Terms of Service

Version: 2.1 Effective Date: 28 April 2026 Last Updated: 7 November 2026 — see Changelog at the bottom. This document still requires solicitor review before being relied on commercially or for insurance underwriting purposes. Items marked to be added before launch are company details or business decisions (fees, exact SLA percentage, liability cap, notice periods) that have not been finalised yet — the surrounding legal mechanism is drafted to UK standard and ready to receive those figures.

1. Parties and Acceptance

These Terms of Service ("Terms") are a contract between EchoVell Ltd, a company registered in England and Wales, which provides AssuraFlow ("AssuraFlow", "we", "us"), and the customer organisation identified on the applicable order form or subscription ("Customer", "you"). By creating an account, signing an order form, or using the Service, Customer agrees to these Terms. If you are entering into these Terms on behalf of an organisation, you confirm you have authority to bind that organisation.

• Company number: to be added before launch
• Registered office: to be added before launch

2. Definitions

• "Service": the AssuraFlow governance, accountability, and evidence orchestration software platform, including the web application, API, and any mobile application AssuraFlow makes available.
• "Customer Data": all data Customer or its Authorised Users submit to, or generate within, the Service, including governance records, evidence, and any service-user-related information Customer chooses to enter.
• "Authorised User": an individual Customer authorises to access the Service under Customer's account.
• "Order Form": the document (online or signed) specifying the subscription tier, fees, term, and any SLA for Customer's use of the Service.
• "DPA": the Data Processing Agreement at DPA.md, incorporated into these Terms by reference for all processing of personal data.

3. Scope of Service

AssuraFlow provides governance, accountability, and evidence orchestration software for UK care providers. The Service supports oversight, evidence readiness, and remediation-lifecycle workflows. The Service does not deliver care and does not replace care planning, medication administration (MAR), rostering, payroll, or care notes systems — see NI-CHARTER-ACCOUNTABILITY-BOUNDARY.md for the full boundary of what the Service does and does not do. Any AI-assisted features are governed additionally by AI-USAGE-DISCLOSURE-POLICY.md; AI output is assistive only and Customer's accountable staff remain responsible for all governance decisions.

4. Accounts and Authorised Users

• Customer is responsible for the acts and omissions of its Authorised Users as if they were Customer's own, and for keeping account credentials confidential.
• Customer must promptly notify AssuraFlow of any suspected unauthorised access or account compromise.
• AssuraFlow may suspend an Authorised User's access where reasonably necessary to protect the security or integrity of the Service (see §12).

5. Roles and Data Protection

Customer is Data Controller for Customer Data (including any service-user data entered into AssuraFlow). AssuraFlow is Data Processor for Customer Data, and Data Controller only for AssuraFlow's own account and billing metadata. The DPA governs all processing of personal data under these Terms and takes precedence over these Terms on data protection matters in the event of conflict.

6. Acceptable Use

Customer must use the Service lawfully and must not:

• upload malware, illegal content, or data it does not have proper authority to submit (including special category health data beyond what the DPA's permitted categories cover, without a separate written agreement — see DPA.md §3.2);
• attempt to circumvent tenant isolation, access controls, or rate limits, or probe, scan, or test the Service's security without AssuraFlow's prior written authorisation;
• resell, sublicense, or provide the Service to any third party outside Customer's own organisation, except as expressly permitted on the Order Form;
• reverse engineer, decompile, or attempt to extract source code from the Service, except to the extent such restriction is unenforceable under applicable law.

7. Fees and Payment

Fees are set out on the applicable Order Form. Except as stated there:

• Fees are exclusive of VAT, which is payable in addition where applicable.
• Payment terms: to be added before launch (for example, net 30 days from invoice).
• Late payments accrue statutory interest under the Late Payment of Commercial Debts (Interest) Act 1998, unless the Order Form states otherwise.
• AssuraFlow may suspend the Service for accounts more than a number of days overdue (to be added before launch), after written notice.

8. Intellectual Property

AssuraFlow and its licensors own all rights in the Service, including its software, design, and documentation. Nothing in these Terms transfers any such rights to Customer. Customer grants AssuraFlow a licence to host, process, and display Customer Data solely to provide the Service, comply with law, and as otherwise permitted under the DPA.

9. Confidentiality

Each party will protect the other's confidential information (including Customer Data, and AssuraFlow's non-public product and security information) with at least reasonable care, and use it only to perform under these Terms. This does not apply to information that is public through no fault of the receiving party, was already known to it, or is independently developed. Confidentiality obligations survive termination for a period to be added before launch (for example, 3 years, matching DPA §14.3).

10. Security

AssuraFlow applies encryption in transit and at rest, role-based access control, immutable audit logging, and incident response controls, described further in INFORMATION-SECURITY-POLICY.md and INCIDENT-RESPONSE-PLAN.md. Customer Data is stored and processed in the United Kingdom, on Microsoft Azure (UK South). Before go-live, the Service runs in a test environment that holds no real customer data. See SUBPROCESSORS-DATA-RESIDENCY-STATEMENT.md for the subprocessor list and where each one processes data.

11. Service Availability

Service-level targets, planned maintenance windows, and support hours are defined in the SLA and Order Form. Where no specific SLA is agreed, AssuraFlow will use reasonable endeavours to maintain Service availability but does not guarantee uninterrupted or error-free operation. Planned maintenance will be notified in advance where reasonably practicable.

12. Suspension

In addition to §7, AssuraFlow may suspend Customer's or an Authorised User's access, with notice where practicable, if: use of the Service breaches §6 (Acceptable Use); the account poses a security risk to the Service or other customers; or suspension is required by law or a competent authority. AssuraFlow will restore access promptly once the underlying issue is resolved.

13. Data Rights

Customer retains ownership of Customer Data. AssuraFlow grants export capabilities and supports data portability workflows as described in the DPA §9. On termination, data export and secure deletion are executed per §14 below and the offboarding runbook.

14. Term and Termination

• These Terms take effect on the Order Form start date and continue for the term stated there, renewing as specified unless either party gives notice of non-renewal per the Order Form.
• Either party may terminate for the other's uncured material breach on written notice of a period to be added before launch (for example, 30 days), or immediately if the other party becomes insolvent.
• On termination, Customer Data is exported (on request) and securely deleted per DPA.md §4 and §14, and the offboarding runbook.
• Sections that by their nature should survive termination — including Confidentiality (§9), Limitation of Liability (§16), Indemnification (§17), and Governing Law (§20) — survive.

15. Warranties and Disclaimers

Each party warrants it has authority to enter into these Terms. AssuraFlow warrants it will provide the Service with reasonable skill and care. Except as expressly stated in these Terms or the DPA, the Service is provided "as is" and AssuraFlow disclaims all other warranties, whether express or implied, to the fullest extent permitted by law — including implied warranties of satisfactory quality or fitness for a particular purpose, except where such exclusion is not permitted by the Supply of Goods and Services Act 1982 or other applicable law.

16. Limitation of Liability

Nothing in these Terms limits or excludes either party's liability for: death or personal injury caused by negligence; fraud or fraudulent misrepresentation; or any other liability that cannot be limited or excluded under English law (including certain data protection breaches).

Subject to the above, and to the extent permitted by the Unfair Contract Terms Act 1977: neither party is liable to the other for any indirect or consequential loss; and each party's total aggregate liability arising out of or in connection with these Terms, whether in contract, tort (including negligence), or otherwise, is capped at an amount to be added before launch (the UK SaaS market norm is typically fees paid in the 12 months preceding the claim, sometimes with a higher cap for data breach / confidentiality claims).

This clause has been drafted to the structure a UK court would expect to see tested for reasonableness under UCTA — the cap is a business decision for AssuraFlow's commercial/legal team to set, not a legal gap.

17. Indemnification

Each party will indemnify the other against third-party claims, losses, and reasonable costs arising from: the indemnifying party's breach of Confidentiality (§9); or, for Customer, Customer Data infringing a third party's rights or breaching applicable law; or, for AssuraFlow, the Service infringing a third party's UK intellectual property rights — in each case subject to the liability cap in §16 unless stated otherwise on the Order Form.

18. Force Majeure

Neither party is liable for delay or failure to perform caused by events beyond its reasonable control (including internet or utility outages, third-party sub-processor outages, or acts of government), provided the affected party gives notice and uses reasonable efforts to mitigate. This does not excuse Customer's payment obligations for Service already provided.

19. General

• Notices: sent in writing to the addresses/emails on the Order Form, or to legal@assuraflow.io for AssuraFlow.
• Assignment: neither party may assign these Terms without the other's consent, except AssuraFlow may assign to an acquirer of substantially all its business, with notice to Customer.
• Severability: if any provision is found unenforceable, the remaining provisions continue in effect, and the parties will negotiate a replacement provision reflecting the original intent.
• Entire agreement: these Terms, the Order Form, and the DPA constitute the entire agreement between the parties on their subject matter, and supersede prior discussions on that subject.
• Changes to these Terms: AssuraFlow may update these Terms with written notice of a period to be added before launch (for example, 30 days) for material changes; continued use after the effective date constitutes acceptance.

20. Governing Law and Dispute Resolution

These Terms are governed by the laws of England and Wales. The parties will first attempt to resolve any dispute through good-faith negotiation between senior representatives; if unresolved within a period to be added before launch (for example, 30 days), either party may bring proceedings in the courts of England and Wales, which have exclusive jurisdiction.

---

Changelog