Legal

CATO is a data analysis platform designed for biomedical researchers. It provides AI-assisted data exploration, statistical analysis, code execution, and literature review capabilities. By using CATO, you agree to the rules in this policy.

These rules are not a substitute for the law, for your professional and ethical duties, or for the approvals your work needs. Ethics or IRB approval, participant consent, data-use agreements, biosafety and export rules, and your institution's policies all still apply to what you do with CATO, and complying with them is your responsibility.

CATO is intended for:

• Exploratory data analysis and statistical modeling
• Generating and executing analysis code in sandboxed environments
• Biomedical literature search and review, including multi-source academic search, AI-powered evidence extraction, citation network analysis, and document generation
• Organizing and managing research datasets
• Full-text analysis of open-access research papers
• Use of the bioinformatics tools, analysis libraries, reference datasets, and genome references installed in the sandbox

Literature search, Deep Search, and the agent's database tools send search terms, identifiers, sequences, and other query elements to external services, including public academic, clinical-trial, patent, and biological databases and, except on Enterprise plans, our literature search provider. The agent writes many of these queries from the content of your conversation and files. Do not include personal information or PHI in a search, or in material the agent may use to build one.

Standard accounts may not upload, enter, or otherwise transmit Protected Health Information (PHI) as defined under HIPAA or other identifiable consumer health, genetic, biometric, or patient-level data. This includes patient names, medical record numbers, dates of birth, identifiable genomes, biometric identifiers, or any combination of data elements that could reasonably identify an individual.

If your data originates from health records, you are responsible for ensuring it has been properly de-identified in accordance with HIPAA Safe Harbor (removal of all 18 identifier categories) or Expert Determination (a person with appropriate expertise has determined that the re-identification risk is very small) before uploading it to CATO. Medical images must also be de-identified: remove identifying header fields, such as those in DICOM files, and any names, dates, or other identifiers shown in the image itself. The agent can view images in your project, and an image it views is sent to our AI model providers.

You must also refrain from entering PHI into chat conversations, including patient names, identifiers, or any information that could be linked to a specific individual.

Organizations that need to process PHI must enter into an enterprise agreement with Nyrus. A Business Associate Agreement (BAA) with Nyrus, together with the corresponding agreements with the third-party service providers that would handle the data, may be available as part of such an agreement. Contact us to discuss enterprise agreements and deployment options.

You may not use CATO to:

• Process PHI without an enterprise BAA in place
• Process other identifiable consumer health, genetic, biometric, or patient-level data through a standard account
• Attempt to re-identify de-identified datasets
• Circumvent security controls or sandbox restrictions
• Generate malicious code or conduct unauthorized access
• Violate any applicable laws or regulations
• Systematically download or redistribute full-text research papers beyond fair use
• Circumvent publisher access controls or paywalls through CATO's literature tools
• Deceive or defraud anyone, impersonate a person or organization, run scams or spam, or present AI-generated output as the independent work of a person

You may not use CATO to:

• Threaten, harass, intimidate, or defame anyone
• Promote or facilitate suicide, self-harm, or disordered eating
• Promote or facilitate violence, terrorism, or sexual violence
• Plan or carry out illegal activity, or obtain illicit goods or services
• Develop malware, or compromise, damage, or gain unauthorized access to any system or data that is not yours

CATO analyzes sequences, structures, and biomedical data, so it could in principle be misused. You may not use CATO to design, develop, produce, acquire, or enhance biological, chemical, radiological, or nuclear weapons or their means of delivery, or to assist anyone else in doing so. In particular, you may not use CATO to:

• Increase the transmissibility, virulence, host range, environmental stability, or immune or treatment evasion of a pathogen
• Design, synthesize, or obtain toxins, select agents, or regulated pathogens, or plan routes to acquire them
• Evade biosecurity screening, sequence screening, biosafety containment, or export controls
• Conduct dual-use research of concern without the institutional biosafety and oversight approvals that research requires

We may refuse, limit, or review requests that touch these areas, and we may report credible threats to the authorities.

You may not use CATO to:

• Fabricate, falsify, or simulate data, results, images, figures, or citations and present them as real
• Present AI-generated analysis as independently verified, or omit the checks that a claim needs before it is published
• Evade ethics or IRB approval, participant consent, a data-use agreement, or the access terms of a data repository such as dbGaP or EGA
• Plagiarize, or produce work for paper mills or for others to submit as their own

A human author takes responsibility for every result produced with CATO. Follow the disclosure rules of the journals, institutions, and funders you submit work to.

You can make a conversation or a figure visible to anyone who has its link. A shared conversation shows its messages and the agent's work in them, including commands, code, tool results, and figures, and it continues to show messages added after the link is created. A figure's public citation page shows the version of the figure you cited, the name you chose to be cited under, and the code and command that produced that version. Anyone with the link can view, copy, and pass on that content without signing in until you revoke the link or delete the conversation or figure.

You are responsible for what you share. You may not share PHI, other personal information, data you are not authorized to disclose, credentials, or content that violates this policy.

The agent runs code in isolated sandboxes attached to your project's filesystem. A sandbox accepts no inbound connections, can reach only an approved list of public destinations over HTTPS, and runs within fixed limits on memory, processors, storage, processes, and running time. A sandbox is deleted a few minutes after the agent stops using it, and in any case after four hours; any process still running in it ends. The sandbox exists to analyze your data. You may not use it to:

• Mine cryptocurrency or run workloads unrelated to your research
• Host servers, proxies, tunnels, relays, or bots, or serve content to third parties
• Scan, probe, flood, or attack any network or system, or send spam or bulk email
• Scrape or download data in breach of a site's terms, or evade the sandbox's network, resource, or time limits
• Store or process credentials, secrets, or data you are not authorized to hold

The agent acts on your instructions. It writes and runs code, installs packages, queries external services, and can continue a task over several turns, including waiting for long-running commands, without a new message from you. You are responsible for what the agent does at your direction, as you are for code you run yourself, and you must stop a run that is doing something you did not intend.

Reference datasets and genome references provided in the sandbox remain subject to the terms of their original sources, including any limits on commercial use and redistribution, and you must comply with those terms.

You must be at least 18 years old, or older if the age of majority where you live is higher, to use CATO. Whatever your age, you may never use CATO to exploit, endanger, or sexualize anyone under 18, or to groom or expose a minor to harm. You may never use CATO to produce or describe child sexual abuse material, whether or not any part of it is AI-generated.

You are responsible for maintaining the confidentiality of your account credentials. Do not share your login with others; each person who uses CATO needs their own account or lab seat. You may not access CATO, its public pages, or its Output with bots, scripts, scrapers, or crawlers without our prior written permission. You may not evade or attempt to evade usage limits, rate limits, or sandbox limits, including by opening or using additional accounts.

Nyrus may suspend or terminate an account, withdraw credit or plan access, or remove a share link or public page that violates this policy. Where practicable, we will notify you before acting and give you an opportunity to export your data. We may act without notice where a violation is serious or urgent or where the law requires it. You may appeal a decision by emailing contact@nyrus.ai.

To report a violation of this policy, content on a shared conversation or public figure page, or a security vulnerability, email contact@nyrus.ai with the link or other details that identify it.