Effective Date: 30 October 2026

Vula Medical (Pty) Ltd ("Vula", "we", "us", "our") uses artificial intelligence to help our users, being healthcare practitioners, communicate, refer patients and keep accurate records more efficiently. We believe AI may enhance the use of the Vula Platform, subject to responsible and transparent use and under the control of the healthcare practitioner. This Artificial Intelligence Policy ("AI Policy") explains how we use AI on the Vula Platform, what we commit to, and what we require from users using AI Features.

1. ABOUT THIS AI POLICY

1.1 This AI Policy applies to the Vula Medical App, the Vula Online Web Portal and the Vula Medical Website (together, the "Platform") and to all AI Features made available on the Platform.

1.2 This AI Policy forms part of, and is incorporated by reference into, the Licensed Application End User Licence Agreement ("EULA") and the Website Terms of Use. By using an AI Feature, you agree to this AI Policy. If there is a conflict between this AI Policy and the EULA, the EULA prevails, except where this AI Policy places a more specific obligation on Vula in relation to AI Features, in which case this AI Policy prevails to that extent.

1.3 This AI Policy must be read together with our Privacy Policy and our Patient Privacy Notice, which explain in more detail how we process personal information. Capitalised terms not defined in this AI Policy have the meanings given to them in the EULA, the Privacy Policy or the Protection of Personal Information Act 4 of 2013 ("POPIA").

2. DEFINITIONS

2.1 In this AI Policy:

2.2 "AI" means artificial intelligence, including machine learning, speech recognition and large language models, and other techniques by which software generates outputs such as text, transcripts, classifications, summaries or suggestions.

2.3 "AI Feature" means any feature of the Platform that uses AI, as described in clause 4.

2.4 "AI Output" means any content generated by an AI Feature, including a transcript, summary, suggestion or classification.

2.5 "De-identified Information" means information from which a person cannot be identified by any reasonably foreseeable method, prepared in accordance with Vula's de-identification standard.

2.6 "Patient Information" means personal information and special personal information about a patient that is entered into or generated on the Platform.

2.7 "User" or "you" means a registered healthcare practitioner, healthcare student, administrator or other person authorised to use the Platform.

3. OUR COMMITMENTS

3.1 When we design, provide and improve AI Features, we commit to the following:

(a) Healthcare practitioners make the diagnosis, not AI: AI Features assist you. They do not make clinical decisions, and they do not take action on a patient's care without a User's review and approval.

(b) Transparency: We tell you which features use AI, and we label AI Output as AI-generated.

(c) Privacy and confidentiality: We process personal information in AI Features in a manner that protects their confidentiality, in accordance with POPIA, the National Health Act 61 of 2003, the Privacy Policy and the Patient Privacy Notice. We do not sell identifiable personal information or Patient Information, and we do not share personal information or Patient Information in identifiable form with third parties to train their AI models.

(d) Safety and quality: We test AI Features before release, monitor their performance after release, and suspend or withdraw features that do not perform safely.

(e) Fairness: We assess AI Features for differences in performance across the settings, languages and users of the Platform, and work to reduce them.

(f) Accountability: Every AI Feature has an accountable owner at Vula, and AI is subject to oversight by Vula's management and Board.

(g) Compliance: We use AI in accordance with applicable law, including POPIA, the National Health Act and, where relevant, the requirements of the South African Health Products Regulatory Authority (SAHPRA).

4. AI FEATURES ON THE PLATFORM

4.1 Call transcription: This feature is optional. A User chooses whether to place a recorded call or a standard call, and a transcript is produced only for recorded calls. Where a User places a recorded voice call through the Platform, the recording is converted into a written transcript using automated speech-recognition technology. The transcript is saved to the referral, is marked as automatically generated and not verified, and cannot be edited. The audio recording remains the primary record of the discussion, and corrections are recorded as a separate note on the referral.

4.2 We may introduce further AI Features from time to time. A current list of AI Features is available on request.

4.3 Before introducing an AI Feature that summarises, analyses or interprets clinical information, we will notify Users and update this AI Policy, the Privacy Policy and the Patient Privacy Notice where required. Where reasonably possible, we will make new AI Features optional.

5. WHAT AI FEATURES ARE NOT

5.1 AI Features do not provide medical advice, diagnosis or treatment recommendations, and must not be used for that purpose. Unless we expressly state otherwise in relation to a specific feature, AI Features are not intended to be medical devices, as regulated by the South African Health Products Regulatory Authority (SAHPRA).

5.1 AI Output may be inaccurate, incomplete or out of date. Speech recognition may be less accurate for some languages, accents, medical terms and noisy environments. AI Output is not a verbatim or authoritative record and must be reviewed and considered carefully before relying on it.

5.3 AI Features are not an emergency service and must not be relied on where an immediate response is required.

6. YOUR RESPONSIBILITIES WHEN USING AI FEATURES

6.1 When you use an AI Feature, you agree to:

(a) review AI Output carefully before relying on it, sharing it or including it in a patient's record and accept full responsibility for any reliance on AI Output;

(b) exercise your own professional judgment - you remain solely responsible for clinical decisions, in accordance with the laws and professional rules that apply to you, including those of the Health Professions Council of South Africa, the South African Nursing Council or the Allied Health Professions Council of South Africa, as applicable;

(c) correct any inaccurate AI Output in the manner provided on the Platform (for transcripts, by adding a separate note to the referral);

(d) enter into the Platform only the Patient Information that is necessary for the referral or consultation;

(e) ensure that patients have been informed about the use of the Platform, including AI Features, as described in the Patient Privacy Notice, and that any consent required by law or your professional rules has been obtained, including, where you record that a patient has consented to the de-identification of their information, that this consent was in fact obtained;

(f) not use an AI Feature, or AI Output, as the sole basis for a decision that has legal consequences for, or significantly affects, any person;

(g) not attempt to manipulate, bypass, reverse engineer or extract data from an AI Feature (including through prompts designed to make it behave contrary to its purpose), or use it for any unlawful purpose; and

(h) report any inaccurate, harmful, biased or unexpected AI Output to us as soon as possible, using the contact details in clause 15.

7. HOW WE USE INFORMATION IN CONNECTION WITH AI

7.1 To provide AI Features to you, we process personal information and Patient Information on your behalf, as your operator, in accordance with the EULA and the Patient Privacy Notice.

7.2 We may use information processed on the Platform to develop, test, monitor and improve AI Features. We use De-identified Information for these purposes wherever reasonably possible. Where Patient Information is used, we do so only as authorised by the EULA (or any separate agreement with the relevant practice or facility), and only in accordance with POPIA. We de-identify Patient Information to develop AI Features, or to make it available to third parties to develop their own AI models, only where the patient’s consent to de-identification has been recorded, as described in the EULA and the Patient Privacy Notice.

7.3 The third-party providers that support our AI Features are not permitted to use your personal information or Patient Information to train their own AI models.

7.4 We do not sell identifiable personal information, and we do not provide identifiable Patient Information to third parties for the purpose of training their AI. De-identified Information is not personal information. We may make De-identified Information available to third parties, including under licence or by sale, including for the development, training and testing of their own AI models, as described in the Privacy Policy and the Patient Privacy Notice.

7.5 Information relating to particularly sensitive health conditions is subject to additional safeguards, and is not used to develop AI Features except under specific, approved safeguards.

8. THIRD-PARTY AI PROVIDERS AND WHERE INFORMATION IS PROCESSED

8.1 Some AI Features are provided with the assistance of third-party technology providers, such as speech-recognition and cloud-hosting providers. These providers process information on our behalf, on our documented instructions, under written agreements or agreed terms and conditions that require them to keep the information confidential and secure.

8.2 Some of these providers process information outside South Africa (our cloud hosting is provided on Amazon Web Services data centres in Europe, and our real-time communications provider processes call audio in the United States). Where this happens, we transfer information only in accordance with section 72 of POPIA, as described in the "Transborder Flow" sections of the Privacy Policy and the Patient Privacy Notice. The categories of provider we use are set out in the Privacy Policy, and a current list is available on request from our Information Officer.

9. HUMAN OVERSIGHT AND SAFETY

9.1 AI Output is labelled as AI-generated. Where an AI Feature produces clinical content, the Platform is designed so that a User must review and approve that content before it is used, and that approval is recorded.

9.2 We monitor AI Features for errors, changes in performance and the rate at which Users correct AI Output. We may suspend, modify or withdraw any AI Feature at any time, including to address a safety, quality or legal concern.

9.3 We do not provide AI Output directly to patients.

10. INFORMATION FOR PATIENTS

10.1 If your healthcare practitioner uses the Platform, AI Features may assist them - for example, by producing a written transcript of a call with a specialist about your care. Your healthcare practitioner remains responsible for decisions about your care, and AI does not make those decisions.

10.2 Your healthcare practitioner, or the practice or facility treating you, is responsible for your health information. If you have questions about how your information is used, or wish to access or correct it, please contact them first. You may also contact our Information Officer, who will refer your request to your healthcare practitioner and assist them to respond.

11. YOUR RIGHTS

11.1 You have the rights set out in the Privacy Policy, including the right to request access to and correction or deletion of your personal information, the right to object to certain processing, and the right not to be subject to a decision based solely on automated processing, subject to the limitations in POPIA.

11.2 If you are not satisfied with how we have handled your personal information, you may lodge a complaint with the Information Regulator (South Africa): JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001; email: enquiries@inforegulator.org.za; website: https://inforegulator.org.za.

12. REPORTING CONCERNS ABOUT AI

12.1 If you believe an AI Feature has produced inaccurate, harmful or biased output, or that information has been mishandled, please contact us using the details in clause 15. Please do not include Patient Information in your report unless it is necessary - where possible, refer to the referral by its reference number.

12.2 We will investigate reports, take appropriate action, which may include suspending the AI Feature concerned, and, where a report concerns a security compromise, follow the notification procedures described in the Privacy Policy and the Patient Privacy Notice.

13. LIMITATION OF LIABILITY

13.1 AI Features and AI Output are provided as aids to your professional practice. To the extent permitted by law, and subject to the limitation of liability provisions of the EULA and the Website Terms of Use, Vula is not liable for any loss or harm arising from reliance on AI Output, whether or not it has been reviewed by a User, or from use of an AI Feature contrary to this AI Policy.

13.2 Nothing in this AI Policy excludes or limits Vula's liability for fraud, wilful misconduct or gross negligence, or any liability that cannot lawfully be excluded or limited, including under the Consumer Protection Act 68 of 2008 or POPIA as applicable.

14. CHANGES TO THIS AI POLICY

14.1 We may update this AI Policy from time to time, including when we introduce, change or withdraw AI Features or when the law changes. The Effective Date at the top of this AI Policy shows when it was last updated.

14.2 We will notify Users of any material change by notice in the Vula Medical App or Web Portal, or by email to the address associated with their Vula account. Continued use of an AI Feature after a change takes effect constitutes acceptance of the updated AI Policy.

15. CONTACT US

15.1 For any questions regarding this AI Policy or to report a concern relating to an AI Feature, please contact us using the following contact details:

(a) General and support queries: support@vulamedical.com.