General Terms of Use

Article 1 – Purpose

These general terms of use define the rules for using the web application 'Hally-pharma – vnapp' (hereinafter 'the Application') developed and published by Hally SAS. This Application is specifically designed to support the operations required to define a cleaning validation strategy within the Hally application environment, for professional use.

By accessing the Application from the web, the User may use it after subscribing and expressly accepting, without restriction or reservation, these general terms of use in their entirety, which they acknowledge having read and understood.

In the event of non-acceptance of the general terms of use stipulated in this agreement, the User must not access the Application.

Article 2 – Legal Notices

The Application is developed and published by Hally SAS, a simplified joint-stock company (SAS) with a share capital of €4,000, registered with the Lyon Trade and Companies Register under number 943 731 976, with its registered office at 58, avenue Leclerc – 69007 Lyon.

Hally SAS can be contacted at the email address [email protected]

Article 3 – Definitions

This clause defines the key terms of the agreement, which have contractual value:

• Application: refers to the Hally software application published and provided by Hally SAS, available at hally-pharma.fr. The Application includes access to the user interface, content, software, programs, tools (including calculation, documentation, and monitoring tools), databases, operating systems, technical documentation, and all other elements and services, including updates and successive evolutions. The Application may include elements subject to pharmaceutical industry regulations (including GMP, 21 CFR Part 11, or equivalents), compliance with which is the shared responsibility of Hally SAS and the User.
• Content: refers to, without limitation, the structure of the Application, editorial content, data, texts, images, photographs, graphic charters, brands, logos, acronyms, corporate names, and all other content within the Application.
• Services: refers to the various features and services offered by the Application.
• User: refers to any individual accessing the Application, either professionally on behalf of a client entity (legal person), or individually within the scope of the free or demo version. In a professional context, the User declares being duly authorized to represent and legally bind the organization for which they use the Application. In an individual context (demo mode), the User acts on their own behalf and does not bind any third-party entity. Certain features may then be restricted and data automatically deleted after a defined period, as specified in these Terms.
• Login and password: refers to all information required to identify a User on the Application. The password is confidential information that the User must keep secret, used in conjunction with their login to prove their identity.

Article 4 – Access to the Application

The Application is designed to implement the elements required to define a cleaning validation strategy.

The Application allows users to, in particular:

• Describe the characteristics of products (finished products, cleaning agents, intermediate products), equipment, manufacturing processes, cleaning processes, analytical methods, and sampling methods
• Define risk analysis methods
• Group products and equipment into families
• Calculate acceptance criteria

This list of features is non-exhaustive and may be modified at any time by Hally SAS, which reserves the right to modify, improve, or remove said features at its discretion, without incurring any liability in this regard.

To use the Application, the User must have an internet connection. The User shall ensure the compatibility of their device with the Application and shall take steps to protect its content (using antivirus software, for example).

The User must also create an account on the Application. To do so, a valid email address and password must be provided.

The Application maintains a history of critical activities performed by the User (data creation and modifications, calculations, exports) to ensure traceability in compliance with Good Manufacturing Practices (GMP) and 21 CFR Part 11 requirements.

Article 5 – Regulatory Compliance – Traceability and Validation

Hally SAS undertakes to ensure that the Application meets the requirements applicable to computerized systems used in processes subject to Good Manufacturing Practices (GMP) and GxP principles, in particular the requirements defined in the GAMP 5 guide and 21 CFR Part 11 regulation.

As such, the critical features of the Application are subject to a development, maintenance, and validation process compliant with current best practices for computerized systems, including change control, validation testing, associated documentation, and version management.

The Application is validated by Hally SAS according to a software lifecycle-based approach, in accordance with applicable regulatory expectations. Validation documentation (validation plan, protocols, reports, etc.) is available upon request, exclusively for professional clients with a paid subscription.

Furthermore, the Application incorporates an audit trail system that records key actions performed by Users on critical data, such as modifications, creations, and deletions, in compliance with data integrity requirements (ALCOA+ principle). These records cannot be modified or deleted by Users and are retained throughout the lifetime of the Application.

The User remains solely responsible for implementing the measures and steps necessary to comply with the regulatory requirements applicable to their activity. The Application is a support tool, and its use cannot replace professional judgment or the User's legal or regulatory obligations.

Article 6 – Partners

The Application uses the services of the following service providers:

• OVH: used for data hosting. Registered office located at 2, rue Kellermann, 59100 Roubaix.

Article 7 – Financial Terms

The Application is offered to Users at two subscription levels:

• Free subscription: the free subscription allows the User to access a limited version of the Application, strictly reserved for individual use, for testing, demonstration, or functional evaluation purposes. It is accessible without contractual commitment, and certain advanced features, storage capacities, or customization options may be disabled or restricted. This subscription does not permit use in a professional context subject to regulatory requirements (such as GMP, GxP, 21 CFR Part 11, or equivalents). Any regulated use or use for process validation purposes must be covered by a paid subscription.
• Paid subscription: the paid subscription provides access to all Application features, in a framework suited to regulated professional use. It is subject to an annual subscription, according to the terms specified in the applicable General Terms of Sale (GTS). Additional options (e.g., number of available projects) may be offered depending on the chosen subscription. Access to this subscription is reserved for entities having duly entered into a contract or subscription with Hally SAS.

Article 8 – Commercial Terms and Service Levels

These General Terms of Use (GTU) exclusively govern access to and use of the Application.

Commercial terms — including subscription terms, commitment periods, support services, and service levels (SLA – Service Level Agreement) applicable to professional clients — are defined in separate General Terms of Sale (GTS) or in a specific commercial contract.

In the event of a conflict between these GTU and the General Terms of Sale (GTS), the GTS shall prevail for all provisions relating to commercial terms, service commitments, support, and financial obligations.

Article 9 – Intellectual Property and License

Hally SAS is the exclusive owner of all logos, trademarks, signs, and intellectual property rights, software, relating to the Application and its features, subject to the rights of companies whose license Hally SAS operates.

Hally SAS hereby grants the User a personal, non-exclusive, revocable, non-assignable, non-transferable, worldwide right to use the Application and its Content, solely for their own needs within the scope of using the Application, to the exclusion of any other purpose.

The User expressly agrees not to:

• Permanently or temporarily reproduce the Application, in whole or in part, by any means and in any form
• Access and/or use the source code of the Application and/or its software components
• Use software or processes designed to copy the Application's content
• Perform any adaptation, modification, translation, transcription, arrangement, compilation, decompilation, assembly, disassembly, transcoding, or apply reverse engineering to any part of the Application
• Export the Application, merge all or part of the Application with other computer programs
• Sell, rent, sublicense, or distribute the Application to third parties in any way, without prior contractual agreement with Hally SAS
• Extract or reuse, including for private purposes, without prior written authorization from Hally SAS, a substantial or non-substantial part of the content of databases and archives constituted by the Application
• Set up systems likely to hack the Application in whole or in part, or likely to violate these general terms of use
• Attempt to misuse the Application or its features, or insert viruses into it

The User agrees, throughout the period of use of the Application and for a period of twelve (12) months following the end of their contractual relationship with Hally SAS, not to directly or indirectly solicit or recruit any employee, collaborator, or subcontractor of Hally SAS who participated in the development, support, or evolution of the Application.

The User also agrees not to use the features, ergonomics, structure, or any other element of the Application as a basis for developing or having a competing or similar software solution developed, even indirectly, or to analyze the functional behavior of the Application with the aim of reproducing all or part of it.

Any violation of these commitments may give rise to legal proceedings, in particular for unfair competition, breach of established business relationships, or protection of trade secrets, without prejudice to damages and interim measures that Hally SAS may seek.

Article 10 – Personal Data

Hally SAS collects and processes personal data relating to Users in the context of performing these GTU.

These collections and processing within the scope of the GTU are carried out in accordance with the French Data Protection Act of January 6, 1978, as amended, the European General Data Protection Regulation (EU) 2016/679 of April 27, 2016, and any other applicable regulations.

Hally SAS undertakes to comply with applicable personal data legislation and to do everything within its power to ensure the security of Users' personal data, within the limits of the obligations incumbent upon it under the aforementioned legislation.

The terms of collection and processing of Users' personal data are detailed in the Legal Notices, which form an integral part of these GTU. Access to the Application implies explicit acceptance of these GTU and the personal data management policy.

Article 11 – Security Incidents and Data Breaches

Hally SAS implements appropriate technical and organizational measures to ensure a level of security appropriate to the risk, in particular to prevent the destruction, loss, alteration, unauthorized disclosure, or unauthorized access to personal or professional data processed through the Application.

In the event of a personal data breach, within the meaning of Regulation (EU) 2016/679 (GDPR), and where such breach is likely to generate a risk for the rights and freedoms of the individuals concerned, Hally SAS undertakes to:

• Inform the affected User or client without delay
• Document the nature of the breach, measures taken, potentially affected data, and corrective actions taken
• Notify, where applicable, the breach to the CNIL within the regulatory timeframes
• Cooperate with the client in fulfilling notification obligations to supervisory authorities or data subjects, where this falls on the client as data controller

The User undertakes to inform Hally SAS, as promptly as possible, of any security incident or suspected compromise of their credentials or technical environment that could affect the security or confidentiality of data processed through the Application.

Article 12 – Liability and Force Majeure

The Application and software are provided 'as is', without any warranty of any kind, either express or implied, other than that provided by applicable law.

Hally SAS undertakes to make its best efforts to secure access, consultation, and use of the Application. The Application is in principle available 24 hours a day, 7 days a week, subject to any breakdowns and maintenance operations necessary for the proper functioning of the Application. In this regard, Hally SAS is only bound by an obligation of means.

Hally SAS shall in no case be held liable for:

• Indirect, material, or immaterial damages resulting from unavailability or malfunction of the Service, except in the event of a proven breach of its contractual or regulatory obligations
• Damages resulting from a case of force majeure as defined by French case law, or an unforeseeable and insurmountable act of a third party
• Damages caused by misuse of the Application, or a breach of the User's contractual or regulatory obligations
• Loss, alteration, or erroneous transmission of data when due to causes beyond its control, provided that Hally SAS has implemented standard state-of-the-art security and backup measures
• The User's inability to access the Application or certain features, particularly in the event of internet connection interruption, scheduled maintenance, or technical incident beyond Hally SAS's control

The User is solely responsible for verifying the completeness and validity of the data they transmit through the Application.

Furthermore, the User acknowledges the limitations and constraints inherent to the internet and recognizes the impossibility of a total guarantee of data exchange security. While Hally SAS undertakes to implement the necessary means to best ensure data security and confidentiality, the User shall also implement all necessary security means to protect their own data.

Article 13 – Business Continuity and Data Backup

Hally SAS implements a business continuity plan (BCP) and a disaster recovery plan (DRP) aimed at ensuring the availability, integrity, and sustainability of data hosted on the Application.

User data is subject to daily backups, stored on secure redundant infrastructures located in France, with certified hosting providers. These backups include operational data as well as traceability records (audit trails).

Hally SAS targets the following continuity objectives:

• RPO (Recovery Point Objective): maximum 24 hours, i.e., data loss not exceeding one day of activity
• RTO (Recovery Time Objective): maximum 48 hours, i.e., operational recovery within two business days following a confirmed critical incident

These objectives are provided as guidance, within the scope of an obligation of means. In the event of an incident affecting data availability or integrity, Hally SAS undertakes to inform the affected Users as promptly as possible, assist them in restoration operations, and provide them with the information needed to document the event in their own quality system.

Article 14 – Modifications

These General Terms of Use may be modified or supplemented at any time by Hally SAS, in particular to adapt them to technical, legal, or case law developments, or when new features are added to the Application.

Any substantial modification to the GTU will be notified to Users via the Application and/or by email, at least thirty (30) days before they come into effect. During this period, the User may either accept the new terms or request the termination of their account under the conditions set out in Article 16.

The modified terms will come into effect on the date indicated in the notification. Continued use of the Application after that date will constitute unreserved acceptance of the new GTU.

Article 15 – Duration

This agreement is for an indefinite period. The agreement takes effect with respect to the User from the moment they use the Application.

Article 16 – Termination

The User may terminate this agreement at any time, without notice or penalty, by expressly requesting Hally SAS to delete their account via the contact link on the Application. Deletion will be effective within seven (7) business days.

Upon termination of the agreement, the User's data will be retained for thirty (30) calendar days to allow for recovery. After this period, it will be securely deleted, unless legal or regulatory obligations require prolonged retention (particularly under GMP, GxP, or equivalent requirements).

Traceability records (audit trails) are retained for as long as the Hally Application is in service, to ensure regulatory compliance and continuity of traceability obligations. Upon account deletion, the complete data export will also include the associated audit trails in a structured and readable format. It is the User's responsibility to request an export of their data in a readable and structured format (e.g., CSV, JSON, or PDF).

Hally SAS may terminate the User's use of the Application at any time in the event of non-compliance with contractual or legal obligations. In this case, the User will be notified by email and will have limited access to the Application for a maximum period of thirty (30) days to recover their data. After this period, all rights and licenses granted to the User will be terminated, and the User must cease all use of the Application.

Upon termination, the User remains solely responsible for the regulatory archiving of data they have collected and processed through the Application.

Article 17 – Contact

For any questions relating to this agreement and/or the Application, the User may send an email to [email protected].

Article 18 – Applicable Law and Jurisdiction

These General Terms of Use are governed by French law.

In the event of a dispute or claim relating to their interpretation, performance, or validity, the parties shall endeavor to reach an amicable settlement within three (3) months of notification of the dispute.

In the absence of an amicable agreement within this period, and unless otherwise agreed contractually, the dispute shall be submitted to the exclusive jurisdiction of the courts within the jurisdiction of the Lyon Court of Appeal (France).

However, in the event of a contractual relationship with a client established outside France or subject to a non-French-speaking jurisdiction, Hally SAS may, at its discretion or at the client's request, propose recourse to private arbitration proceedings, administered in accordance with the Arbitration Rules of the International Chamber of Commerce (ICC) or any other recognized arbitration center, the procedural language being French or English, and the seat set at Paris, Geneva, or Brussels, at Hally SAS's choice.

If one or more provisions of these GTU are declared null or unenforceable by a competent court, the remaining provisions shall remain in full force and effect.