Terms of service

1. About these terms

ClinDesk is provided by AppstackX Ltd (“we”, “us”), company number [to confirm], registered office [to confirm]. In these terms, the “clinic” is the organisation named in the order, “users” are the people the clinic invites, the “service” is ClinDesk – the clinic management system, with its diary, patient records, billing, patient portal and messages – its support, and the Reports add-on (powered by ClinForms) if the order includes it, and “clinic data” is all information the clinic, its users or its patients put into the service, including patient information.

The agreement is made up of the order (which sets out the subscription, fees and any agreed service levels), these terms and the data processing agreement (DPA). If they conflict, the DPA wins on anything about personal data, then the order, then these terms.

2. Accounts and users

• Accounts are set up by invitation. The clinic’s owner or administrators decide who is invited, what role and which sites each user has, and remove users who no longer need access.
• Every user must sign in with their own account and two-step verification. Users must keep their password and authenticator device secure and must not share accounts.
• Patients who use the clinic’s patient portal sign in with one-time links sent to the email address on their record. The clinic is responsible for keeping patients’ contact details correct.
• The clinic is responsible for what its users do in the service and must tell us promptly at khuram@appstackx.co.uk if it suspects unauthorised access.

3. Acceptable use

The clinic and its users must not:

• use the service unlawfully, or to process information the clinic has no right to process;
• send messages through the service that the recipient has not agreed to receive where the law requires agreement;
• upload malicious code, or try to break, probe or get around the service’s security or limits;
• copy, resell or reverse engineer the service, or use it to build a competing product;
• use the service in a way that could harm it or other customers, for example by overloading it.

We may suspend access that breaks these rules or puts the service or other customers at risk, and will tell the clinic why.

4. Clinical and professional responsibility

• ClinDesk is a tool for running a clinic and keeping its records. It does not diagnose, recommend treatment or give medical or legal advice. [to confirm]
• The clinic and its clinicians are responsible for the clinical records they write and sign, for clinical decisions, and for the letters, forms and messages they send from the service.
• The clinic is responsible for the data it brings across from another system, for checking it after an import, and for having the right to contact each patient in the way it chooses.
• If the clinic has the Reports add-on: drafted answers to referrers’ forms can be incomplete or wrong. The treating clinician must review every answer against the records, complete any gaps and add any opinion themselves before approving a form. The clinic is responsible for the content of every approved form and for sending it to the referrer; the add-on never sends a form to a referrer on its own. The clinic is responsible for having the right to use each referrer’s form and for following any instructions the referrer gives about it.

5. Clinic data and data protection

• The clinic owns its clinic data. We use it only to provide the service to the clinic, as the DPA sets out.
• For patient information the clinic is the controller and we are its processor. The DPA, which forms part of this agreement, sets out the instructions, security measures, sub-processors, breach notification and the return or deletion of data.
• The clinic decides how long its records are kept. Clinical records are never deleted automatically while the agreement runs.
• We may use information about how the service is used, which does not identify patients, users or clinics, to run, secure and improve the service.
• When the agreement ends, we return the clinic’s data and then delete it, except where the law requires us to keep it. How the data is returned: [to confirm].

Our privacy policy explains how we handle the personal data we control.

6. Availability and support

• We use reasonable care and skill to keep the service available and secure. Unless the order sets a service level, we do not promise that it will be uninterrupted or error-free.
• We try to carry out planned maintenance outside UK clinic hours and give notice of significant downtime.
• Support is by [to confirm] ([to confirm]).
• We may improve and change the service. We will not remove a feature the clinic relies on without reasonable notice.

7. Fees and payments

Fees are set out in the order. Unless the order says otherwise, invoices are payable within 30 days and fees [to confirm] VAT. We may change fees for a renewal term by giving at least 60 days’ notice before it starts. If an invoice is unpaid 14 days after we have reminded the clinic, we may suspend the service until it is paid.

The clinic sets its own prices for patients and payers and is responsible for its invoices, VAT and claims to insurers. Card payments from patients are optional and are taken by our card payment provider. [to confirm]

8. Intellectual property

We own the service and everything we provide with it. The clinic owns its clinic data and the records, letters and forms it creates; it gives us the right to use them only to provide the service. If the clinic sends us suggestions, we may use them freely.

9. Confidentiality

Each party keeps the other’s confidential information confidential and uses it only for this agreement, except where it is already public or disclosure is required by law. This continues after the agreement ends.

10. Liability

• Nothing in these terms limits liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, or for anything else that cannot be limited by law.
• Neither party is liable for loss of profits, revenue, business or goodwill, or for any indirect or consequential loss.
• Subject to the points above, each party’s total liability arising from the agreement in any 12-month period is limited to [to confirm]. The order or the DPA may set a different limit for data protection claims.
• We are not responsible for the clinical content of records, letters or approved forms, for decisions made using them, for messages the clinic sends, or for problems caused by the clinic’s own systems, records or instructions.

11. Term and termination

• The agreement runs for the subscription term in the order and renews as the order says.
• Either party may end the agreement by written notice if the other materially breaches it and does not put the breach right within 30 days of being asked to, or if the other becomes insolvent.
• Sections that by their nature continue (such as confidentiality, liability and data return) survive the end of the agreement.

12. Changes to these terms

We may update these terms. We will give clinics at least 30 days’ notice by email of changes that affect them materially; the new terms then apply from the start of the next subscription term unless the clinic agrees earlier.

13. General

• Neither party is liable for delays caused by events beyond its reasonable control.
• Neither party may transfer the agreement without the other’s consent, except to a successor of its whole business.
• Notices are given by email to the addresses in the order (for us: khuram@appstackx.co.uk).
• The agreement is the entire agreement about its subject. No one else has rights under it.
• If part of the agreement is unenforceable, the rest still applies. Not enforcing a right is not a waiver of it.

14. Governing law

The agreement and any dispute about it are governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.