Terms of service

1. Who this contract is with

These terms are an agreement between CLINICIFY LTD, a company registered in England and Wales (company number 17386702, registered office 16 Mansfield Road, Poole, BH14 0DF, UK), and the organisation that subscribes to Clinicify.

You are contracting as a business, not as a consumer. The consumer cancellation rights in the Consumer Contracts Regulations do not apply.

The person who accepts these terms must be authorised to commit the clinic. If you are signing up on behalf of a clinic, you confirm you have that authority.

2. Definitions

Only the words that would otherwise be ambiguous:

Practitioner

A staff member who delivers appointments and therefore holds a diary. Practitioners consume a seat on your plan.

Receptionist

A staff member who manages bookings and records but does not hold a diary. Receptionist accounts are free and do not consume a practitioner seat.

Patient

A patient record in your clinic's account. Your plan includes an allowance of these, described in section 6.

Your data

Everything you or your patients put into Clinicify, including patient records, notes, lab results, photographs and payment records.

The DPA

Our data processing agreement, which forms part of this contract and covers Article 28 of the UK GDPR.

3. What Clinicify is, and what it is not

Clinicify is a record-keeping and administrative tool. It helps you manage appointments, patient records, lab results, payments and CQC compliance evidence.

Clinicify is not a medical device. It is not registered as one, and it is not intended for diagnosis, prevention, monitoring, prediction, prognosis or treatment of any condition. Do not use it as one.

Clinicify does not provide clinical advice. Nothing in the software is a clinical recommendation. Where a feature drafts text or summarises information, including the question-and-answer feature, it is a drafting aid. A clinician reads it, decides, and remains responsible for the decision. Clinical judgement is yours and stays yours.

You remain responsible for meeting your own professional, regulatory and CQC obligations. Using our software does not transfer any of them to us.

4. Your account

You are responsible for the accounts you create, for keeping credentials secure, and for what happens under those accounts. Each person needs their own account. Do not share logins: shared logins destroy the audit trail you need for CQC, and they make it impossible to tell who did what to a patient record.

Tell us promptly if you think an account has been compromised.

You must be at least 18 and legally able to enter a contract.

5. Plans, subscription and billing

Prices exclude VAT, which is added at the applicable rate.

Annual billing is ten months' price for twelve months, so two months free. The patient allowances in the last column are explained in section 6.

• Receptionist accounts are free and do not consume a practitioner seat.
• The free trial is 14 days and needs no card. If it finishes without a subscription, the 90-day rule in section 20 applies, exactly as it would for a clinic that cancelled a paid plan.
• Billing is monthly or annually in advance, whichever you choose, and renews automatically until you cancel.
• Fees are payable by the payment method you give us. You authorise us to charge it for each renewal.
• No pro-rata refunds. If you cancel, your access continues to the end of the period you have already paid for, and we do not refund the unused part. Nothing here affects your rights if we have broken these terms.
• If a payment fails, we will tell you and our payment provider will retry on its own schedule. If it remains unpaid after those retries are exhausted, which is usually about three weeks, we may suspend access after 7 days' written notice. We will not delete your data because of an unpaid invoice without telling you first and giving you a chance to export it.
• Late payment. Overdue invoices carry statutory interest under the Late Payment of Commercial Debts (Interest) Act 1998, which is 8% above the Bank of England base rate. We would always rather talk to you than charge it.
• Price changes: at least 30 days' notice before a new price applies to your renewal. You can cancel instead of accepting it.

6. Patient allowances and what happens if you exceed one

This clause can stop a real patient from booking, so it is worth reading rather than skimming.

Each plan includes a patient allowance: 150 on Solo, 500 on Team, 2,000 on Scale.

Above the allowance there is a grace band of 10 extra patients on Solo, 20 on Team and 50 on Scale, so up to 160, 520 and 2,050 in total. Inside the grace band everything keeps working normally and we email you to say you are close to the limit.

Beyond the grace band, new patients cannot be added. A first-time patient trying to book online is turned away. Your existing patients are unaffected and can still book as usual.

Upgrading your plan restores it immediately. There is no waiting period and no data is lost while you are over the limit.

7. Payments your clinic takes from patients

Clinics take card payments from their patients through Stripe Connect, using the clinic's own Stripe account.

• Your clinic is the merchant of record, not Clinicify. The payment is between you and your patient.
• Stripe's own terms govern that relationship, and Stripe's fees apply. You will need to accept them directly with Stripe.
• Clinicify currently takes no commission on patient payments. That is our position today rather than a promise for all time. If it ever changes, we will give you notice before it applies to you, and you can cancel instead of accepting it.
• Deposits, cancellation windows and refunds are yours to set and are a matter between you and your patient. We provide the mechanism, not the policy, and we are not a party to any dispute about a treatment or a refund.

8. Acceptable use

Do not:

• break the law, or use Clinicify to help anyone else break it
• upload data you do not have the right to hold or share with us
• try to break into the service, other clinics' data, or any account that is not yours, including by probing, scanning or testing our security without our written permission
• reverse engineer, decompile or copy the software, or try to extract its source code, except where the law expressly permits it
• resell, sublicense or white-label the service without our written agreement
• upload malware, or anything designed to interfere with the service or with other customers
• use the service to send unsolicited marketing

If you break these rules in a way that puts patients, other customers or the service at risk, we may suspend access immediately and explain why. Otherwise we will raise it with you first and give you a chance to fix it.

9. Fair use and automated access

The plans are priced for normal clinical use by a clinic of that size. We do not meter every action, and we would rather not start.

• Do not put load on the service that is not normal clinical use: bulk scripted requests, scraping, load testing, or using one account to serve clinics that are not covered by your subscription.
• Automated or programmatic access, including through any API we offer, needs our agreement and is subject to rate limits. We may rate-limit or block traffic that threatens the service for other customers, and we will tell you when we do.
• If your usage is genuinely growing, that is a plan conversation, not an enforcement one. We will contact you before taking any action that affects your clinic.

10. Your data, and your duties as controller

Your patient data belongs to you. We claim no ownership of it. You grant us only the permission we need to host, process and back it up in order to run the service for you, and to provide support when you ask.

You are the data controller for your patient data. We are your processor. That means:

• You decide what patient data goes into Clinicify, why, and how long it is kept. You are responsible for having a lawful basis, for meeting the special category conditions that health data requires, and for telling your patients how their data is used.
• We process patient data only on your instructions, only to provide the service, and never for our own purposes.
• We will help you answer patient requests for access, correction or deletion, and help you meet your obligations if there is a breach.
• The detail is in our data processing agreement, which forms part of this contract. Our privacy policy explains what we do with data in practice, including the sub-processors we use.

We may use aggregated, anonymised statistics about how the service is used to operate and improve it. Anonymised means it cannot be linked back to you, your clinic or any patient.

We do not use your patient data to train AI models.

11. Security and breach notification

What we do:

• Encryption in transit over TLS, and encryption at rest.
• Per-clinic encryption keys for patient data.
• Role-based access within a clinic, so staff see what their role needs.
• Audit logging of access to patient records.
• Multi-factor authentication available to staff accounts.
• Integration tokens for Google and Zoom encrypted at rest with AES-256-GCM, with the key held separately from the database.

Breach notification. If there is a personal data breach affecting your data, we will notify you without undue delay and in any event within 72 hours of becoming aware of it. We will tell you what we know, what we are doing, and what we recommend you do. You have your own 72-hour duty to the ICO as controller, and you cannot meet it if we are slow, so we treat this as a hard commitment rather than a target.

12. Third-party integrations

You can connect Clinicify to third-party services, including Google Calendar, Google Meet, Zoom, Stripe and Xero. Those connections are optional and you choose to turn them on.

When you connect a third-party service, that provider's own terms and privacy policy apply to what they do with the data. We are not responsible for their service, and we cannot promise it will keep working: providers change and withdraw their APIs. If an integration stops working we will tell you.

Our privacy policy sets out exactly what we do with Google Calendar data and Zoom data, including the Limited Use commitment we make under the Google API Services User Data Policy.

13. Beta and preview features

We sometimes release a feature marked beta, preview or early access so clinics can try it and tell us what is wrong with it.

• Those features are provided as they are. They may be incomplete, they may change, and they may be withdrawn.
• Any availability commitment in section 14 does not apply to them, and our liability for them is limited to the same extent as the rest of this contract.
• We will not put a beta feature in the path of something clinically important without telling you it is a beta.
• Do not rely on a beta feature as your only record of anything.

14. Availability and support

We aim to keep Clinicify available at all times, and we build it to be reliable, but we do not promise uninterrupted service. No software is up all of the time.

We carry out planned maintenance outside normal clinic hours where we can, and we give notice of work likely to interrupt the service. Emergency work to protect security or data may happen without notice.

We aim for 99.5% availability each month, excluding planned maintenance. That is a target we hold ourselves to rather than a contractual commitment with service credits. We would rather state a number we mean than sell you an SLA a small team cannot honour at three in the morning.

Support is by email, Monday to Friday, 9am to 5pm UK time, excluding bank holidays. We aim to respond the same working day to anything preventing clinical use of the software, and within two working days otherwise. There is no out-of-hours support.

Things outside our reasonable control are not our responsibility. See section 18.

15. Feedback

Tell us what is wrong and what is missing. If you suggest an improvement, we may use it, build it and ship it to every customer without owing you anything for it, and without it becoming yours or ours to fight over.

This covers your suggestions only. It gives us no rights over your data, your clinical content or anything else you own.

16. Publicity

We will not name your clinic as a customer, or use your logo, without your written permission. Not in marketing, not on the website, not in a pitch deck.

In healthcare the fact that a particular clinic uses a particular system is not ours to broadcast. If you are happy to be named, we will ask first and you can withdraw permission later.

17. Our liability

Nothing in these terms limits our liability for:

• death or personal injury caused by our negligence
• fraud or fraudulent misrepresentation
• anything else that cannot be limited by law

Subject to that:

• We are not liable for lost profits, lost revenue, lost business, lost goodwill, or for any indirect or consequential loss.
• We are not liable for clinical decisions. Those are yours. Nor are we liable for your failure to meet your own regulatory obligations.
• We are not liable for data you have lost where you could have exported it and did not, or where the loss was caused by you or someone using your accounts.
• Our total liability under this contract, however it arises, is capped at the total fees you paid us in the 6 months before the claim.

The service is provided as it is. Beyond what these terms say, we give no other warranties, express or implied, so far as the law allows us to exclude them.

You will cover us for claims brought against us that arise from your unlawful use of the service or from data you had no right to put into it.

18. Force majeure

Neither of us is in breach of this contract because of something outside our reasonable control. That includes failure of the public internet, failure of a cloud provider we depend on, power failure, fire, flood, epidemic, war, civil unrest, industrial action we are not party to, or a change in the law that makes performance unlawful.

If it happens, the affected obligations are paused rather than excused, and we will tell you what is happening and what we are doing. If it goes on for more than 30 days, either of us can end the contract by written notice, and we will refund the unused part of anything you have paid in advance.

This does not excuse paying money that is already owed, and it does not excuse our security or breach notification obligations.

19. Anti-bribery and modern slavery

Both of us will comply with the Bribery Act 2010 and will not offer or accept a bribe or any other improper payment in connection with this contract.

Both of us will comply with the Modern Slavery Act 2015 and will take reasonable steps to make sure there is no slavery or human trafficking in our own operations or supply chain.

20. Ending the contract

You can cancel at any time, in the app or by emailing us. Cancellation takes effect at the end of the period you have paid for, monthly or annual, and you keep access until then.

We can end the contract at any time, without notice. If we do that other than because you broke these terms, we will refund the unused part of anything you have paid in advance, and you still get the 90 days below to sign in and take your records with you.

Either of us can end it immediately if the other breaks these terms seriously and does not fix it within 30 days of being asked to, or becomes insolvent.

We can suspend access immediately where use of the service is unlawful, or is putting patient data, our service or other customers at risk. We will tell you why and restore access once it is resolved.

What happens to your data: 90 days, one rule for everyone. When your subscription ends, or a free trial finishes without one, your clinic and its data are kept for 90 days and then permanently deleted. During those 90 days you can sign in and export everything. We email you 14 days and 3 days before the deletion date, so it never comes as a surprise. Subscribing again at any point during the 90 days stops the deletion and restores full access.

What the account can and cannot do during those 90 days:

• You can sign in, view everything, and export your data.
• Patients cannot book new appointments, pay online, or send new questions.
• Appointments already booked can still be seen and cancelled.
• Nothing is deleted until the 90 days are up.

After the 90 days we delete your data in line with the retention periods in our privacy policy and the deletion obligations in the DPA, except where the law requires us to keep something, such as billing records.

21. Getting your data out

You can export your data at any time while your subscription is active. You do not need to ask us, and we do not hold your data hostage at the exit. Export download links expire 7 days after they are generated, for the obvious reason that a permanent link to a clinic's full patient list is a bad idea.

When the contract ends, you have the 90 days in section 20 to export your data, and you can sign in throughout to do it.

What you get is a single ZIP file containing:

• clinic-export.json, complete, machine-readable, and re-importable.
• csv/<entity>.csv, one spreadsheet per entity, for clinical review.
• The stored documents themselves, such as lab report files.

There is no PDF export. If you need records in a particular format for a regulator, the CSV files and the original documents are the place to start.

If you ask us for help exporting, we will help, and we will not charge you for it. Charging for the exit would rather undermine the paragraph above. You are responsible for keeping the clinical records your professional and regulatory duties require you to keep, including after you stop using Clinicify.

22. Changes to the service and these terms

We will keep improving Clinicify. Features will change, and occasionally we will retire one. We will not remove something you depend on without notice, and we will not make a change that materially reduces the core service during a month you have already paid for.

We may update these terms. If a change materially affects you, we will email the account holder at least 30 days before it takes effect. If you do not accept the change, you can cancel before it applies. Carrying on using the service after that date means you accept the new terms.

23. Which document wins

If these documents disagree with each other, they take priority in this order:

1. The data processing agreement, on anything about the processing of personal data.
2. These terms of service, on everything else.
3. The privacy policy, which describes what we do rather than creating obligations between us.

Any order form or written agreement we sign with you specifically overrides all three, on the points it actually covers.

24. What survives the contract ending

These clauses continue to apply after this contract ends, for as long as they need to: 10, your data and controller duties, 11, breach notification for breaches affecting data we still hold, 15, feedback, 16, publicity, 17, liability, 22, data export and deletion, 24, precedence, this clause, and 28, governing law. The deletion and confidentiality obligations in the DPA also survive.

25. General

• These terms, the DPA and our privacy policy are the whole agreement between us on this subject.
• Subcontracting. We may use sub-processors and subcontractors to provide the service, listed in our privacy policy and governed by the DPA. We remain responsible to you for what they do.
• Assignment. You may not transfer this contract without our written consent. We may transfer it as part of a sale or reorganisation of our business, and we will tell you if we do.
• If a court finds part of these terms unenforceable, the rest still applies.
• If we do not enforce something straight away, we have not given up the right to enforce it later.
• Nobody other than you and us has rights under this contract.
• Notices to us go to [email protected]. Notices to you go to the account holder's email address.

26. Governing law

These terms are governed by the law of England and Wales. The courts of England and Wales have exclusive jurisdiction over any dispute arising from them.

27. Contact us

Questions about these terms: get in touch.

Data protection and privacy: [email protected]

Post: 16 Mansfield Road, Poole, BH14 0DF, UK

See also our privacy policy and data processing agreement.