Terms for clinics piloting the service

Last updated: 2026-05-15 · Version v1.0

These are clinic-facing terms. Patients interact only by SMS and are covered by the per-clinic privacy notice and SMS opt-in wording. Each pilot clinic also signs a Data Processing Agreement.

Draft — pending solicitor review. These terms are published for transparency during the pilot stage and will be reviewed and finalised by a UK solicitor before any production launch with real patient data.

Service scope

Missed-call SMS follow-up, patient intent capture, urgency flagging, and a receptionist dashboard. The service is provided to the dental clinic ("Customer"); patients interact via SMS only. Reception remains in control of every conversation.

Not a clinical decision-making tool

The service does not diagnose, prescribe, or give clinical advice.
The service does not book or modify appointments without reception confirmation.
The service is not a substitute for dental professionals, reception protocols, safeguarding policies, or clinical judgement.
Red-flag wording is fixed and routes patients to NHS 111. Reception is notified in parallel and must call the patient.

Customer responsibilities

Sign the Data Processing Agreement before connecting a real Twilio number.
Maintain ICO registration and a privacy notice naming the clinic as data controller.
Provide a named clinical lead (Clinical Safety Officer) to review and sign the hazard log.
Train reception on the dashboard and the Pause AI workflow.
Respond to patient enquiries surfaced by the dashboard within reasonable time.
Verify patient identity in the clinic's PMS (R4+ / Carestream / Dentally) before sharing clinical detail.

Acceptable use

UK dental clinics only. UK patient phone numbers only by default.
No use for marketing or non-clinic-related SMS.
No use for cross-clinic data analysis.
STOP / opt-out keywords must be honoured and not worked around.

Pilot terms

During pilot, the service is provided on a free-trial basis (4 weeks from setup-complete). Conversion to paid follows the conversion call at day 21. Either party may cancel in writing. On cancellation, patient data is returned and deleted within 30 days unless the Customer requests a longer return window.

Availability

The service runs on Vercel + Supabase + Twilio. We do not commit to a formal SLA during pilot stage. We monitor `/api/health` and use a 30-second kill switch to disable AI replies system-wide if needed. Customer is notified of any incident affecting their clinic within 24 hours.

Security and incidents

We follow the procedures in our Incident Runbook. UK GDPR Art. 33 breach notification within 72 hours of awareness. The Customer is notified at the same time as the ICO if their data is affected.

Sub-processors

Vercel, Supabase, Twilio, OpenAI (optional), Stripe (billing), Sentry (optional), Upstash (optional), Resend (reserved). The full sub-processor list is in the DPA. We notify Customers at least 30 days before adding a new sub-processor.

Limitation of liability

The service is provided as-is during pilot stage. We are not liable for clinical decisions made by the Customer's staff. We are not liable for patient outcomes arising from clinic actions taken on the basis of dashboard summaries. Customer remains responsible for clinical judgement in all cases.

Changes

We may update these terms with 30 days' notice. Customer may terminate during the notice period if they do not accept the changes.

Governing law

England and Wales. Disputes go to the courts of England and Wales.

Status

Pilot stage. These terms have been reviewed informally per the Mode 2 process (compliance/COMPLIANCE_MODES.md). A paid solicitor review will replace this version when the product reaches Mode 3.

Pilot stage. Mode 2 — informal solicitor review on file. Paid review will replace this version when flipping to Mode 3.