Terms of service

1. Acceptance of Terms

By creating an account, accessing or using the Service you agree to be bound by these Terms of Service ("Terms") and our Privacy Policy, incorporated herein by reference. If you are entering into these Terms on behalf of a company or other legal entity, you represent that you have the authority to bind that entity.

If you do not agree to these Terms in their entirety, you may not access or use the Service.

2. Description of Service

Stasio is a cloud-based practice management platform for therapy centres and medical clinics, operated by Mercano Global SRL. The Service provides tools for appointment scheduling, patient record management, clinical documentation, staff coordination, financial tracking and related operational functions ("the Service").

3. Eligibility

The Service is intended exclusively for use by registered businesses, healthcare practitioners and legal entities operating in a professional capacity. You must be at least 18 years of age. The Service is not a consumer product and is not directed at individuals acting in a personal or non-professional capacity. To the extent permitted by applicable law, rights and protections afforded exclusively to consumers under Romanian and EU consumer legislation do not apply to commercial use of this Service.

4. Accounts and Security

You are responsible for maintaining the confidentiality of your account credentials and for all activity that occurs under your account. You must notify us immediately of any suspected unauthorised access. We are not liable for losses arising from unauthorised use of your credentials.

You must provide accurate and complete information when registering and keep it up to date. You may not impersonate any person or entity or misrepresent your identity or affiliation.

5. Subscriptions and Billing

Access to the Service requires an active paid subscription. The following terms apply:

Subscriptions are billed on a monthly basis in advance.
Payments are processed by Paddle Payments Ltd. / Stripe Payments Europe Ltd. (Ireland). By subscribing, you also accept Paddle's / Stripe's terms of service and privacy policy.
Subscriptions automatically renew at the end of each billing period unless cancelled before the renewal date through the billing settings in the platform.
We reserve the right to change subscription prices. We will provide at least 30 days' advance notice of any price change. Continued use of the Service after the new price takes effect constitutes acceptance.
Except where required by applicable law, subscription fees are non-refundable. No refunds or credits are issued for partial billing periods, unused features or downtime not caused by us.
If a payment fails, we will retry payment collection for up to 5 days. If payment is not collected within that period, access will be suspended. During suspension, data remains intact but the Service is inaccessible. The 90-day account deletion clock does not start during an active suspension period.

6. Data Processing Agreement

This section constitutes the Data Processing Agreement (DPA) between you ("the Controller") and Mercano Global SRL ("the Processor") in accordance with Article 28 of Regulation (EU) 2016/679 (GDPR) and Romanian Law 190/2018 implementing GDPR in Romania. By accepting these Terms you enter into this DPA.

6.1 — You are the Data Controller

When you use the Service to store, manage or process personal data about your patients, clients, staff or other individuals, you are the Data Controller within the meaning of Art. 4(7) GDPR. You independently determine the purposes and means of that processing.

6.2 — We are the Data Processor

Mercano Global SRL is the Data Processor within the meaning of Art. 4(8) GDPR. We process personal data uploaded to or generated within your account solely to provide the Service and only on your documented instructions as set out in these Terms. We do not process such data for any independent purpose.

6.3 — Your Sole Responsibility as Data Controller

You acknowledge that as Data Controller you are solely and exclusively responsible for all of the following:

Establishing and maintaining a valid legal basis under Art. 6 GDPR — and, where applicable, Art. 9 GDPR for special category data such as health data — for each category of personal data you upload or process through the Service.
Complying fully with all applicable data protection and privacy laws in your jurisdiction, including GDPR, national implementing legislation, and any sector-specific laws governing medical, health or therapy records.
Complying with local data retention obligations applicable to clinical and medical records in your country. For Romanian practitioners this includes, without limitation, Law 46/2003 on patients' rights, Law 95/2006 on healthcare reform and all applicable ministerial orders governing medical record retention periods, which typically require retention of 10–25 years depending on record type — periods that far exceed our 90-day post-expiry account deletion window. You must export and retain records in accordance with these obligations before your subscription lapses.
Providing all required privacy notices to and, where necessary, obtaining all valid consents from your patients, clients and staff before uploading their data to the Service.
Responding to data subject rights requests (access, rectification, erasure, restriction, portability, objection) from your patients, clients and staff within the timeframes required by applicable law.
Maintaining records of processing activities as required by Art. 30 GDPR.
Conducting Data Protection Impact Assessments (DPIAs) where required by Art. 35 GDPR.
Ensuring your staff are adequately trained on data protection and bound by appropriate confidentiality obligations.
Implementing appropriate access controls and security practices within your own organisation when accessing the platform.

Mercano Global SRL accepts no liability for your failure to fulfil any of the above obligations. Any regulatory penalties, supervisory investigations, fines, claims or losses arising from your breach of your data controller obligations are your sole responsibility and are not covered by the limitation of liability in Section 10.

6.4 — Our Processor Obligations

Mercano Global SRL undertakes to:

Process personal data only on your documented instructions and for no other purpose;
Ensure that all persons authorised to process personal data are subject to binding confidentiality obligations;
Implement and maintain appropriate technical and organisational security measures in accordance with Art. 32 GDPR (see our Privacy Policy, Section 8);
Engage sub-processors only as listed in our Privacy Policy, imposing equivalent data protection obligations on each. The sub-processor list may be updated from time to time; you are responsible for reviewing the Privacy Policy periodically to stay informed of any changes;
Assist you, to the extent reasonably practicable and at your cost, in fulfilling your obligations to respond to data subject rights requests;
Assist you, to the extent reasonably practicable, with your obligations under Arts. 32–36 GDPR (security measures, breach notification, DPIAs and prior consultation with supervisory authorities);
Notify you without undue delay upon becoming aware of a personal data breach affecting your data;
At your election, delete or return all personal data upon termination of the Service, subject to any data we are legally required to retain;
Make available all information reasonably necessary to demonstrate compliance with Art. 28 GDPR and allow for audits or inspections conducted by you or your appointed auditor, subject to reasonable advance notice and confidentiality obligations.

6.5 — Subject Matter and Processing Details

Nature and purpose: Providing the Service as described in Section 2, including storage, retrieval and operational processing of practice data on your behalf.
Duration: For the term of your active subscription and as specified in Section 7.
Types of personal data: Names, contact details, dates of birth, appointment records, clinical notes, session documentation, uploaded files, therapy goals, progress records and session payment references.
Categories of data subjects: Your patients and clients, their guardians or authorised contacts, and your staff members.

7. Data Retention and Deletion

7.1 — Active Subscriptions

All practice data is retained and fully accessible for the duration of an active subscription.

7.2 — 90-Day Post-Expiry Deletion

Permanent deletion notice. If your trial / subscription expires and is not renewed, your account enters a read-only grace period. If the subscription is not reactivated within 90 calendar days of the expiry date, all practice data associated with your account will be permanently and irreversibly deleted. This includes all patient and client records, clinical notes, appointments, uploaded files, goals, staff data and all related personal data. This deletion cannot be reversed or recovered under any circumstances, by any means. We will send email reminder notices before the final deletion date.

7.3 — Your Export Obligation

The Service provides a GDPR-compliant data export function. You are solely responsible for exporting your data and ensuring it is retained in accordance with all applicable data retention laws before your subscription lapses. Mercano Global SRL is not liable for any data loss, regulatory consequence, civil claim or legal liability arising from your failure to export data before the 90-day deletion window expires.

7.4 — Account Closure on Request

If you request voluntary account closure, all practice data will be permanently deleted within 30 days of the closure request, subject to data we are legally obliged to retain (such as billing records required by Romanian fiscal law).

8. Acceptable Use

You agree not to:

Use the Service for any unlawful purpose or in violation of any applicable regulation;
Upload or process data you are not lawfully authorised to process;
Attempt to gain unauthorised access to any part of the Service, its infrastructure or another user's data;
Introduce malicious code, conduct denial-of-service attacks or otherwise interfere with the Service;
Reverse-engineer, decompile or disassemble any part of the Service;
Resell, sublicense or redistribute access to the Service without our prior written consent;
Send unsolicited communications through the Service;
Circumvent security controls, access controls or multi-tenancy isolation mechanisms.

We reserve the right to suspend or terminate your access immediately and without notice upon discovery of any serious prohibited use.

9. Intellectual Property

The Service, including its software, design, trademarks and non-customer content, is owned by Mercano Global SRL and protected by applicable Romanian and EU intellectual property law. These Terms do not grant you any right, title or interest in our intellectual property.

Your data remains your property. By using the Service, you grant us a limited, non-exclusive, revocable licence to host, store and process your data solely for the purpose of providing the Service to you.

10. Limitation of Liability

10.1 — Disclaimer of Warranties

THE SERVICE IS PROVIDED "AS IS" AND "AS AVAILABLE" WITHOUT WARRANTIES OF ANY KIND, WHETHER EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, ACCURACY, COMPLETENESS, RELIABILITY, UNINTERRUPTED AVAILABILITY, OR NON-INFRINGEMENT. WE DO NOT WARRANT THAT THE SERVICE WILL BE ERROR-FREE OR THAT DEFECTS WILL BE CORRECTED.

10.2 — Exclusion of Consequential Damages

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, MERCANO GLOBAL SRL, ITS DIRECTORS, OFFICERS, EMPLOYEES, AGENTS AND SUPPLIERS SHALL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, PUNITIVE OR EXEMPLARY DAMAGES, HOWEVER CAUSED AND REGARDLESS OF THE THEORY OF LIABILITY (TORT, CONTRACT, STRICT LIABILITY OR OTHERWISE), ARISING OUT OF OR IN CONNECTION WITH THESE TERMS OR THE SERVICE, INCLUDING BUT NOT LIMITED TO:

LOSS OF DATA, CORRUPTION OF DATA OR FAILURE TO RECOVER DATA FOR ANY REASON;
LOSS OF PROFITS, REVENUE, BUSINESS OPPORTUNITIES OR ANTICIPATED SAVINGS;
BUSINESS INTERRUPTION OR LOSS OF GOODWILL;
SERVICE OUTAGES, DOWNTIME, UNAVAILABILITY OR DEGRADED PERFORMANCE;
ERRORS, BUGS OR INACCURACIES IN THE SERVICE OR ITS OUTPUT;
UNAUTHORISED ACCESS TO OR ALTERATION, DISCLOSURE OR DESTRUCTION OF YOUR DATA BY THIRD PARTIES, INCLUDING THROUGH SECURITY INCIDENTS OUTSIDE OUR REASONABLE CONTROL;
ANY REGULATORY FINES, PENALTIES, SUPERVISORY ACTIONS OR SANCTIONS IMPOSED ON YOU AS DATA CONTROLLER FOR YOUR FAILURE TO COMPLY WITH APPLICABLE DATA PROTECTION LAW;
ANY CLAIMS, DEMANDS OR PROCEEDINGS BROUGHT BY YOUR PATIENTS, CLIENTS OR STAFF ARISING FROM YOUR PROCESSING OF THEIR PERSONAL DATA OR YOUR FAILURE TO COMPLY WITH YOUR DATA CONTROLLER OBLIGATIONS.

10.3 — Cap on Total Liability

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, OUR TOTAL CUMULATIVE LIABILITY TO YOU FOR ALL CLAIMS ARISING OUT OF OR RELATED TO THESE TERMS OR THE SERVICE — WHETHER IN CONTRACT, TORT, STATUTE OR OTHERWISE — SHALL NOT EXCEED THE TOTAL SUBSCRIPTION FEES PAID BY YOU TO US DURING THE 12 CALENDAR MONTHS IMMEDIATELY PRECEDING THE EVENT GIVING RISE TO THE CLAIM.

10.4 — Essential Basis of the Bargain

The limitations in this Section 10 reflect a fair and negotiated allocation of risk between commercial parties. These limitations are an essential basis on which we offer the Service at the stated subscription price. Without them, the pricing would necessarily be materially higher.

10.5 — Exceptions

Nothing in these Terms excludes or limits liability for: (a) death or personal injury caused by negligence; (b) fraud or fraudulent misrepresentation; or (c) any other liability that cannot lawfully be excluded or limited under mandatory provisions of Romanian or EU law.

11. Indemnification

You agree to indemnify, defend and hold harmless Mercano Global SRL and its officers, directors, employees, agents and successors from and against any and all claims, damages, losses, liabilities, costs and expenses (including reasonable legal fees) arising out of or relating to: (a) your use of the Service; (b) your breach of these Terms; (c) your failure to comply with your obligations as Data Controller under applicable data protection law; (d) any claim brought by a data subject — including a patient, client or staff member — relating to your processing of their personal data; or (e) your violation of any applicable law or any third-party right.

12. Service Availability

We aim to maintain high availability of the Service but do not guarantee uninterrupted, error-free access. Scheduled maintenance will be announced in advance where reasonably practicable. We are not liable for losses arising from scheduled or unscheduled downtime, technical failures, or circumstances beyond our reasonable control, including failures of third-party infrastructure providers (hosting, storage, payment processors, notification services), acts of God, telecommunications failures or Internet connectivity disruptions.

13. Changes to These Terms

We may modify these Terms at any time. For material changes — including changes to pricing, the DPA, or the liability or data deletion provisions — we will provide at least 30 days' prior notice by email to your registered address or via an in-app notification.

If you object to a material change, you may terminate your subscription before the change takes effect and will receive a pro-rata refund of prepaid fees for the remainder of the current billing period. Minor amendments (such as clarifications, typographical corrections or changes required by law) may take effect immediately. Continued use of the Service after changes are effective constitutes acceptance.

14. Termination

You may terminate your subscription at any time via the billing settings in the platform. Termination takes effect at the end of the current billing period. Subscription fees for the current period are non-refundable unless required by law.

We may suspend or terminate your access without prior notice in cases of: (a) serious or repeated breach of these Terms; (b) conduct that materially threatens the security, integrity or availability of the Service; (c) sustained non-payment beyond the grace period in Section 5; or (d) a legal or regulatory requirement to do so. For other breaches, we will provide 14 days' written notice and the opportunity to remedy the breach before termination.

Sections 6.3, 7, 9, 10, 11 and 14 survive termination of these Terms.

15. Governing Law and Jurisdiction

These Terms and any dispute or claim arising out of or in connection with them — including non-contractual disputes or claims — are governed by and construed in accordance with the laws of Romania, including the Romanian Civil Code (Law 287/2009) and applicable EU regulations.

Any dispute that cannot be resolved amicably within 30 days of written notice shall be submitted to the exclusive jurisdiction of the competent courts of Bucharest, Romania.

16. Miscellaneous

Entire agreement: These Terms together with the Privacy Policy constitute the entire agreement between the parties relating to the Service and supersede all prior agreements and representations.
Severability: If any provision of these Terms is found to be unenforceable, the remaining provisions continue in full force and effect.
No waiver: Our failure to enforce any provision of these Terms does not constitute a waiver of that provision or any other provision.
Assignment: You may not assign or transfer any rights under these Terms without our prior written consent. We may assign our rights and obligations to an affiliate or in connection with a merger, acquisition or sale of assets, with 30 days' notice.
Language: These Terms are written in English. In the event of any inconsistency between an English version and a translated version, the English version prevails.