SMARTMATTER LLC (trading as Consentz)

Consentz Terms and Conditions
Last revised: August 7th 2026

Schedule 1

1.0 INTRODUCTION

1.1 Consentz has developed the Software and provides the Services on a subscription or pay-as-you-go basis.

1.2 Consentz hosts, maintains and supports the Client’s implementation and use of Consentz’s Software.

1.3 Client wishes to contract with Consentz in order to make use of the Services in its business operations. Consentz has agreed to provide the Services (and any Additional Services as applicable) and Client has agreed to receive and pay for the Services (and any Additional Services as applicable) subject to these Terms and in accordance with the Order Form.

1.4 This Agreement shall consist of these Terms together with:

1.4.1 the Order Form;

1.4.2 the Service Availability, Maintenance and Support Services (Support Services) description set out in Schedule 2;

1.4.3 the data protection provisions in Schedule 4;

1.4.4 the clinic privacy and consent responsibilities in Schedule 5; and

1.4.5 the Directory Listing and Lead Services terms set out in Schedule 6, where the Client uses those services.

1.5 If there is a conflict: (a) Schedule 4 shall prevail in relation to Clinic Patient Data and controller-processor obligations; (b) Schedule 6 shall prevail in relation to Directory Listings, Enquiries, Released Leads and Lead Services; (c) the Order Form shall prevail in relation to the service scope, Fees and any provision that it expressly identifies as overriding a specified clause of these Terms; and (d) these Terms shall prevail in all other respects. An Order Form shall not override Schedule 4 or Schedule 6 unless it expressly identifies the relevant provision and is signed by authorised representatives of both parties.

2.0 DEFINITIONS AND INTERPRETATIONS

2.1 In these Terms (except where the context otherwise requires) the following words and phrases shall have the following meanings:

Additional Services: those additional services selected by the Client as set out in an Order Form, which may include Customisations as referred to in clause 8.

Additional Services Fees: refers to the fees for the Additional Services set out in the Order Form.

Agreement: all the documentation containing the provisions of the Agreement, namely the Order Form, the main body of these Terms and the Schedules, including any amendments to that documentation from time to time.

Authorised Representatives: refers to the Client Authorised Representative and the Consentz Authorised Representative.

Authorised Users: those employees, agents and independent contractors of Client who are authorised by the Client to use the Services and the Documentation.

Account Data: personal and business information processed by Consentz as an independent controller to establish, administer, secure and support the Client relationship, Client Accounts and the Services.

Anonymous Data: information derived from use of the Services that has been aggregated and irreversibly anonymised so that no individual, patient, practitioner or Client is reasonably identifiable using means reasonably likely to be available If any individual, patient, practitioner or Client data can be reconstructed, so that an individual could be identified such data will be protected as pseudonymised personal data.

Business Day: any day which is not a Saturday, Sunday or public holiday in the UK.

Business Hours: the hours of 09:00 to 17:00 GMT/BST on a Business Day.

Claim(s): all demands, claims, actions, proceedings and liabilities, whether actual or threatened, known or unknown, in contract, tort, statute or otherwise, together with all related Losses.

Client: the clinic, practitioner, company or other business that accepts this Agreement by signing or accepting an Order Form, creating a Client Account, completing a Directory sign-up, accepting or purchasing a Lead, or otherwise using the Services.

Client Account: refers to the online account accessible by way of a Consentz Login, which shall comprise a username and password combination selected by the Client.

Client Authorised Representative: as set out in the Order Form or any replacement notified by the Client in writing to the Consentz Authorised Representative.

Client Content: business information, materials, text, images, branding, communications and other content supplied, uploaded or made available by or on behalf of the Client, excluding Clinic Patient Data.

Client Data: Clinic Patient Data and Client Content, but excluding Account Data, Enquiry Data, Usage Data and Anonymous Data.

Clinic Patient Data: Personal Data processed by Consentz on behalf of the Client in connection with the clinical CRM, EHR, consent, booking, communications and related Platform functions, including patient, staff and business-contact information and special category health data.

Client Intellectual Property: Client’s trademarks, business names and branding and all other Intellectual Property Rights owned by or licensed to Client.

Confidential Information: information that is proprietary or confidential and is either clearly labelled as such or identified as Confidential Information in clause 14.

Consentz Authorised Representative: as set out in the Order Form or any replacement notified by Consentz in writing to the Client Authorised Representative.

Consentz Intellectual Property: refers to all Intellectual Property Rights present on or in the Software (including source code), media, other materials and other content within the same, but excluding the Client Intellectual Property.

Consentz Legal Policies: refers to the policies applicable to the Services and the Platform as amended, superseded or replaced by Consentz from time to time.

Consentz Parties/Party: includes Consentz and its affiliated or related companies and subsidiaries and their respective joint venturers, successors, assigns, directors, sub-contractors, officers, employees and agents.

Consentz Subscriber: refers to a Client who has subscribed to the Services.

Customisation: a customisation of the Services, whether made through the development, configuration or integration of software, or otherwise.

Data: Client Data.

Data Privacy Laws: all data-protection, privacy, electronic-communications and cybersecurity laws applicable to the relevant processing, including the UK GDPR, the Data Protection Act 2018, the Data (Use and Access) Act 2025 and PECR (in each case as they apply to the processing of personal data in the UK), together with binding replacement or successor legislation.

Directory: the Consentz patient-facing clinic and practitioner directory made available at consentz.com and related domains.

Directory Listing: a profile of the Client or a practitioner published in the Directory, whether created by Consentz from public or professional sources or supplied or claimed by the Client.

Documentation: the policies, procedures and/or written instructions provided by Consentz to Client.

Effective Date: means the date stated in the Order Form or, if none is stated, the date upon which the Parties execute the Order Form.

Enquiry: a request submitted by a patient or Directory user for information, pricing, a consultation or another clinic service.

Enquiry Data: the Personal Data contained in or relating to an Enquiry. Enquiry Data is not Clinic Patient Data or Client Data and is controlled by Consentz until identifiable Enquiry Data is released or made available to a verified Recipient Clinic.

Fees: includes all fees payable to Consentz, as set out in the Order Form and clause 12.

Force Majeure Event: any happening or event beyond the reasonable control of the Party concerned, which results in a failure or delay in the performance of that Party’s obligations under this Agreement.

HIPAA: the US Health Insurance Portability and Accountability Act of 1996 and its implementing regulations, as amended.

Initial Subscription Term: has the meaning given to it in clause 6.1.

Intellectual Property Rights: patents, rights to inventions, copyright and neighbouring and related rights, trademarks and service marks, business names and domain names, rights in get-up and trade dress, goodwill and the right to sue for passing off or unfair competition, rights in designs, database rights, rights to use, and protect the confidentiality of, confidential information (including know-how and trade secrets) and all other intellectual property rights, in each case whether registered or unregistered and including all applications and rights to apply for and be granted, renewals or extensions of, and rights to claim priority from, such rights and all similar or equivalent rights or forms of protection which subsist or will subsist now or in the future in any part of the world.

Lead: a Released Lead relating to the selected clinic or, where the patient has separately authorised it, a named alternative clinic.

Lead Fee: the per-Lead or subscription fee for the Lead Services set out in the Order Form or the Directory sign-up.

Lead Services: the collection, validation, routing and administration of Enquiries and Leads by Consentz.

Losses: claims, losses, demands, actions, third party claims, damages, costs (including court costs and legal fees), fines, liabilities, obligations, liens and expenses.

Maintenance Services: the general maintenance of the Platform and Services, and the application of Updates and Upgrades.

Order Form: an online or hard-copy order form, Client Account sign-up, Directory sign-up, Lead acceptance or purchase flow, or other ordering process made available by Consentz and accepted by or on behalf of the Client, in each case incorporating these Terms by reference.

Patients: refers to patients of the Client.

Personal Data: personal data as defined by applicable Data Privacy Laws. For the purposes of Schedule 4, Personal Data includes Clinic Patient Data processed by Consentz on behalf of the Client.

Recipient Clinic: any clinic or practitioner to which a Lead is routed, including the Client.

Released Lead or Routed: the point at which identifiable Enquiry Data is first displayed, disclosed or otherwise made available by Consentz to a verified Recipient Clinic that has accepted the applicable terms and paid the Lead Fee or has an active entitlement to receive the Lead.

Renewal Subscription Term(s): has the meaning given to it in clause 6.1.

Platform: refers to the platform managed by Consentz and used by Consentz to provide the Services.

Services: the subscription based, hosted Software as a service provided by Consentz to Client via the Platform under these Terms, which enables Clients to store patient medical data and other information relating to their clinics on-line.

Set-Up Fee: the fees payable for the Set-Up Services as set out in the Order Form, as applicable.

Set-Up Services: the configuration, implementation and integration Services in accordance with the Order Form, as applicable.

Software: refers to all human readable, machine operable and all other forms of the proprietary software provided to Client as software as a service as part of the Services (incorporating all forms of any modifications made to it by Consentz from time to time).

Subscription Fees: the subscription fees payable by Client to Consentz for use of the Services.

Subscription Term: refers to the Initial Subscription Term together with any subsequent Renewal Subscription Terms.

Support Services: support in relation to the use of, and the identification and resolution of errors in, the Consentz Services set out in Schedule 2, but shall not include the provision of training services.

Terms: refers to these Consentz Terms.

Update: a hotfix, patch or minor version update to any Platform software.

Usage Data: technical, security, diagnostic and product-usage information generated through use of the Services, excluding Clinic Patient Data except to the limited extent necessary for security, support or service operation.

Upgrade: a major version upgrade of any Platform software.

Visibility Score: Consentz’s proprietary, non-clinical assessment of online visibility, discoverability and profile completeness displayed in the Directory.

Virus: anything or device (including any software, code, file or programme), which may: prevent, impair or otherwise adversely affect the operation of any computer software, hardware or network, any telecommunications service, equipment or network or any other service or device; prevent, impair or otherwise adversely affect access to or the operation of any programme or data, including the reliability of any programme or data (whether by re-arranging, altering or erasing the programme or data in whole or part or otherwise); or adversely affect the user experience, including worms, trojan horses, viruses and other similar things or devices.

3.0 GENERAL

3.1 Consentz has agreed to provide the Services and the Client has agreed to take and pay for the Services subject to these Terms.

3.2 By signing or accepting an Order Form, creating a Client Account, clicking to accept these Terms, purchasing or accepting a Lead, or using any Service or the Platform, the Client agrees to be bound by this Agreement. The individual taking that action warrants that they have authority to bind the Client.

3.3 These Terms form a legally binding agreement between the Client and Consentz in relation to the Client’s use of the Services. Unless the Parties expressly agree otherwise in writing, each Order Form shall create a distinct contract under these Terms.

3.4 If the Client violates these Terms or any terms in the Agreement, Consentz may terminate its use of the Services and the Platform, bar it from future use of the Services and the Platform and/or take appropriate legal action against it.

3.5 Words denoting an obligation on the Client to do any act, matter or thing includes an obligation to procure that it be done and words placing the Client under an obligation or a restriction include an obligation not to permit or allow infringement of the obligation or restriction.

3.6 Consentz may retain electronic records of account creation, verification, acceptance, payment and use as evidence that the Client agreed to this Agreement and that the person acting for the Client represented that they had authority to do so.

Consentz retains such records only for as long as necessary for those purposes and in accordance with the Consentz Privacy Policy.

4.0 REGISTRATION

4.1 Once the Client has agreed to receive the Services, Consentz will generate the Client Account for it.

4.2 All details submitted by the Client must be true, accurate and complete.

4.3 When executing this agreement by way of the Order Form, the individual signing represents and warrants that they have authority to bind the Client to these Terms.

4.4 It is in Consentz’s absolute discretion to decide if the Client shall qualify as a Consentz Subscriber for the purposes of gaining access to the Services. The Client must comply with all requests Consentz may make for proof of identity and business references and/or financial standing. Consentz reserves the right to decline any application for a Consentz subscription with or without notice or cause and in its entire sole discretion.

Consentz does not currently carry out background or criminal-record checks; it verifies identity (such as name and contact details) and business details only. Where Consentz introduces such checks it will handle any criminal-records information under the additional protections required for that class of data under the Data Privacy Laws.

4.5 Upon successful verification, a Client Account will be activated and a Consentz Login will be issued which the Client may change.

4.6 The Client will keep the Consentz Login relevant to the Platform and the Services confidential and will not reveal it to anyone else. The Client shall be responsible for all activities that are carried out under the Consentz Login. Consentz will not be liable where a Consentz Login is unlawfully used by another. The Client agrees to notify Consentz immediately by email to care@consentz.com of any such unauthorised use. Consentz may also suspend or disable a Consentz Login or Client Account where reasonably necessary to protect the security or integrity of the Services or personal data..

Consentz remains responsible for a personal data breach caused by its own act or omission, other than where a Consentz Login has been misused by the Client or its authorised users.

5.0 CLIENT RIGHTS

5.1 Upon being registered by Consentz, Consentz grants to the Client a non-exclusive, non-transferable right to permit the Authorised Users to use the Services and the Documentation during the Subscription Term solely for the Client’s internal business operations.

5.2 Consentz is entitled to make any changes to the specification, functionality and features of the Software that it desires at its sole discretion but shall provide notice of the same to the Client where necessary.

5.3 The Client will have administration privileges over the accounts of its Authorised Users, and the Client shall ensure that it disables the accounts for Authorised Users, who subsequently terminate their relationship with it.

5.4 The Client shall not access, store, distribute or transmit any Viruses, or any other material during the course of its use of the Services that, in Consentz’s sole discretion, is unacceptable or illegal and Consentz reserves the right, without liability or prejudice to its other rights, to disable the Client’s access to any material that breaches the provisions of this clause.

5.5 The Client shall not:

5.5.1 except as may be allowed by any applicable law which is incapable of exclusion by agreement between the Client and Consentz, and except to the extent expressly permitted under these Terms:

5.5.2 attempt to copy, modify, duplicate, create derivative works from, frame, mirror, republish, download, display, transmit, or distribute all or any portion of the Software and/or Documentation (as applicable) in any form or media or by any means;

5.5.3 attempt to reverse compile, disassemble, reverse engineer or otherwise reduce to human-perceivable form all or any part of the Software;

5.5.4 access all or any part of the Services and Documentation in order to build a product or service which competes with the Services and/or the Documentation;

5.5.5 use the Services and/or Documentation to provide services to third parties;

5.5.6 subject to clause 20, license, sell, rent, lease, transfer, assign, distribute, display, disclose, or otherwise commercially exploit, or otherwise make the Services and/or Documentation available to any third party except the Authorised Users; or

5.5.7 attempt to obtain, or assist third parties in obtaining, access to the Services and/or Documentation, other than as provided under this clause 5.

5.6 The Client shall use all reasonable endeavours to prevent any unauthorised access to, or use of, the Services and/or the Documentation and, in the event of any such unauthorised access or use, promptly notify Consentz.

5.7 The rights provided under this clause are granted to the Client only, and shall not be considered granted to any subsidiary or holding company.

6.0 TERM

6.1 Subject to earlier termination in accordance with clause 15, these Terms shall commence on the Effective Date and shall continue for a period of one (1) year (Initial Subscription Term) and, thereafter, it shall automatically renew for successive one (1) year periods (each a Renewal Subscription Term) unless:

6.1.1 either party notifies the other party of termination, in writing, at least ninety (90) days before the end of the Initial Subscription Term or any Renewal Subscription Term, in which case these Terms shall terminate upon the expiry of the applicable Initial Subscription Term or Renewal Subscription Term;

6.1.2 either party notifies the other party of termination, in writing, within 30 days of the Effective Date, in which case these Terms shall terminate immediately; or

6.1.3 it is otherwise terminated in accordance with the provisions of these Terms.

6.2 The renewal is automatic. The version of these Terms in force when a Renewal Subscription Term begins will apply to that Renewal Subscription Term. During a Subscription Term, Consentz may update Consentz Legal Policies and may amend these Terms where reasonably necessary to address changes in law, regulation, security, technology, third-party services or the operation of the Services. Consentz will give reasonable notice of a material amendment where practicable. Continued use after the effective date constitutes acceptance, but no amendment will increase Fees during a committed Subscription Term except as permitted by clause 12.5 or the Order Form.

6.3 Should the Client decide not to renew, it must send the notice of non-renewal by email to the Consentz Authorised Representative in accordance with the notice period set out at clause 6.1.1.

6.4 These Terms will also apply to the Client Account and each individual Lead that has been purchased from the time (and not as part of a subscription). The Client accepts them until all obligations relating to the relevant Lead have been performed or discharged. Clauses 6.1 to 6.3 do not apply to non-subscription Client Accounts and individual Lead purchases.

6.5 Provisions which by their nature are intended to survive shall continue after the end of the subscription referred to in clauses 6.1 to 6.3 or completion of the relevant Lead purchase (as applicable).

7.0 SERVICES

7.1 Consentz undertakes that the Services and any Additional Services will be performed with reasonable skill and care.

7.2 Consentz shall provide the Set-Up Services (if applicable) to the Client promptly and as near to the Effective Date as possible.

7.3 The Client acknowledges that a delay in the Client performing its obligations in the Agreement may result in a delay in the performance of the Set-Up Services; and Consentz will not be liable to the Client in respect of any failure to meet the Set-Up Services timetable to the extent that that failure arises out of a delay in the Client performing its obligations under these Terms.

7.4 Subject to any written agreement of the parties to the contrary, any Intellectual Property Rights that may arise out of the performance of the Set-Up Services by Consentz shall be the exclusive property of Consentz.

7.5 The undertaking at clause 7.1 shall not apply to the extent of any non-conformance which is caused by use of the Services contrary to the Documentation. If the Services do not conform with such undertaking, Consentz will, at its expense, use reasonable commercial endeavours to correct any such non-conformance in accordance with the Support Services detailed in Schedule 2 and will make reasonable commercial endeavours to provide the Client with an alternative means of accomplishing the desired performance. Such correction or substitution constitutes the Client’s sole and exclusive remedy for any breach of the undertaking set out in clause 7.1.

7.6 These Terms shall not prevent Consentz from entering into similar agreements with third parties, or from independently developing, using, selling or licensing documentation, products and/or services which are similar to those provided under these Terms.

8.0 ADDITIONAL SERVICES

8.1 The Client may choose to take Additional Services (as described on the Order Form) for which Additional Services Fees shall be payable as set out in the Order Form.

8.2 The Client and Consentz agree that Consentz may design, develop and implement a Customisation or Customisations in accordance with a Statement of Work pursuant to the Order Form or otherwise in writing by the Parties.

8.3 All Intellectual Property Rights in the Customisations shall, as between the parties, be the exclusive property of Consentz (unless the parties agree otherwise in writing).

8.4 From the time and date when a Customisation is first delivered or made available by Consentz to the Client, the Customisation shall form part of the Platform, and accordingly from that time and date your rights to use the Customisation shall be governed by these Terms.

8.5 The Client acknowledges that Consentz may make any Customisation available to any of its clients or any other third party at any time after the end of the period following the making available of the Customisation to the Client.

8.6 Where the Client uses the Directory Listing or Lead Services, the terms in Schedule 6 apply in addition to these Terms. The Client’s use of those services constitutes acceptance of Schedule 6.

9.0 SUPPORT SERVICES

9.1 Consentz shall, during the Subscription Term, provide the Support Services with reasonable skill and care and make available the Documentation to the Client on and subject to the Order Form, these Terms and the Support Services description set out at Schedule 2. The parties acknowledge and agree that Schedule 2 shall govern the availability of the Services as well as their maintenance and support.

9.2 Consentz may suspend the provision of the Support Services if any amount due to be paid by the Client under these Terms is overdue and Consentz has given to the Client at least fourteen (14) days’ written notice, following the amount becoming overdue, of its intention to suspend the Support Services on this basis.

10.0 INTELLECTUAL PROPERTY

10.1 Consentz and/or its licensors will remain the owners of all Consentz Intellectual Property Rights. For the duration of the Subscription Term, Consentz grants to the Client a non-exclusive licence to use the Consentz Intellectual Property for the sole purposes of enabling the Client to use the Services. Except as expressly permitted by this Agreement, the Client may not use any of Consentz’s Intellectual Property Rights without Consentz’s prior written consent and shall have no right to use the source code form of the Software.

10.2 The Client shall remain the owner of its Client Intellectual Property and Client Content. The Client grants Consentz a non-exclusive, worldwide, royalty-free licence during the Subscription Term and any reasonable wind-down, backup or legal-retention period to host, copy, reproduce, transmit, display, adapt and otherwise use Client Content and Client Data only to provide, secure, support and improve the Services, comply with law and exercise Consentz’s rights under this Agreement. Consentz may use Anonymous Data and feedback on a perpetual basis, provided that it does not identify the Client, any practitioner or any patient.

To the extent Client Content or Client Data includes personal data, Consentz processes that personal data under Schedule 4 and the Data Privacy Laws, not under this intellectual-property licence.

10.3 The Client shall promptly give notice in writing to Consentz in the event that the Client becomes aware of any claim that any of the Client Intellectual Property Rights infringes the rights of any third party. In such an event, Consentz shall, at its absolute discretion, determine what action if any it shall take in respect of the matter (including immediately terminating these Terms) and the Client shall fully indemnify Consentz for and against any damages, losses, costs and expenses (including reasonable legal costs and expenses) or other liabilities incurred by Consentz as a result of such claim.

11.0 CLIENT OBLIGATIONS

11.1 The Client shall (and where applicable shall procure that Authorised Users shall):

11.1.1 provide Consentz with all necessary co-operation in relation to these Terms and all necessary access to such information as may be required by Consentz, in order to provide the Services, including but not limited to Data, security access information and configuration services as applicable;

11.1.2 operate the Client’s business in accordance with good industry practice and in accordance with any applicable codes, regulations or guidance of any governmental, non-governmental or other applicable regulatory organisation;

11.1.3 comply with the Consentz Legal Policies (which will be supplied) when using the Platform;

11.1.4 carry out all of the Client’s other responsibilities set out in these Terms in a timely and efficient manner. If there are delays in the Client’s provision of such assistance, Consentz may adjust any timetable or delivery schedule as reasonably necessary;

11.1.5 ensure that the Authorised Users use the Services and the Documentation in accordance with these Terms and shall be responsible for any Authorised User’s breach of these Terms;

11.1.6 obtain and maintain all necessary licences, consents, and permissions necessary for Consentz, its contractors, agents, partners to perform their obligations under these Terms, including without limitation the Services; and

11.1.7 be solely responsible for procuring and maintaining its network connections, internet connections and telecommunications.

11.2 The Client is solely responsible for all clinical and professional matters, including diagnosis, clinical assessment, treatment suitability, informed consent, prescribing, dosage, treatment delivery, emergency response, practitioner competence and supervision, clinical-record accuracy, retention and compliance with professional and regulatory requirements.

11.3 Unless an Order Form expressly states otherwise, the Services are administrative and workflow tools and are not intended to replace professional judgement or operate as an autonomous medical device or clinical decision-maker. Any template, alert, score, recommendation, summary, generated content, artificial-intelligence output or decision-support feature must be reviewed by a suitably qualified person before clinical or patient-facing use. The Client shall not rely on such output as the sole basis for diagnosis, prescribing or treatment.

11.4 The Client shall configure and use the Services only for lawful purposes and in accordance with the Documentation. The Client is responsible for determining whether its intended configuration or use requires any medical-device registration, clinical validation, patient authorisation or other regulatory approval.

11.5 A Client subject to HIPAA shall not upload or cause Consentz to create, receive, maintain or transmit protected health information unless Consentz has entered into an applicable Business Associate Agreement with that Client. In the absence of an executed Business Associate Agreement, the Client shall not use the Services for a workflow that requires Consentz to act as its HIPAA Business Associate.

11.6 The Client and its Authorised Users shall not submit special-category data (including health data) about any person through the Directory, an Enquiry or the Lead Services except where the relevant feature expressly provides for it and the Client has a lawful basis and additional condition to do so.

12.0 CONSENTZ FEES & PAYMENT

12.1 The Client shall pay the Fees promptly as they fall due in accordance with the Order Form.

12.2 If Consentz does not receive payment in accordance with these Terms and the Order Form, without prejudice to any other rights and remedies of Consentz:

12.2.1 Consentz may, without liability to the Client, disable its Client Login to its Client Account and access to all or part of the Services and Consentz shall be under no obligation to provide any or all of the Services while the invoice(s) concerned remains unpaid; and

12.2.2 charge the Client interest on the overdue amount at the rate of 8% per annum above the Bank of England base rate from time to time (which interest will accrue daily until the date of actual payment and be compounded at the end of each calendar month).

12.3 All Fees payable under these Terms shall be payable in pounds sterling (or such other currency stated in the Order Form or Directory sign-up) and are non-refundable.

12.4 All amounts stated in or in relation to these Terms are, unless the context requires otherwise, stated exclusive of any applicable value added taxes, which will be added to those amounts and payable by the Client to Consentz.

12.5 Consentz may elect to vary any element of the Consentz Fees by giving to the Client not less than thirty (30) days’ written notice of the variation, providing that no such variation shall result in an aggregate percentage increase in the relevant element of the Fees during the Subscription Term that exceeds five percent (5%) over the percentage increase, during the same period, in the Retail Prices Index (all items) published by the UK Office for National Statistics.

12.6 If there is any invoice dispute, the Client shall pay the amount in full pending the resolution of any dispute and, upon resolution, Consentz shall (if necessary) pay any adjustment due within thirty (30) Business Days. The Client agrees to pay all amounts due in full and the Client shall not, for any reason whatsoever, be entitled to assert any credit, set-off or counterclaim against Consentz in order to justify withholding payment of any such amount in whole or in part.

13.0 DATA PROTECTION, OWNERSHIP & DATA LOSS

13.1 Schedule 4 applies where Consentz processes Personal Data as processor on behalf of the Client. Schedule 4 does not apply to Personal Data for which the parties act as individual controllers. These Terms and Conditions do not apply to the collection and processing of any anonymous Personal Data that falls outside the scope of the Data Privacy Laws..

13.2 As between the parties, the Client retains all rights in Client Content and, so far as any rights are capable of subsisting, in the Clinic Patient Data (including the database rights in relation to such Client Content and Clinic Patient Data). Consentz determines the purposes and means of processing Account Data, Enquiry Data, Usage Data and Anonymous Data as an independent controller, subject to applicable law and the Consentz Privacy Policy. Nothing in this Agreement treats Personal Data as property capable of ownership where applicable law provides otherwise.

13.3 The Client grants Consentz and its approved subprocessors a non-exclusive licence to copy, host, reproduce, transmit, adapt, export and otherwise process Client Data to the extent reasonably necessary to provide, secure, support and improve the Services, comply with documented instructions and applicable law, and exercise Consentz’s rights under this Agreement.

To the extent Client Data includes personal data, this reflects Consentz's processing on the Client's behalf under Schedule 4 and the Data Privacy Laws.

13.4 The Client is solely responsible for providing legally compliant privacy information to its Patients and other data subjects, determining and documenting its lawful bases and special-category conditions, obtaining any consent or authorisation that it chooses or is required to rely upon, and responding to data-subject requests The Client is the controller of Clinic Patient Data and is responsible for complying with all of its obligations as controller (see Schedule 4), including ensuring it has the consents and lawful bases needed for Consentz to process that data on its behalf.. Consentz may provide configurable notices, forms and consent templates for convenience, but they are not legal advice and the Client remains responsible for reviewing, configuring and approving them in accordance with Schedule 5.

13.5 Consentz shall create backup copies of Client Data at least daily and shall use reasonable commercial endeavours to maintain a daily backup for seven days, a weekly backup for four weeks and a monthly backup for 12 months, subject to technical changes, disaster recovery testing and any different period stated in the Order Form or Documentation. In the event of loss or damage to Client Data, other than in accordance with its obligations under Data Privacy Laws, the Client’s sole and exclusive remedy shall be for Consentz to use reasonable commercial endeavours to restore the affected data from the latest reasonably available backup. Restoration may overwrite data created after the relevant backup. Consentz shall not be responsible for loss, alteration or disclosure caused by the Client, an Authorised User, a third party outside Consentz’s reasonable control or use contrary to the Documentation.

13.6 Consentz may create and use Anonymous Data for analytics, benchmarking, security, fraud prevention, research, product development and improvement, and may disclose Anonymous Data to third parties. Consentz will not intentionally re-identify Anonymous Data or publish it in a form that reasonably identifies a patient, practitioner or Client.

13.7 Where the Client instructs Consentz to process data unlawfully or in a way that Consentz reasonably believes creates a material legal, security or patient-safety risk, Consentz may refuse or suspend the instruction or affected Service without liability while the parties seek a lawful solution.

14.0 CONFIDENTIALITY

14.1 Save as is otherwise required by law or any regulatory authority, each party undertakes to the other that during the Subscription Term and thereafter it shall keep secret and shall not without the prior written consent of the other party disclose to any third party (except to its legal and professional advisors) any Confidential Information learned by the recipient party or disclosed to the recipient party by such other party pursuant to, or otherwise in connection with these Terms, except to the extent that any Confidential Information:

14.1.1 is (otherwise than by breach of these Terms) in the public domain;

14.1.2 is already known by the recipient party other than pursuant to disclosure from the other party; or

14.1.3 is required to be disclosed by law, by any court of competent jurisdiction or by any regulatory or administrative body.

14.2 To the extent that it is necessary to give effect to these Terms, the recipient party may disclose Confidential Information to its employees as may reasonably be necessary provided that the recipient party shall:

14.2.1 before disclosure, make such employees aware of their obligations of confidentiality under these Terms;

14.2.2 at all times procure compliance with such obligations of confidentiality; and

14.2.3 if requested by the disclosing party, procure named employees to execute a confidentiality agreement directly in favour of the disclosing party.

14.3 Neither party shall issue any press release or other public announcement relating to the subject matter of these Terms without the prior written consent of the other party.

14.4 This clause 14 shall survive termination of these Terms howsoever arising.

15.0 TERMINATION

15.1 Either party may terminate this Agreement with immediate effect without liability by service of written notice on the other and without prejudice to its other rights, if the other party:

15.1.1 is in material breach of this Agreement (which includes a material breach of the Data Privacy Laws or of Schedule 4, 5 or 6) where the breach is incapable of remedy;

15.1.2 is in material breach of this Agreement where the breach is capable of remedy and fails to remedy that breach within thirty (30) days after receiving written notice of such breach or other default from the non-defaulting party; or

15.1.3 if any of the following events occur:

(i) it is, or is deemed for the purposes of any applicable law to be, unable to pay its debts as they fall due for payment;

(ii) a petition is presented or documents filed with a court or any registrar or any resolution is passed for its winding-up, administration or dissolution or for the seeking of relief under any applicable bankruptcy, insolvency, company or similar law;

(iii) any liquidator, trustee in bankruptcy, judicial custodian, compulsory manager, receiver, supervisor, administrative receiver, administrator or similar officer is appointed in respect of it or any of its assets; or

(iv) any event analogous to the events listed in (i) to (iii) above takes place in respect of it in any jurisdiction.

15.2 Clause 15.1.3 (i)-(iv) above does not apply to a petition for winding-up presented by a creditor which is being contested in good faith and with due diligence and which is discharged or struck out within twenty-one (21) days.

15.3 Consentz may suspend access to the Services with immediate effect at any time during the Subscription Term if Client is in material breach of any obligation in this Agreement which shall include, but is in no way limited to, where any delinquent payment is not received by Consentz within fifteen (15) calendar days after notice to Client. Client will continue to be charged for and be liable for all Fees during any period of suspension. Where either Party initiates termination of this Agreement in accordance with clause 15, Client will continue to be obligated to pay all balances lawfully due and payable.

15.4 On termination of these Terms for any reason:

15.4.1 all rights granted under these Terms shall immediately terminate;

15.4.2 each party shall return and make no further use of any property including any Intellectual Property Rights (and all copies of them) belonging to the other party;

15.4.3 for thirty (30) days after the effective date of termination, the Client may instruct Consentz in writing either to make one standard export of the then-current Clinic Patient Data reasonably available in a commonly used electronic format or to delete that data from active systems. Consentz shall not charge for a standard export, or for any return, deletion or destruction of personal data required by the Data Privacy Laws, and shall not withhold it pending payment of other Fees; Consentz may charge reasonable fees only for non-standard extraction, migration or professional services. The Client is responsible for requesting and securely downloading its export within that period. If the Client gives no instruction within that period, or after Consentz has completed the requested export, Consentz may delete Client Data from active systems and thereafter from backups in accordance with its ordinary backup cycle, except to the extent retention is required by law. Consentz has no obligation to maintain ongoing Platform access after termination and shall not be liable for deletion after the export period where the Client failed to request or retrieve the export; and

15.4.4 the accrued rights of Consentz or Client as at termination, or the continuation after termination of any provision expressly stated to survive or implicitly surviving termination shall not be affected or prejudiced.

16.0 WARRANTIES AND INDEMNITIES

16.1 The Client hereby warrants, represents and undertakes to Consentz that these Terms constitute its valid, legal and binding agreement, enforceable in accordance with the Terms.

16.2 Consentz shall defend the Client against any Claim that the Software, Services or Documentation infringes any patent, copyright, trade mark, database right or right of confidentiality, and shall indemnify the Client for any amounts awarded against the Client in judgment or settlement of such Claims, provided that:

16.2.1 Consentz is given prompt notice of any such Claim;

16.2.2 the Client provides reasonable co-operation to Consentz in the defence and settlement of such Claim, at Consentz’s expense; and

16.2.3 Consentz is given sole authority to defend or settle the Claim.

16.3 In no event shall any Consentz Party be liable to the Client to the extent that the alleged infringement is based on:

16.3.1 a modification of the Software, Services or Documentation by anyone other than Consentz;

16.3.2 the Client’s use of the Software, Services or Documentation in a manner contrary to the instructions given to the Client by Consentz; or

16.3.3 the Client’s use of the Software, Services or Documentation after notice of the alleged or actual infringement from Consentz or any appropriate authority.

16.4 Clause 16 states the Client’s sole and exclusive rights and remedies and the entire obligations and liability of the Consentz Parties, for infringement of any patent, copyright, trade mark, database right or right of confidentiality.

16.5 The Client acknowledges that complex software is never wholly free from defects, errors and bugs (and security vulnerabilities); and subject to the other provisions of these Terms, Consentz gives no warranty or representation that the Services will be wholly free from defects, errors and bugs (or will be wholly secure).

16.6 The Client acknowledges that the Services are designed to be compatible only with that software and those systems specified as compatible by Consentz; and Consentz does not warrant or represent that the Services will be compatible with any other software or systems.

16.7 The Client acknowledges that Consentz does not provide clinical, medical, legal, data-protection, financial, accountancy, taxation or regulatory advice. The Client is solely responsible for determining whether the Services, configurations, templates and workflows are suitable and lawful for its practice and for all decisions, treatment and communications made using or informed by the Services.

16.8 Any artificial-intelligence, automation, transcription, summarisation, scoring, drafting or decision-support feature may produce incomplete, inaccurate or unsuitable output. The Client shall ensure appropriate human review and shall not use any output as the sole basis for diagnosis, prescribing, treatment or another decision producing legal or similarly significant effects for a patient unless the use is expressly authorised by Consentz and complies with applicable law.

Consentz does not currently carry out solely automated decision-making that produces legal or similarly significant effects on a patient. Where applicable law gives a right to object to solely automated decision-making, or if Consentz later introduces such processing, it will do so only on a lawful basis under Article 22 UK GDPR, with notice and a means for the person to obtain human review, to express their view and to contest the decision.

16.9 The Client shall indemnify and keep indemnified the Consentz Parties against all Losses (including regulatory fines and monetary penalties, to the extent lawfully indemnifiable) arising out of or in connection with: (a) Client Data, Client Content or instructions supplied by or for the Client; (b) the Client’s clinical services, diagnosis, prescribing, treatment, patient communications or professional conduct; (c) the Client’s breach of the Data Privacy Laws (including all of its obligations as a controller), direct-marketing laws, professional rules, licensing requirements or this Agreement; (d) unauthorised, unlawful or negligent use of the Services by the Client or an Authorised User; or (e) any claim by a patient, employee, practitioner, regulator or third party arising from the Client’s acts or omissions, except to the extent that the Loss was directly caused by Consentz’s material breach of this Agreement.

16.10 Consentz shall give the Client reasonably prompt notice of a Claim under clause 16.9 where practicable. Consentz may control the defence and settlement of the Claim, and the Client shall provide reasonable cooperation at its own cost. Consentz shall not settle a Claim in a manner that requires the Client to admit wrongdoing or undertake a material non-monetary obligation without the Client’s consent, not to be unreasonably withheld. The Client shall not settle a Claim affecting a Consentz Party without Consentz’s prior written consent.

17.0 LIMITATION OF LIABILITY

17.1 This clause 17 sets out the entire financial liability of Consentz (including any liability for the acts or omissions of its employees, agents and sub-contractors) to the Client:

17.1.1 arising under or in connection with these Terms;

17.1.2 in respect of any use made by the Client of the Software, Services and Documentation or any part of them; and

17.1.3 in respect of any representation, statement or tortious act or omission (including negligence) arising under or in connection with these Terms.

17.2 Subject to clause 17.4, Consentz shall not be liable to the Client in contract, misrepresentation, restitution or otherwise for any loss of profits, loss of business, depletion of goodwill and/or similar losses or loss or corruption of data or information, or pure economic loss, or for any special, indirect or consequential loss, costs, damages, charges or expenses however arising under these Terms.

Nothing in clause 17.2 excludes or limits any liability that cannot lawfully be excluded or limited under the Data Privacy Laws.

17.3 Consentz’s total aggregate and maximum liability, in contract (including in respect of the indemnity at clause 16.2), tort (including negligence or breach of statutory duty), misrepresentation, restitution or otherwise, arising in connection with the performance or contemplated performance of these Terms shall be limited to the total Fees paid or payable to Consentz by the Client under the Order Form, subscription, Lead purchase or other transaction most directly giving rise to the Claim during the three (3) continuous months immediately preceding the date on which the Claim arose.

17.4 Nothing in this clause 17 shall however exclude or restrict Consentz’s liability for:

17.4.1 fraudulent misrepresentations;

17.4.2 any liability where the law does not permit such exclusion of liability; and

17.4.3 death or personal injury arising from negligence.

17.5 Consentz shall not be in breach of any of its obligations under these Terms which arise or occur due to the act, omission, and default of the Client or your failure to comply with any of its obligations under these Terms.

17.6 Except as expressly set out in these Terms:

17.6.1 no conditions, warranties or other terms, including any implied terms relating to satisfactory quality or fitness for any purpose, will apply to the Software, Documentation, Services or to anything supplied or provided by Consentz under this Agreement which are all provided to the Client on an ‘as is’ basis. The Client acknowledges that the service may be subject to limitations, delays and other problems inherent in the use of such communications facilities;

17.6.2 the Client assume sole responsibility for the results obtained from the use of the Services and the Documentation and for conclusions drawn from such use; and

17.6.3 all warranties, representations, conditions and all other terms of any kind whatsoever implied by statute or common law are, to the fullest extent permitted by applicable law, excluded from these Terms.

17.7 No action arising out of or in connection with these Terms may be brought by the Client more than twelve (12) months after the date of the event from which the Claim (or last of a series of related Claims) arose.

The time limit in clause 17.7 does not apply to a claim under the Data Privacy Laws that cannot be limited in this way, or to any claim for which a longer period is required by applicable law.

17.8 The limitations in clause 17.3 do not limit the Client’s obligations to pay Fees or the Client’s liability under clauses 10.3, 16.9, Schedule 4 or Schedule 6, or for breach of data protection, confidentiality, infringement of Consentz Intellectual Property, misuse of Client Accounts or fraud. For the avoidance of doubt, Consentz’s liability remains subject to the limitations in this clause 17, including the three-month cap in clause 17.3.

18.0 FORCE MAJEURE

18.1 Consentz shall have no liability to Client under these Terms if it is prevented from or delayed in performing its obligations under these Terms, or from carrying on its business, by one or more Force Majeure Events provided that the Client is notified of such and the expected duration.

19.0 NOTICES

19.1 Any notice given or made under these Terms shall be in writing and in English and signed by or on behalf of the party giving it and shall be:

19.1.1 delivered by hand (which shall be deemed to have been received when delivered, or if delivery is not in business hours, at 9 am on the first business day following delivery);

19.1.2 sent by pre-paid first-class post or recorded delivery post to the other party at its address set out in these Terms, or such other address as may have been notified by that party for such purposes (which shall be deemed to have been received at the time at which it would have been delivered in the normal course of post); or

19.1.3 by email to your Authorised Representative at Consentz, at care@consentz.com (which shall be deemed to be received as verified by automated receipt or electronic log).

19.2 Client and Consentz agree that the provisions of this clause shall not apply in relation to the service of any process in any legal action or proceedings arising out of or in connection with these Terms or the legal relationships established by these Terms.

20.0 GENERAL

20.1 These Terms shall be binding on and inure to the benefit of each of Client and Consentz and their respective successors and assigns. Client shall not assign or sub-contract any of its rights or obligations under these Terms (in whole or in part) without the prior written consent of Consentz. Consentz shall be entitled to assign or subcontract any of its rights or obligations under these Terms in whole or in part.

20.2 If any one or more of the provisions of these Terms should be held to be invalid, illegal or unenforceable in any respect, the validity and enforceability of the remaining provisions contained in these Terms shall not in any way be affected or impaired and Client and Consentz shall amend these Terms to add a new provision having an effect as near as legally permissible to the one held to be invalid, illegal or unenforceable.

20.3 This Agreement constitutes the entire agreement and understanding between the parties concerning its subject matter and supersedes all prior contracts, licences, arrangements and understandings relating to that subject matter. Each party acknowledges that it has not relied on any statement, representation, assurance or warranty not expressly set out in this Agreement and shall have no remedy in respect of it, except that nothing in this clause limits liability for fraud or fraudulent misrepresentation.

20.4 These Terms are not intended to create any partnership or joint venture relationship between Consentz and Client or authorise either party to act as agent for the other, and neither party shall have the authority to act in the name of, or on behalf of, or otherwise to bind the other in any way.

20.5 Consentz may subcontract any of its obligations under the Agreement, providing that Consentz shall remain responsible to the Client for the performance of any subcontracted obligations. Notwithstanding any other provision of these Terms, the Client acknowledges and agrees that Consentz may subcontract to any reputable third party hosting business the hosting of the Consentz Platform and the provision of related Support Services.

20.6 Except for updates expressly permitted by clauses 5.2, 6.2, 12.5, the Consentz Legal Policies or another provision of this Agreement, no variation to this Agreement shall be effective unless in writing and agreed by authorised representatives of both parties. A waiver is effective only if in writing and shall not constitute a waiver of any later breach or any other right.

20.7 Save for a Consentz Party, a person who is not a party to these Terms has no right under the Contracts (Rights of Third Parties) Act 1999 to enforce these Terms.

21.0 GOVERNING LAW & JURISDICTION

21.1 These Terms and any dispute or claim arising out of or in connection with it or its subject matter, whether of a contractual or non-contractual nature, shall be governed by and construed in accordance with the laws of England and Wales. The parties agree to submit to the exclusive jurisdiction of the English courts in respect of any dispute arising out of or in connection with these Terms.

SCHEDULE 2

Service Availability, Maintenance and Support Services (‘Support Services’)

Part 1: Service Availability

1. Consentz shall use reasonable endeavours to ensure that the uptime for the Services is at least 99.5% during each calendar month.

2. Consentz shall be responsible for measuring uptime, and shall do so using any reasonable methodology.

3. Downtime caused directly or indirectly by any of the following shall not be considered when calculating whether Consentz has met the availability target in paragraph 1: (a) a Force Majeure Event; (b) a fault or failure of the internet or any public telecommunications network; (c) a fault or failure of the Client’s computer systems or networks; (d) any breach by the Client of the Agreement; or (e) scheduled maintenance carried out in accordance with the Agreement.

Part 2: Maintenance Services

1. Consentz shall where practicable give to the Client prior written notice of scheduled Maintenance Services that are likely to affect the availability of the Consentz Services or are likely to have a material negative impact upon the Consentz Services, without prejudice to Consentz’s other notice obligations under this Part 2 of Schedule 2.

2. Consentz shall provide all scheduled Maintenance Services outside Business Hours.

3. Consentz shall give to the Client written notice of the application of any security Update to the Platform and prior written notice of the application of any non-security Update to the Platform.

4. Consentz shall apply Updates to the Platform as follows: (a) third party security Updates shall be applied to the Platform promptly following release by the relevant third party, providing that Consentz may acting reasonably decide not to apply any particular third party security Update; (b) Consentz’s security Updates shall be applied to the Platform promptly following the identification of the relevant security risk and the completion of the testing of the relevant Update; and (c) other Updates shall be applied to the Platform in accordance with any timetable notified by Consentz to the Client or agreed by the parties from time to time.

5. Consentz shall give to the Client prior written notice of the application of an Upgrade to the Platform.

Part 3: Support Services

1. Consentz shall make available to the Client a helpdesk in accordance with the provisions of this Part 3 of Schedule 2.

2. Consentz shall ensure that the helpdesk is accessible by telephone, email and using Consentz’s web-based notification system.

3. Consentz shall ensure that the helpdesk is operational and adequately staffed during Business Hours during the Term. In addition, Consentz shall provide a special telephone number for the Client to report critical issues outside of Business Hours.

4. The Client shall ensure that all requests for Support Services that it may make from time to time shall be made through the helpdesk.

5. Issues raised through the Support Services shall be categorised as follows: (a) critical: the Services are inoperable or a core function of the Services is unavailable; (b) serious: a core function of the Services is significantly impaired; (c) moderate: a core function of the Services is impaired, where the impairment does not constitute a serious issue; or a non-core function of the Services is significantly impaired; and (d) minor: any impairment of the Services not falling into the above categories; and any cosmetic issue affecting the Services.

6. Consentz shall determine, acting reasonably, into which severity category an issue falls.

7. Consentz shall use reasonable endeavours to respond to requests for Support Services promptly, and in any case in accordance with the following time periods: (a) critical: 1 Business Hour; (b) serious: 4 Business Hours; (c) moderate: 1 Business Day; and (d) minor: 5 Business Days.

8. Consentz shall ensure that its response to a request for Support Services shall include the following information (to the extent such information is relevant to the request): an acknowledgement of receipt of the request, where practicable an initial diagnosis in relation to any reported error, and an anticipated timetable for action in relation to the request.

9. Consentz shall use reasonable endeavours to resolve issues promptly. The following are target resolution times only: (a) critical: 4 Business Hours; (b) serious: 12 Business Hours; (c) moderate: 8 Business Days; and (d) minor: 30 Business Days. Resolution may depend on third parties, Client cooperation, the complexity of the issue, security testing and deployment requirements.

10. The Support Services shall be provided remotely, save to the extent that the parties agree otherwise in writing.

11. If the total hours spent by the personnel of Consentz performing the Support Services during any calendar month exceed 10, then: (a) Consentz will cease to have an obligation to provide Support Services to the Client during the remainder of that period; and (b) Consentz may agree to provide Support Services to the Client during the remainder of that period, but the provision of those Support Services will be subject to additional Fees.

12. Consentz shall have no obligation to provide Support Services in respect of any issue caused by: (a) the improper use of the Services by the Client; or (b) any alteration to the Services made without the prior consent of Consentz.

13. The availability, response and resolution figures in this Schedule are service targets measured by Consentz using a reasonable methodology. They are not conditions, warranties or guarantees, time is not of the essence, and failure to meet a target does not entitle the Client to a service credit, refund, payment withholding or termination right unless the Order Form expressly states otherwise. Subject to clause 17, the correction, workaround or substitution remedies described in clause 7.5 are the Client’s sole and exclusive remedies in relation to availability, support or performance failures.

SCHEDULE 3

Data Retention Policy

This Schedule sets out how long Consentz keeps Personal Data.

Where a longer period is required by law, a regulator or an ongoing or anticipated legal claim, the relevant records are kept for that period and then deleted or irreversibly anonymised.

SCHEDULE 4

Data Processing Terms

1. Scope and interpretation

1.1 This Schedule applies only where Consentz processes Personal Data on behalf of the Client. Terms such as controller, processor, data subject, personal data breach, processing and supervisory authority have the meanings given by applicable Data Privacy Laws.

1.2 The subject matter and duration of processing are the provision of the Services for the Subscription Term and any limited return, deletion, backup or legal-retention period. The nature and purpose of processing include hosting, storage, organisation, retrieval, transmission, support, security, backup and management of clinic, staff and patient records.

1.3 The types of Personal Data may include identity and contact information, demographic and appointment information, images and media, consent forms, communications, payment-related records, treatment, health and clinical information and other data configured or uploaded by the Client. Data subjects may include Patients, prospective patients, staff, practitioners, contractors and business contacts.

2. Roles, instructions and Client responsibility

2.1 The Client is the controller and Consentz is the processor of Clinic Patient Data. Each party shall comply with the Data Privacy Laws applicable to its role.

2.2 Consentz shall process Clinic Patient Data only on the Client’s documented instructions, including this Agreement, the Client’s configuration of its account settings and use of the Services and other written instructions accepted by Consentz, unless applicable law requires processing. Consentz shall inform the Client before legally required processing unless the law prohibits that notice.

The Client's configuration and use of the Services, recorded in the platform's settings and activity logs, constitute the Client's documented instructions, and the Client is responsible for the settings and options it configures.

2.3 Consentz shall inform the Client if, in Consentz’s opinion, a documented instruction infringes Data Privacy Laws. Consentz may refuse, suspend or seek clarification of an instruction that it reasonably believes infringes Data Privacy Laws, is technically infeasible, falls outside the Services or creates a material security or patient-safety risk, without liability while the parties seek a lawful and practicable solution.

2.4 The Client warrants that it has all notices, lawful bases, special-category conditions, consents, permissions and authority necessary for the collection and processing of Clinic Patient Data and for Consentz to process it under this Agreement. The Client shall not instruct Consentz to process unlawful, excessive or inaccurate data and shall indemnify the Consentz Parties against Losses arising from breach of this paragraph, except to the extent directly caused by Consentz’s material breach of this Schedule.

This indemnity applies in addition to, and not instead of, clause 16.9 of the main body of these Terms and Conditions and Schedule 6 of these Terms and Conditions.

3. Confidentiality and security

3.1 Consentz shall ensure that persons authorised to process Clinic Patient Data are subject to confidentiality obligations and access it only as necessary for their duties.

3.2 Taking into account the state of the art, implementation cost and the nature, scope, context and purposes of processing, Consentz shall maintain appropriate technical and organisational measures designed to protect Clinic Patient Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. Measures may include access controls, encryption in transit, logical separation, logging, backup and restoration procedures, vulnerability and patch management, incident response, personnel controls and subprocessor due diligence.

3.3 Consentz may update its security measures provided that the overall level of protection is not materially reduced. The Services do not guarantee absolute security, and the Client remains responsible for secure devices, credentials, user access, configurations and local systems.

4. Subprocessors

4.1 The Client gives Consentz general written authorisation to engage subprocessors. Consentz shall maintain a current list of material subprocessors and, where required by Data Privacy Laws, give prior notice of a material addition or replacement.

4.2 The Client may object on reasonable, documented data-protection grounds within ten (10) Business Days after notice. The parties shall work in good faith to resolve the objection. If no reasonable alternative is available, Consentz may suspend the affected feature or terminate the affected Service on notice without liability other than refunding prepaid Fees for the unused terminated period.

4.3 Consentz shall impose data-protection obligations on each subprocessor that are no less protective in material respects than the relevant obligations in this Schedule and shall remain responsible for the subprocessor’s performance to the extent required by Data Privacy Laws.

5. Data-subject requests and compliance assistance

5.1 Taking into account the nature of processing, Consentz shall provide reasonable assistance through the functionality of the Services or otherwise to help the Client respond to data-subject requests. Consentz may charge reasonable Fees for assistance that is excessive, repetitive, caused by the Client’s configuration or outside standard functionality.

5.2 Taking into account the nature of processing and information available to it, Consentz shall provide reasonable assistance with the Client’s obligations relating to security, breach notification, data-protection impact assessments and prior consultation. The Client remains responsible for deciding whether and how those obligations apply.

6. Personal data breaches

6.1 Consentz shall notify the Client without undue delay after becoming aware of a personal data breach affecting Clinic Patient Data and shall provide information reasonably available to Consentz to assist the Client with its notification obligations. Initial information may be provided in phases. Notice is not an admission of fault or liability.

6.2 The Client shall notify Consentz without undue delay of any suspected or actual compromise of Client Accounts, credentials, devices, integrations or Clinic Patient Data that may affect the Services and shall cooperate with containment and remediation.

7. International transfers

7.1 The Client authorises Consentz and its subprocessors to process Clinic Patient Data in the countries identified in the subprocessor information made available by Consentz, provided that each restricted transfer is supported by an applicable adequacy regulation, the UK International Data Transfer Agreement, the UK Addendum to approved EU Standard Contractual Clauses or another lawful transfer mechanism, together with any assessment or supplementary measure required by Data Privacy Laws.

7.2 The parties shall reasonably cooperate to execute or update transfer documentation where required. If a lawful transfer mechanism becomes unavailable, Consentz may adopt an alternative lawful mechanism, suspend the affected processing or terminate the affected Service without liability other than refunding prepaid Fees for the unused terminated period.

8. Audits and information

8.1 Consentz may, on reasonable written request and subject to confidentiality, make available information reasonably necessary to demonstrate compliance with this Schedule, such as its ISO 27001 certificate, policy summaries and audit attestations; Consentz need not disclose full internal audit reports or security-sensitive detail.

8.2 The Client may conduct one audit in any 12-month period on at least thirty (30) days’ notice, during Business Hours and without unreasonable disruption, first using remote review and available independent evidence. Additional audits are permitted where required by a supervisory authority or following a material breach reasonably affecting the Client.

8.3 The Client shall bear its audit costs and Consentz’s reasonable costs of assistance unless the audit identifies a material breach by Consentz. Auditors must be independent, suitably qualified, non-competitors and bound by confidentiality. No audit may expose information concerning other clients, security-sensitive material or privileged information.

9. Return and deletion

9.1 At the Client’s choice, Consentz shall return or delete Clinic Patient Data after termination in accordance with clause 15.4.3 and the ordinary backup cycle, unless applicable law requires retention. Consentz shall not charge for any return, deletion or destruction of personal data required by the Data Privacy Laws. Data retained temporarily in backups shall remain protected and shall not be restored except for disaster recovery, legal requirements or security purposes, and shall be deleted through the ordinary backup cycle.

10. Independent-controller processing

10.1 This Schedule does not apply to Account Data, Enquiry Data, Released Leads, Usage Data or Anonymous Data. Each party acts as an independent controller for data it processes for its own purposes, including compliance, security, billing, fraud prevention, consent and disclosure evidence, claims and regulatory obligations.

SCHEDULE 5

Clinic Privacy Notices and Consent Configuration

1. The Client is the controller of Clinic Patient Data and is solely responsible for the legal content, timing and delivery of privacy information to Patients, staff and other data subjects.

2. The Client is solely responsible for collecting all permissions and consents and ensuring that Consentz has a lawful basis on which to process the Personal Data. The Client shall not rely on a single bundled consent for treatment records, service administration and marketing where separate bases or choices are required.

3. Although Consentz may make configurable privacy notices, consent wording, forms, templates and workflow options available as operational tools, they are not guaranteed to be suitable for the Client’s practice or jurisdiction and must be reviewed, completed and approved by the Client before use, as the Client is responsible for its own compliance with the Data Privacy Laws.

4. The Client is solely responsible for ensuring that any withdrawal or objection requests are handled by the Client as controller (and the Consentz is informed in writing as soon as practicable of any withdrawal of consent or objection to processing that the Client receives from an individual).

5. The Client shall keep its contact details, privacy notice, retention rules, consent wording and regulatory information configured in the Platform accurate and current. Consentz may suspend a template or feature that it reasonably believes is unlawful, misleading or creates material risk.

Consentz does not determine, advise on, monitor or accept responsibility for the Client's compliance with its own obligations as controller under these Terms and Conditions or the Data Privacy Laws. The notices, templates and configuration options Consentz provides are operational tools only, and using them does not transfer any of the Client's responsibilities or liabilities to Consentz.

SCHEDULE 6

Directory Listing and Lead / Introduction Services

1. Application and contract formation

1.1 This Schedule applies where the Client has a Directory Listing, creates an account to review or purchase an Enquiry, or uses the Lead Services. It is additional to and governed by these Terms, including clauses 16, 17 and 21.

1.2 Before Consentz releases identifiable Enquiry Data, the Client must create or activate a Client Account, complete any identity or authority checks required by Consentz, accept this Agreement and Schedule, and pay the Lead Fee or hold an active entitlement to receive the Lead. The person accepting or purchasing the Lead warrants that they are authorised to act for the named clinic or practitioner.

1.3 Consentz may retain account, verification, acceptance, payment and access logs as evidence of the Client’s agreement, authority and receipt of a Released Lead.

2. Directory Listings

2.1 Consentz may create, publish and maintain a Directory Listing for the Client or its practitioners using information obtained from public or professional sources or supplied or claimed by the Client. Consentz is under no obligation to list any person and may decline, suspend, amend or remove a Listing at its discretion.

Where Consentz creates a Listing from public or professional sources, it does so without contacting the listed person first and provides the information required by Article 14 UK GDPR through the Consentz Privacy Policy. The listed person may object to the Listing or ask Consentz to correct, remove or suppress it at any time, and Consentz will action (and the Client shall ensure that it also complies with any) reasonable requests promptly.

2.2 The Client may claim its Listing, submit corrections, object to processing or request suppression in accordance with the Consentz Privacy Policy. The Client is responsible for the accuracy, legality and currency of information it supplies, claims or asks Consentz to publish.

2.3 Consentz may display the Directory Listing publicly, permit indexing by search engines and use it to enable patients to request an introduction. A Listing does not create an agency, referral, endorsement, partnership or professional relationship between Consentz and the listed person.

3.1 The Visibility Score is Consentz’s proprietary opinion of non-clinical online-visibility, discoverability and profile-completeness signals only. It is not an assessment of clinical competence, patient safety, treatment suitability, outcomes, reputation, regulatory compliance or endorsement.

The Visibility Score is produced by automated means, which may include artificial intelligence. The listed person may object to the automated Score and request human review; the Score is not used to make a decision producing legal or similarly significant effects.

3.2 Consentz may change the factors, methodology or weighting from time to time. The Client may request correction of underlying factual profile information and human review of a Score it believes is materially inaccurate. To the fullest extent permitted by law, the Client shall not treat good-faith publication of a clearly labelled Visibility Score or methodology-based opinion as a breach of this Agreement or actionable statement, without prejudice to rights that cannot lawfully be excluded.

4. Lead Services and release workflow

4.1 The Lead Services provide introductions only. Consentz does not diagnose, recommend treatment, verify clinical suitability, guarantee patient intent, endorse a Recipient Clinic or participate in the treatment relationship, which is solely between the Recipient Clinic and the patient.

4.2 Consentz gives no warranty as to the number, quality, accuracy, completeness, exclusivity, contactability or conversion of any Enquiry or Lead. An Enquiry may be fraudulent, mistaken, incomplete, withdrawn or submitted to more than one service or provider.

4.3 Where a patient selects a clinic that has not yet accepted the Lead, Consentz may send that clinic a blind notification that an Enquiry is available. Before release, the notification will not disclose the patient’s name, direct contact details, precise address or free-text enquiry content. It may include non-identifying commercial information such as a broad treatment category, general area, preferred contact method, price and expiry time.

4.4 Consentz will release identifiable Enquiry Data only after the Client has satisfied paragraph 1.2. A Lead is Released or Routed when Consentz first makes identifiable Enquiry Data available in the Client Account or by another approved secure method, whether or not the Client subsequently views, downloads or contacts it.

4.5 If the selected clinic does not accept an Enquiry, Consentz will not release the patient’s identity to that clinic and will not release it to an alternative clinic unless the patient has separately selected or authorised the named alternative clinic in accordance with the Consentz Privacy Policy.

4.6 Where a patient separately authorises named alternative clinics, the Lead may be offered or Released to more than one Recipient Clinic. The Client receives no exclusivity unless the Order Form expressly states otherwise.

5. Lead Fees, billing and invalid Leads

5.1 The Client shall pay the Lead Fee stated in the Order Form, Directory sign-up or purchase flow. Lead Fees are non-refundable except for a credit expressly granted under paragraph 5.3.

5.2 A Lead is chargeable when it is Released or Routed, regardless of whether the Client opens it, responds, contacts the patient, books an appointment, provides treatment or earns revenue from it.

5.3 The Client may report a Lead as invalid within seven (7) days after release only where it is a duplicate Lead previously charged by Consentz to the same Client within the previous thirty (30) days, contains manifestly false or non-functioning direct contact details at the time of release, or is demonstrably a Consentz test submission. Consentz shall determine validity acting reasonably and, where accepted, the Client’s sole remedy is a credit or waiver of the relevant Lead Fee.

5.4 A Lead is not invalid merely because the patient does not answer, changes their mind, is unsuitable for treatment, has contacted another provider, declines the Client’s price, does not attend or does not convert. The Client shall not initiate a chargeback or withhold other Fees for a disputed Lead and clauses 12.6 and 17 apply.

6. Recipient Clinic obligations and controller-to-controller data sharing

6.1 Independent controllers. Consentz and the Client are independent controllers in respect of Enquiry Data, as set out in paragraph 8. They are not joint controllers, and neither acts as the other's processor in respect of a Released Lead. Schedule 4 governs only Clinic Patient Data processed by Consentz on the Client's behalf and does not apply to a Released Lead.

6.2 Consentz's warranty on release. Before a Lead is Released or Routed, Consentz warrants that it has obtained the patient's consent to share the Enquiry Data with the Recipient Clinic, including explicit consent to share any health-related information contained in the Enquiry, and has provided the patient with the information required by the Data Privacy Laws. The Client may rely on that consent as the basis on which the Enquiry Data is shared with it.

6.3 The Client's role on release. From the point a Lead is Released or Routed, the Client is an independent controller of that Enquiry Data and is responsible for its own compliance with the Data Privacy Laws, including establishing its own lawful basis and, where required, its own special-category condition for any further processing, and providing its own privacy information to the patient.

6.4 Purpose limitation. The Client shall process a Released Lead only to respond to and pursue the patient's Enquiry. The Client shall not use it for any unrelated marketing, shall not sell, rent or further disclose it (other than to its own processors under a compliant written contract), and shall contact the patient only by means, and to the extent, permitted by PECR and covered by the consent obtained.

6.5 Security. The Client shall implement appropriate technical and organisational measures to protect a Released Lead against unauthorised or unlawful processing and against accidental loss, destruction or damage, in accordance with the Data Privacy Laws.

6.6 Data subject rights. Each party is responsible for handling requests from the patient in respect of the Enquiry Data it holds as controller. The parties shall give each other reasonable cooperation and information to enable the other to comply with such requests and with its obligations under the Data Privacy Laws.

6.7 Personal data breach. If either party becomes aware of a personal data breach affecting the Enquiry Data, it shall notify the other without undue delay and provide reasonable information to enable the other to meet its own obligations under the Data Privacy Laws.

6.8 International transfers. Neither party shall transfer Enquiry Data outside the United Kingdom unless a lawful transfer mechanism under the Data Privacy Laws is in place.

6.9 Retention. Once it becomes a controller of a Released Lead, the Client shall determine and apply its own retention period in accordance with the Data Privacy Laws. Consentz retains Enquiry Data as controller in accordance with paragraph 8.2 and the Consentz Privacy Policy.

6.10 Responsibility and indemnity. Each party is responsible for its own compliance as a controller. Without limiting clause 17 and in addition to paragraph 9, the Client shall indemnify the Consentz Parties against Losses (including any fine or penalty imposed by a supervisory authority, and any claim by a patient or third party) arising from the Client's processing of a Released Lead as a controller or its breach of this paragraph 6, except to the extent directly caused by Consentz's breach of paragraph 6.2. Neither party is required to indemnify the other for the other's own breach.

7. Clinical and regulatory compliance

7.1 The Client is solely responsible for all registrations, licences, insurance, prescribing authority, advertising compliance and professional obligations required for its services, including CQC, JCCP, GMC, NMC, GPhC or equivalent requirements where applicable.

7.2 The Client is solely responsible for assessing the patient, treatment suitability, informed consent, prescribing, treatment, follow-up, complaints and adverse events. Consentz provides no clinical, legal or regulatory advice and the Directory and Lead Services are not an endorsement.

8. Data-protection roles

8.1 Consentz is the independent controller of Enquiry Data until release to the Client. On release, the Client is an independent controller of the Enquiry Data.

Where a clinic receives an Enquiry directly through its own Client Account, without Consentz sourcing, collecting or routing it, the clinic is also the controller and Consentz acts only as its processor under Schedule 4.

8.2 Consentz may retain a copy of Enquiry Data as controller for routing, billing, consent and disclosure evidence, quality, security, fraud prevention, complaints, regulatory compliance and legal claims in accordance with the Consentz Privacy Policy.

9. Client warranties and indemnity

9.1 The Client warrants that it is authorised to act for the named clinic or practitioner, that all account and regulatory information it provides is accurate, and that it will comply with this Schedule and all applicable law in its use of Directory Listings and Leads.

9.2 Notwithstanding anything in the main body of these Terms and Conditions, the Client shall indemnify and keep indemnified the Consentz Parties against all Losses arising out of or in connection with: (a) breach of paragraphs 6 or 7 of this Schedule 6; (b) the Client’s contact with, treatment of or handling of any patient data , personal data or Lead; (c) any personal data processed in relation to or any act or omission in relation to any message, call, campaign or onward disclosure made by or for the Client; (d) any inaccurate information supplied or claimed by the Client; (e) the Client’s licensing, advertising, prescribing, clinical or regulatory non-compliance; or (f) any patient, regulator or third-party claim arising from the Client’s acts or omissions, except to the extent directly caused by Consentz’s material breach of this Schedule.

9.3 The limitation in clause 17.3 of the main body of these Terms and Conditions does not limit the Client’s liability under this paragraph 9 of Schedule 6. Consentz may control the defence and settlement of an indemnified Claim, subject to the procedure in clause 16.10 of the main body of these Terms and Conditions. The indemnity in clause 9.2 above applies in addition to, and not instead of, clause 16.9 of the main body of these Terms and Conditions.

10. Suspension, removal and cooperation

10.1 Consentz may immediately suspend or withdraw a Directory Listing, blind notification, Client Account, Lead or Lead Services, with or without prior notice, where the Client is in breach, a patient or practitioner complains, payment fails, Consentz reasonably suspects misuse, fraud, unlawful contact or regulatory risk, or suspension is reasonably necessary to protect a patient, Consentz or a third party.

10.2 The Client shall promptly provide information reasonably requested by Consentz to investigate a complaint, verify authority, demonstrate compliance or respond to a regulator. Failure to cooperate is a material breach.

11. No agency or entitlement

11.1 Nothing in this Schedule appoints the Client as Consentz’s agent or gives the Client any entitlement to future Leads, ranking, placement, exclusivity or continued publication. Consentz may change or discontinue the Directory or Lead Services at any time, subject to any express commitment in an Order Form.