AI Data Processing Policy

biosuite offers the following AI-assisted features:

• AI invoice reading – automated optical character recognition (OCR) and structured extraction of a defined set of commercial invoice fields from uploaded PDF invoices. The fields currently extracted are: supplier name, invoice number, invoice date, due date, currency, subtotal, VAT amount, total amount, an invoice description, and invoice line items (description, quantity, unit price, and line total). No other data is retained, and the extraction schema expressly excludes IBAN and other bank account numbers, SWIFT/BIC codes, payment card data, payment references, and full recognised text. Free-text values such as the description and line item text are length-limited and automatically filtered for bank and payment identifiers before storage. The AI provider returns the document's recognised text together with the structured fields; only the approved fields listed above are retained, and the recognised text is neither logged nor stored. Vendor bank or payment account details are not retained as structured data, and the Service does not process or contribute to payments.
• AI contract reading – extraction of contract details (vendor, value, dates, terms, renewal clauses) from uploaded PDFs and images.
• AI invoice ↔ PO matching – ranking suggestions that propose which existing purchase order or contract a vendor invoice most likely belongs to, based on metadata such as vendor, amounts, dates, and line descriptions. Linking is always manual and audited.
• AI PO drafting from contracts – drafting purchase orders from a contract's payment schedule. The user reviews and confirms before any purchase order is created.

AI processing is triggered only when a user explicitly uploads a document for extraction, or explicitly requests match suggestions or a drafted purchase order. No documents or procurement records are processed automatically.

Invoice reading

1. The user selects a PDF invoice in biosuite. The upload is authorised on the server through server-side access controls, and the file is directed to a private object storage service configured with EU jurisdiction.
2. The browser transfers the file directly to that storage service. The file is not routed through, and is not stored in, biosuite's core application environment.
3. biosuite asks the AI provider to read that single document, which the AI provider retrieves directly from the object storage service through a time-limited, access-controlled retrieval mechanism.
4. The AI provider returns the document's recognised text together with the structured fields defined by biosuite's schema. The response is received by a server-side function, which retains only the approved fields; the recognised text is neither logged nor stored and is discarded when the function returns.
5. biosuite validates the returned values and presents them to the user as a draft in an editable form for review and correction.
6. biosuite stores the fields only after the user saves them, together with limited processing metadata such as the model used, the processing time, the processing status, and the number of pages. The AI provider's full API response, the full OCR text, and page images are not stored.
7. The uploaded invoice file remains in the object storage service as a supporting document in the workspace and is displayed to the user through a time-limited, access-controlled retrieval mechanism. When a user deletes an invoice, the invoice and its document are immediately removed from all views, reports and totals, and the uploaded document is no longer accessible through the Service unless the invoice is restored. The document remains in the object storage service for 30 days so that a company administrator can restore the invoice, after which the document and the associated invoice fields are automatically and permanently deleted. A record of the deletion is retained.

Contract reading

1. The user uploads a contract inside biosuite.
2. The document binary is transmitted via an encrypted API call through the AI gateway for the requested AI processing.
3. The model returns structured extracted data.
4. Extracted data is presented to the user as a draft for review and confirmation.
5. biosuite does not persist extracted data in the workspace until the user explicitly saves it.
6. The source contract file is deleted after extraction, regardless of whether the extracted data is saved, and is not retained in the workspace.

Invoice ↔ purchase order matching

1. The user opens a vendor invoice and explicitly requests match suggestions.
2. biosuite assembles a candidate set of purchase orders and contracts from the user's own workspace, scoped strictly by the user's existing access permissions (including department visibility).
3. Candidate metadata – limited to fields relevant to matching, such as vendor, totals, dates, currency, and truncated line descriptions – is transmitted via an encrypted API call through the AI gateway for the requested AI processing. Underlying source documents are not transmitted as part of this feature.
4. The model returns a ranked list of suggestions with a confidence indicator and short reason.
5. Suggestions are presented to the user as drafts. No link between an invoice and a purchase order or contract is created until the user explicitly confirms a suggestion.

PO drafting from contracts

1. The user opens a contract and explicitly requests a drafted purchase order.
2. Contract metadata relevant to drafting – such as vendor, payment schedule, amounts, currency, and referenced line items – is transmitted via an encrypted API call through the AI gateway for the requested AI processing.
3. The model returns a draft purchase order with proposed line items, amounts, and dates.
4. The draft is presented to the user for review. No purchase order is created in the workspace until the user explicitly confirms it.

Where AI functionality is delivered through Lovable's AI gateway, the relevant AI model or infrastructure providers are engaged by Lovable as Lovable's subprocessors. biosuite does not engage those providers directly unless expressly listed in this policy. The AI gateway with Lovable is used under a data processing agreement that prohibits the use of Customer Personal Data for model training. Invoice reading is not delivered through the AI gateway: biosuite engages the AI document-reading provider directly, under its own data processing agreement.

Sub-processors process content solely for the purpose of providing the requested AI inference. For all AI features described in this policy, biosuite enables the available controls over data retention and has opted out of the use of inputs and outputs for model training, where the provider offers that choice. biosuite does not use Customer Uploaded Data to train, fine-tune, or develop any AI or machine learning models.

biosuite does not represent that all AI processing takes place exclusively within the EU/EEA. The document storage bucket is configured with EU jurisdiction, and the AI provider for invoice reading is established in the EU, but that provider may engage sub-processors located outside the EU/EEA. See Section 8.

AI inference itself is stateless: the AI provider retrieves the document or metadata for the duration of the API call and returns structured data. The uploaded invoice document is retained in the EU object storage bucket as a supporting document in the customer's workspace until the customer deletes it and the subsequent 30-day restore period has passed. Contract files uploaded for contract reading are deleted after extraction and are not retained. Matching metadata is transmitted for the duration of the API call and is not stored by biosuite outside this process, except as necessary for security, logging, or legal compliance. Extracted results and confirmed match links are stored in the customer's workspace only after user confirmation, and are subject to the retention terms in the main DPA. biosuite stores only the approved fields together with limited processing metadata; it does not store the AI provider's full API response, the full OCR text, or page images. Application logs record processing metadata only – such as invoice identifier, company identifier, model name, status, processing time, and internal error codes – and are designed not to record document content, extracted document text, access links, or credentials.

AI-extracted data and AI-suggested matches are provided as-is as a drafting aid. Automated reading depends on document quality, layout, and language, and the underlying model version may change over time; the model used is recorded with each processed invoice. biosuite does not guarantee the accuracy, completeness, or fitness of AI output for any purpose. Users are responsible for reviewing and confirming all extracted data and suggested matches before saving. biosuite shall not be liable for decisions made based on unverified AI output, including but not limited to incorrect financial figures, dates, contractual terms, or invoice-to-purchase-order assignments.

All AI-extracted data and all AI-suggested matches require explicit human confirmation before they enter the system of record. Extracted invoice fields are always presented in an editable form so that the user can review and correct every value before saving. No automated decisions with legal or financial effect are made without user action, in accordance with GDPR Article 22.

biosuite processes Customer Uploaded Data through AI features solely as Data Processor on the Customer's documented instructions, which include the Customer's use of the Service and of the AI features described in this policy. The Customer, as Data Controller, is responsible for ensuring a lawful basis under Article 6 GDPR for such processing. The main DPA governs all processor obligations.

Invoice document content is retrieved and read by our AI document-reading provider, which is established in the European Union. That provider may engage its own sub-processors located outside the EEA. Contract content and matching metadata may be processed by Lovable and its authorized subprocessors outside the EEA. Transfer safeguards (including Standard Contractual Clauses) are described in the main DPA. biosuite does not represent that all AI processing takes place exclusively within the EU/EEA.

Material changes will be communicated via the application or email. Continued use of AI features after notification constitutes acceptance.

Questions about this policy should be directed to the contact details in the main Privacy Policy.