DROID SUBJECT AGREEMENT & WAIVER

DRAFT v1 — FOR ATTORNEY REVIEW ONLY. NOT LEGAL ADVICE. NOT FOR EXECUTION. Prepared for review by counsel. Bracketed items require legal confirmation. This document is intended to be shown to the Subject in the EpicMe intake flow before any data is collected.

EpicMe, Inc. [ENTITY NAME/FORM TBC] ("EpicMe", "we", "us") Effective when you sign at the bottom.

Before You Start — Read This

Your employer or organization ("Customer") has arranged for EpicMe to build AI digital twins for its team. But this particular twin is of you — it will be built from your answers, your documents, and your professional voice. That's why we're asking you directly, in your own agreement, separate from anything your employer signed.

Three things we want you to know before anything else:

1. This is voluntary. You can say no. You can stop later. You can delete everything. None of that requires a reason, and it must not cost you anything at work. 2. The Droid is not you. It's an AI approximation of how you answer professional questions. It can be wrong. 3. You stay in control of your data. You can view it, correct it, export it, and delete it at any time.

If that sounds fine, here are the details.

1. What the Droid Is (and Isn't)

1.1 What we build. EpicMe builds a queryable AI "Droid" — a professional digital twin that answers questions *as you would*, based on the information you provide during intake and afterward. Colleagues, tools, and partners can ask your Droid things like "How would [you] approach this decision?" or "What's [your] view on this proposal?" and get an answer in your professional voice.

1.2 What it isn't. The Droid is an AI approximation, not you. It generates responses using artificial intelligence, and like all AI systems, it can be wrong — it may misstate your views, oversimplify, omit context, or produce answers you would never give. We measure the Droid's fidelity to your actual responses, but fidelity is measured, not guaranteed.

1.3 Who can query it. The Droid is made queryable through API keys issued to authorized third parties ("API Consumers") — for example, meeting tools, business partners, and the Customer itself. The Droid speaks in your professional voice to those parties, within the professional scope described in Section 3.

2. Your Participation Is Voluntary

2.1 You may decline. Participation in EpicMe is entirely voluntary. You may decline to participate, decline to answer any intake question, and decline any optional consent, without giving a reason.

2.2 You may withdraw at any time. At any time, you may pause your Droid, withdraw any optional consent, or delete your Droid and all associated data (Section 8). Withdrawal takes effect going forward and does not require anyone's approval.

2.3 No penalty. Under EpicMe's agreement with the Customer, the Customer has committed that your decision to decline, withdraw, or delete must not be used as the basis for any adverse employment or engagement action — no discipline, no loss of pay, benefits, opportunities, or standing. [CONFIRM: mirror obligation in Master Services Agreement, Section [__].] If you believe you are being pressured to participate, you can tell us at [PRIVACY/ETHICS CONTACT EMAIL] and we will [ESCALATION PROCESS TBD].

2.4 What this document is — and is not. This document is your authorization, acknowledgment, and waiver. Where data protection law (such as the GDPR) applies, this document is not intended to serve as the sole lawful basis for processing your personal data. The Customer and EpicMe rely on their own lawful bases as described in the EpicMe Privacy Policy [LINK] and the Customer's own notices; the *optional* consents in Section 6 are separate, genuinely optional, and revocable. [ATTORNEY: confirm lawful-basis architecture per deployment jurisdiction, esp. Art. 6/9 GDPR and employee-consent validity.]

3. Your Authorization: Data, Persona, and Likeness

3.1 What you authorize. Subject to this Agreement, you authorize EpicMe — and, solely as part of the Customer's deployment, the Customer — to:

• (a) collect and process the information you provide (Section 5) to build and maintain your Droid;
• (b) host, operate, and improve your Droid;
• (c) make your Droid queryable by API Consumers authorized under the Customer's deployment; and
• (d) have the Droid respond in your professional persona and voice of communication — your tone, style, and manner of professional expression — including identifying itself as the Droid of [SUBJECT NAME].

3.2 Professional scope only. This authorization covers your professional persona only: how you reason, decide, communicate, and work. It does not authorize use of your persona or likeness for advertising or endorsements without your separate written consent, impersonation of you outside the Droid context, use of your image, photo, or synthesized audio/video likeness [CONFIRM: current product is text-only — adjust if voice/video synthesis is added], or any non-professional or personal use.

3.3 AI disclosure. The Droid will be identified to API Consumers as an AI representation, not as you personally. [CONFIRM disclosure mechanics in product.]

3.4 If you leave the Customer. Because your Droid is *of you* but deployed *by your employer*, here is the default arrangement when your employment or engagement with the Customer ends [ATTORNEY: confirm defaults; these may be varied in the MSA or by jurisdiction]:

• (a) Deactivation by default. Your Droid is deactivated and API Consumer access under the Customer's deployment is revoked within [30] days of EpicMe being notified that you have left, unless you affirmatively choose otherwise.
• (b) Your data remains yours to control. Your rights to export, correct, and delete (Section 8) survive your departure.
• (c) Portability. You may export your Droid data (JSON format) and, where EpicMe offers it, port your Droid to a personal or successor-employer deployment. [CONFIRM: portability offering and any Customer-confidential-information carve-outs — e.g., intake answers referencing Customer confidential information may be excluded from portability per MSA Section [__].]
• (d) Deletion. If you take no action within [90] days of deactivation, your Droid and associated personal data are deleted, subject to legal retention requirements.
• (e) The Customer does not own you. The Customer does not acquire ownership of your persona, likeness, or personal data by virtue of the deployment. [ATTORNEY: reconcile with MSA IP/data-ownership provisions.]

3.5 Revocation. You may revoke the authorization in this Section 3 at any time by deleting your Droid (Section 8). Revocation is prospective: it does not undo queries already answered, but it stops all future use.

4. Acknowledgment, Waiver & Release

Please read this section carefully — it limits your ability to make claims against EpicMe.

4.1 You acknowledge that:

• (a) the Droid is an AI system that generates approximations of your professional responses and may produce inaccurate, incomplete, or misleading outputs;
• (b) fidelity to your actual views is measured but not guaranteed;
• (c) API Consumers, the Customer, and others may read and act on Droid outputs; and
• (d) you should not treat the Droid as a substitute for asking you directly on matters that are important, sensitive, or binding.

4.2 Droid outputs are not your commitments. Statements made by your Droid are not statements made by you and do not create contracts, promises, approvals, waivers, admissions, or other binding commitments or obligations by you or on your behalf. Anyone who wants your actual agreement must obtain it from you personally.

4.3 Release. To the maximum extent permitted by applicable law, you release and hold harmless EpicMe and its officers, directors, employees, and agents from any and all claims, liabilities, and damages arising out of (a) the accuracy or inaccuracy of Droid outputs, and (b) decisions or actions taken by you, the Customer, or any API Consumer in reliance on Droid outputs.

4.4 What this release does NOT cover. This release does not waive: your statutory data protection rights (including those in Sections 6 and 8); claims arising from EpicMe's fraud, willful misconduct, or gross negligence; claims arising from EpicMe's use of your data or persona outside the scope you authorized in this Agreement; or any rights that cannot be waived under applicable law. [ATTORNEY: confirm enforceability of release scope by jurisdiction; some jurisdictions restrict pre-injury releases and employment-context waivers.]

5. The Data You Provide — and Data About Other People

5.1 What you'll provide. During intake and afterward, you may provide: intake questionnaire answers (which can include information about your family, career history, decision-making scenarios, and communication style); documents such as your CV, peer evaluations, writing samples, and social-media exports; and, optionally, data imported from a prior AI-clone service you used.

5.2 Your warranties about third-party data. Some of what you provide will describe other people — family members, colleagues, the authors of your peer reviews. You promise that:

• (a) you have the right to provide the information and documents you upload, including any information about other people contained in them, and that providing it does not violate any law, confidentiality obligation, or agreement you are bound by;
• (b) for data imported from a prior AI-clone or similar service, you have the right to export and re-use that data under that service's terms and applicable law; and
• (c) you will not upload data about others that is gratuitous, sensitive, or unrelated to building your professional Droid.

5.3 A practical ask. Where you can, keep information about other people to what's genuinely needed to describe *your* style and decisions. The Droid is about you.

6. Consent to Processing & Optional Consents

6.1 Privacy Policy. How EpicMe collects, uses, shares, and protects your personal data is described in the EpicMe Privacy Policy [LINK], which is incorporated by reference. This Agreement doesn't repeat it, but you should read it.

6.2 Processors. Your data is processed by EpicMe's service providers, currently: Anthropic (AI processing; inputs retained approximately 30 days and not used to train Anthropic's models), Supabase (database hosting), and Vercel (application hosting). The current list and details are in the Privacy Policy.

6.3 Optional consents — off by default, revocable anytime. The following are strictly optional, presented as separate opt-in choices during intake, and revocable at any time from your dashboard without affecting your ability to have a Droid:

• ☐ Public-web research: EpicMe may research publicly available information about you (e.g., published articles, public profiles) to improve Droid fidelity.
• ☐ Social-media exports: EpicMe may process social-media export files you choose to upload.
• ☐ Anonymized aggregate learning: EpicMe may use anonymized, aggregated insights derived from your data to improve EpicMe's systems generally. Anonymized means it can no longer be linked to you.

Revoking an optional consent stops that processing going forward; it does not retroactively invalidate processing already performed.

7. No Regulated Professional Advice

If you are a licensed or regulated professional (for example: physician, attorney, CPA, financial advisor, engineer, therapist), you acknowledge and agree that your Droid must not be used to give regulated professional advice in your name, and that Droid outputs do not constitute medical, legal, financial, accounting, or other regulated professional advice, do not create a professional–client relationship, and are not rendered under your license. You agree to configure your intake responses accordingly and to notify EpicMe at [CONTACT EMAIL] if you hold a license that requires additional restrictions on your Droid. [ATTORNEY: consider per-profession guardrails and whether EpicMe should offer a "licensed professional" mode.]

8. Your Data Rights — and How to Use Them

You can do all of the following at any time, yourself, without asking permission:

Deletion is completed within [30] days, subject to residual copies in backups (purged on the backup cycle described in the Privacy Policy) and any retention required by law. Where the GDPR or similar law applies, you may also have additional rights (objection, restriction, complaint to a supervisory authority) as described in the Privacy Policy.

9. General Terms

9.1 Relationship to other documents. This Agreement is between you and EpicMe. The Customer's deployment is governed by the separate Master Services Agreement between EpicMe and the Customer; you are not a party to it, but this Agreement references commitments the Customer has made in it. If this Agreement conflicts with the Privacy Policy on data-protection matters, the Privacy Policy controls; on all other matters, this Agreement controls. [ATTORNEY: confirm hierarchy.]

9.2 Changes. If EpicMe materially changes this Agreement, we will notify you and, where required, ask you to re-accept. Continued use after notice constitutes acceptance only where permitted by law. [ATTORNEY: confirm modification mechanics for consumer/employee context.]

9.3 Severability. If any provision is found unenforceable, the rest remains in effect.

9.4 Governing law. This Agreement is governed by the laws of [GOVERNING LAW JURISDICTION], without regard to conflict-of-laws rules, and subject to any mandatory protections of the jurisdiction where you live or work. [ATTORNEY: dispute-resolution clause — arbitration vs. courts — deliberately omitted from v1 pending review.]

9.5 Entire agreement. This Agreement, together with the Privacy Policy, is the entire agreement between you and EpicMe regarding your Droid.

Acknowledgment & Signature

By signing below, I confirm that:

• I have read and understood this Agreement, including the Waiver & Release in Section 4;
• I understand my Droid is an AI approximation that can be wrong and that its answers do not bind me;
• my participation is voluntary, and I know I can withdraw or delete everything at any time without penalty;
• the warranties I give about third-party and imported data (Section 5) are true;
• I have had the opportunity to ask questions before signing.

*Optional consents (Section 6.3) are presented separately in the intake flow and are not required to sign this Agreement.*

Questions? Contact us at [SUPPORT EMAIL] or [PRIVACY EMAIL]. We'd rather answer questions now than surprise you later.

*Document version: v1-draft. For attorney review — not legal advice.*