Indago Acceptable Use Policy
1. What this covers
This Acceptable Use Policy (the "Policy") governs use of the Indago service operated by Indago, Inc. ("Indago," "we," "us").
There is one service. It is reached through more than one surface:
- The web application at app.indago.bio
- The Indago Regulatory Drafting Agent ("IRDA"), our connector, wherever it is published. Today that is Claude. It may in future be an Office add-in, another assistant, or another compatible client.
- Any application programming interface, integration, add-in, or client we publish now or later
- The hosted sign-in, checkout, and account pages that support any of the above
Behind every surface sits the same platform: the same engine, the same retrieval and provenance graph, the same prompt library, and a tenant of the same kind. What differs between surfaces is the interface and the entitlements attached to your plan. This Policy applies the same way to all of them, including surfaces that do not exist yet.
It also covers everything the service produces for you, including working drafts, gap analysis findings, answers, citations, and exports ("Output").
2. Acceptance and precedence
You accept this Policy when you accept our click-wrap terms at sign-in, on whichever surface you sign in through. Acceptance is recorded against your identity with the version accepted and the date. Breach of this Policy is a material breach of those terms.
Where you or your organization holds a signed customer agreement with us, that agreement governs and this Policy applies only so far as it is not inconsistent with it. Where there is no signed agreement, this Policy and the click-wrap terms are the whole of the arrangement between us.
3. Who is bound
"You" means the individual who accepted the terms, the organization on whose behalf they accepted, and any person using an account, credentials, seat, or installation issued to or controlled by either.
You are responsible for everything done through your account or your organization's tenant, whether or not you authorized it and whether or not you knew of it.
If you use the service in the course of your employment, you confirm you are authorized by your employer to accept these terms, to connect the document locations you connect, and to have that material processed as described in our documentation and privacy policy.
4. Plans, seats, and entitlements
Your plan sets what you may do: the number of seats, the number of programs, the drafting entitlement, the usage allowance, the processing ceiling, and the depth of provenance you see. Those limits are whatever the plan you bought states at the time you bought it. They are enforced in the product and they change from time to time as plans change.
- You must not share a seat, share credentials, or let more than one individual work through a seat licensed to one.
- You must not create multiple accounts, identities, email domains, programs, tenants, or installations in order to obtain additional free allowance, extend a trial, evade a limit, or avoid a fee.
- You must not resell, sublicense, rent, or otherwise make the service available to a third party, or run it as a service bureau or managed service for anyone other than yourself, your employer, or, where your plan expressly provides for it, your own clients in their own separated tenants.
- Allowance belongs to the program, not to the person. It does not roll over, cannot be topped up, cannot be transferred between programs, tenants, or accounts, and carries no cash value.
- You must not circumvent, disable, tamper with, or misreport any metering, entitlement counter, processing ceiling, rate limit, confirmation step, or billing mechanism, or replay a confirmation given for a different operation.
Metered volume never converts into a plan feature. Because every surface runs on the same platform, the capabilities your plan withholds are present in the system and switched off for your account. No quantity of usage, and no payment on a lower plan, unlocks assembly of a compiled package, the consistency pass, the full provenance record, unwatermarked package export, additional seats, additional programs, a shared workspace, version history, continuous gap analysis, work on already-filed submissions, or any enterprise control. Reaching any of them by technical means, rather than by taking the plan that includes them, is a breach of this Policy.
5. Content you must not connect or submit
Do not upload, authorize, or otherwise place within reach of the service:
- Protected Health Information as defined under HIPAA, or any other individually identifiable patient health information
- Personal information about any individual beyond the ordinary business contact details of the people working on the program
- Payment card data, financial account numbers, government identification numbers, or biometric data
- Material subject to export control, including data controlled under ITAR or the EAR
- Third-party confidential, proprietary, or licensed material you do not have the right to disclose to us and have processed
- Material that infringes or misappropriates any intellectual property right
- Malicious code of any kind
- Material that is unlawful, or that you are under a legal or contractual duty not to disclose
Indago is not a HIPAA covered entity or business associate, offers no Business Associate Agreement, and its systems are not certified for patient data.
When you authorize a source location, you authorize everything inside the scope you grant. Checking that scope before you grant it, and de-identifying clinical material before it reaches us, is your responsibility. Any detection or refusal we perform at ingestion is a safeguard for our benefit, not a warranty, and it does not reduce your obligation under this section.
6. Protecting the engine
The service returns finished text produced by our engine, using our retrieval, our provenance graph, and our prompt library. Those instructions are never exposed to you or to any client application. You must not:
- Attempt to extract, reconstruct, elicit, or expose our system prompts, section templates, retrieval logic, scoring criteria, or model configuration, whether by prompt injection, adversarial input, repeated probing, or any other method
- Reverse engineer, decompile, or attempt to derive the architecture or source of the service
- Use Output, or systematic querying of the service, to train, fine-tune, distill, benchmark, evaluate, or otherwise develop any machine learning model, dataset, or artificial intelligence system
- Build, or assist anyone in building, a product or service that competes with Indago
- Conduct comparative evaluation of the service against any other product, or publish the results of one, without our prior written consent
- Invoke the service by scripted, programmatic, or automated means outside an interface we have published for that purpose, or drive it at a rate or volume inconsistent with the seats and programs on your plan
- Issue requests designed to chain into unbounded processing, recursive tool invocation, or ingestion beyond the scope fixed at authorization
- Probe, scan, or test the security of the service, or attempt to reach another tenant's data, without our prior written authorization
7. Protecting the draft
Except inside an unlocked submission package, everything the service produces is a working draft. Working drafts are watermarked, carry a draft identifier, and are stored against that identifier so the text can later be verified as ours.
- You must not remove, obscure, alter, or defeat a watermark, a draft identifier, or any provenance or ownership notice attached to Output.
- You must not represent a working draft as a compiled package, an assembled submission, or a submission-ready section, because it is none of those things.
- You must not present rewritten or altered text as Indago-generated, or otherwise defeat the verification path, where the provenance of the text matters to a reviewer, a regulator, an investor, or a partner.
You own the documents you connect and you own the Output generated for your program. Indago owns the platform, the engine, the prompt library, the templates, and everything underlying them. Feedback you choose to give us is voluntary, and you grant us a royalty-free, perpetual license to use it to improve the service.
We can tell you what we generated. We cannot control what a third-party client application does with our text once it is in your session there. Asking such a client to rewrite an Indago draft is your decision and your risk. The rewritten text is not ours, is not covered by verification, and must not be described as Indago Output.
8. No regulatory warranty
The service produces drafts for a qualified professional to review. It is not a regulatory consultant, a medical writer, or a source of legal or medical advice.
- You must not file, submit, or cause to be submitted to any health authority any Output that has not been reviewed and approved by a qualified individual acting for you.
- Final responsibility for the accuracy, clinical validity, and regulatory compliance of anything you file rests with you. We are not liable for regulatory delays, deficiencies, or rejections.
- Section coverage differs by plan and by surface, and a set of drafted sections is not a module or a submission. Do not rely on Output as more than what your plan produces.
- You must not use the service or its Output for any unlawful purpose, or in furtherance of fraud, misrepresentation, or evasion of a regulatory obligation.
9. Use through third-party client applications
Where you reach the service through a client application we do not operate, including Claude today and any assistant, add-in, or client we support in future, the following applies.
- The client is yours, not ours. Your agreement with its provider, its handling of your session, its administrative controls, and its availability are matters between you and that provider. Your organization's administrator may block connectors and we cannot override that.
- Indago has no partnership with, and no affiliation to, any client provider. Nothing in your use of the service may imply otherwise.
- Source documents never transit the client. Your requests, the arguments of the calls the client makes on your behalf, and whatever our tools return do enter that session. Once our Output is there, it is subject to your agreement with that provider.
- You must not route content prohibited by Section 5 to us through a client, and you must not use a client to circumvent the seats, entitlement, allowance, or ceilings on your plan.
We may restrict, modify, or discontinue support for any client application at any time.
10. Connector-specific provisions
These apply where you reach the service through IRDA on a connector plan rather than through a platform subscription. Where they conflict with Section 4, these govern for that account.
- A connector account is a single seat, tied to a single work email identity, holding a single program. Personal, disposable, and non-organizational email addresses are not permitted and we may close an account registered with one.
- Free access is limited to one trial per email domain. It is a one-time allowance and it does not renew.
- The scope of a connected source is fixed at the moment you authorize it. We read only what was in scope then, we do not discover further material later, and we do not write anything back into your document store.
- Drafting entitlement, usage allowance, processing ceiling, and provenance depth are set by the published rates for your plan. Those rates are provisional during the pilot period and may change on notice.
- A sales grant raising a limit on a named account is temporary, expires, and is not a discount or a permanent entitlement.
- Moving to a platform subscription is a change of entitlement on the same tenant. Your corpus and drafts stay where they are and nothing is reprocessed.
11. Retention, deletion, and lapse
Your corpus, index, and derived drafts are held while your plan is active and are deleted 90 days after the plan lapses, is terminated, or the account goes idle. You are warned before that happens. Where a signed customer agreement sets a different period, that agreement governs.
Deletion on demand is available at any time, including through a single tool call on the connector surface. The service is not a document archive and is not a place to store a program between funding rounds. We accept no responsibility for material you have not exported before a scheduled deletion.
12. Monitoring and enforcement
We record operational telemetry, usage metadata, and system logs to run the service, meter it, enforce this Policy, and protect other users. We are not obliged to monitor and we do not undertake to detect any particular breach.
Where we believe on reasonable grounds that this Policy has been breached or that a breach is threatened, we may, in our sole discretion and in any order:
- Investigate, including by reviewing account metadata and, where necessary, the operation involved
- Throttle, rate-limit, or queue the account
- Disable specific tools, features, programs, seats, or installations
- Suspend or close the account immediately and without prior notice where we consider that continued access presents a risk to the service, to another customer, to us, or of legal liability
- Refuse to process, or remove, material that breaches Section 5
- Terminate for cause
- Report conduct to law enforcement, to a regulator, or to an affected third party where we are required to or reasonably consider it necessary
Fees are non-refundable and non-cancelable. Suspension or closure under this section does not entitle you to a refund, a credit, a return of unused allowance, or an extension of term, and does not relieve you of fees owed for the current term.
The remedies in this section are cumulative and do not limit any other remedy available to us.
13. Indemnity
You will defend, indemnify, and hold harmless Indago, its officers, directors, employees, and contractors against any claim, demand, proceeding, loss, liability, damage, fine, penalty, cost, and expense, including reasonable legal fees, arising out of or relating to:
- Your breach of this Policy
- Material you connected, uploaded, or authorized us to access
- Use of Output by you or by anyone you gave it to
- Any regulatory submission, filing, or communication made by you or on your behalf
This survives termination.
14. Reporting
Report suspected misuse, unauthorized access, credential compromise, or material that should not have been connected to privacy@indago.bio without delay.
15. Changes
We may modify this Policy at any time, including to cover a new access surface. The current version is published at this address and applies from the date it is posted.
For a customer under a signed agreement, a modification takes effect at the start of the next renewal term, except where it is required by law, is necessary to address a security, abuse, availability, or legal risk, or restricts conduct that was already prohibited. Modifications of that kind take effect immediately on posting. For all other users, a modification takes effect on posting and continued use is acceptance of it.
16. General
No failure or delay by us in enforcing this Policy waives any right. No waiver is effective unless we give it in writing, and a waiver on one occasion does not apply to another.
If any provision is held unenforceable, it is limited or severed to the minimum extent necessary and the rest stays in force.
Sections 5, 6, 7, 8, 12, and 13 survive termination.
17. Contact
Indago, Inc.
254 Chapman Rd, Ste 208 #27568, Newark, DE 19702
Abuse, misuse, and policy enquiries: privacy@indago.bio
General: hello@indago.bio