NESA Terms and Conditions

Terms and Conditions · Privacy Policy · Security and Data Protection

These are the terms for the NESA product. They replace the waitlist terms, which cover only the waitlist page at getnesa.com and do not apply to an account. Section 10 says which activation paths are working today — it is the section we would most like you to read, and we keep it current.

The short version

This is a summary, not a substitute for the terms below. Where the two differ, the terms below govern.

• NESA is a vault and a delivery system. You put information in. You give the people around you jobs. When something happens, NESA opens only what that job needs, to the person who accepted it.
• Nothing opens all at once. There are four rungs, and the bottom ones disclose almost nothing. Most situations resolve at "she is in Marin, moving, forty per cent battery" without touching your records.
• Nothing above the first rung opens on one person’s say-so. A second, independent thing has to happen.
• NESA is not an emergency service. It does not call 911, dispatch help, or track you. In an emergency, call your local emergency number.
• NESA discloses information. It does not confer authority. Opening someone’s financial records does not give them the legal standing to act on your behalf. That takes a power of attorney, and always will.
• We cannot read your vault. Your keys are derived on your device. That also means we cannot reset your vault password or recover your vault for you — that is what your recovery key is for, and you must keep it.
• One feature is the exception. When you ask Scribe to read a document, it is decrypted and sent to an outside AI service. Only when you ask, only for the document you named, and only for a short list of document types. Section 12.
• Everything is recorded, and you are entitled to see it. What opened, to whom, on what basis, and for how long — including when you were unconscious for all of it. The screen that shows you that record is still being built, so until it ships, ask us and we will send it. Section 11.4.
• We never sell your information, never share it for advertising, and never use it to train anyone’s models.

1. These terms, and who you are agreeing with

These Terms and Conditions (the Terms) are a contract between you and Interim Adult, Inc., a Delaware corporation ("we", "us", "our"). NESA means the service and the product; we are the company that operates it. Where these Terms say NESA does or does not do something, that is our obligation and we are bound by it.

They apply when you create an account, subscribe, use NESA, or are named by a subscriber and take any action in the service. By doing any of those things you accept these Terms. If you do not accept them, do not use NESA.

Two other documents form part of these Terms and are incorporated by reference: the Privacy Policy and the Security and Data Protection Statement. Read them. The Security statement describes limits on what we are able to do for you, and those limits are contractual, not aspirational.

Section 27 contains a binding arbitration agreement and a waiver of class actions. It affects how disputes between us are resolved. Please read it.

2. What NESA is, and what it is not

2.1 What NESA is

NESA is an encrypted personal vault with a rules-driven delivery system. You upload your own records — medical information, insurance details, contacts, key documents, instructions, and similar material. You name the people around you and give each of them a job. When something appears to have happened to you, NESA opens the part of your vault that job needs, to the person who accepted it, and no more.

NESA runs at two addresses — one built for a phone, one built for a laptop. Same account, same vault, same encrypted data; a different interface for a different device. Both can be installed to a home screen. Neither is yet a native app from an app store, which is why several things in section 10 are not available. Section 11.5 sets out the differences that matter, because they are not only cosmetic.

Legally, our role is custodian and conduit. We hold your information for you and we deliver it on your instruction. That is the whole of our role. These Terms are the services and vault-custody agreement between us: they authorize us to store your own information and to transmit the subsets you specified to the people you specified when an event has been verified. They do not make us your agent, and nothing in them transfers any authority over you or your affairs to us.

2.2 What NESA is not

These are absolute limits on the service, not disclaimers we hope you will overlook.

We are not a medical, legal, or financial services provider, and we do not give advice of any kind. Nothing NESA displays, sends, or generates is medical advice, legal advice, or financial advice, and nothing in the service should be relied on as a substitute for a qualified professional.

3. Eligibility

You must be at least 18 years old and a resident of the United States, and you must have the legal capacity to enter into a contract. NESA is offered only in the United States and is not directed to anyone outside it. Coverage outside the United States is materially worse for reasons set out in section 11.6, and you should not rely on NESA while abroad.

You may create an account only for yourself. You may not create or operate an account on someone else’s behalf.

4. Your account, your keys, and the absence of a back door

Your vault is encrypted with a key that exists only on your device. We do not hold it and we cannot decrypt your vault. The consequences are real and you should understand them before you rely on NESA:

• There are three ways into your vault and you control all of them — your vault password, your recovery key, and any passkey you register. We hold none of them.
• We cannot reset your vault password. No support agent, engineer, or executive at NESA can, because none of us has the means to. There is no override.
• Your recovery key is the backstop, and it is issued once. Save it somewhere you will still have it in five years. If you use it to reset your password, it is retired and you are issued a new one — save that too.
• If you lose your vault password and your recovery key, your vault is permanently unopenable. Not delayed — gone, for you and for everyone else including us.
• Changing your vault password does not revoke anything else. Your recovery key and your registered passkeys keep working, because they wrap the key rather than the password. If you need to shut other routes down, lock your vault.

You are responsible for keeping your password, your recovery key, and your devices secure, and for every action taken through your account. Tell us promptly at security@getnesa.com if you believe your account has been compromised. Section 9 of the Security and Data Protection Statement describes recovery in full.

You must keep your contact details accurate and your notification channels working. Almost everything in sections 6 to 10 depends on NESA being able to reach you before it tells anybody anything.

5. What you may store, and what you may not

The vault is for your own information: your records, your documents, your instructions, and the contact details of the people you name. You are responsible for what you put in it and for keeping it accurate. NESA does not verify, review, or validate your content — and the people you named may act on it at the worst possible moment, so an out-of-date entry is not a harmless one.

Some of what you store is about other people — your dependants, your pets’ vet, your emergency contacts. You are responsible for having a proper basis to hold and to share it, and for telling those people where it is appropriate to. Where you store information about a child, you are confirming you have the authority to do so. If a person whose details you hold asks us to remove them, we will help, and we will tell you.

You may not store, and you must not upload:

• material you have no right to hold or to disclose, including another person’s records held without their knowledge or consent;
• account passwords, banking credentials, card numbers, or anything else that would let a holder move money or transact in your name;
• material that is unlawful to possess;
• material intended to harass, threaten, defraud, or endanger any person;
• malware or anything designed to interfere with the service or any system it touches.

Because we cannot read your vault, we cannot enforce this section by inspection and we do not attempt to. Where we have a lawful basis we may suspend or terminate an account we reasonably believe is being used in breach of it — which may mean terminating access without ever having seen the content in question.

6. Your people, and the jobs you give them

6.1 Roles are jobs, not rankings

You do not grant people fields. You ask them to do something, and the access follows from the job. Every role is non-exclusive: any number of people can hold any of them, and holding one does not rank you above or below anyone else. Whether the people you name can see one another is a setting you control, and an activation overrides it — section 8.4 sets out exactly what becomes visible, and for how long.

A role opens whole categories, not selected fields. Before you save one, NESA shows you what that person will be able to see. Secret locations is the exception: it opens only at rung 3, and only under the verifier route in section 9. Your roster of people is never itself a disclosable category.

Two things that preview does not currently tell you well enough, and we would rather say so than let you rely on it. It shows what a job opens at rung 2, which is the widest a person reaches in an ordinary emergency — so it can look wider than most situations will be, and narrower than rung 3 would be. And the Personal category, which is in every job, includes your date and place of birth; so the smallest job you can give somebody still shows them that. We think that is acceptable, because Personal is what makes anything else usable, but you should know it rather than discover it.

An invitation you send does not expire on its own. It stays valid until it is used or you remove it. If you invited somebody a year ago and they never replied, that link still works — remove it from your account if you no longer want it to.

6.2 A job has to be accepted

Naming someone is a request, not an assignment. NESA sends them the ask in plain language — what you would be asking of them, not a permission level — and they may accept, decline, or offer to take a smaller job instead. Declining is a legitimate answer and we present it as one.

• An unaccepted role does nothing. It carries no weight in an escalation and cannot corroborate anything.
• You see the gaps. If nobody has accepted the job of coming to the hospital, NESA is designed to tell you so, plainly, while nothing is wrong. If it cannot reach our servers to check, it should tell you that instead of showing you a reassuring blank — that distinction is one we are still finishing, and until we have, treat an empty screen as "unknown" rather than "nobody".
• People can withdraw at any time, and we will tell you when they do, because a path may stop working and repairing it is yours to do. If someone withdraws who was also your named verifier under section 9, that route falls back to "nobody but me" — check your setup after any withdrawal.

6.3 If you have named nobody, nothing can open

Activation is inert without people. If you have not named anyone, or nobody has accepted, then no event — nothing detected, nothing reported, nothing scanned — can open anything to anyone, because there is nobody for it to open to. Filling in your vault does not by itself make you covered. NESA will say so in the app. We say it here too, because it is the single assumption we least want you to make.

6.4 If you are a person somebody named

These Terms apply to your use of NESA. You take on no liability to the subscriber by accepting a job, and nothing here obliges you to act. You may withdraw at any time by telling us. The Privacy Policy explains what we hold about you, why, and how to have it removed. Where you are asked to make a statement under section 9, section 9.3 sets out what you are actually asserting.

7. Two different permissions, and why we keep them apart

NESA asks you for two things that sound similar and are not. Conflating them would produce a worse outcome for you, so we keep them separate in the product and separate here.

7.1 What the signal permission is actually for

It is easy to read a request for motion and location as a request to watch you. It is closer to the opposite. These signals are what let NESA answer a worried phone call with "she is up and moving" instead of opening anything at all. Their main job is not detecting that something is wrong; it is explaining away the ordinary silences so that nothing escalates. Without them, the answer to a worried relative is not a wider disclosure — it is no answer, and a system with nothing to go on.

Motion and location are separate permissions and you may grant either without the other. Motion is the one that matters: it is what proves you are alive and what your personal pattern is built from. Location makes rung 1 useful to someone who is worried and gives a responder somewhere to go. Motion granted and location denied is a perfectly reasonable choice and NESA supports it without nagging you.

7.2 Turning a permission off makes NESA quieter, never louder

This is a commitment, not a setting. A path that has lost the evidence it depends on switches off. It never falls back to escalating on weaker grounds. A system that became twitchier the more privacy you asked for would be most dangerous to the people most careful about it, and we will not build that.

Before you make the choice, NESA shows you exactly which paths stop working without each permission. If you turn one off anyway, we honour it and disable the affected paths rather than degrading them into something else.

7.3 Permissions lapse on their own, and we will tell you when they do

These are commitments about the mobile application, and they take effect with it. Phone operating systems re-prompt periodically and quietly downgrade background permissions — a meaningful number of people lose coverage without ever deciding to. We commit to the following:

• We check permission state every time the app opens, and on a regular check from our servers — not once at setup.
• We tell you when a path goes dark, and we distinguish between you turning something off and the operating system downgrading it.
• The app shows you which paths are working right now, and for any that are not, why.
• We do not claim coverage we no longer have. If a path is off, your coverage display says so.

8. How an activation works

8.1 Silence is not the trigger

On the paths that depend on it, NESA looks for evidence that you are fine before anything escalates — recent steps and recent movement, measured against your own ordinary pattern. If it finds any, the matter ends there, silently, and nothing opens. This check is designed to be the part of the system doing the most work, and its normal output is that nothing happens.

This check needs the mobile application, and there is not one yet. Until there is, a concern raised by a person cannot be answered with evidence that you are up and about — so it opens rung 1 to them and stops there unless something independent corroborates it. Section 10 says which paths this affects.

8.2 The four rungs

Access is not all-or-nothing. What opens depends on how much is actually known.

8.3 Rules that hold across every rung

• Activation can only open what you granted in advance. It never invents a permission. If you never cleared your sister for your medical section, no emergency in the world opens it to her.
• One person is never enough to get past rung 1. Rung 2 needs a second independent thing, and agreement is not corroboration — the second person must add something they saw or tried themselves. There is no way to simply concur.
• Someone who took no job reaches rung 0 and no further. A person holding "just tell me" can raise a concern, and it will never on its own take an alert past rung 0, and never counts as the second independent thing. They accepted no responsibility, and the system does not pretend otherwise.
• Location is an area, never an address. NESA does not hold precise coordinates for you at all, at any rung. What a rung can disclose is a named area and whether you are moving. The one exception is a broadcast you send yourself — see section 10.
• Location is a snapshot, not a feed. One reading is taken when a rung opens. If a situation escalates, that is a new event and takes a new reading. The number of readings equals the number of things that happened, never the passage of time.
• Every alert expires, and can be ended early by anyone confirming you are fine. Once the mobile application exists, evidence will end it too: a phone that reconnects with hours of ordinary walking on it closes the alert by itself.
• Standing down reverses it. Access is withdrawn, any live sharing is cut at our end, and everyone who was actually paged is told it is over.
• Your own veto wins instantly, at any rung, at any time.
• Everything is recorded, unconditionally, including when you were unconscious throughout — what opened, to whom, on what basis, and for how long. This is not a setting and cannot be turned off. Section 11.4 explains how you get at that record today.

8.4 The group conversation

Every activation, at every rung including rung 0, opens a conversation between the people involved, with a banner saying what is or may be going on. Most situations are resolved by people talking to each other rather than by anyone reading your records. Each person sees only what their own rung entitles them to see.

An activation opens that conversation whatever you had set. Ordinarily you decide whether the people you have named can see one another at all: they are connected to each other by default, and you can disconnect them. During an activation the conversation opens either way: everyone holding a job in your circle can see who else is in the room. That is the whole purpose of the room — somebody who cannot see who else has been called cannot coordinate with them — but it does reverse a choice you made, and we would rather set it down here than have you discover it at the worst possible moment.

What opens is who is in the room, and nothing else: the names of the other people you named. Not their email addresses or phone numbers, which stay behind the setting you chose. Not one line of your vault, not one grant, not one word of why the alert was raised beyond the banner your rung already shows you. When the alert ends the room closes again — though, as everywhere else in these Terms, what was already said stays readable to whoever was in it at the time.

That conversation is outside your vault and outside its protections. Its messages are encrypted to the people in it and we cannot read them — but everyone in the room reads the same messages, so the per-person limits you set do not apply inside it. It is a coordination channel, not a disclosure channel, and nothing from your vault is posted into it. But if someone types your medication list into a message, everyone in that conversation can read it. Please tell the people you name not to do this.

A message is never a close. Someone writing "I’ve got her" is useful, but an alert ends only by an explicit action or by expiry — never by inference from something somebody said.

9. If you cannot tell us yourself

9.1 You choose the route, in advance

Rung 3 is your financial and legal information, and the question of who may open it when you cannot is not ours to answer. You choose one of three routes during setup, and we ask you plainly rather than defaulting you into one:

If you have a durable power of attorney, the person named in it is the natural verifier and NESA will ask for them by name. We are not inventing a parallel legal instrument. We are pointing at the one you already have.

9.2 Protections that apply whichever route you chose

• Your phone must not contradict them. If your motion data shows you out walking, an attestation that you cannot act for yourself is refused. This protection needs the mobile application. Until it exists we do not pretend to have run the check — the record shows that it was unavailable, rather than that it passed.
• It opens a window, not a door. Rung 3 is never time-critical — medical urgency is rung 2 and is already open by then. A safe combination can wait. There is a delay of 24 hours, you are alerted on every channel available throughout, and any sign of life cancels it.
• The statement is permanent. It is not a button. It is a specific written assertion, named, recorded, and shown to you afterwards in full — what opened, to whom, on whose attestation, and for how long.
• You are told, always. Section 8.3 applies here without exception.

9.3 If you are asked to make a statement

If you are asked to attest that a subscriber cannot act for themselves, you are asserting only that, and only as at that moment, and only from what you have yourself seen or been told. You are not making a clinical determination of incapacity, you are not being asked for a medical or legal opinion, and NESA does not treat your statement as one. Your statement is recorded permanently under your name and is shown to the subscriber afterwards. Do not make it if you are not sure. Declining costs nothing and there is no penalty of any kind for saying you do not know.

If you are a named verifier acting in a professional capacity — a lawyer, an executor, a physician — you act under your own professional obligations, which are yours and not affected by these Terms. We are not your client and you are not ours; you take on no duty to us by confirming, and we pay you nothing.

10. The activation paths, and which of them are working

NESA is built and improved in stages, and some paths described in our materials need a mobile application or a permission from Apple or Google that we do not yet have. Rather than describe the finished design and let you assume it is all running, this section states what each path does and whether it is available.

The definitive answer is in the app. Your coverage display shows what is working for your account right now, including anything that has gone dark because a permission lapsed. Where this table and your coverage display disagree, your coverage display is right.

One more thing this table does not show. The route you choose under section 9 — how rung 3 opens if you cannot open it yourself — does not yet have a screen in the app. Until it does, the fail-closed default applies to everyone: rung 3 opens to nobody but you. Nothing can reach your financial and legal information while you are unable to act, because the mechanism that would let it is not yet reachable. That is safe rather than useful, and it is being built.

11. Limits, stated plainly

Every one of these is a real constraint on what NESA can do for you. We would rather you knew them now than discovered them later.

11.1 If there is no signal, NESA cannot activate at that moment

No network means no message to our servers, and therefore no disclosure, at the time it happens. No design changes this, and it belongs in our stated limits rather than being left for you to discover.

What NESA is designed to do is treat the absence itself as evidence: a phone that is normally connected and goes quiet for an unusual length of time would open the group conversation and rung 1, with real content, because the phone kept recording while it was offline — last seen at the trailhead at six, moving, forty per cent battery. Absence alone would never reach rung 2, however long it lasts. This path needs the mobile application and is not available today. See section 10.

11.2 A notification will be waiting for them, not necessarily waking them

NESA sends notifications. It cannot currently pierce a silenced or sleeping phone — that requires a separate permission from Apple which we have not yet obtained. Until we do, assume a notification will be waiting for someone when they next look at their phone, not that it will wake them at three in the morning. If your plan depends on someone being woken, that plan needs a phone call in it, made by a person.

11.3 Every path needs somebody to raise it

NESA has no way to notice by itself that something has happened to you. Every path below starts with a person who knows you deciding something is wrong. If nobody raises it, nothing opens — so the people you name, and whether they can reach you, matter more than any setting in the app.

11.4 The record exists; the screen for it does not yet

Every activation, every rung, every recipient and every refusal is written down, and that is real and running — but the screen that shows it to you is still being built. Until it ships, write to privacy@getnesa.com and we will send you your record. We would rather do it by hand than tell you the right exists and leave you unable to use it.

11.5 The web version is not the phone version

Both give you the same vault. They are not equally good at everything, and the differences are safety-relevant rather than cosmetic.

• Location on a laptop is weaker. A browser location grant belongs to that browser, and your movement is only observed while the tab is open. It is not a substitute for a phone, and the app says so on the screen where you grant it.
• Scanning is phone-only. On a laptop you upload a file instead.
• The web version locks itself after 15 minutes idle, with a warning first, and each tab unlocks separately — unlocking one does not unlock another.
• There is a shared-computer mode. Tell NESA the machine is not yours and it locks after two minutes, offers no passkey, and leaves no session behind you. Use it in a library, a hotel, or an office.
• A passkey registered at one address does not work at the other. That is how the passkey standard works and we cannot change it. Your password and your recovery key work at both. If you use only Face ID, register it at each address you actually use.
• Both can be installed, and both are called NESA. If you install both you will have two identical-looking icons. We would rather warn you than have you wonder.

11.6 Coverage outside the United States

NESA is a United States service. Outside it, notification delivery is materially worse and in some places absent — regulatory changes have removed push notifications for web applications entirely in parts of Europe. Do not rely on NESA abroad.

11.7 The passive layer, when it exists, is not medical monitoring

The signals in section 7 are steps, movement and whether your phone is reachable. They do not measure your health, they cannot detect a medical event, and they are not a diagnostic of any kind. Their purpose is to explain away ordinary silence so that nothing escalates unnecessarily.

11.8 What revoking does, and does not, do

When you revoke a job or stand down an alert, that person can read nothing further from that moment. That part is real and enforced. But revocation stops future access; it does not undo access that already happened.

• If a section was open to somebody and their app had already collected the key to it, revoking does not reach into their device and take that key back. They may retain the ability to read that section as it was.
• Removing someone from the group conversation stops them reading anything said afterwards. It does not un-read what was said before.
• Locking your vault does not close disclosures that are already open. Standing down the alert does that. They are two different actions.

What it does do, precisely: it closes what that job opened, not everything that person can see. If somebody holds two jobs and you end one, access the other still justifies stays open — ending Money and admin does not shut a medical section that their Medical job independently covers.

Re-encrypting a section after a revocation is work we intend to do and have not done. Until we have, treat revocation as closing a door rather than erasing a memory, and revoke early rather than late.

11.9 Disclosure is not authority

This bears repeating on its own. When NESA opens your financial or legal information to someone, it has told them something. It has not made them able to do anything. They cannot transact on your account, sign on your behalf, admit you anywhere, or make a decision that is legally yours. If someone in your life may need to act rather than merely to know, they need a power of attorney, a healthcare proxy, or an equivalent instrument, and they need it independently of NESA. Naming that person as your verifier under section 9 is a good idea; it is not a substitute for the instrument itself.

12. Scribe, AI, and the one place your information leaves

12.1 Scribe can read a document, and that means sending it out

Scribe is the assistant that helps you fill your vault. It can do the data entry from what you tell it, and it can read a document you point it at. Both require it to see the actual words, which means:

• What you type into Scribe is sent to an outside AI service to produce the reply. It leaves the encrypted boundary in plain text.
• A document you ask Scribe to read is decrypted on your device and sent to that service, in full. Only a short list of document types can be read at all — see below.

This is the only place in NESA where your own information leaves the encryption boundary, and we bound it deliberately:

• Most of your vault cannot be read at all. Reading is limited to a named list of document types — identity documents, medical cards and medication lists, vehicle and pet insurance, travel documents, utility accounts, and a few practical lines such as funeral wishes, recipes and charitable giving. Your will and other legal papers, your financial statements, anything under Secret locations, anything belonging to a dependant, and your family stories and personal letters have no read button anywhere in the product. You can store them. You cannot send them. Our servers enforce this, not only the app. A read names the document, and the server looks up that document’s own filing and refuses anything the list does not cover — so the limit does not depend on the app you are running. One thing it cannot do: the decryption happens on your device, so a modified app could hand the server one document’s name with another document’s picture. We would rather bound the claim than overstate it.
• Uploading a document does not send it anywhere. Dropping a file in encrypts it and stores it. Reading it is a separate, explicit action on that specific file.
• Nothing reads a document on upload, on selection, or on a timer. There is no background scanning of your vault, and there will not be.
• The trade is stated on the button, every time you use it — not once in a settings page, and not only here.
• Scribe proposes; you confirm. Nothing it suggests is saved until you accept it, and anything it could not write is said out loud rather than silently dropped.
• You can switch Scribe off, and off is enforced on our side. Not a preference the app promises to honour: with Scribe off the server refuses the request outright, so no version of the app — ours, a modified one, or a future one — can send anything. Turning it back on is a deliberate act, and the moment you agreed is recorded.
• You can send part of a page instead of all of it. Draw a box around the line you want read, and only what is inside it is encoded and sent. The cropping happens on your device before anything leaves it, so the rest of the page is never transmitted — not held back at the other end, never sent.
• Every read is listed, in Settings. The document’s own name, where it was filed, when it was sent, and whether the whole page or only part of it went. No content: not the reply, not the fields that came back, not a summary. That list is assembled by your own device from what your app did, rather than authored independently by our servers — so it is a record of your app’s actions. Moving it server-side is queued work.

What that provider does with it. Our use of the service runs under its commercial terms, with a data protection agreement incorporated into them. What we send is not used to train anyone’s models, and it is deleted by the provider within 30 days. We send no account identifier with a request, so you are pseudonymous there by construction. A document you asked Scribe to read is still the one thing our own deletion process cannot reach — but it is bounded at 30 days rather than open-ended. We have asked that provider for a zero-retention arrangement, which would remove the window entirely; that request is pending.

12.2 What AI does not do

Everywhere else, automated systems including AI components are bounded by design and by contract:

• No system at NESA decides what to release. Scope comes from the job you assigned and the rung that opened, and from nothing else.
• No AI component holds authority over a disclosure. Whether a rung opens is decided by a deterministic engine that re-checks the evidence, your current people and roles, and your current revocations at the moment of release.
• The coordinator does not advise, interpret, triage, or improvise.

These constraints are engineering properties of the system, not policies we apply case by case. Sections 5 and 11 of the Security and Data Protection Statement describe them, and our AI governance document is available on request from security@getnesa.com.

If you believe something opened that should not have, tell us at once at support@getnesa.com or privacy@getnesa.com — either reaches the same people. We will investigate, give you the full record, tell the recipients that the disclosure was disputed if you ask us to, and help you revoke and re-scope. We cannot un-send information that has been delivered. Nobody can.

13. Two failure modes you are accepting

Decide whether NESA is right for you with both of these in front of you.

• Something opens that should not have. A rung may open in error — through a defect, a mistaken report, a person who attested wrongly, or deliberate manipulation. The design pushes the cost of this down: rung 0 and rung 1 disclose almost nothing, rung 2 needs two independent things, and rung 3 needs the route you chose plus a delay you are alerted throughout. It cannot be eliminated.
• Nothing opens when it should have. A real event may produce no disclosure — through no signal, an outage, a lapsed permission, a path that is not yet available, nobody having accepted a job, or a person who could not be reached. NESA is not a guarantee that help will arrive or that information will land in time.
• Something you revoked is still readable to somebody. Section 11.8 explains the narrow but real sense in which revocation does not reach backwards.

Do not construct a plan for your safety in which NESA is the only element.

14. Legal documents

NESA may make legal document services available — healthcare proxies, powers of attorney and similar instruments — through a third-party provider or network of licensed attorneys. Where it does:

• Those documents are prepared and reviewed by attorneys licensed in the relevant state. We do not prepare them and we are not your lawyer.
• Your relationship for those services is with that provider, on their terms, and any attorney-client relationship is with them.
• Our role is limited to embedding the flow, and to storing and delivering the executed result as an ordinary vault document.
• Any execution assistance we facilitate, including remote online notarization, is an administrative service. It is not legal advice.

You are free to use your own attorney instead and store the executed instrument in NESA. Formal instruments carry execution requirements — witnesses, notarization — that vary by state. Signing something inside an app is not, by itself, legally sufficient for these instruments.

14.1 Getting records from your own providers

Federal law gives you a right of access to your own medical records held by your healthcare providers. Where NESA helps you request those records, we are acting as your helper in exercising your own right — preparing the request for you to send, and receiving the records into your vault where you have directed the provider to send them. We are not requesting them in our own name and we hold no authority of yours.

15. Your free trial

We are not charging anybody yet. Beta is free and there is no payment mechanism in NESA today. Sections 15 and 16 are the terms that will apply from the moment we begin charging, and we will tell you before that happens — you will not wake up subscribed.

When it opens, NESA offers a 7-day free trial, with no card required. You get full access for those seven days.

• We will remind you before the trial ends — you will not be charged by surprise, and there is nothing to cancel, because we have not taken a payment method.
• If you do nothing, nothing happens. No charge, no card, no invoice. The trial simply ends.
• When it ends, your vault becomes read-only. You keep access to everything you put in. Saving new information, sharing, and the activation features in sections 6 to 10 require a subscription. Your activation paths stop working, and we will say so clearly rather than let you assume you are still covered.
• One trial per email address.

To subscribe, you enter your payment details at that point and not before.

16. Subscription, renewal, and cancellation

Prices are in US dollars and exclude any applicable tax. The price, the billing period and the renewal terms are shown to you before you pay and in your confirmation email. As at the date of these Terms:

16.1 Automatic renewal

Your subscription renews automatically at the end of each term, at the then-current price for your plan, charged to your payment method, until you cancel. We will send you a renewal reminder before each renewal charge, with the amount, the date, and a direct route to cancel. Where a state’s automatic renewal law requires longer notice or additional disclosure, we apply it — and we apply the strictest applicable standard to every subscriber, wherever they live.

16.2 Cancelling

You may cancel at any time from your account settings, in as few steps as it took to subscribe, without speaking to anyone. Cancellation stops the next renewal. Your subscription continues to the end of the term you have paid for, and then your vault becomes read-only on the same terms as section 15.

16.3 The founding price

If you subscribed at the founding rate, we will honour it for as long as your subscription remains continuously active — there is no end date and no step-up, so for as long as you stay, this is your price. Two things follow, and they are different:

• If you cancel and later come back, you come back at the standard price. The founding rate is not held for you while you are away.
• If a payment fails, you do not lose it. A failed card is not a decision to leave. We retry, we tell you, and you keep the founding rate through that period. Only a voluntary cancellation ends it.

16.4 Price changes

We may change prices. Any change takes effect at your next renewal, never mid-term, and we will tell you before it applies with enough notice for you to cancel first.

16.5 Refunds

Except where the law requires otherwise, fees are not refundable, and cancelling does not entitle you to a refund of the current term. If we terminate your account for a reason other than your breach of these Terms, we will refund the unused portion of your term.

16.6 Failed payment

If a payment fails we will tell you and retry over a grace period. If it remains unpaid your vault becomes read-only, and your founding rate is not affected — a failed card is not a decision to leave. Non-payment never deletes your vault by itself. If the subscription eventually ends, that is a termination, and section 19 then applies: activation stops, you have 60 days to export, and only after that is anything erased.

17. Acceptable use

This section is our acceptable use policy. Where any other document refers to a NESA acceptable use policy, it means this section.

You may not: use NESA for any unlawful purpose; attempt to gain access to any account, vault, or system that is not yours; probe, scan, or test the security of the service other than through our vulnerability reporting process; interfere with or overload the service; reverse engineer, decompile, or attempt to derive source code except to the extent that restriction is unenforceable by law; scrape or use automated means to access the service; resell or provide the service to third parties; misrepresent your identity or your authority to name a person; raise a concern you know to be unfounded; or attest under section 9 to something you do not believe to be true.

The last two are the most serious misuse of NESA. A false report can cause a person’s private medical information to be disclosed and can cause real alarm to people who care about them. A false attestation is worse: it is an attempt to open someone’s financial and legal life against their will, made under your own name and recorded permanently. We treat either as grounds for immediate termination and, where appropriate, referral to law enforcement.

18. Intellectual property

Yours stays yours. You own everything you put into NESA. We claim no ownership of it. You grant us only the narrow licence we need to operate the service for you: to store, transmit, back up, and deliver your content in accordance with your instructions and these Terms. That licence ends when your content is deleted. It does not permit us to use your content to develop or train any model, and we do not.

Ours stays ours. The NESA name, logo, software, design, documentation, and the systems behind them are owned by Interim Adult, Inc. or its licensors. You get a limited, personal, non-exclusive, non-transferable, revocable right to use NESA for its intended purpose.

If you send us feedback or a suggestion, we may use it without obligation to you.

19. Suspension, termination, and what happens to your vault

You may terminate at any time by cancelling and closing your account. We may suspend or terminate your account if you materially breach these Terms, if we are required to by law, or if we reasonably believe it is necessary to prevent harm. Except where immediate action is necessary, we will give you notice and a chance to put it right.

We may also discontinue NESA entirely. If we do, we will give you at least 90 days’ notice, make sure you can take a copy of everything throughout, refund the unused portion of your term, and tell everyone you have named that their role has ended.

On termination for any reason: activation stops immediately and nothing further can open to anyone; you have 60 days to take a copy of everything you put in; and after that we delete your data as described in the Privacy Policy. Only you can produce that copy, since only you can decrypt it — the export tool is being built, and until it ships, tell us and we will walk you through getting your information out before the window closes. We will not start the clock on somebody who cannot yet use the door.

When you ask us to delete your account, there is a 30-day window before erasure begins, and your circle is told that you have asked. Any return to your account during that window cancels it — signing in, your recovery key, Face ID or a passkey, or the app restoring your session on its own when you open it. Undoing it is deliberately not a button you have to find. The Privacy Policy sets out exactly what is erased, and the short list of things that survive it.

Sections that by their nature should survive termination do — including sections 18, 20, 21, 22, 23, 27, 28 and 29.

20. Death of a subscriber

If you die, anything you pre-authorized for that situation operates as you set it up, once the event is verified to the standard your setup requires — which will ordinarily mean documentary evidence, not an assertion.

Beyond that, NESA gives no one automatic access to your vault. We are not your executor and we do not administer estates. A personal representative asserting a right of access must establish their authority to us, and we will act on what we can verify and on what the law of your state requires. Even then we can only give access to an account; we cannot decrypt a vault. If nobody holds your vault password or your recovery key, the contents remain unreadable to everyone — including us, and including your estate.

If you want your estate to reach your vault, arrange it while you are able to: name your executor as your verifier under section 9, and make sure the person who will need your recovery key can find it. A recovery key in a sealed envelope with your will is a perfectly good answer. Please do not leave this to be worked out afterwards — it is the one problem in this product that genuinely cannot be solved later.

21. Disclaimers

We provide NESA with reasonable skill and care, and we take the reliability of this service seriously. Subject to that:

To the fullest extent permitted by law, NESA is provided "as is" and "as available", and we disclaim all warranties not expressly given in these Terms, including implied warranties of merchantability, fitness for a particular purpose, title, and non-infringement.

In particular, we do not warrant that the service will be uninterrupted, timely, or error-free; that any event will be detected, verified, or detected in time; that any rung will open or will open within any period; that any notification will be delivered, delivered promptly, or seen; that any person you named will respond, act, or be reachable; that any recipient will read, understand, act on, or honour what they receive; that any hospital, clinician, institution, or authority will accept or give effect to anything delivered through NESA; or that any information you have stored is accurate or current.

Nothing in these Terms excludes liability for death or personal injury caused by our negligence, for fraud or fraudulent misrepresentation, for gross negligence or wilful misconduct, or for anything else that cannot lawfully be excluded. Some states do not allow certain exclusions, and in those states the exclusion applies only so far as that state allows.

22. Limitation of liability

To the fullest extent permitted by law, neither party is liable to the other for indirect, incidental, special, consequential, exemplary, or punitive damages, or for lost profits, lost revenue, lost business, or loss of goodwill, however caused and on any theory of liability, even if advised of the possibility.

Our total aggregate liability arising out of or relating to NESA or these Terms is limited to the greater of (a) the fees you paid us in the twelve months before the event giving rise to the claim, and (b) one hundred US dollars ($100).

This cap applies to all claims in the aggregate, including any claim arising from something opening that should not have, or from nothing opening when it should have. It does not apply to liability that cannot lawfully be limited, including the matters listed in the last paragraph of section 21.

We say plainly what this means: NESA costs less per year than a modest insurance premium, and the risks it addresses can be far larger than that. The price could not be what it is if we carried unlimited exposure to those risks. This allocation of risk is a basis of the bargain between us, and it is reflected in what you pay.

23. Indemnity

You will indemnify and hold harmless Interim Adult, Inc. and its officers, directors, employees, and agents from third-party claims, and reasonable legal costs, arising from: your breach of these Terms; content you stored that you had no right to store or disclose; a person you named without their permission; a report or attestation you made that you did not believe to be true; or your use of NESA in a manner these Terms prohibit. We will tell you promptly of any such claim, let you control the defense with counsel of your choosing, and cooperate with you.

This indemnity does not apply to the extent a claim arises from our own breach, negligence, or wilful misconduct. We maintain insurance appropriate to a service of this kind, and we will look to that insurance before we look to you.

24. Third-party services

NESA relies on third parties to operate — hosting, payment processing, messaging, and, where offered, legal document services. They are described by category in the Privacy Policy, and a current named list is available on request. We select them with care, hold them to written contracts including data protection terms, and remain responsible to you for the service.

25. Changes to these Terms

We may update these Terms. If a change is material — a change to your rights, to how activation works, to what any rung opens, to fees, or to section 27 — we will give you at least 30 days’ notice by email before it takes effect, not merely post it. If you do not accept a material change you may cancel before it takes effect and we will refund the unused portion of your term. Non-material changes take effect when posted, with the date at the top updated.

Two specific commitments about future changes. If we ever begin collecting a category of signal we do not collect today, or extend what an existing signal is used for, we will ask you again rather than rely on a permission you gave for something else. And if we ever build a feature that reads the contents of your vault — including on your own instruction — we will tell you before it ships and it will not be switched on for you by default.

26. Notices and force majeure

We will send notices to the email address on your account; keep it current. You may send notices to legal@getnesa.com and to Interim Adult, Inc. at its registered address. Notices about a live activation also go through every channel you have enabled.

Neither party is liable for failure to perform caused by events beyond its reasonable control, including natural disasters, war, civil unrest, epidemics, labor disputes, failures of telecommunications or utility providers, government action, or large-scale internet or cloud infrastructure failure.

27. Disputes: informal resolution, then arbitration

27.1 Talk to us first

Before starting formal proceedings, please send a written description of the dispute and the relief you want to legal@getnesa.com. We will do the same for you. Both parties agree to try in good faith to resolve it informally for 60 days.

27.2 Binding arbitration

If informal resolution fails, any dispute arising out of or relating to these Terms or NESA will be resolved by final and binding arbitration, administered by the American Arbitration Association under its Consumer Arbitration Rules, before a single arbitrator, seated in New York, New York or — at your election — in the county where you live, or by telephone or video. Where the AAA Consumer Rules apply, we pay the arbitration fees they allocate to us and, for claims under $10,000, we will pay your filing fee as well.

27.3 Class action waiver

You and we each agree to bring claims only in an individual capacity, and not as a plaintiff or class member in any class, collective, consolidated, or representative proceeding. If this paragraph is found unenforceable as to a particular claim, that claim — and only that claim — is severed from arbitration and heard in court.

27.4 Your right to opt out

You may opt out of arbitration. Email legal@getnesa.com with your name and the words "arbitration opt-out" within 30 days of first accepting these Terms. Opting out costs you nothing, changes nothing else about your account, and we will not treat you differently for it.

27.5 Carve-outs

Either party may bring an individual claim in small claims court, and either party may seek injunctive relief in court to protect intellectual property or to stop unauthorized access to the service. Nothing in this section prevents you from reporting a matter to any government agency or regulator.

28. Governing law and venue

These Terms are governed by the laws of the State of Delaware, without regard to its conflict-of-laws rules. Where arbitration does not apply, the state and federal courts located in Delaware have exclusive jurisdiction.

This choice of law does not deprive you of the protection of the mandatory consumer-protection, privacy, or health-data laws of the state where you live. Those apply regardless, and we intend them to.

29. General

Entire agreement and order of precedence. These Terms, the Privacy Policy, and the Security and Data Protection Statement are the entire agreement between us about NESA. If they conflict, the order of precedence is: Schedule A while it applies, then these Terms, then the Privacy Policy, then the Security and Data Protection Statement. All three govern over any marketing, website, or sales material — if something we published elsewhere says more than these documents do, these documents are what you are entitled to rely on, and we want to know about the discrepancy.

Severability. If any provision is held unenforceable, it is modified to the minimum extent necessary or severed, and the rest stands.

No waiver. Not enforcing a provision is not a waiver of it.

Assignment. You may not assign these Terms. We may assign them to an affiliate or in connection with a merger, acquisition, or sale of assets — in which case the acquirer takes the vault as ciphertext, bound by these Terms and the Privacy Policy as they stand, and we will tell you before it happens and give you the chance to export and close your account.

No third-party beneficiaries. Except that a person you named may rely on sections 6.4 and 9.3 as they apply to them, these Terms create no rights for anyone else.

Independent parties. Nothing here creates a partnership, joint venture, employment, agency, or fiduciary relationship between us.

30. How to reach us

General and account: support@getnesa.com

Privacy, and requests about your data: privacy@getnesa.com

Security and vulnerability reports: security@getnesa.com

Legal notices: legal@getnesa.com

Interim Adult, Inc., a Delaware corporation. Registered address available on request and in your subscription confirmation.

Schedule A — Closed beta

This Schedule applies only while your account is part of the NESA closed beta. It adds to and, where it conflicts, overrides the Terms above. It ceases to apply when NESA becomes generally available, and we will tell you when that happens.

A1. What beta means

The closed beta is a real service holding real information for a small, invited group. It is not a simulation and you should treat your vault as live. It is also unfinished software, and you should expect defects, changes without notice, planned interruptions, and features that arrive, change, or disappear.

A2. Activation coverage during beta

Section 10 applies with particular force. During beta, the paths that depend on a mobile application do not exist at all — there is no fall detection, no crash detection, and no passive layer, because there is no mobile app to run them. What works is what you do yourself and what a person you named reports. Your coverage display is the authority on this and it is kept current.

There is an optional daily tap you can switch on. It is reassurance, not a mechanism. Whether you opened an app is not evidence about your body, and we will not build an escalation on top of it — the automatic monitoring that used to sit behind it was retired in August and is not coming back in that form. Leaving the tap off costs you no coverage that you would otherwise have.

A3. Geography

The closed beta is offered in New York City. Availability elsewhere is at our discretion.

A4. Please do not rely on beta alone

Keep whatever arrangements you already have. If NESA is currently your only plan for a medical emergency, an incapacity, or your death, it should not be — not yet, and honestly not ever as the only one. Keep a paper copy of anything that would matter at 2 a.m., and make sure the people who matter know where it is.

A5. Feedback

We will contact you about your beta experience and we may ask for feedback. You do not have to give it. Anything you do give us we may use freely to improve NESA, subject always to the Privacy Policy — we will never quote you or identify you without your express permission.

A6. Fees and ending beta

Beta is free and we are not charging anybody. If we discontinue the beta or your participation in it, we will give you at least 30 days’ notice, make sure you can take a copy of everything, refund anything you have paid, and tell the people you named that their role has ended.

A7. Liability during beta

Section 22 applies in full. Given the price of beta participation, we draw attention to the floor in that section: our aggregate liability will not be less than one hundred US dollars, whatever you have paid.