# BEAUTY FAMILY Terms of Use
Version 2026-10-13.4

## 1. Parties and purpose of the service

BEAUTY FAMILY is a software service for managing a beauty practice: maintaining client records and appointments, generating documents, recording services and using available integrations. The service operator is sole proprietor Kozachenko Valeriia Ihorivna, taxpayer identification number 3590800369; address: 37 Nauky Avenue, Kharkiv, Kharkiv Region, 61072, Ukraine; date of state registration: 30 June 2026; email for support, legal enquiries and personal data requests: familylawcompany@gmail.com.

A User is an adult with full legal capacity who uses the service for their professional activities, or an authorised representative of the relevant entity. A Client is a person for whom the User arranges an appointment or provides a service. The workspace owner determines employees' permitted access. The platform administrator manages the service and does not become a party to the medical or beauty service relationship between the User and the Client merely by providing the software.

The service is not a healthcare institution, emergency medical care, an electronic prescription or a substitute for mandatory medical information systems. Registration does not confirm the User's education, qualifications, licence or the lawfulness of their activities.

## 2. Acceptance of the Terms and electronic communications

These Terms constitute the Operator's offer regarding use of the service. After signing in, the User opens the available Terms and Privacy Policy, personally selects the checkboxes, which are unchecked by default, and clicks ‘Accept and continue’. The agreement for access is concluded when the server successfully records the acceptance. Merely browsing the website, signing in with Google or remaining silent does not constitute acceptance of the Terms.

The system records the account identifier, email, document version and checksums, the date and time of acceptance, acceptance of the Terms, acknowledgement of the Privacy Policy and confirmation of responsibilities for client data. The record is available to the User on the acceptance page. A new mandatory version requires renewed express acceptance; previous records are not overwritten. This action is not represented as a qualified electronic signature.

Acknowledgement of the Privacy Policy confirms receipt of information about processing, rather than blanket consent to any use of data. The User obtains any separate consents required from Clients. These checkboxes do not authorise advertising or recurring charges. To correct an acceptance error, discontinue use or obtain your data, contact the Operator; failure to accept does not deprive you of your statutory data rights.

The User keeps their contact details up to date. Electronic communications and operation records may be used as evidence, subject to applicable law and the right to challenge their authenticity. Generating a document does not authenticate the Client's signature.

## 3. Reference materials and medical decisions

All references concerning procedures, products, anaesthetics, doses, methods of administration, adverse reactions, risks, contraindications and aftercare are provided solely for information. They do not constitute individual advice, a medical prescription, a recommendation to use a particular method or product, confirmation of its suitability for a particular person, or authorisation for a medical intervention.

Decisions on diagnosis and treatment, product selection, dosage, administration method and treatment area are made by an appropriately qualified physician in the relevant specialty within a lawfully organised medical practice. The relevant sole proprietor or institution must hold the Ukrainian Ministry of Health licence to conduct business activities in medical practice; the physician must be entitled to work in the relevant specialty within that practice. For non-medical services, the User acts within their competence and applicable requirements.

An entry in the catalogue does not confirm registration in Ukraine, the lawfulness of a particular use, commercial availability or the User's competence. A reference to a foreign regulator or manufacturer does not replace Ukrainian registration where it is required. Before use, the User checks the current instructions for the specific formulation, appropriate sources, contraindications, interactions and individual circumstances.

Search, sorting, default values, reference examples and incomplete-field notices assist with completing documents and do not confirm the clinical correctness of a decision. Example quantities are not patient-specific doses. The User enters and verifies the final data. In an emergency, seek emergency medical assistance rather than relying on the service's reference materials.

## 4. Documents and legal materials

The service generates documents from selected templates and entered data. Before use, the User checks completeness, consistency with the actual circumstances, lawfulness, identifying details, wording and required signatures. Standard materials do not replace individual legal advice for a specific situation unless such advice has been commissioned under a separate arrangement.

Generating an Agreement and a comprehensive Service Order does not in itself replace actually informing the Client, obtaining appropriate consent, maintaining mandatory medical records, issuing a fiscal receipt or providing other documents required by law for the particular activity. Terms between the User and their Client do not impose an obligation on the Operator to perform a procedure.

A saved document version reflects the data at the time of generation. Subsequent catalogue changes do not overwrite historical documents. Corrections must be made in an appropriate manner that preserves an accurate history; falsifying signatures, consent, performance dates or service results is prohibited.

## 5. Account and access

New accounts are created by invitation from the service administrator or an authorised company or workspace administrator acting within their permissions. Open self-registration is not available. An invitation is linked to the email specified by the administrator; signing in with another address does not grant the invited access. Access for owners of new workspaces is approved by the platform administrator.

The User provides accurate information, has authority to act on behalf of the stated entity, protects their Google account and devices, and does not share their personal access with third parties. Employees use separate authorised accounts. Access must be revoked promptly for former employees and persons who no longer have authority.

The User reports suspicious sign-ins or leaks and cooperates in containing incidents. The mere fact that an operation was performed through an account does not relieve the Operator of investigating a substantiated report that the account was compromised. Available features, quantitative limits and duration are determined by the selected plan. Trial access for salons is provided separately.

## 6. Client data and lawful entry of data

Before creating a client or patient record, linking correspondence to it, or entering or importing client materials into BEAUTY FAMILY, the User independently obtains that person's separate, voluntary, specific and informed consent to processing their data in the service and retains evidence of it. These Terms do not permit those actions without such consent. The special procedure below applies to the minimum processing of an initial enquiry. A legal representative's authority must be verified separately.

The consent must identify BEAUTY FAMILY, the User as the data controller, the Operator, the processing purposes, the necessary categories of data, transfers for technical processing and the recipients involved, as well as the procedure for exercising rights and withdrawing consent. Where health information, photographs or other sensitive data are entered, the consent must clearly cover the relevant categories and purposes. The User provides the person with current processing information before obtaining consent.

The User independently documents and retains evidence of the separate consent, its content, date and the identity of the person who gave it, in a form that demonstrates that it was obtained. The User's acceptance of these Terms, the Client's consent to a procedure, or the signing of an Agreement or Service Order does not replace that separate consent. The service does not include this consent in the Agreement and Service Order it generates; the User arranges to obtain it separately.

The User observes medical confidentiality and other applicable professional secrecy, enters only necessary data and limits access to authorised persons. Consent to processing in the service is not a general authorisation to disclose, publish or use data for advertising and does not override specific statutory restrictions. A Client's consent does not authorise entering other people's data without an appropriate basis.

After consent is withdrawn, the User stops entering new data and carrying out other operations that relied on it, and provides the Operator with lawful instructions to restrict or erase data without undue delay. Further retention is permitted only on a separate appropriate legal basis and to the extent necessary. Obtaining consent does not relieve the Operator of its own obligations regarding security, confidentiality and lawful data processing.

Health information and other special categories require a separate appropriate legal basis. It must not be assumed that every beauty activity automatically qualifies for the healthcare exception. Importing from a previous system does not remove these requirements. The Operator does not require medical documents, questionnaires or photographs to be sent to general support; examples of errors should be anonymised.

Consent to a procedure, taking photographs, processing data and publishing photographs for advertising are separate matters. Refusing advertising use is not equivalent to refusing necessary documentation. The service's current main forms are intended for adult Clients; a declaration of adulthood must not be used for a minor or replace verification of representation.

An initial enquiry in a connected channel may be received before a client record is created. The User gives advance notice of processing through the service and determines an appropriate legal basis for receiving and responding to it. Where a person requests a service or information about its terms, the minimum processing necessary to handle that request may take place to prepare a contract at that person's request. This is not a general authorisation to transfer correspondence history, advertise, create a full client record or process sensitive data. For other enquiries, the User separately determines the applicable basis; if none exists, the User stops processing and arranges deletion.

Before a channel starts operating, its public profile, bot description or accessible notice must explain that correspondence is received in the service's workspace, identify the data controller and who may reply, and explain where to read the Privacy Policy and how to make a data request. The Operator provides public documents; the User ensures that their correspondents are informed. Case materials, medical information and other unnecessary sensitive data should not be requested in initial correspondence. Protected materials received unexpectedly must not be used for new purposes and must be referred to the responsible person for restricted handling.

Creating a record, selecting an existing record and booking a consultation or appointment are separate actions by an employee. The employee verifies the person's identity, authority and the scope of the consent obtained. The employee's confirmation in a form is their statement that they have fulfilled this responsibility, not consent given by the Client. Sending a message, connecting a channel and the workspace owner's acceptance of the Terms do not replace the Client's separate consent to these actions.

Where the GDPR applies, the controller separately checks the bases under Articles 6, 9 and 10. Consent required by the service must not be fictitious, coerced or broader than the necessary purposes; consent to optional advertising is not a condition of the main service. If the applicable legal regime does not permit the chosen processing method, the relevant data must not be entered into the service.

## 7. Prohibited use

The service must not be used for unlawful medical or other activities, activities without the necessary rights or licences, fraud, document forgery, concealment of illegal operations, unlawful collection or disclosure of data, breaches of medical confidentiality, harassment, discrimination or infringement of intellectual property rights.

Uploading malicious code, bypassing authentication or access permissions, attempting to obtain other workspaces' data, transferring other people's keys, automatically collecting non-public data, creating spam or phishing, conducting unauthorised load attacks or deliberately disrupting the service is prohibited. Research permitted by law and good-faith reporting of vulnerabilities do not constitute violations merely because they criticise the product.

Medical or beauty treatment photographs may be stored only lawfully, to the extent necessary and with restricted access. This does not authorise sharing intimate materials without consent or illegal images of children. The Operator may request evidence of authority or lawful use proportionate to the specific risk, without routinely demanding medical records.

## 8. Subscription, payment and automatic renewal

Under this version, access to the software service is provided without automatic charges or recurring debits. A plan designation or trial period shown in the workspace determines the available features and limits and does not in itself create a payment obligation. Payments by a beauty practitioner's Clients for the practitioner's services are not payments to the Operator for the software.

Introducing paid features will require separate information about the services included, price, term, payment, renewal and refunds, and a properly placed order by the User. Free or trial access does not automatically become paid access. These Terms do not authorise the Operator to debit funds.

## 9. Refunds

The Operator does not charge for access under this version. Anyone who believes they have received an erroneous payment demand on behalf of the service should contact familylawcompany@gmail.com, stating the date, amount and transaction identifier without providing full card details. Future payment and refund rules will be communicated before a paid service is ordered; the User's mandatory statutory rights are preserved.

## 10. Integrations, communications and availability

Google provides sign-in, while Gmail and Google Drive are connected separately with the User's permission. Signing in with Google alone does not grant access to a mailbox. Saving a document to Drive and sending an email create copies in the relevant service or with the recipient. The Operator does not guarantee uninterrupted operation of external providers.

The User checks recipients and has an appropriate basis for mailings; a service reminder does not legitimise advertising without the necessary consent. Delivery of email or an external notification is not guaranteed. In the current version, automatic reminders and campaigns are sent by email. Employees may also reply in connected Instagram and Telegram conversations; these are not SMS messages or automatic advertising campaigns.

The Operator maintains operation within the agreed plan, may perform justified technical maintenance and gives notice of planned significant restrictions. Uninterrupted, error-free operation and a particular availability percentage are not promised without a separate SLA. This does not remove the obligation to remedy the Operator's own defects and fulfil its obligations. The User must have a way to continue critical appointments if the service is unavailable.

The User connects only a mailbox or drive they are entitled to use for the workspace. Connecting an address for the whole team allows the server to act through it according to workspace settings, including in the background. Before connecting or revoking access, the User separately confirms the consequences; the procedure and its distinction from data deletion are described in the Privacy Policy and at https://beauty.familylawcompany.online/data-controls.

Mailing purchased addresses or addresses collected without a proper basis, disregarding advertising opt-outs, impersonating senders and bypassing the email provider's limits are prohibited. The User ensures appropriate consent to advertising emails and an accessible opt-out mechanism, and honours opt-outs. Advertising campaigns must not be disguised as service communications, and service emails must not be used to bypass an advertising opt-out.

Google Drive is used to export generated documents following an action selected by the User or an enabled rule. The connection is not intended to back up the entire CRM database, service keys or arbitrary application content, distribute files in bulk or circumvent storage limits. Copies on Drive remain under the drive owner's control; deleting a record in BEAUTY FAMILY does not automatically delete those copies.

Instagram and Telegram are connected separately by the workspace owner or an authorised manager. They must be entitled to manage the relevant professional account, bot or permitted business connection, determine which employees have access and ensure that transferring correspondence is lawful. Instagram is used for messaging, not as a new way to sign in to the CRM. Telegram Business passes only the chats made available to the bot through the owner's settings; these must not become active CRM conversations before the owner confirms them.

A connection allows the server to receive events and store authorised correspondence even while the browser is closed. Employees may read and send replies within their granted permissions. Connecting another person's account, extending access to personal chats without authority, bypassing platform restrictions, concealing bot operation or sending unwanted messages is prohibited. Advertising use requires a separate basis and compliance with platform rules.

Feature availability depends on the permissions, mode and app review of the external platform, the connection status and its time limits for replies. The Operator does not claim a partnership with or approval already obtained from Meta or Telegram. Missing messages or delivery confirmations must be checked; the User must not rely on a messenger as the sole channel for critical deadlines.

The current TikTok module stores the profile name and offers an external link. Receiving TikTok Direct messages through an API has not been implemented. For Instagram and Telegram attachments, the CRM displays a service marker rather than downloading the media file itself. A text caption or shared contact may form part of the correspondence.

Disconnecting stops new use of the channel in the CRM and clears its active key. It does not mean deletion of history, client records or all permissions on the external platform. Separate instructions are provided on the data controls page. History must not be retained longer than needed for the lawful purpose communicated to the person.

## 11. Rights to the service, templates and data

The Operator uses the combined FAMILY LAW COMPANY trademark (certificate No. 361207 dated 2 April 2025; owner: Kozachenko Vladyslav Vitaliiovych), software and document templates under licence agreement No. 1 dated 1 August 2026. Granting a right of use does not transfer ownership of the trademark. These Terms do not describe the service name as a separately registered trademark.

The Operator grants a limited, non-exclusive right to use the available features and templates for the User's own lawful activities during the access period. The User may save, print and use properly generated documents after access ends. Obtaining access does not transfer exclusive rights to the software, brand or template library.

Reselling the service or template catalogue as a standalone product, unlawfully copying code or using trademarks in a way that suggests a partnership or guarantee is not permitted. These restrictions do not remove rights that the law expressly allows to be exercised without the rights holder's consent.

Client data does not become the Operator's property. The User grants only the authority necessary to store, process and transfer it to recipients connected by the User for the purpose of providing the service. This is not a licence to sell medical data, advertise on its basis or use it to train artificial intelligence models.

## 12. Access restrictions and termination

The Operator may restrict access proportionately because of a confirmed material breach, a security threat or a binding lawful requirement. Where possible, the User is warned and given time to remedy the issue. Immediate restrictions are permissible in the event of an urgent risk; the reasons and means of challenging the restriction are communicated unless the law prohibits disclosure. Disagreement with criticism of the service alone is not a reason to block access.

When the access period ends, new operations may be restricted, but the Operator provides a lawful means of obtaining the User's data and historical documents; security restrictions may require prior identity verification. Access to one's own data must not be used as unconditional security in a payment dispute.

The User may discontinue use and request account closure, export and deletion of data. Before deletion, the User checks mandatory document retention periods and their authority regarding client data. Account closure and data deletion are separate actions; their consequences are agreed in accordance with the Privacy Policy and the data processing addendum. A request may be submitted through ‘My data requests’ or the contact email; the ‘Received’ status confirms that the request was registered, not that deletion has been completed.

Reports of illegal content, privacy violations or dangerous use of the service should be sent to familylawcompany@gmail.com with sufficient information for verification. The Operator reviews reports, restricts processing or access where there is an appropriate basis, and provides affected persons with the information that can be disclosed, taking account of other people's rights and professional secrecy.

## 13. Liability and protection of legitimate interests

The User is responsible for their own clinical decisions, the quality of the services they provide, their education and licensing basis, the accuracy of entered data, appropriate client consent and the use of generated documents. The Operator is responsible for its own performance of the agreement, security and data processing under applicable law. An informational disclaimer does not relieve the Operator of liability for its own unlawful conduct.

The domain owner, software rights holder and hosting provider do not become a physician, product seller, representative of the User or party to the agreement with the User's Client merely by performing their technical role. Each is responsible for their own actions and obligations under the law and their contract. These Terms do not give third parties absolute immunity or amend agreements to which the User is not a party.

Liability is determined by applicable law, taking account of a proven breach, damage, causation and fault where required. Free access does not relieve the Operator of liability for its own unlawful acts. These Terms do not exclude liability that the law prohibits limiting, including liability for intentional breaches, and do not restrict mandatory consumer rights where applicable.

If a breach by the User gives rise to substantiated third-party claims against the Operator, the User compensates proven losses and reasonable necessary costs to the extent caused by their culpable actions and established by agreement or a proper decision. The Operator promptly informs the User of the claim, allows participation in the defence, and does not shift the consequences of its own breach or a settlement it entered into unilaterally onto the User.

## 14. Force majeure, changes and disputes

An extraordinary event that is unavoidable in the particular circumstances may relieve a party of liability only to the extent of its proven causal effect. Merely referring to war, outages, a cyberattack or a contractor's failure does not prove that performance was impossible. The party informs the other of the impediment, minimises its consequences and performs the part of its obligations that remains possible.

The Operator gives advance notice of material changes through the service or by email, generally at least 30 calendar days in advance, except for urgent changes required by law or to protect security. For the first published version, access is granted after acceptance. Previous versions and acceptance records are retained; a new version does not retrospectively change past legal relationships. The User may discontinue use and request export and deletion of data.

Ukrainian law applies. Enquiries are sent using the Operator's contact details; the parties first attempt to resolve disputes through negotiation. This does not remove the right to apply to a competent court or the Ukrainian Parliament Commissioner for Human Rights. The invalidity of an individual provision does not automatically invalidate the rest of the Terms. Mandatory provisions of law take precedence.

Version 2026-10-13.4 supplements the rules for social channels. For a new User, and for a User who voluntarily accepts this version to use social channels, it applies after acceptance is recorded. For core CRM features, an existing acceptance of version 2026-10-07.3 remains valid for 30 calendar days from publication of the notice of the new version. After that period, renewed acceptance is required to continue; access to data requests and the contact email remains available. The new rules do not retrospectively alter past actions. The Operator announces the update on the service page and provides the stated period; the date on which a file was prepared is not itself the publication date.

## Addendum. Instructions for processing client data

A. Subject matter. The User, as controller, instructs the Operator, as processor, to process client data solely to provide the selected service features. Categories of persons: Clients, legal representatives where the relevant scenario applies, and authorised employees. Categories of data: contact and identifying information, appointments, questionnaires, health information, services, products, photographs, documents, messages and technical identifiers, only to the extent lawfully entered. Operations: receipt, storage, structuring, display to authorised persons, file generation, transfer through an authorised integration, backup, correction and deletion.

A.1. Prerequisite for the instructions. The User obtains the Client's or patient's separate consent and safeguards professional secrecy in accordance with section 6 of the Terms. Instructions to the Operator do not replace that consent or extend its scope.

B. Instructions. The instructions are defined by these Terms, workspace settings, permitted User actions and separate documented lawful requests. The Operator does not use client data for its own advertising, sales, profiling or AI training. If an instruction clearly violates the law or exceeds the service's capabilities, the Operator informs the User and suspends its execution until the issue is properly resolved.

C. Confidentiality. Authorised employees and contractors are bound by confidentiality obligations, have only necessary access and may not arbitrarily inspect client data. Administrator access through the standard panel does not include client records, questionnaires, photographs or documents from other workspaces. Server-side processing and privileged technical access are described in the Privacy Policy without promising end-to-end encryption, which the current version does not provide.

D. External providers. The Operator engages only necessary providers with appropriate contractual obligations and describes their functions in the Privacy Policy. For a planned material change of provider affecting client data, the Operator gives advance notice and considers reasonable objections. If the risk cannot be resolved, the parties agree on discontinuing the relevant feature, exporting data and making appropriate financial settlements. Engaging a contractor does not remove the Operator's obligations to the User.

E. Rights and incidents. The Operator assists the User in responding to lawful requests for access, correction, restriction, export and deletion within its functions. A Client's request concerning a medical record is forwarded to the relevant controller after verification, without disclosing data to an unauthorised requester. Once the Operator becomes aware of a personal data breach affecting workspace data, it notifies the User without undue delay, providing the known circumstances, categories of data, consequences and measures taken. Notifications are made within the periods required by applicable law and the nature of the incident.

F. Completion. On the User's lawful instructions, the Operator arranges the return or deletion of data, taking account of mandatory retention and the protection of rights in a specific dispute. Clearing the live database, private files, backups and external copies involves separate operations. Requests are sent to familylawcompany@gmail.com and fulfilled after authority is verified; the reasons, scope and duration of any lawful deferral are communicated to the requester. Account closure does not mean immediate erasure of all backups. Restoration from a backup must respect lawful deletion requests that have already been fulfilled.

G. Verification of compliance. On a reasoned request from the controller, the Operator provides the available information needed to demonstrate compliance with these instructions, agrees on a proportionate verification method and assists with risk assessment within the scope of its processing. Verification does not grant access to other users' data, secret keys or information whose disclosure would create a security risk. Specific audit requirements under applicable law remain in force.

H. Social channels. The instructions also cover correspondents in connected business channels, their identifiers, available names, message text, times, statuses and links to client records. Initial enquiries are processed only to reply and prepare the requested service under section 6; subsequent entry of client data requires the separate consent specified there. The controller determines the lawful purpose, authorised employees and necessary retention period; the Operator carries out the permitted technical instructions.

H.1. Return and deletion of social data cover not only the client record but also separate conversations, messages, links, activity logs, technical identifiers, keys and relevant backups. Copies on the external platform and held by the correspondent are controlled separately. The Operator's obligations concerning its own breaches and compliance with lawful requirements are not transferred to the User.

I. GDPR Article 28 terms. The instructions apply for the period of providing the agreed features and bringing processing to a controlled end. This addendum defines the subject matter, operations and categories of data and persons. The controller may issue documented lawful instructions; it determines purposes and legal bases and is responsible for communicating them to individuals. The Operator processes data only on those instructions, including for international transfers, unless Union or Member State law applicable to the processor requires otherwise; it informs the controller of that requirement before processing unless that law prohibits notification on important grounds of public interest. Requirements of authorities in third countries are assessed separately, including under Article 48 and Chapter V of the GDPR, and do not automatically authorise departure from the instructions.

I.1. Authorised persons must maintain confidentiality. The Operator implements the measures under Article 32 and assists with individuals' rights and compliance with Articles 32–36, taking account of the nature of processing and the information available. It immediately informs the controller of any instruction that it considers to infringe data protection rules.

I.2. Acceptance of this addendum constitutes general written authorisation for the necessary subprocessors identified in that role in the Privacy Policy. The Operator gives at least 30 calendar days' advance notice of planned additions or replacements and an opportunity to raise a reasoned objection before engagement. Equivalent data protection obligations are imposed on the subprocessor; the Operator remains responsible to the controller for their performance. Independent platforms do not become subprocessors merely because they are mentioned in the Privacy Policy.

I.3. At the end of processing, the Operator returns or deletes the data and existing copies at the controller's choice, except where retention is required by Union or Member State law; its basis, scope and duration are documented. The Operator provides the necessary evidence of compliance and permits and assists with proportionate audits and inspections by the controller or an authorised auditor. Organisational arrangements protect other clients' data but do not remove the right to audit.

I.4. For processing subject to the GDPR, the specific rules in clauses I–I.4 take precedence in the event of a conflict with the general processing instructions. The Operator's own minimum records for a separate lawful purpose do not authorise retaining the entire client dataset after the instructions end.