); - Repurposed or off-label pharmaceutical medication; - High-dose intravenous therapy (such as intravenous Vitamin C); - Dietary modification, ketogenic regimen, or fasting schedule; - Botanical extract, nutraceutical, or dietary supplement;

YOU MUST FIRST PRESENT AND DISCUSS THE SCIENTIFIC STUDIES AND LITERATURE CITATIONS DIRECTLY WITH YOUR BOARD-CERTIFIED ONCOLOGIST OR OTHER QUALIFIED HEALTHCARE PRACTITIONER AND TREATING MEDICAL TEAM. Only your treating physician can evaluate potential drug-drug interactions, contraindications, organ function tolerances (renal, hepatic, cardiac), and personalized safety profiles.

4. Artificial Intelligence Generation and Scientific Limitations

The Soraya AI Chatbot and the Personalized Research Report use advanced artificial intelligence models (including Google Vertex AI and retrieval-augmented generation search pipelines). You must understand the inherent limitations of AI-assisted scientific synthesis:

1. Analytical Synthesis, Not Clinical Verification: AI models analyze patterns across medical literature and summarize correlations. They do not possess clinical intuition, cannot examine the physical body, and cannot replace a multidisciplinary tumor board review.
2. Rapid Evolution of Literature: Oncology research progresses rapidly. Clinical trials, safety advisories, and drug approvals change continuously. While our pipelines search current medical databases, we do not warrant that all citations represent the newest or universally accepted consensus.
3. Evidence Tiers and Preclinical Caution: The Platform clearly differentiates between tiers of scientific evidence:
4. Tier 1: Human randomized controlled trials (RCTs), systematic reviews, and meta-analyses;
5. Tier 2: Prospective and retrospective observational human cohort studies;
6. Tier 3: Case reports, case series, and pilot feasibility studies;
7. Tier 4: In vivo animal models (mice, rats) and in vitro cell line experiments. Evidence categorized as Tier 4 reflects laboratory findings only. Biological activity in a petri dish or mouse model often fails to replicate in human patients or can produce unexpected toxicities. Never treat preclinical data as clinical proof of efficacy.

5. Off-Label Medications and Drug Repurposing Risks

Certain sections of the Book, Chatbot responses, and Personalized Research Reports discuss pharmaceutical compounds used outside their authorized regulatory indications (off-label drug use, such as metformin, mebendazole, itraconazole, or atorvastatin in oncology settings).

1. Regulatory Status: Off-label uses discussed on the Platform have not necessarily been approved by the United States Food and Drug Administration (FDA), European Medicines Agency (EMA), United Kingdom MHRA, or other regulatory authorities for your specific tumor type.
2. Interaction and Toxicity Risks: Combining repurposed pharmaceuticals with standard chemotherapy or targeted drugs carries significant risks of cytochrome P450 (CYP) enzyme inhibition or induction, liver toxicity, QT prolongation, myelosuppression, and altered chemotherapy clearance.
3. Prescription Legality: Only a licensed medical practitioner possessing prescribing authority in your jurisdiction can legally evaluate and prescribe off-label pharmaceuticals.

6. Medical Emergencies

THE PLATFORM IS NOT DESIGNED, INTENDED, OR SUITABLE FOR MANAGING ACUTE SYMPTOMS OR MEDICAL EMERGENCIES.

If you are experiencing any of the following symptoms: - Fever of 38.0 C (100.4 F) or higher while receiving chemotherapy (neutropenic fever); - Severe shortness of breath, acute chest pain, or rapid heartbeat; - Sudden weakness, numbness, speech difficulties, or confusion; - Persistent vomiting, severe diarrhea, or inability to keep fluids down; - Uncontrolled bleeding or sudden severe pain;

CALL YOUR LOCAL EMERGENCY SERVICES IMMEDIATELY: - Dial 112 in the European Union and European Economic Area; - Dial 999 in the United Kingdom; - Dial 911 in the United States and Canada; - Or proceed directly to the nearest hospital emergency room.

Do not submit queries regarding emergency symptoms to the Chatbot or wait for report generation.

7. Third-Party Clinics, Labs, and Providers

Reports or educational modules may reference third-party medical clinics, integrative oncology centers, specialty testing laboratories (such as RGCC, Guardant Health, Foundation Medicine), or diagnostic facilities.

1. Independent Third Parties: These providers operate independently from Patient Led Health Limited. We do not own, manage, supervise, or employ personnel at these facilities.
2. No Guarantee of Outcome: Mention of any provider does not constitute a recommendation, endorsement, warranty, or guarantee regarding the safety, legality, efficacy, or cost of their medical procedures.
3. Due Diligence: You and your family are solely responsible for conducting independent background checks, verifying medical licensing, and assessing clinical credentials before engaging any clinic or undergoing any procedure.

8. Summary of Patient Responsibility

By accessing soraya.health and using its tools, you agree that: 1. You are an informed, adult healthcare consumer seeking educational research. 2. You retain complete personal autonomy and responsibility for all health choices you make. 3. You will not discontinue or postpone prescribed oncological therapies based upon materials accessed on the Platform. 4. You release Patient Led Health Limited from any liability regarding decisions made or actions taken based on content provided through the Platform.

Refund and Cancellation Policy

Effective Date: 23 October 2026
Last Updated: 23 October 2026
Operating Entity: Patient Led Health Limited
Platform: soraya.health / Hacking Cancer

1. Overview and Consumer Rights Framework

This Refund and Cancellation Policy outlines your rights and obligations regarding purchases made through soraya.health (the "Website"), the "Hacking Cancer" digital curriculum and reader (the "Book Reader"), the Soraya AI conversational assistant (the "Chatbot"), and the bespoke oncology synthesis document (the "Personalized Research Report").

This policy complies with: - European Union Directive 2011/83/EU on Consumer Rights; - United Kingdom Consumer Contracts (Information, Cancellation and Additional Charges) Regulations 2013; - Hong Kong Sale of Goods Ordinance (Cap. 26) and Supply of Services (Implied Terms) Ordinance (Cap. 457).

2. Personalized Research Report (Bespoke Product)

2.1. Statutory Exemption from the 14-Day Right of Withdrawal

Under Article 16(c) of EU Directive 2011/83/EU, the United Kingdom Consumer Contracts Regulations, and general distance selling frameworks, the statutory 14-day cooling-off period and right of withdrawal DO NOT APPLY to contracts for the supply of:

"goods made to the consumer's specifications or clearly personalized."

The Personalized Research Report is an individualized, custom document. Each report requires automated extraction of your specific pathology markers, genomic profile, blood laboratory values, and disease staging, followed by customized cloud computing processes through multi-agent artificial intelligence pipelines and literature retrieval databases.

Because computing resources, external database queries, and custom document compilation begin immediately upon payment confirmation: ALL SALES OF PERSONALIZED RESEARCH REPORTS ARE FINAL AND NON-REFUNDABLE ONCE GENERATION HAS COMMENCED.

2.2. Remedy for Technical Non-Delivery

If a server malfunction, system crash, or infrastructure fault prevents the completion or delivery of your Personalized Research Report: 1. You must notify our support team in writing at [email protected] within seven (7) business days of purchase, including your order email, transaction ID, and questionnaire submission timestamp. 2. We will investigate the issue within two (2) business days. 3. If our technical team is unable to re-process and successfully deliver your completed report within seventy-two (72) hours of your notice, Company will issue a 100% full refund to the original payment method processed through Stripe.

3. Digital Book Subscriptions and Chatbot Entitlements

3.1. Right of Withdrawal for Digital Content

For subscriptions that provide immediate access to digital content (the premium lessons of the Book Reader and extended allowances for the Chatbot): 1. Prior to Access: If you purchase a subscription and have NOT logged into the premium reader or utilized premium chatbot messages, you have the statutory right to withdraw from the contract within fourteen (14) days from the date of purchase. 2. Loss of Withdrawal Right Upon Performance: Under Article 16(m) of EU Directive 2011/83/EU, your right of withdrawal is lost once the performance of digital content has begun. When you check the terms at checkout and proceed to read premium book lessons or initiate premium chatbot dialogues, you expressly consent to immediate digital performance and acknowledge that you lose your 14-day right of withdrawal.

3.2. Subscription Cancellation Procedure

1. Ongoing Subscriptions: You may cancel recurring monthly or annual subscriptions at any time via your Account settings or by emailing [email protected].
2. Effective Cancellation Date: When you cancel an active subscription, cancellation takes effect at the conclusion of your current paid billing period. You will retain full access to premium book modules and chatbot allowances until the current period expires.
3. No Pro-Rata Refunds: We do not issue partial, pro-rata, or retroactive refunds for unused portions of an active subscription month or year.

4. Payment Gateway and Refund Execution

1. Processing Gateway: All refunds are issued exclusively through Stripe Inc. back to the original card, bank account, or digital wallet used for the transaction.
2. Processing Timelines: Once a refund is approved by our billing team, Stripe typically processes the credit within five (5) to ten (10) business days, depending on your card issuer and banking network.
3. Currency Conversion: Refunds are issued in the original billing currency. Company is not responsible for foreign exchange fluctuations or currency conversion fees charged by your card issuer.

5. Chargebacks and Payment Disputes

We encourage open communication to resolve billing discrepancies promptly.

If you believe a charge was made in error or was unauthorized, you agree to contact us at [email protected] prior to initiating a chargeback or dispute with your credit card company or banking institution.

If an unjustified or fraudulent chargeback is filed: 1. Company reserves the right to suspend or permanently terminate your Account and revoke all platform entitlements. 2. Company may submit evidence, including questionnaire timestamps, authentication logs, IP addresses, and completed report deliveries, to your financial institution.

6. How to Request Assistance or a Refund

To request assistance or report a technical defect with a report purchase:

Email: [email protected]
Subject line: "Billing Support / Refund Request - [Your Order Email]"

Please provide: - Your full name; - Account email address; - Stripe invoice ID or receipt number; - Detailed description of the technical defect or issue encountered.

Cookie and Local Storage Policy

Effective Date: 23 October 2026
Last Updated: 23 October 2026
Operating Entity: Patient Led Health Limited
Platform: soraya.health / Hacking Cancer

1. Introduction

This Cookie and Local Storage Policy explains how Patient Led Health Limited ("Company", "we", "us", or "our") uses cookies, browser local storage, session storage, and similar technical mechanisms on the website located at soraya.health (the "Website") and associated web applications, including the digital book reader and conversational chatbot.

This policy complies with Directive 2002/58/EC of the European Parliament and of the Council (the ePrivacy Directive), the European Union General Data Protection Regulation (GDPR), and the United Kingdom Privacy and Electronic Communications Regulations (PECR).

2. What Are Cookies and Local Storage?

• Cookies are small data files placed on your computer or mobile device by a web server when you visit a website. Cookies are sent back to the originating website on each subsequent visit to recognize your browser, maintain security sessions, and remember user preferences.
• Local Storage and Session Storage are modern browser-based storage mechanisms that store key-value data directly in your browser. Local storage persists until manually cleared, while session storage is automatically deleted when you close your browser tab.

3. Categories of Technologies We Use

We adhere to a data minimization philosophy. We do NOT deploy invasive behavioral advertising cookies, social media tracking pixels, or cross-site data broker trackers.

Our platform utilizes only the following essential and functional technologies:

3.1. Strictly Necessary Technologies

These items are essential for the operation, technical performance, and security of the Platform. Because they are strictly necessary to deliver the service requested by you, they do not require prior consent under Article 5(3) of the ePrivacy Directive.

3.2. Functional and Preference Technologies

These items allow the Platform to remember choices you make and provide personalized, enhanced functionality.

4. No Third-Party Advertising or Retargeting

We do not allow third-party advertising networks to place tracking cookies on our Website. We do not participate in ad exchanges, retargeting campaigns (such as Meta Pixel or Google Ads Remarketing), or behavioral profiling.

5. How You Can Manage and Disable Cookies

You have the right to control, block, or delete cookies and browser storage at any time through your web browser settings:

• Chrome: Settings > Privacy and Security > Cookies and other site data.
• Firefox: Options > Privacy & Security > Cookies and Site Data.
• Safari: Preferences > Privacy > Block all cookies / Manage Website Data.
• Microsoft Edge: Settings > Cookies and site permissions > Manage and delete cookies.

Effect of Disabling Cookies: Because our cookies and local storage tokens are strictly necessary for user authentication and platform security, disabling browser storage entirely will prevent you from logging into your Account, reading the Book Reader, using the Chatbot, or accessing your Personalized Research Reports.

6. Updates to This Policy

We may amend this Cookie and Local Storage Policy from time to time. Any changes will be posted on this page with an updated "Last Updated" date.

7. Contact Information

If you have questions regarding our technical cookies or data practices, contact:

Patient Led Health Limited
Suite 1106-8, 11/F, Tai Yau Building
No. 181 Johnston Road, Wanchai, Hong Kong
Email: [email protected]

Acceptable Use Policy

Effective Date: 23 October 2026
Last Updated: 23 October 2026
Operating Entity: Patient Led Health Limited
Platform: soraya.health / Hacking Cancer

1. Purpose and Scope

This Acceptable Use Policy ("AUP") defines the rules and restrictions governing your access to and use of the platform operated by Patient Led Health Limited ("Company", "we", "us", or "our"), including the website at soraya.health, the "Hacking Cancer" digital curriculum and reader (the "Book Reader"), the Soraya AI conversational assistant (the "Chatbot"), and the Personalized Research Report service (collectively, the "Platform").

This AUP protects our proprietary educational research, intellectual property, computational infrastructure, and user community. By creating an Account or accessing any part of the Platform, you agree to adhere strictly to this policy.

2. Anti-Scraping and Intellectual Property Protection

The "Hacking Cancer" book curriculum, literature syntheses, database cross-references, and multi-agent report structures represent valuable proprietary assets.

You agree that you will NOT: 1. Automated Scraping: Use any automated software, web scraper, spider, crawler, bot, script, or headless browser to access, harvest, download, extract, or scrape content, text, data, or media from the Book Reader or Website. 2. Bulk Downloading: Systematically query the API to extract book lessons, modules, or database records in bulk. The Book Reader is licensed strictly for individual, page-by-page educational reading via the authorized web interface. 3. Watermark Tampering: The Book Reader embeds dynamic per-user visual and cryptographic watermarks displaying your email address, user identifier, or session token. You may not alter, blur, crop, conceal, intercept, or remove these watermarks. Any leaked screenshot, digital image, or text excerpt bearing your unique identifier establishes prima facie evidence of unauthorized distribution by your Account. 4. Redistribution and Commercial Exploitation: Sell, rent, lease, syndicate, republish, mirror, publicly broadcast, or commercially exploit any portion of the Book Curriculum, Chatbot transcripts, or Personalized Research Reports. 5. AI Training Ingestion: Ingest, parse, or feed any book lessons, research tables, prompt templates, or generated reports into external large language models, machine learning datasets, vector databases, or generative AI training pipelines.

3. Artificial Intelligence Safety and Anti-Tampering

The Soraya AI Chatbot and report generation services are designed to assist patients in educational cancer literature navigation under strict safety constraints.

You agree that you will NOT: 1. Prompt Injection and Jailbreaking: Attempt to override, bypass, or manipulate the Chatbot's safety guardrails, operational filters, or instruction hierarchy through prompt injection, adversarial prompting, role-play exploits, or jailbreak scripts. 2. System Prompt Extraction: Submit commands, questions, or formatting prompts designed to induce the model to reveal, print, or leak system instructions, internal developer notes, prompt text, or configuration settings. 3. Database Extraction: Systematically query the Chatbot using automated tools to re-engineer, extract, or reconstruct our underlying proprietary RAG corpus, Discovery Engine data stores, or curated research databases. 4. Abuse of Fair-Use Limits: Attempt to circumvent account message quotas, daily query limits, or rate limiters through rapid multi-threading, rotating IP addresses, or creating multiple accounts.

4. Medical Record and Data Integrity

The Platform processes sensitive health data to generate personalized research syntheses.

You agree that you will NOT: 1. Fraudulent Records: Upload forged, falsified, altered, or fabricated medical records, laboratory results, or physician notes. 2. Third-Party Privacy Infringement: Upload medical records, biopsy reports, or genomic profiles belonging to any third party without documented legal authority (such as valid power of attorney, legal guardianship, or verified written consent). 3. Malicious Files: Upload or transmit any file that contains computer viruses, corrupted data, malware, trojans, ransomware, or executable scripts disguised as PDF, DOCX, or image files. All uploaded documents must be authentic medical records.

5. System Security and Infrastructure

You agree that you will NOT: 1. Security Circumvention: Probe, scan, or test the vulnerability of the Platform, networks, or cloud infrastructure, or breach security or authentication measures. 2. Denial of Service: Engage in any activity that overburdens, impairs, or attacks our servers, Cloud Run services, or databases, including distributed denial-of-service (DDoS) attacks or automated brute-force attempts. 3. Account Sharing and Multi-User Access: Share, sell, rent, or transfer your login credentials to third parties, or permit concurrent access from multiple locations or unauthorized individuals under a single-user personal entitlement. 4. API Reverse Engineering: Reverse engineer, decompile, disassemble, or derive the source code of the Platform, FastAPI microservices, or frontend application.

6. Prohibited Content and Conduct

You agree that you will NOT use the Platform to: 1. Transmit, promote, or disseminate unlawful, defamatory, harassing, abusive, threatening, obscene, or fraudulent communications. 2. Impersonate any person or entity, including Patient Led Health Limited personnel, physicians, or other platform users. 3. Solicit commercial medical sales, unverified cancer cures, illegal pharmaceuticals, or fraudulent medical devices. 4. Use the Chatbot to generate harmful medical misinformation or encourage patients to abandon life-saving oncological care.

7. Monitoring, Enforcement, and Legal Consequences

1. Automated Auditing: We maintain active monitoring systems, including Cloudflare bot mitigation, rate-limiting algorithms, and automated prompt-injection detection filters.
2. Immediate Suspension: If we determine, in our sole discretion, that you have violated this AUP, we reserve the right to immediately suspend or permanently terminate your Account, revoke all subscription entitlements, and block your IP address and credentials without prior notice and without entitlement to any refund.
3. Civil and Criminal Recourse: Unauthorized scraping, data theft, reverse engineering, and infrastructure attacks violate applicable laws, including the Computer Crimes Ordinance (Hong Kong), the Computer Fraud and Abuse Act (United States), and international copyright legislation. Patient Led Health Limited will vigorously pursue civil damages, injunctive relief, and criminal referrals against violators.

8. Reporting Violations

If you discover any security vulnerability, prompt leakage, or unauthorized redistribution of our content, please report it immediately to:

Security and Legal Operations
Patient Led Health Limited
Email: [email protected]