Terms of Service

Point of Sale, Marketing, CRM and Health Information Services

Effective date: 1 February 2026

Parties

1. Provider: Serene Co Pty Ltd ACN 697 561 443 ABN 34 697 561 443, a company incorporated in New South Wales, of 7 Elfrida Street, Mosman NSW 2088 (Provider).
2. Customer: The business identified in the Order Form (Customer).

The Provider and Customer are each a Party and together the Parties.

1. Agreement and business use

1.1 These Terms, the signed Order Form, the Health Information and Data Security Schedule, and any expressly incorporated service level or support schedule form the Agreement.

1.2 The Agreement is entered into when an authorised representative of each Party signs the Order Form.

1.3 Each signatory represents that they:

• are authorised to bind the relevant Party;
• are signing for business purposes, not personal or household use; and
• have had an opportunity to review and obtain advice on the Agreement.

1.4 Patients, consumers and other End Customers are not parties to this Agreement.

1.5 If documents conflict, the following order applies:

1. the Order Form;
2. the Health Information and Data Security Schedule;
3. these Terms; and
4. other incorporated policies.

An Order Form overrides the Health Information and Data Security Schedule only if it expressly identifies the provision being varied and the variation is lawful.

1.6 Nothing in the Agreement excludes rights or obligations that cannot lawfully be excluded, including applicable rights under the Australian Consumer Law.

2. Services

2.1 The Provider will supply the cloud-based point-of-sale, appointment, customer relationship management, marketing, reporting and related services described in the Order Form (Services).

2.2 During the Term, the Provider grants the Customer a non-exclusive, non-transferable right to permit its Authorised Users to use the Services for the Customer’s internal business operations.

2.3 The Provider will:

• provide the Services with due care and skill;
• materially comply with the Documentation;
• maintain the functionality, support and availability commitments in the Order Form;
• correct reproducible Provider-caused defects within a reasonable period having regard to their severity;
• maintain reasonable supplier, security, backup and incident-management arrangements; and
• perform its responsibilities under the Health Information and Data Security Schedule.

2.4 The Provider must not enable production storage of Health Information until:

• the approved data locations and subprocessors are recorded in the Order Form;
• the security controls designated as required before production have been implemented;
• the Customer has received the applicable privacy and security information; and
• the Provider has confirmed production activation in writing.

2.5 The Services are administrative and operational tools. Unless expressly identified in the Order Form as regulated clinical functionality, the Services:

• do not diagnose, treat or recommend treatment;
• are not a substitute for professional clinical judgment;
• are not an emergency service;
• are not represented to be a medical device; and
• must not be the Customer’s only means of accessing information required for urgent clinical care.

2.6 The Provider remains responsible for correct processing by the Services and for Provider-caused data loss, corruption, unauthorised access or incorrect calculations. Clause 2.5 does not exclude those responsibilities.

3. Responsibility allocation

3.1 Provider responsibilities

The Provider is responsible for:

• the design, operation, maintenance and security of Provider-controlled systems;
• its personnel, contractors and subprocessors;
• tenant separation and access controls within the Services;
• executing authorised Customer instructions faithfully;
• the operation of Provider-supplied payment and marketing integrations;
• preventing unauthorised Provider use or disclosure of Customer Data;
• Provider-controlled backups and restoration commitments stated in the Order Form;
• detecting, containing and responding to Security Incidents affecting Provider systems;
• supplying export, correction and deletion functionality described in the Agreement; and
• complying with Privacy Laws applying to its own handling of Personal Information and Health Information.

3.2 Customer responsibilities

The Customer is responsible for:

• the healthcare, retail and other services it supplies to End Customers;
• clinical decisions, diagnoses, treatments, prescriptions and professional advice;
• the lawful collection of Customer Data and the accuracy and clinical meaning of information entered by or for the Customer;
• patient notices, consents and other lawful authorities;
• deciding which staff require access and assigning appropriate roles;
• securing Customer-managed devices, networks, email accounts and credentials;
• the legality of the Customer’s products, prices, taxes, refunds, advertising and marketing content;
• selecting marketing recipients and maintaining evidence of required consents;
• the Customer’s merchant, card-scheme, taxation, record-retention and professional obligations;
• reviewing reports, alerts and reconciliations made available by the Services; and
• maintaining appropriate clinical, payment and business-continuity procedures.

3.3 Shared responsibilities

The Parties will cooperate in relation to:

• privacy requests and health-record access or correction;
• Security Incident assessment and notification;
• data retention, legal holds and deletion;
• payment reconciliation;
• business continuity and recovery;
• regulatory inquiries affecting both Parties; and
• orderly data export and transition.

3.4 A Party is responsible only to the extent that loss was caused or contributed to by its breach, negligence, unlawful conduct, personnel, systems or subcontractors.

3.5 The Customer is not responsible for a failure of Provider systems or Provider-selected subprocessors merely because the Customer used the Services. The Provider is not responsible for Customer clinical decisions or Customer-controlled systems merely because information was processed through the Services.

4. Authorised Users and account security

4.1 The Customer may permit only its employees and contractors with a legitimate business need to use the Services.

4.2 The Customer must:

• maintain current user records and promptly revoke unnecessary access;
• assign the least level of access reasonably required;
• not share user accounts;
• require strong passwords and multi-factor authentication where available;
• notify the Provider promptly of suspected account compromise; and
• ensure each Authorised User complies with the Agreement.

4.3 The Provider must provide appropriate role-based access functionality and make multi-factor authentication available for privileged and Customer-administrator accounts before production Health Information is accepted.

4.4 The Customer is not responsible for unauthorised access caused by a Provider vulnerability or failure of Provider-controlled access safeguards.

5. Point-of-sale and payment processing

5.1 Customer is the merchant

The Customer:

• sells directly to its End Customers;
• is the merchant responsible for each sale;
• determines the products, services, prices, taxes and refund terms;
• enters its own merchant agreement with the Approved Payment Processor; and
• is responsible for chargebacks and merchant obligations, except to the extent caused by a Provider Error.

5.2 Direct-charge structure

Where the Order Form specifies a connected-account direct-charge model:

• each card charge is created on the Customer’s connected payment account;
• the Customer, not the Provider, is the merchant account holder;
• the Payment Processor transfers the applicable Platform Transaction Fee to the Provider;
• the Customer receives the remaining settlement amount, less applicable processor fees, refunds, reserves, disputes and adjustments; and
• the Provider does not become the beneficial owner or trustee of the Customer’s remaining settlement proceeds.

Except for initiating transactions and collecting its disclosed Platform Transaction Fee through the approved integration, the Provider does not undertake to hold or settle Customer funds.

5.3 Provider payment responsibilities

The Provider is responsible for:

• accurately transmitting authorised transaction instructions;
• applying the Platform Transaction Fee stated in the Order Form;
• preventing duplicate Provider-generated payment requests;
• correcting Provider-caused fee or transaction errors;
• maintaining reasonable controls over payment integration credentials;
• complying with card-security requirements applicable to payment data the Provider possesses, processes or can affect; and
• reasonable management of its payment integration.

5.4 Processor responsibilities

The Approved Payment Processor is responsible for matters allocated to it under its merchant agreement, including card authorisation, acquiring, settlement, processor fees, reserves and processor-controlled infrastructure.

The Provider is not responsible for a processor, acquirer or card-network interruption beyond its reasonable control, but remains responsible for its own integration and for taking reasonable steps to manage and escalate supplier incidents.

5.5 Card information

The Customer and its users must use only approved payment fields, terminals and integrations.

Full card numbers, PINs, card verification values or other sensitive authentication data must not be entered into CRM notes, clinical notes, free-text fields, file uploads or marketing records.

Outsourcing payment processing does not remove either Party’s obligations within its own PCI DSS or contractual scope.

5.6 Business continuity

Unless the Order Form expressly includes tested offline payment functionality, the Customer must maintain a reasonable alternative procedure for internet, terminal, processor or Service outages. This may include manual invoicing or another lawful payment method.

6. Platform Transaction Fees

6.1 Card Transaction

A Card Transaction is a card payment successfully captured through the Approved Payment Processor using the Services.

A Card Transaction excludes:

• an authorisation that is not captured;
• a declined, cancelled or voided payment;
• a test transaction;
• a cash or non-card payment; and
• a duplicate transaction caused by a Provider Error.

6.2 Principal Card Amount

The Principal Card Amount is the successfully captured card amount for the Customer’s goods or services, after discounts and including GST charged by the Customer on its sale.

Unless the Order Form states otherwise, it excludes:

• an End-Customer Card Surcharge;
• tips and gratuities;
• donations;
• payment-processor fees;
• foreign-exchange fees; and
• any other amount expressly excluded in the Order Form.

For a split-tender sale, only the card-funded portion is included.

6.3 Platform Transaction Fee

The Platform Transaction Fee for each Card Transaction is:

Principal Card Amount × Transaction Fee Rate

The rate is specified in the Order Form. The fee is calculated for each Card Transaction and rounded to the nearest cent.

The Platform Transaction Fee:

• is a business-to-business fee payable by the Customer for the Services;
• is separate from fees charged by the Approved Payment Processor;
• is not a fee charged by the Provider to the End Customer;
• is not an End-Customer Card Surcharge; and
• does not authorise the Customer to pass the fee through as a card surcharge.

6.4 Collection through the Payment Processor

During the Term, the Customer authorises the Provider to instruct the Approved Payment Processor to transfer the correctly calculated Platform Transaction Fee to the Provider as an application or platform fee.

That authority is limited to Fees properly due under the Agreement. It does not authorise deductions for estimated future losses or genuinely disputed Usage Fees.

The Provider must make a transaction-fee report or reconciliation information reasonably available to the Customer.

6.5 Refunds

Unless the Order Form prominently states that Platform Transaction Fees are non-refundable, a successful full or partial refund of a Card Transaction will result in a corresponding pro-rata reversal or credit of the Platform Transaction Fee.

The Provider may apply the credit through the Approved Payment Processor or on the next invoice.

No credit is required for a chargeback, dispute, external processor fee or fraudulent transaction unless:

• the Order Form states otherwise;
• the event was caused by a Provider Error; or
• applicable law requires the credit.

6.6 Chargebacks

The Customer is responsible for chargebacks, retrieval requests and processor dispute fees arising from the Customer’s sales, representations, services or refund practices.

A documented third-party dispute fee may be passed through only if the Order Form permits it and it is itemised. The Provider must not add an undisclosed margin to a third-party chargeback fee.

6.7 Foreign currencies

If a transaction is not settled in Australian dollars, the Payment Processor’s settlement conversion will be used to determine the Australian-dollar Principal Card Amount unless another method is stated in the Order Form.

7. Usage Fees and other charges

7.1 The Provider may separately charge Usage Fees only for the units, rates, allowances and tiers stated in the Order Form.

7.2 The Order Form must identify, for each Usage Fee:

• the billable event or unit;
• whether the unit is measured when submitted, accepted, delivered or completed;
• the included allowance;
• applicable tiers and overage rates;
• how failed attempts, duplicates and retries are treated;
• any cap, minimum or committed quantity;
• the metering source;
• the billing period and time zone;
• rounding rules; and
• whether third-party charges are included or passed through.

7.3 Unless otherwise stated, billing periods use Australia/Sydney time.

7.4 Provider records and Approved Payment Processor records are prima facie evidence of usage and transactions but are not final or conclusive. The Provider must retain supporting billing records for at least 24 months.

7.5 The Provider will provide a usage report with each invoice or make equivalent reporting available through the Services.

7.6 The Customer should notify the Provider of a billing dispute within 60 days after the relevant statement or invoice. This period does not extinguish a statutory right that cannot lawfully be limited.

7.7 While a good-faith billing dispute is investigated:

• the Customer must pay the undisputed amount;
• the Provider must not suspend the Services solely because the disputed amount remains unpaid; and
• verified overcharges must be refunded or credited promptly.

7.8 If metering temporarily fails, the Provider may use a reasonable estimate based on disclosed historical data, but must reconcile the estimate against reliable data when available.

7.9 All Fees are exclusive of GST unless expressly stated otherwise. The Customer must pay applicable GST at the same time as the relevant Fee against a valid tax invoice.

7.10 Rates cannot be changed retrospectively. A rate change may take effect:

• at renewal; or
• after at least 60 days’ written notice, provided the Customer may terminate the affected Service without penalty before the change takes effect.

7.11 Except for Platform Transaction Fees collected through the Payment Processor, Usage Fees are invoiced monthly in arrears and payable within 14 days.

8. Card surcharges charged to End Customers

8.1 An End-Customer Card Surcharge is an additional amount imposed by the Customer because an End Customer pays by card.

8.2 The Customer is responsible for ensuring any surcharge or payment-method pricing:

• is permitted by law, card-network rules and its merchant agreement;
• does not exceed an applicable lawful limit;
• is accurately disclosed;
• is correctly configured; and
• is included in displayed prices where required.

8.3 The Provider may change, restrict or disable surcharge functionality where reasonably necessary to comply with law, card-network rules or Payment Processor requirements.

8.4 The Customer must not relabel a prohibited card surcharge as a booking, service or administration fee where the fee is in substance imposed because the End Customer pays by card.

8.5 Changes to surcharge functionality do not affect the Customer’s obligation to pay the Platform Transaction Fee. The Customer may recover its general business costs through its overall prices where lawful.

9. Marketing and CRM services

9.1 The Customer is responsible for:

• the substance and accuracy of Customer marketing content;
• selecting the audience;
• maintaining required consents and suppression records;
• identifying whether a communication is transactional or promotional;
• complying with the Spam Act 2003, Privacy Laws, the Do Not Call Register Act 2006, healthcare advertising rules and other applicable laws; and
• honouring opt-outs and withdrawals of consent.

9.2 The Provider is responsible for:

• implementing available suppression and unsubscribe functionality;
• processing lawful opt-out instructions;
• not knowingly sending messages contrary to recorded suppression instructions;
• faithfully applying Customer-configured audiences and filters; and
• correcting Provider-caused sending or audience-selection errors.

9.3 Health Information or health-based segmentation must not be used for direct marketing unless:

• the affected individual has given valid, current and specific express consent;
• the Customer has recorded evidence of that consent;
• the use is permitted by Privacy Laws; and
• the Customer has expressly instructed the Provider to perform the campaign.

General acceptance of a privacy policy, inferred consent or failure to opt out is not sufficient authority for health-based direct marketing.

9.4 The Provider must not use Customer Health Information for its own marketing, advertising, lead generation or cross-customer profiling.

9.5 The Customer must not upload purchased marketing lists or use the Services to send unlawful, deceptive or unsolicited communications.

10. Customer Data and Health Information

10.1 Customer Data means information entered, uploaded, generated or stored through the Services for the Customer, including Personal Information and Health Information.

10.2 Health Information has the meaning given by applicable Privacy Laws and includes:

• clinical and treatment records;
• medical histories, medications and photographs;
• appointment and service information;
• billing or retail information collected in providing a health service;
• health-related preferences and communications;
• genetic information; and
• healthcare identifiers.

10.3 Health Information is authorised core Customer Data under this Agreement. It is not prohibited data, provided it is handled in accordance with the Agreement.

10.4 As between the Parties, the Customer retains all rights and interests it lawfully holds in Customer Data. Nothing in the Agreement limits an individual’s statutory rights in relation to their information.

10.5 The Customer grants the Provider a limited right to process Customer Data only as necessary to:

• provide, secure, support and maintain the Services;
• carry out documented Customer instructions;
• prevent fraud or misuse;
• comply with law; or
• perform another purpose expressly stated in the Order Form.

10.6 The Provider must not:

• sell Customer Data;
• use identifiable Customer Data for advertising;
• use Customer Health Information for unrelated analytics;
• combine identifiable health records across customers for profiling;
• attempt to re-identify de-identified information; or
• use Customer Health Information to train a general-purpose artificial intelligence or machine-learning model.

10.7 The Provider may create service statistics only where information has been robustly de-identified so that individuals and the Customer cannot reasonably be identified. The statistics must not contain identifiable clinical content and must not be used to make decisions about an individual.

10.8 A feature that sends Health Information to an artificial-intelligence provider may be used only where:

• the feature is expressly approved in the Order Form;
• the AI provider appears in the approved subprocessor list;
• the proposed use has a lawful basis;
• applicable retention and model-training restrictions are documented; and
• the Customer has been given sufficient information to provide required notices and obtain any required consent.

10.9 The Services do not include access to My Health Record, Medicare claiming, prescribing infrastructure or healthcare-identifier services unless expressly stated in the Order Form and governed by an additional approved schedule.

10.10 The Provider does not represent that the Services are HIPAA certified or compliant with United States health laws unless a separate written addendum expressly states otherwise.

11. Privacy compliance

11.1 Privacy Laws include, to the extent applicable:

• the Privacy Act 1988 (Cth) and Australian Privacy Principles;
• the Notifiable Data Breaches scheme;
• the Health Records and Information Privacy Act 2002 (NSW) and Health Privacy Principles;
• other applicable Australian state or territory health-record laws; and
• binding privacy codes, regulations and orders.

11.2 Each Party must comply with Privacy Laws applying to its own acts and practices. Nothing in the Agreement transfers, excludes or limits a Party’s direct statutory obligations.

11.3 Whether or not the Provider qualifies for a statutory small-business exemption, it must perform its contractual obligations to a standard no less protective than the requirements in the Health Information and Data Security Schedule.

11.4 The Customer remains responsible for:

• establishing a lawful basis for collection;
• providing required patient notices;
• obtaining and recording required consents;
• collecting only relevant and reasonably necessary information;
• determining lawful clinical-record retention periods;
• verifying identity when responding to patient requests; and
• deciding the substantive response to access, correction or complaint requests.

11.5 The Provider remains responsible for:

• its handling of Customer Data;
• Provider personnel and subprocessors;
• platform access controls and tenant separation;
• preventing unauthorised use, modification, disclosure or loss;
• maintaining the agreed security safeguards;
• performing authorised export, correction, retention and deletion instructions; and
• notifying and assisting the Customer in relation to Security Incidents.

11.6 The Customer’s privacy notice should identify the Provider and relevant subprocessors where required by law. The Provider must give the Customer accurate and current information needed for that notice.

12. Data locations and subprocessors

12.1 The Order Form must identify:

• primary hosting locations;
• backup and disaster-recovery locations;
• support-access locations;
• material subprocessors; and
• each relevant Australian state, territory or overseas country.

12.2 The Provider must not permit Health Information to be handled outside New South Wales unless:

• the location is disclosed in the Order Form or approved in writing;
• the transfer or access is permitted under HPP 14 and other applicable Privacy Laws;
• the recipient is bound by written privacy, security, incident, return and deletion obligations appropriate to Health Information; and
• the Provider remains responsible for the recipient’s performance of those obligations.

12.3 The Provider must give at least 30 days’ advance notice of a material new out-of-NSW subprocessor.

12.4 The Customer may reasonably object on genuine privacy, clinical safety or regulatory grounds. The Parties will attempt to implement a reasonable alternative. If no reasonable alternative is available, the Customer may terminate the affected Service without an early-termination fee and export its Customer Data.

12.5 The Provider is not relieved from liability merely because a breach or failure was committed by its chosen subprocessor.

13. Security

13.1 The Provider must maintain technical and organisational safeguards appropriate to the volume, sensitivity and potential impact of the Health Information it holds.

13.2 The safeguards must include, as applicable:

• encryption in transit and at rest;
• unique user identities;
• role-based access and least privilege;
• multi-factor authentication for privileged access;
• tenant-separation controls designed to prevent cross-customer access;
• secure management of secrets and integration credentials;
• logging of access, material changes, exports and deletion;
• reasonable protection of audit records from unauthorised alteration;
• vulnerability identification, patching and remediation;
• secure software-development and change-management practices;
• malware, monitoring and alerting controls;
• backups, restoration procedures and periodic recovery testing;
• incident-response and business-continuity plans;
• personnel confidentiality, privacy and security training;
• access review and prompt deprovisioning; and
• secure destruction or de-identification when information is no longer required.

13.3 Provider-selected telemetry, analytics, support and error-monitoring systems must not receive Health Information unless approved as subprocessors and configured consistently with this Schedule.

13.4 The Provider must conduct risk-based security testing at the intervals stated in the Order Form and remediate material findings within reasonable risk-based periods.

13.5 On reasonable request, the Provider will supply available security documentation sufficient for the Customer to assess compliance. Any detailed reports may be subject to confidentiality and security restrictions.

13.6 No method of internet transmission or storage is completely risk-free. This acknowledgement does not reduce the Provider’s obligation to maintain the safeguards required by the Agreement.

14. Security Incidents

14.1 A Security Incident is an actual or reasonably suspected unauthorised access, use, disclosure, alteration, destruction or loss of Customer Data, or a material compromise of a system used to process Customer Data.

14.2 The Provider must notify the Customer without undue delay and, for a suspected material incident affecting Health Information, within 24 hours after becoming aware of it.

14.3 Initial notice must not be delayed because an investigation is incomplete. The Provider must provide available information about:

• the nature and timing of the incident;
• affected systems and information;
• affected customers or individuals, where known;
• containment and remediation;
• likely consequences;
• evidence preservation; and
• the Provider contact managing the response.

14.4 The Provider must:

• contain and investigate the incident;
• preserve relevant evidence;
• give material rolling updates;
• take reasonable corrective action;
• assist with legally required assessments and notifications; and
• provide a root-cause and remediation summary when reasonably practicable.

14.5 The Customer will ordinarily coordinate communications with its patients because it has the direct clinical relationship. Neither Party may prevent the other from notifying a regulator or individual where that Party is legally required to do so.

14.6 Reasonable forensic, restoration, legally required notification and incident-response costs are allocated between the Parties to the extent each Party caused or contributed to the incident. Those costs are direct losses for clause 25.

15. Access, correction and complaints

15.1 The Customer will ordinarily:

• verify the requesting individual’s identity;
• decide whether access or correction is legally required;
• determine whether any exception applies; and
• communicate the substantive response.

15.2 The Provider must provide reasonable search, export, correction, notation and audit functionality and assist the Customer within five Business Days after a reasonable request.

15.3 If the Provider receives a request or complaint directly from an individual concerning Customer Data, it must promptly refer the request to the Customer unless law requires the Provider to respond directly.

15.4 Corrections must preserve clinically or legally required history. Information must not be silently overwritten where a notation, amendment trail or original record must be retained.

16. Retention, export and deletion

16.1 The Customer is responsible for determining and configuring its lawful clinical, financial and business-record retention periods.

16.2 The Provider must not delete Customer Health Information contrary to an agreed retention instruction or legal hold.

16.3 During the Term, the Customer may export Customer Data using available functionality.

16.4 On termination:

• the Customer will have at least 30 days to export Customer Data;
• the Provider will provide a structured, commonly readable export of records and associated files;
• standard exports will be provided without an additional exit fee;
• extraordinary migration services may be charged only at rates agreed in advance;
• active Customer Data will be securely deleted within 90 days after the export period; and
• residual backup copies will expire through the normal backup cycle within no more than 180 days.

16.5 The Provider may retain information for longer only where required by law, necessary to establish or defend legal claims, or agreed in writing. Retained information remains protected by the Agreement and may not be used for another purpose.

16.6 Deletion must include Provider-controlled systems and instructions to relevant subprocessors. The Provider must provide reasonable confirmation of deletion on request.

17. Confidentiality

17.1 Each Party must:

• use the other Party’s Confidential Information only for the Agreement;
• disclose it only to personnel and contractors who need it and are bound by confidentiality obligations;
• apply reasonable safeguards; and
• notify the other Party of known unauthorised disclosure.

17.2 Customer Data, Health Information, security documentation, business records, pricing and non-public product information are Confidential Information.

17.3 Confidentiality obligations do not apply to information that is lawfully public, independently developed, already lawfully known or lawfully received without restriction.

17.4 A Party may disclose Confidential Information where legally required after giving prior notice where lawful and reasonably practicable.

17.5 These obligations survive termination. Obligations concerning Health Information and trade secrets continue for as long as the information remains confidential.

18. Intellectual property

18.1 The Provider owns the Services, software, Documentation, designs and improvements, excluding Customer Data and Customer materials.

18.2 The Customer owns its trademarks, marketing content and other materials supplied by it.

18.3 The Customer grants the Provider a limited licence to use Customer materials only to provide the Services.

18.4 Feedback may be used by the Provider without restriction if it does not contain Customer Confidential Information or identify an individual.

18.5 The Provider warrants that it has the rights required to provide the Services.

19. Acceptable use

The Customer must not, and must not permit an Authorised User to:

• use the Services unlawfully;
• access another customer’s data;
• bypass access or security controls;
• upload malicious code;
• interfere with Service integrity;
• conduct unauthorised security testing;
• reverse engineer the Services except where law permits;
• store sensitive card authentication data in unapproved fields;
• use Health Information for marketing without the authority required by clause 9.3; or
• use the Services to cause harm, discrimination or unlawful surveillance.

20. Third-party services

20.1 Some functionality depends on payment processors, telecommunications providers, hosting providers, email services and other third parties.

20.2 Customer-selected integrations are governed by the Customer’s separate agreement with the relevant provider. The Customer is responsible for deciding whether to enable them.

20.3 The Provider is responsible for reasonable selection, configuration and management of Provider-selected subprocessors and remains responsible as stated in clauses 12 and 13.

20.4 A Party is not liable for a third-party interruption beyond its reasonable control, but this does not excuse:

• a failure of its own integration;
• unreasonable supplier management;
• failure to implement agreed resilience;
• failure to notify or respond reasonably; or
• liability allocated to it elsewhere in the Agreement.

21. Availability, maintenance and support

21.1 Any availability target is stated in the Order Form. A target is not a guarantee of uninterrupted operation.

21.2 Availability calculations exclude:

• scheduled maintenance notified in advance;
• Customer systems, devices, configuration or connectivity;
• Approved Payment Processor or card-network outages beyond the Provider’s reasonable control;
• suspension permitted by the Agreement; and
• Force Majeure Events.

21.3 Exclusions apply only to the extent the excluded event caused the unavailability.

21.4 The Provider must use reasonable efforts to:

• schedule maintenance outside normal operating periods;
• provide advance notice;
• monitor the Services;
• communicate material incidents; and
• restore affected functionality promptly.

21.5 Service credits, if specified, are not the exclusive remedy for privacy breaches, confidentiality breaches, data loss, wilful misconduct or liability that cannot lawfully be limited.

22. Warranties and Australian Consumer Law

22.1 Each Party warrants that it has authority to enter into and perform the Agreement.

22.2 The Provider warrants that:

• the Services will be supplied with due care and skill;
• the Services will materially conform to the Documentation;
• it will comply with laws applying to its provision of the Services; and
• it will not knowingly introduce malicious code.

22.3 The Customer warrants that:

• it has lawful authority to provide Customer Data and instructions to the Provider;
• its clinical, sales and marketing activities comply with applicable law; and
• Customer materials do not knowingly infringe third-party rights.

22.4 Except for express warranties and non-excludable rights, neither Party gives an implied warranty regarding fitness for an undisclosed purpose.

22.5 Where a guarantee under the Australian Consumer Law applies and liability may lawfully be limited, the Provider’s liability is limited, at its option, to resupplying the affected Services or paying the reasonable cost of resupply, but only where that limitation is fair and reasonable.

23. Suspension

23.1 The Provider may suspend only the affected part of the Services where reasonably necessary to:

• address an immediate security or safety risk;
• prevent unlawful activity;
• comply with law or a Payment Processor direction;
• protect Customer Data; or
• address overdue, undisputed Fees after at least 10 Business Days’ written notice.

23.2 The Provider must:

• limit suspension to what is reasonably necessary;
• notify the Customer promptly;
• explain the reason where lawful;
• restore access when the cause is resolved; and
• preserve Customer Data.

23.3 The Provider must not suspend the Services solely because a Fee is genuinely disputed under clause 7.

23.4 Where safe and lawful, the Provider will preserve read-only or export access to health records during a payment-related suspension.

24. Indemnities

24.1 Customer indemnity

The Customer indemnifies the Provider against a third-party claim to the extent caused by:

• unlawful Customer Data or Customer instructions;
• the Customer’s failure to obtain required notices or consents;
• Customer-authored unlawful marketing;
• the Customer’s clinical treatment, professional advice, products or services; or
• Customer materials infringing third-party intellectual-property rights.

The indemnity does not apply to the extent the claim was caused or contributed to by the Provider, its personnel, its systems or its subprocessors.

24.2 Provider indemnity

The Provider indemnifies the Customer against a third-party claim to the extent caused by:

• the Services infringing third-party intellectual-property rights;
• a Provider breach of confidentiality;
• unauthorised Provider use or disclosure of Customer Data;
• a Security Incident caused by Provider-controlled systems, personnel or subprocessors; or
• the Provider’s unlawful instructions or communications.

The indemnity does not apply to the extent the claim was caused or contributed to by the Customer, its personnel, its systems or Customer-selected integrations.

24.3 Indemnity procedure

The indemnified Party must:

• notify the indemnifying Party promptly;
• take reasonable steps to mitigate loss;
• provide reasonable cooperation at the indemnifying Party’s cost; and
• allow the indemnifying Party to control the defence, subject to reasonable participation and conflicts of interest.

No settlement may admit fault by, or impose a non-monetary obligation on, the indemnified Party without its prior written consent.

24.4 Each Party remains responsible for regulatory penalties imposed for its own contravention. Nothing requires a Party to indemnify a fine where doing so would be unlawful.

24.5 Indemnities are subject to clause 25 unless expressly stated otherwise.

25. Liability

25.1 Responsibility according to fault

Each Party’s liability will be reduced to the extent that the other Party or a third party under the other Party’s control caused or contributed to the loss.

25.2 Excluded losses

Subject to clauses 25.5 and 25.6, neither Party is liable for:

• indirect or consequential loss;
• loss of anticipated profits, revenue, savings or opportunity;
• reputational harm; or
• punitive or exemplary damages.

This exclusion does not apply merely because a loss arises from a privacy or security incident. Reasonable data restoration, forensic investigation, legally required notification and incident-response costs are treated as direct loss.

25.3 General Cap

Subject to clauses 25.4 to 25.6, each Party’s aggregate liability arising from related events is limited to:

• all Platform Transaction Fees, Usage Fees and other Fees paid or payable under the Agreement during the 12 months immediately before the event first giving rise to liability.

For an event during the first 12 months, the cap is the Fees paid or payable before the event plus any minimum committed Fees for the first 12 months.

25.4 Health, Privacy, Security and IP Cap

Each Party’s aggregate liability for:

• breach of privacy or health-information obligations;
• breach of confidentiality;
• a Security Incident;
• loss or corruption of Customer Data;
• the indemnities in clause 24; and
• intellectual-property infringement

is limited to:

• three times the General Cap.

25.5 Uncapped matters

The caps and exclusions do not apply to:

• unpaid Fees properly due;
• fraud or fraudulent misrepresentation;
• wilful misconduct;
• intentional or reckless misuse or disclosure of Personal Information or Health Information;
• death or personal injury caused by negligence;
• deliberate intellectual-property infringement; or
• liability that cannot lawfully be excluded or limited.

25.6 Non-excludable rights

Nothing in the Agreement excludes, restricts or modifies:

• a statutory guarantee, right or remedy that cannot lawfully be excluded;
• liability where a limitation would not be fair and reasonable; or
• the rights of regulators or affected individuals, who are not bound by the contractual caps between the Parties.

25.7 Application of caps

The caps apply to liability in contract, tort including negligence, statute, indemnity and otherwise. Related claims arising from the same underlying cause are treated as one event.

25.8 Service credits

A service credit counts toward the Provider’s liability for the same event, but is not the Customer’s exclusive remedy except for an availability failure that causes no other compensable loss and does not involve a matter listed in clause 25.5.

26. Insurance

26.1 During the Term, the Provider must maintain:

• any workers compensation insurance required by law.

26.2 The Customer must maintain insurance reasonably appropriate to its operations, including professional indemnity for clinical services and public liability.

26.3 On reasonable request, each Party will provide evidence of applicable insurance.

27. Term, renewal and termination

27.1 The Agreement starts on the commencement date in the Order Form and continues for the Initial Term.

27.2 Renewal, notice and cancellation arrangements must be prominently stated in the Order Form.

27.3 Unless otherwise stated, the Agreement renews for successive monthly periods. Either Party may prevent renewal by giving at least 30 days’ notice before the current term ends.

27.4 Either Party may terminate the Agreement if the other Party:

• materially breaches it and fails to remedy the breach within 20 Business Days after notice;
• suffers an insolvency event, subject to applicable insolvency law; or
• repeatedly commits material breaches that are not reasonably capable of reliable remedy.

27.5 The Customer may terminate an affected Service without penalty where expressly permitted by clauses 7.10 or 12.4.

27.6 The Provider may terminate for convenience only on at least 90 days’ notice and must refund any prepaid Fees for the period after termination.

27.7 Termination does not affect accrued rights, payment obligations or provisions intended to survive.

28. Consequences of termination

28.1 On termination:

• the Customer must stop using the Services, except during the export period;
• accrued undisputed Fees remain payable;
• the Provider must make Customer Data available under clause 16;
• each Party must return or destroy the other’s Confidential Information where required; and
• the Provider must not withhold health-record exports solely to secure payment of a genuinely disputed amount.

28.2 Clauses concerning confidentiality, privacy, security incidents, data export and deletion, intellectual property, indemnities, liability, disputes and accrued payment obligations survive termination.

29. Disputes

29.1 A Party must give written notice describing a dispute and the outcome sought.

29.2 A senior representative of each Party must attempt in good faith to resolve the dispute within 10 Business Days.

29.3 If unresolved, the Parties will attempt mediation in Sydney, New South Wales, before commencing court proceedings.

29.4 Nothing prevents a Party from seeking urgent interlocutory relief, enforcing an undisputed debt, reporting a matter to a regulator or complying with a legal notification duty.

30. Force majeure

30.1 A Party is not liable for delay caused by an event beyond its reasonable control, excluding inability to pay.

30.2 The affected Party must notify the other, mitigate the impact and resume performance promptly.

30.3 Force majeure does not excuse the Provider from maintaining agreed backup, security, incident-response and disaster-recovery arrangements.

30.4 If a material force majeure event continues for more than 60 days, either Party may terminate the affected Service without penalty.

31. General terms

31.1 Notices: Contract notices must be sent to the contacts in the Order Form. Security notices must also be sent to the designated security contacts.

31.2 Assignment: Neither Party may assign the Agreement without the other Party’s consent, not to be unreasonably withheld. Consent is not required for a corporate restructure or sale of substantially all relevant business assets if the assignee can perform the Agreement and is not a direct competitor of the other Party.

31.3 Subcontracting: The Provider may subcontract performance but remains responsible for its subcontractors as stated in the Agreement.

31.4 No partnership: The Agreement does not create employment, partnership, agency, fiduciary or joint-venture relationships.

31.5 No waiver: Delay in exercising a right is not a waiver.

31.6 Severability: An invalid provision will be read down where possible and otherwise severed without affecting the remainder.

31.7 Entire agreement: The Agreement contains the entire agreement about its subject matter and supersedes earlier representations, except fraudulent representations.

31.8 Variation: A variation must be in writing and agreed by authorised representatives. The Provider may make minor operational changes that do not materially reduce the Services or Customer rights.

31.9 Governing law: The Agreement is governed by the laws of New South Wales, Australia. The Parties submit to the courts of New South Wales and applicable Commonwealth courts.

31.10 Electronic execution: The Agreement may be signed electronically and in counterparts.

Schedule 1: Order Form

Schedule 1 is the Order Form. It is completed and signed with each Customer and is not published here. Its contents prevail over these Terms only as described in clause 1.5.

Schedule 2: Health Information and Data Security Schedule

1. This Schedule applies whenever the Services collect, hold, access, generate, use, disclose, transfer or delete Health Information.
2. Each Party retains its independent statutory obligations. The Customer is not solely responsible for Health Information held or controlled by the Provider.
3. The Provider may process Health Information only for the purposes in clause 10.5 and must follow lawful documented Customer instructions.
4. Provider personnel may access Health Information only where necessary for authorised support, security, maintenance or legal purposes. Access must be logged and subject to confidentiality and least-privilege controls.
5. The Provider must maintain the controls in clause 13 and the Order Form. A control marked as required before production is a condition of production activation.
6. The Provider must not expose Health Information to an unapproved analytics, telemetry, AI, support or error-monitoring provider.
7. The Provider remains responsible for Provider-selected subprocessors and must impose written requirements addressing: permitted processing; confidentiality; security; incident notification; access and correction support; location and cross-border access; retention; return and deletion; and audit evidence.
8. The Provider must assist with access, correction, complaint, regulatory and breach-response obligations within the periods in the Agreement.
9. The Customer will ordinarily lead patient communications, but each Party may comply with its own notification duties.
10. Neither Party may use Health Information for direct marketing without the express consent and other lawful authority required by clause 9.3.
11. The Provider must not materially reduce an agreed health-information safeguard during the Term without: advance written notice; a documented risk assessment; a reasonable alternative safeguard; and any Customer approval required by law or the Order Form.
12. On termination, Health Information must be exported, retained and deleted under clause 16. The Provider must not use retained backup or legal-hold copies for another purpose.
13. The liability provisions in clause 25 apply to this Schedule. They do not limit the rights of patients, regulators or other third parties.