The version that applies to you is the one you accept in the room. This copy is for information. "Sealroom" is the working name of the Haihtuva service.

Sealroom Platform and Room Use Rules

Version 1.3 (final) Effective date: 12 October 2026

Summary

1. Status and scope of these Rules

1.1 Agreement and individual acceptance

These Sealroom Platform and Room Use Rules, referred to as the Rules, form part of the agreement between Biotech Start-Up Management Oy, referred to as BSUM, and the Customer under the Sealroom Terms of Service, referred to as the Terms.

Capitalised terms not defined in these Rules have the meanings given in the Terms.

Each User accepts these Rules personally as a condition of access. Each User directly undertakes to comply with the provisions concerning:

This direct undertaking applies whether or not the User has authority to bind the Customer. It does not make the User personally responsible for the Customer’s Fees or other organisation-level obligations unless expressly stated in the Terms.

1.2 Relationship to transaction confidentiality arrangements

These Rules are not a Transaction NDA.

Where a Transaction NDA or another confidentiality arrangement applies, it governs the rights and obligations of its parties concerning Transaction Information. BSUM is not a party to that arrangement unless expressly stated and does not undertake to interpret, monitor or enforce it.

These Rules establish additional technical, security and operational conditions for accessing and using Sealroom. Compliance with a Transaction NDA does not excuse non-compliance with these Rules or with BSUM’s independent rights under the Terms.

1.3 Information protected in a Room

Two categories of information may be protected in a Room:

1.4 Permitted Purpose

Permitted Purpose has the meaning given in the Terms and is identified for each Room in the applicable Order or Security Specification.

A User may access and use a Room only for its Permitted Purpose.

1.5 Rooms without a Transaction NDA

Where no Transaction NDA applies, references in these Rules to rights or restrictions under a Transaction NDA do not apply.

Access to and use of information remain subject to:

1.6 No waiver through visibility

The fact that a User can observe a feature, workflow, output format, analytical structure, configuration or system behaviour through authorised access does not:

1.7 No residuals right

No residuals right or licence is granted.

Retention of Platform Information in unaided memory does not authorise its use or disclosure in breach of the Terms or these Rules.

This provision does not restrict the use of general professional knowledge, experience and skills that do not disclose, reproduce or materially incorporate Platform Information.

1.8 Mandatory law

Nothing in these Rules excludes or restricts an activity or right that cannot lawfully be excluded or restricted by agreement.

Information obtained through such an activity may be used only within the scope and for the purpose permitted by applicable mandatory law.

1.9 Independent development

These Rules do not prevent the Customer or a User from independently developing, investing in, acquiring or advising on a product or service without:

1.10 Order of precedence

The documents apply as follows:

The Security Specification does not override or reduce the platform-protection, confidentiality, acceptable-use or intellectual-property restrictions in the Terms, these Rules or the AI Use Notice.

2. Authorisation and Permitted Purpose

2.1 Applicable confidentiality obligations

Each User must comply with any Transaction NDA and any other confidentiality, access or use restrictions applicable to that User or the organisation for which the User acts.

If a User is uncertain whether an act is permitted, the User must consult their own organisation before proceeding.

2.2 Customer responsibility

The Customer is responsible for ensuring that each person it invites or authorises:

2.3 No additional rights

Access to a Room does not create any right to use, disclose, copy or retain Transaction Information beyond what the disclosing party, any applicable Transaction NDA and applicable law permit.

Availability of a technical function does not by itself establish that using that function for a particular purpose is legally or contractually permitted.

3. Rules of conduct

3.1 Capture and reproduction

Users must not photograph, film, screen-record, screenshot or otherwise make a facsimile or substantial reproduction of:

This restriction includes capture or reproduction through:

This section does not prohibit ordinary analytical notes that do not:

3.2 Extraction

Users must not:

Nothing in this section prohibits legitimate use of accessibility functionality to access the Service, provided that the functionality is not used to circumvent an access restriction or create an unauthorised extraction or reproduction.

3.3 Accounts and sessions

Accounts and authentication credentials are personal.

Users must not:

A User must protect their credentials and notify their Customer administrator and BSUM without undue delay after becoming aware of suspected credential loss or misuse.

3.4 Security controls

Users must not bypass, disable, obscure, manipulate or interfere with:

3.5 External AI tools and external systems

A User must not enter, upload, paste, transmit or otherwise make available Platform Information to an external AI tool, chat service, translation service, document-analysis system or other external service without BSUM's prior written approval. BSUM may withhold approval where the proposed transfer creates a material risk to Platform Information or the security of Sealroom.

BSUM does not restrict how the Customer handles its own information. Whether Transaction Information obtained through the Room, or Customer Results containing it, may be processed in an external service is governed by the applicable Transaction NDA, the disclosing party's permission and applicable law, and is the responsibility of the Customer and its Users.

AI models expressly approved in the Security Specification and used through the functions provided by Sealroom are not external systems for this section.

This section does not prevent processing or disclosure required by applicable law or a binding order. Where legally permitted, the User must give prior notice to BSUM and limit the processing or disclosure to what is legally required.

3.6 Disclosure

Users must not disclose Transaction Information, or Customer Results containing or materially revealing Transaction Information, to anyone who is not authorised to receive it under:

Employment by, engagement with, or affiliation to the same organisation does not by itself establish authorisation.

3.7 Prompts, instructions and analytical logic

Users must not attempt to extract, reveal, copy, reconstruct or systematically derive:

Prohibited methods include:

3.8 Security testing

Users must not test, scan, probe or attempt to exploit the security of a Room or the Service without BSUM’s prior written permission.

A User who inadvertently identifies a suspected vulnerability must:

Good-faith reporting does not authorise further testing.

3.9 Platform observation and competitive misuse

Users must not use access to Sealroom to copy, map, systematically observe, study, test or analyse non-public Sealroom:

for the purpose of reproducing, reverse engineering, benchmarking for product development, developing or improving a competing product or service.

Users must not disclose non-public observations about Sealroom to personnel involved in designing, engineering, training, operating, marketing or improving a competing service.

This section does not prevent:

provided that the evaluation:

Sections 5.3 and 9 of the Terms apply.

3.10 Approved Competitor access

Where BSUM approves access by a Competitor, access is limited to:

Approval does not permit the Competitor to:

BSUM may require:

4. Logging, watermarks and monitoring

4.1 Watermarks

Protected pages may be displayed one page at a time in a protected viewer.

A protected page may contain a traceable watermark including:

The watermark fields and their purpose are disclosed to the User before the User first opens a protected document.

The fields must be limited to what is reasonably necessary for deterrence, tracing and investigation.

Network-address information may be retained in restricted security logs where justified. It is not displayed in a visible watermark unless the Security Specification identifies and documents a specific necessity for that Room.

4.2 Audit records

The Room may record:

The Security Specification identifies, at an appropriate level:

The substance of a User’s AI questions, searches, notes and Customer Results is not disclosed to the other transaction side or made available to BSUM personnel through ordinary Service functionality unless:

Technical processing by approved subprocessors remains subject to the Terms, applicable data-processing arrangements and the Security Specification.

4.3 Visibility of access information

Each User may access their own available access history.

Administrators may access security and access information concerning Users managed by their own organisation to the extent reasonably necessary for administration, compliance and security.

The Seller may receive information concerning access to its documents only to the extent stated in the Security Specification.

Unless the Buyer expressly shares it, the Seller must not receive:

If document-level or User-level Buyer access information is made available to the Seller:

By default the Seller sees which documents each Buyer organisation opened, not per-person timings. The Seller may ask a Buyer to share per-person reading detail; a Buyer administrator decides under the organisation's settings for the project, may withdraw the decision at any time, and the decision is recorded.

4.4 Misuse monitoring

The Room may evaluate content-free activity patterns for indications of misuse, including:

Misuse monitoring must be:

Alerts must contain only information reasonably necessary to investigate the event and may be disclosed only to authorised recipients identified in the Security Specification.

The substance of AI questions and Customer Results is not included in content-free security alerts sent to BSUM.

4.5 Seller document controls

Subject to the applicable Transaction NDA and Room configuration, a Seller may:

Withdrawal does not automatically remove copies or Customer Results that were already lawfully created outside the Room where the applicable Transaction NDA or other governing conditions permit their retention.

Withdrawal does not give the Seller access to or control over Buyer questions, notes or Customer Results.

5. Enforcement and incidents

5.1 Suspension

BSUM may suspend or remove access immediately for a User, organisation side or Room where BSUM reasonably believes that:

Suspension is a protective measure and does not by itself establish that a breach occurred.

BSUM will notify the affected Customer administrator of the suspension and its general reason without undue delay unless notice:

BSUM will review a continuing suspension periodically and restore access when the grounds no longer apply.

The Seller may separately remove access to its documents.

5.2 Investigation and evidence

BSUM may investigate suspected misuse using records lawfully available to it under the Terms and the Security Specification.

Where permitted by law and the Terms, BSUM may provide a relevant Seller, Buyer, Customer or competent authority with signed, content-free evidence reasonably necessary to investigate, prevent or enforce a suspected breach.

Before disclosure, BSUM must consider:

BSUM must not disclose the substance of Buyer-private analytical work under this section.

Except where prohibited by law or reasonably necessary to prevent imminent material harm, protect the Service, preserve evidence or stop continued unauthorised disclosure, BSUM will notify the affected Customer before disclosure.

5.3 Evidence preservation

Records preserved in connection with suspected misuse must be:

5.4 Transaction NDA enforcement

Each party to a Transaction NDA is responsible for enforcing its own rights under that agreement.

BSUM’s role is limited to its rights and obligations under the Terms, these Rules, the AI Use Notice, the Security Specification and applicable law.

5.5 Consequences and liability

A breach of these Rules may result in:

A breach may also give rise to liability under an applicable Transaction NDA.

Nothing in these Rules grants enforcement rights to a person who is not entitled to enforce the relevant agreement, except as expressly provided in the Terms.

5.6 Incident reporting

A User must notify their Customer administrator and BSUM without undue delay after becoming aware of:

5.7 Accidental capture or transfer

Where an unauthorised capture or external transfer occurs accidentally, the User must:

Prompt, complete and good-faith remediation may be taken into account when BSUM determines the proportionate response. It does not automatically excuse the underlying breach.

6. Survival and acceptance

6.1 Survival

The provisions concerning:

survive termination or loss of access to the extent stated in the Terms or required by their nature.

6.2 Acceptance

Each User accepts these Rules electronically as described in section 15 of the Terms.

The acceptance record identifies the User, Customer, document, version, time and exact-text fingerprint and records acceptance by the authenticated User.

Finnish law and the dispute provisions in the Terms apply. The English text prevails over any translation.