Terms and conditions

Version 9 October 2026

Binding language: Dutch. This English text is a non-binding translation; in case of any difference the Dutch text prevails.

---

Article 1. Definitions

In these General Terms and Conditions the following terms, in singular and plural, have the meaning set out below.

1.1 Neolyth: Neolyth, a sole proprietorship (eenmanszaak) of Mr Marwand Ayubi, Graafseweg 274, 6532 ZV Nijmegen, the Netherlands, Chamber of Commerce (KvK) no. 95055592, VAT no. NL005127223B03. Sendis is the name of the Service, not a legal person.

1.2 Client: the legal person, or the natural person acting in the course of a profession or business, that concludes an Agreement with Neolyth.

1.3 Service: the online messaging service Neolyth offers under the name Sendis, consisting of the web application for Users, the portal for Recipients and related functions, as described in Article 4.

1.4 Agreement: the combination of an Individual Agreement or another accepted order, these General Terms and Conditions and the Data Processing Agreement.

1.5 Individual Agreement: an agreement signed by both Parties recording specific arrangements on the Service, such as the number of Users, the price or a Test Phase.

1.6 Data Processing Agreement: the data processing agreement between the Parties within the meaning of Article 28 GDPR, with its annexes.

1.7 User: a natural person who has been given an account in the Service by or on behalf of the Client, such as a clinician or support staff member.

1.8 Administrator: a User with the owner or administrator role of the Organisation in the Service.

1.9 Organisation: the environment in the Service in which the Client's accounts, settings and messages are managed.

1.10 Recipient: any person outside the Organisation to or from whom a message is sent through the Service, such as a patient or client of the Client.

1.11 Delivery Method: the way in which a Recipient obtains access to a message, as described in Article 4.3.

1.12 Content: the text of messages and the attachments sent or received through the Service.

1.13 GDPR: Regulation (EU) 2016/679 and the Dutch GDPR Implementation Act (UAVG).

1.14 Party: Neolyth or the Client; together the Parties.

1.15 In Writing: by letter or by email, unless expressly provided otherwise.

1.16 Business Day: a day other than a Saturday, Sunday or public holiday recognised in the Netherlands.

Article 2. Applicability and order of precedence

2.1 These General Terms and Conditions apply to every offer by Neolyth relating to the Service and to every Agreement.

2.2 Purchasing or other terms of the Client do not apply and are expressly rejected. The NLdigital Terms and other industry terms do not apply.

2.3 Deviations from these General Terms and Conditions apply only if agreed In Writing in an Individual Agreement, and only to that Agreement.

2.4 In case of conflict between parts of the Agreement, the following order of precedence applies: (a) the Data Processing Agreement, as regards the processing and protection of personal data; (b) the Individual Agreement; (c) these General Terms and Conditions. Liability, including in connection with the processing of personal data, is governed solely by Article 13 and by any lower amount for a Test Phase agreed in an Individual Agreement; item (a) does not affect this.

2.5 Neolyth makes these General Terms and Conditions available electronically before or at the conclusion of the Agreement in a way that allows the Client to store and consult them. Neolyth keeps every previous version and provides it on request.

Article 3. Formation and target group

3.1 The Service is intended solely for healthcare providers and other professional organisations and practitioners acting in the course of their profession or business. The Service is not intended for consumers. The Client declares that it does not conclude the Agreement as a consumer.

3.2 Access to the Service is possible only by invitation from Neolyth or from an Administrator. Neolyth is not obliged to accept a request and may attach conditions to acceptance, such as a check of registration in the Trade Register.

3.3 The Agreement is formed by signature of an Individual Agreement or by Neolyth's acceptance In Writing of an order. The person acting on behalf of the Client declares that he or she is authorised to do so.

3.4 Recipients do not conclude an agreement with Neolyth. Their access to the portal takes place within the framework of the Agreement with the Client.

Article 4. The Service

4.1 Function. The Service allows Users to exchange messages with attachments securely with other Users and with Recipients. Recipients without an account read and reply to messages through the portal.

4.2 Encryption of the message text. The text of a message is encrypted in the sender's browser before it is sent to Neolyth's servers.

4.3 Delivery Methods. The Service offers the following Delivery Methods. The sender chooses a Delivery Method per message, within the settings of the Organisation. (a) Registered recipient. The message key is encrypted in the browser with the key of the recipient, who has an account. (b) Access code. The message key is encrypted in the browser with a key derived from an access code chosen by the sender. The access code is not sent to Neolyth. The protection this Delivery Method offers depends on the strength of the chosen access code. (c) One-time code by email or SMS. The Recipient obtains access after entering a one-time code sent to his or her email address or phone number. With this Delivery Method access to the message key runs through the server: Neolyth's server stores, in encrypted form, the secret that unlocks the message key, and after verification hands that secret to the Recipient's browser. Neolyth is therefore technically able to decrypt the Content.

4.4 Organisation recovery facility. For every Organisation, except a personal account without a team organisation, a recovery key is created so that messages remain accessible if a User loses his or her password or leaves. Every message within the Organisation is also encrypted for that recovery key. Neolyth holds the recovery key in encrypted form in its own key management system. The Organisation cannot currently choose another recovery model. Neolyth is therefore technically able to decrypt all messages and attachments of the Organisation, including under the Delivery Methods in Article 4.3(a) and (b). For those Delivery Methods Neolyth has no access to the Content other than through this recovery facility, apart from the processing of attachments described in Article 4.5. Neolyth uses the recovery facility only as provided in the Data Processing Agreement.

4.5 Attachments. Under every Delivery Method, attachments are scanned on Neolyth's server for viruses and other malicious code. The attachment is processed unencrypted only for that scan and for encryption. The server then encrypts the attachment with a key the server generates, and the attachment is stored in encrypted form.

4.6 Data that is not encrypted. Not all data is encrypted. Among other things, the subject line, the names, email addresses and phone numbers of sender and Recipient, times of sending and opening, the chosen Delivery Method and the name and size of attachments are readable by Neolyth. An email notification to a Recipient states the name of the sender and of the Organisation. The full description is in Article 4 of and Annex C to the Data Processing Agreement.

4.7 Contact link. An Organisation can use a contact link through which third parties can send a first message after verification by email. For messages through the contact link and replies to them, access to the message key runs through the server, as with the Delivery Method in Article 4.3(c). If the third party opts for an email copy of their own message, that copy is sent unencrypted by Neolyth's server, via the email service provider, to their email address. An Administrator can disable the contact link.

4.8 Expiry period. The sender can set an expiry period per message and an Administrator can set a default period for the Organisation. If no period is set, a message is retained for as long as the Agreement lasts. On expiry the Content and the associated keys are deleted; the data referred to in Article 4.6 is retained as described in the Data Processing Agreement. Attachments have their own expiry of 7, 30 or 90 days, by default 30 days, and are deleted after that, even if no expiry has been set for the message itself.

4.9 Description is decisive. Neolyth warrants only that the Service works substantially as described in this Article and in Article 4 of and Annex C to the Data Processing Agreement. Statements in marketing material, on the website or in conversations do not form part of the Agreement unless the Parties agree so In Writing.

4.10 Changes to functions. Neolyth may adapt the Service technically and functionally. An adaptation that reduces the protection of the Content or materially restricts a function is a change within the meaning of Article 17.

Article 5. Not a record, not an emergency channel

5.1 Not a medical record. The Service is a means of communication and not a record or archive system. The Service is not the Client's record within the meaning of Article 7:454 of the Dutch Civil Code. The record-keeping duty and the statutory retention periods remain entirely with the Client. The Client records information that belongs in the record in its own record system in good time.

5.2 No guarantee of recovery. Neolyth does not warrant that messages can be fully restored after a fault, an error or a security incident. The Client organises its working practices accordingly.

5.3 No urgent or crisis communication. The Service is not suitable for urgent or crisis communication, nor as the only route to reach a Recipient on a time-critical matter. Delivery may be delayed or fail. The Client informs its patients or clients that they must use the usual channels for urgent matters.

Article 6. Obligations of the Client

6.1 Secure use. The Client ensures that its Users use the Service carefully and securely. It is responsible for all acts performed with the accounts of its Users.

6.2 Accounts and second factor. Every account is personal. Login credentials are not shared. Neolyth strongly recommends that every User sets up a second factor or passkey. The Service does not currently enforce this; the Client itself ensures that its Users do so.

6.3 Choice of Delivery Method. The Client, as controller, chooses a Delivery Method appropriate to the sensitivity of the Content, taking into account the description in Article 4. For data concerning health it preferably uses the Delivery Methods in Article 4.3(a) or (b).

6.4 Access codes. With the access code Delivery Method the sender chooses a code that is not easy to guess. Neolyth recommends at least 8 characters. The sender shares the code with the Recipient through a channel other than the email address at which the Recipient receives the notification, for example in person or by phone.

6.5 Subject line. The subject line is not encrypted and may appear in email notifications. The Client does not put data concerning health or other sensitive data in the subject line or in attachment file names.

6.6 Correct data. The Client is responsible for the accuracy of the email addresses, phone numbers and other Recipient data it enters. A message that reaches the wrong person because of an incorrect address is at the Client's risk, unless this results from a failure by Neolyth.

6.7 Management of Users. The Client keeps the list of its Users and Administrators up to date and removes departing Users from the Organisation in good time. A User removed from the Organisation can still consult his or her own sent and received messages. Where necessary the Client takes additional measures, such as letting messages expire in good time or having the account blocked in consultation with Neolyth.

6.8 Laws and regulations. The Client complies with the laws and regulations applicable to its use of the Service, including the GDPR, the rules on professional secrecy and the rules of its profession. It informs its patients or clients about the use of the Service to the extent the law requires.

6.9 Own facilities. The Client provides the equipment, browsers and internet connection needed to use the Service and keeps them secure and up to date.

Article 7. Acceptable use

7.1 The Service may not be used: (a) for content or acts contrary to the law, to rights of third parties or to public order; (b) to distribute malware or to circumvent or test security measures without Neolyth's prior permission In Writing; (c) for unsolicited bulk messages or advertising; (d) in a way that hinders the operation of the Service for others, including automated or repeated use of verification steps; (e) to replicate, reverse engineer or resell the Service.

7.2 In case of a reasonable suspicion of a breach, Neolyth may restrict the access of the User or Organisation concerned as provided in Article 9.

Article 8. Availability, maintenance and support

8.1 Neolyth uses its best efforts to keep the Service available but does not warrant uninterrupted or error-free operation. The Service runs on a single application server without a fallback site. No availability level, resolution time or response time applies unless the Parties agree one In Writing in an Individual Agreement.

8.2 Neolyth may perform maintenance and install updates. Where reasonably possible it announces planned maintenance that leads to unavailability in advance and preferably performs it outside office hours. Urgent security maintenance may be performed without notice.

8.3 Support is provided by email on Business Days during office hours, on a best-efforts basis. Neolyth gives priority to reports affecting the confidentiality or delivery of messages.

Article 9. Suspension

9.1 Neolyth may suspend use of the Service in whole or in part where in its reasonable judgement this is necessary: (a) to protect the security of the Service or the integrity of data; (b) in case of a reasonable suspicion of a breach of Article 7; (c) in case of non-payment, as provided in Article 11.5; (d) under a legal obligation or an order of a competent authority.

9.2 Neolyth limits the suspension to what is necessary, notifies the Client without undue delay, stating its reasons, unless the law prohibits this, and lifts the suspension as soon as the reason has ceased.

9.3 Suspension does not affect the Client's right of access to its data to consult and save it, or Article 16, unless that access itself is the security risk; in that case Neolyth offers a secure alternative as soon as possible.

Article 10. Test Phase

10.1 The Parties may agree in an Individual Agreement on a technical test phase in which the Service is used for the first time under real-world conditions.

10.2 During the period for which a technical test phase has been agreed, the provisions on it in the Individual Agreement apply and prevail over these General Terms and Conditions, except as regards the protection of personal data, where the Data Processing Agreement prevails. Liability is governed by the last sentence of Article 2.4.

Article 11. Price and payment

11.1 Price. The price of the Service is EUR 10 per User per month, including VAT. A 10% discount applies to annual payment. An Individual Agreement may set a different price.

11.2 Number of Users. The price is calculated on the number of Users with an active account in the Organisation. An increase is charged pro rata from the next invoice period.

11.3 Trial period. Neolyth may offer a free trial period with limitations such as a maximum number of messages. After the trial period Neolyth may block the sending of messages until a paid subscription has been taken out. In the trial period too, real personal data may be processed only after the Data Processing Agreement has been concluded. No SMS Codes are charged during the trial period.

11.4 Payment. Payment is made in advance per month or per year, through the payment service provider Mollie B.V. or, if agreed In Writing, by invoice with a payment term of 14 days. By way of exception, additional SMS Codes under Article 11.8 are charged in arrears per calendar month, together with or separately from the advance payment, and paid in the same way as the price. Where payment is made through Mollie B.V., Neolyth may collect the amount using the payment method the Client uses for the price, after notifying the amount In Writing at least 2 Business Days in advance.

11.5 Late payment. If the Client does not pay on time, Neolyth sends a reminder In Writing with a term of 14 days. If payment has still not been made after that, the Client is in default, owes the statutory commercial interest and Neolyth may suspend the sending of new messages. Consulting existing messages remains possible and Article 16 continues to apply.

11.6 Price change. Neolyth announces a price increase In Writing at least 30 days in advance. An increase in the rate under Article 11.8 and a reduction of the included number under Article 11.7 count as a price increase. The Client may then terminate the Agreement with effect from the date the increase takes effect. For a prepaid year the old price applies until the end of that year.

11.7 SMS Codes. An SMS Code is any SMS containing a verification code that the Service sends on behalf of the Organisation, including a code giving a Recipient access to a message under the Delivery Method of Article 4.3(c), also where the Recipient requests a new code, and a login or second-factor code for a User. Each SMS Code sent counts separately; one message may give rise to more than one SMS Code. For each calendar month, 20 SMS Codes per User are included in the price under Article 11.1. The included number applies to the Organisation as a whole and equals 20 times the number of Users for whom the price for that calendar month is due, in full or pro rata. Unused SMS Codes lapse at the end of the calendar month and are not credited or refunded.

11.8 Additional SMS Codes. For each SMS Code above the included number the Client owes EUR 0.12 excluding VAT. Unlike the price under Article 11.1, this rate is exclusive of VAT; VAT is added on invoicing. This rate forms part of the price of the Service. An Individual Agreement may set a different included number or rate. SMS Codes sent during the Export Window under Article 16.1 are not charged.

11.9 No blocking. Exceeding the included number is never a reason for Neolyth to restrict or block the sending of SMS Codes. This is without prejudice to technical limits to prevent misuse, such as a maximum number of SMS Codes per phone number per period, and to Article 9.

Article 12. Intellectual property

12.1 All intellectual property rights in the Service and the associated software and documentation vest in Neolyth or its licensors.

12.2 Neolyth grants the Client, for the term of the Agreement, a non-exclusive and non-transferable right, without the right to sublicense, to use the Service in accordance with the Agreement, for the number of Users for which payment is made.

12.3 The rights in the Content remain with the Client or its Recipients. Neolyth acquires no rights in it and uses the Content only to provide the Service.

12.4 Neolyth may freely use suggestions and feedback from the Client on the Service to improve the Service. The Client does not include patient data in such feedback.

Article 13. Liability

13.1 Direct damage only. The liability of a Party towards the other Party is limited to compensation of direct damage. Direct damage means only: (a) reasonable costs of establishing the cause and extent of the damage; (b) reasonable costs of remedying the failure or making the performance conform to the Agreement; (c) reasonable costs of preventing or limiting damage; (d) reasonable costs the injured Party must incur to comply with a statutory notification duty following a personal data breach attributable to the other Party; (e) amounts the injured Party has paid to a data subject under Article 82 GDPR, to the extent that payment is for the other Party's account under Article 82(5) GDPR.

13.2 No indirect damage. Liability for indirect damage is excluded. This includes consequential damage, lost profit, lost savings, reputational damage, damage from business interruption and damage from loss of data that the Client should have recorded in its own systems under Article 5.1.

13.3 Aggregate amount. The total liability of each Party towards the other Party is limited to the greater of: (a) the fees the Client paid under the Agreement in the twelve months before the first event giving rise to liability; and (b) EUR 25,000. This amount is one aggregate amount for the entire term of the Agreement, for all events and claims together, and does not reset. It applies to all liability under these General Terms and Conditions, the Individual Agreement and the Data Processing Agreement together, and on any other ground, such as tort. A lower aggregate amount for a Test Phase agreed in an Individual Agreement forms part of this aggregate amount and is not added to it.

13.4 Exception. The limitations in this Article do not apply to damage caused by intent or deliberate recklessness of the liable Party itself or of its senior management. Neolyth's senior management means Mr Ayubi and any other person charged with the management of its business.

13.5 Payment obligations. This Article does not limit the Client's obligation to pay the price due.

13.6 Rights of data subjects. This Article applies only between the Parties. It does not affect the rights of data subjects against either Party under Article 82 GDPR. Recourse between the Parties following a claim by a data subject falls under this Article, to the extent the law permits.

13.7 Notice of default. Liability for a failure arises only if the injured Party promptly gives the other Party notice of default In Writing with a reasonable period to remedy, and the other Party still fails after that period, unless performance is permanently impossible.

13.8 Expiry period. Every right to compensation lapses 24 months after the event from which the damage results, unless the injured Party has brought legal proceedings before that date.

13.9 Neolyth gives no indemnities and no warranties other than as expressly stated in the Agreement.

Article 14. Confidentiality

14.1 Each Party keeps confidential information received from the other Party confidential and uses it only to perform the Agreement. This does not apply to information that is public, that was lawfully obtained from a third party, or that must be disclosed under the law or a court decision.

14.2 Neolyth acknowledges that the Content may contain data covered by the professional secrecy of the Client's healthcare professionals. Neolyth acts as an auxiliary of the Client and treats such data with the same confidentiality. Neolyth does not take cognisance of the Content except as provided in the Data Processing Agreement.

14.3 The confidentiality obligation in Article 14.1 lasts until five years after the end of the Agreement. For personal data and the Content the confidentiality obligation is not limited in time.

Article 15. Term and termination

15.1 Term. The Agreement is for an indefinite period, unless agreed otherwise.

15.2 Termination by the Client. With monthly payment the Client may terminate the Agreement with effect from the end of any calendar month. With annual payment the Agreement ends at the end of the paid year if the Client has terminated at least one month before that end; otherwise the subscription is renewed for one year. Neolyth reminds the Client In Writing of that renewal at least 30 days before the end of the year.

15.3 Termination by Neolyth. Neolyth may terminate the Agreement In Writing with three months' notice. Neolyth then refunds prepaid fees for the period after the end date pro rata.

15.4 Rescission. Either Party may rescind the Agreement In Writing with immediate effect if: (a) the other Party fails to perform a material obligation and has not remedied the failure within 30 days of a notice of default In Writing; (b) the other Party is declared bankrupt, applies for a moratorium of payments or becomes subject to the statutory debt restructuring scheme.

15.5 Discontinuation of the Service. If Neolyth discontinues the Service for all customers, Article 15.3 applies.

15.6 Provisions that by their nature are intended to continue after the end of the Agreement remain in force, including Articles 13, 14, 16 and 21.

Article 16. Data at the end of the Agreement

16.1 Export window. After the end of the Agreement the Client's Users retain access to the Service for 30 days to consult and save messages and attachments (the Export Window). Neolyth may block the sending of new messages during the Export Window.

16.2 No separate export. The Service has no export function. The Users can consult and save messages and attachments in the Service themselves during the Export Window, to the extent attachments have not expired under Article 4.8. Neolyth provides no separate export and decrypts no Content for that purpose, unless the Client instructs it to do so In Writing in the manner the Data Processing Agreement prescribes; the Parties then agree the form of such a return In Writing.

16.3 Deletion. After the Export Window Neolyth deletes the Client's data in accordance with the Data Processing Agreement. The Client may also request earlier deletion.

16.4 The Export Window is extended by any period during which the Service was unavailable for a cause on Neolyth's side.

Article 17. Changes to these General Terms and Conditions

17.1 Neolyth may change these General Terms and Conditions. It announces a change In Writing at least 30 days before its effective date, with the amended text and a short explanation.

17.2 If the Client does not agree with a change, it may terminate the Agreement free of charge with effect from the effective date of the change. Neolyth then refunds prepaid fees for the period after the end date pro rata.

17.3 A change that is solely to the Client's benefit, or that is required by law, may take effect earlier.

17.4 A change does not affect arrangements in an Individual Agreement or the Data Processing Agreement. Those can be changed only with the consent In Writing of both Parties, except to the extent the Data Processing Agreement itself provides otherwise.

Article 18. Force majeure

18.1 Neither Party is liable for a failure resulting from force majeure. Force majeure includes: failures of the internet or the electricity grid, failures at hosting and telecom providers that Neolyth could not reasonably prevent, war, terrorism, pandemics and government measures.

18.2 Force majeure does not release Neolyth from its obligations under the Data Processing Agreement to notify a personal data breach and limit its consequences.

18.3 If force majeure lasts longer than 30 days, either Party may terminate the Agreement In Writing, without any obligation to pay compensation. Article 16 applies.

Article 19. Transfer

19.1 Neither Party may transfer its rights and obligations under the Agreement without the consent In Writing of the other Party. Such consent will not be unreasonably withheld.

19.2 Neolyth may transfer the Agreement, including the Data Processing Agreement, in its entirety by contract takeover within the meaning of Article 6:159 of the Dutch Civil Code to a legal person that continues Neolyth's business and in which Mr Ayubi has control, such as a private limited company (B.V.). The following applies: (a) the transferee assumes all of Neolyth's obligations without reduction; (b) Neolyth notifies the Client In Writing at least 30 days before the transfer; (c) the Client may, within that period, terminate the Agreement free of charge with effect from the date of transfer, with application of Article 16 and a pro rata refund of prepaid fees. The Client gives its cooperation in advance to a transfer that meets these conditions.

Article 20. Notices

20.1 Notices under the Agreement are given In Writing. Neolyth's address for notices is hello@neolyth.io or the postal address in Article 1.1. The Client's address is the address in the Individual Agreement or, failing that, the email address of the owner of the Organisation in the Service.

20.2 Each Party keeps its address for notices up to date.

Article 21. Final provisions

21.1 If a provision of the Agreement is void or annulled, the other provisions remain in force. The Parties then replace the provision with a valid provision that comes as close as possible to its purpose.

21.2 The Dutch text of these General Terms and Conditions is binding. A translation is provided for convenience only.

21.3 The Agreement is governed by Dutch law.

21.4 Disputes are submitted exclusively to the District Court of Gelderland, sitting in Arnhem, without prejudice to the mandatory jurisdiction of the subdistrict court (kantonrechter). The Parties first try to resolve a dispute by consultation; this does not prevent either Party from seeking interim relief.