Terms and Conditions

1. Who these terms are with

These terms form a binding agreement between Elite Allied Health Pty Ltd, a company registered in Australia (ACN 645 070 579), trading as Clinic Chimp ("Clinic Chimp", "we", "us", "our") and the practice, clinic or business that subscribes to the service (the "Customer", "you", "your").

By ticking the acceptance box at sign-up, you confirm that you have read these terms, that you agree to them on behalf of your practice, and that you are authorised to bind your practice to them.

The service is for businesses only. You confirm that you are subscribing for the purposes of your trade, business or profession, including as a sole trader, and not as a consumer. If we ask, you will give us details that show this, such as your company number, VAT number or professional registration.

An "Authorised User" is a practitioner, manager, front desk team member or other member of your practice whom you permit to use the service. "Customer Data" means information supplied by you or an Authorised User, imported from a system you connect, or created for your practice through use of the service. "Customer Personal Data" means the personal data within Customer Data. You are responsible for ensuring that your Authorised Users comply with these terms.

These terms are version gb-1.0, effective 10 October 2026. They are written for practices established in the United Kingdom and are governed by the law of England and Wales. Schedule 1 (Data processing) and Schedule 2 (International data transfers) form part of them.

2. What the service is

Clinic Chimp is an analytics and coaching tool for allied health practices. It connects to your practice-management system, imports selected appointment, invoice, patient, practitioner, location, product and service details, and presents metrics, dashboards, goals, patient audits and email reports built from them.

The service primarily reports on information your practice already holds. It is not a practice-management system, a medical device, a billing system or a source of clinical truth. Your practice-management system remains your system of record.

The patient-audit feature can create a treatment note in your practice-management system, but only after an Authorised User takes an explicit action and reviews the note text. The note is attributed to that user as the acting clinician and cannot be undone through the practice-management system API. You are responsible for checking the note before confirming it and for correcting it in your practice-management system if necessary.

Clinic Chimp does not provide clinical, financial, legal, accounting or tax advice. Nothing the service outputs is a recommendation about the care of any individual patient. Decisions about patient care, staffing, billing and business strategy remain entirely yours, and you are responsible for them.

3. Your account

You must give accurate details when you sign up and keep them current. You are responsible for everything done under your account, including by Authorised Users and people you invite to it.

Keep credentials secure and do not share logins between people. Each person who uses the service should have their own account. Tell us promptly if you believe an account has been compromised.

You are responsible for making sure the people you invite are entitled to see the information their role exposes. Manager roles can see whole-practice financial and patient information; front desk roles see the patient audit for the whole practice; practitioner roles see their own metrics.

If you add an external recipient for reports, such as your business coach, we send that person the reports you choose, on your instruction. You are responsible for deciding who receives them and for having a lawful basis to share that information with them.

Your subscription gives your Authorised Users a limited, non-exclusive, non-transferable right to access and use the service for your practice's internal business purposes during the subscription. The number and types of Authorised Users you may invite are limited by the plan you select.

4. Connecting your practice-management system

To use the service you give us an API credential for your practice-management system. You authorise us to use that credential to read your practice data, and to write treatment notes back where you use a feature that does so.

You warrant that you are entitled to give us that credential and that access, that doing so does not breach your agreement with your practice-management provider, and that you have a lawful basis under data protection law, and a condition for processing health data, for us to process the patient information it exposes on your behalf.

We keep that credential in an access-restricted database that is encrypted at rest by our database provider, transmit it over encrypted connections, and make it available only to server-side processes that operate the integration for you. You can revoke it at any time in your practice-management system; the service will stop syncing if you do.

Your practice-management system is a separate product supplied by a third party under its own terms. We are not responsible for it, for its availability, or for the accuracy of the data it gives us. If it changes or withdraws its API, some features may stop working.

5. Data accuracy

The metrics we show are only ever as good as the data your practice enters. Appointment statuses, invoice records and patient records all flow through from your practice-management system as they are.

Some metrics use defined rules that will not always match the raw numbers your practice-management system reports. For example, a consultation is only counted as completed where an invoice exists for it. Those definitions are documented in the service. Check them before relying on a figure for anything that matters.

Do not use the service as your only source for anything with a legal, tax, regulatory or clinical consequence.

6. Fees, VAT and billing

You select a subscription plan at sign-up. Each plan includes the practitioner and administrator licences shown on the pricing and checkout pages. Solo includes 1 practitioner and 1 administrator, Small includes 3 practitioners and 2 administrators, Medium includes 6 practitioners and 3 administrators, and Large includes up to 5 administrators and the number of practitioner licences you purchase.

Large starts at 7 practitioner licences and is priced at £60 per month plus £3.50 per month for each practitioner licence beyond 6. Invited users occupy a licence from the time an invitation is sent. Adding a user within your purchased limits does not change your price, and we do not move you to a more expensive plan automatically. If you reach a limit, you must choose a larger plan or purchase additional Large-plan practitioner licences before adding another user.

Prices are in pounds sterling and exclude VAT. We supply the service from outside the United Kingdom to business customers and are not registered for VAT in the United Kingdom, so you account for any UK VAT due under the reverse charge, and our invoices show that the reverse charge applies.

New accounts include a 30-day free trial. We collect your card at sign-up but do not charge it during the trial. If you cancel before the trial ends you are not charged at all.

After the trial, fees are billed monthly in advance through our payment provider. Your subscription renews automatically each month until you cancel it.

If you redeem a discount or promotional code, the discount applies for the period and to the extent stated when you redeem it. When a discount ends, the standard price for your plan applies from your next billing month. Where a discount ends other than at a date stated when you redeemed it, we will give you at least 30 days written notice first.

A plan or licence change you confirm takes effect immediately and our payment provider calculates a pro-rata adjustment for the remainder of the billing month. A downgrade cannot proceed while the number of licences in use exceeds the new plan's limits. Any resulting account credit is applied to future subscription fees rather than paid as a cash refund.

We may change our prices. If we do, we will give you at least 30 days written notice before the change applies to you, and you may cancel before it takes effect without penalty. A price change never applies to a period you have already paid for.

If a payment fails we will tell you and give you a reasonable opportunity to fix it before suspending the service.

7. Cancelling

You can cancel at any time, effective at the end of your current billing month. You keep access until then. We do not charge a cancellation fee and we do not lock you into a minimum term.

We do not refund fees for a month already started, except where we have ended your subscription under clause 16 for a reason that is not your fault, in which case we refund the unused portion.

Before your access ends you can export the synced datasets listed in the service's data-export area as CSV files. The export does not include every setting, audit record or item of content created within Clinic Chimp.

What happens to Customer Personal Data when your subscription ends is set out in Schedule 1.

8. Acceptable use

You must not:

• use the service in a way that breaches any law, including data protection, confidentiality and health records law
• upload or connect data you are not entitled to disclose to us
• attempt to access another practice's data, or probe, scan or test the security of the service
• reverse engineer, copy or resell the service, or use it to build a competing product
• use the service to make decisions about an individual patient's clinical care
• give access to anyone outside your practice without our written agreement, other than external report recipients you choose under clause 3

9. Data protection

Each of us will comply with the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018 as they apply to it.

For Customer Personal Data, including your patients' data, you are the controller and we are your processor. Patient data includes data concerning health, a special category of personal data. You are responsible for having a lawful basis and a condition for processing it, for telling your patients how their data is used, and for the instructions you give us. We process Customer Personal Data only to provide, secure and support the service for you, and as Schedule 1 sets out. We do not sell it and we do not use it for advertising.

For the personal data of your Authorised Users and business contacts that we need to run your account, such as names, email addresses, billing details, support messages and usage records, we are a controller in our own right. Our Privacy Policy explains how we handle it.

Our primary database, which holds core synced practice and patient data, is located in London, United Kingdom, and our application functions are configured to run in London. Data is encrypted in transit and at rest, and access between practices is separated at the database level, not merely hidden in the interface.

We are established in Australia and our personnel administer and support the service from there. Some of our providers process limited information outside the United Kingdom, including in the United States and the European Economic Area. Schedule 2 and our Privacy Policy describe these transfers and the safeguards that apply to them.

10. Who owns what

You own your data. Connecting it to the service does not transfer any ownership of it to us.

You grant us the licence we need to host, process, transmit and display that data in order to operate the service for you, and to keep backups.

We own the service itself: the software, the interface, the metric definitions and the documentation. These terms do not give you any ownership of it. You may use the reports and exports the service produces for your own practice's purposes without restriction.

11. Anonymised benchmarking

You instruct us to produce anonymised, aggregated statistics from your Customer Data, for example typical rebooking rates for podiatry practices in a region, so that we can offer benchmarks and improve the service.

Statistics are calculated at practice level, combined with data from at least five practices, and stripped of anything that identifies a patient, a practitioner or your practice, judged against the means reasonably likely to be used by us or anyone who receives them. We suppress any figure drawn from so few records that a person or practice could be identified from it, use no free text and keep no keys that would link a statistic back to its source. We never attempt to re-identify anyone from them, and if a statistic is ever found to be identifiable we delete it or anonymise it again.

Statistics that are anonymous in this way are not personal data, and we may use them for our own purposes during and after these terms. We use no Customer Personal Data for our own purposes other than producing them. Your privacy notice to patients should mention that you use a service that produces anonymised statistics from their records.

We do not sell your data, in identified or anonymised form.

If you would rather your practice was not included in benchmarking at all, email us and we will exclude it. Excluding your practice does not affect anything else about your subscription.

12. Availability and support

We aim to keep the service available, but we do not guarantee it will be uninterrupted or error-free. It may be unavailable for maintenance, or because of a problem with a provider we depend on.

Data syncs run on a schedule. Dashboards reflect the most recent successful sync, not live data, and a first import of a full practice history can take hours.

Support is by email at reports@clinicchimp.com. We aim to respond within two business days.

13. Confidentiality

Each of us may learn confidential information about the other. Each party will protect the other's confidential information using at least reasonable care, use it only for this agreement, and disclose it only to its personnel, professional advisers and subcontractors who need it for that purpose and are subject to confidentiality obligations, or where the law requires disclosure.

This does not apply to information that is already public other than through a breach of confidence, that the receiving party already held lawfully, that it receives lawfully from someone without a duty of confidence, that it develops independently, or whose disclosure the other party approves in writing.

On request or when this agreement ends, each party will return or securely destroy the other's confidential information that it no longer needs, except for information it must retain by law or that remains temporarily in secure backups. These obligations continue for five years after the agreement ends, and indefinitely for trade secrets and personal data while they remain confidential.

14. Our liability

Nothing in these terms limits or excludes liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, or for anything else that cannot be limited or excluded by law.

Subject to that, our total liability to you for all claims arising out of or in connection with these terms, whether in contract, tort (including negligence) or otherwise, is limited in aggregate, in each 12-month period starting on the date you first accepted these terms, to the greater of the fees you paid us in the 12 months before the event giving rise to the claim and £1,000.

Subject to the first paragraph of this clause, neither of us is liable to the other for loss of profit, loss of revenue, loss of business, loss of goodwill, or any indirect or consequential loss, or for loss or corruption of data caused by the other's systems.

The limit in the second paragraph does not apply to your obligation to pay fees, to either party's wilful misconduct, or to a breach by us of clause 9 or Schedule 1.

You are best placed to protect your practice against losses specific to it, for example by keeping your practice-management system as your record and holding appropriate insurance. That is part of why these limits are reasonable.

15. Indemnity

You indemnify us against loss we suffer from a third-party claim arising out of your breach of clause 4 (your authority to give us access to your data), clause 8 (acceptable use), or your unlawful use of the service.

This indemnity does not apply to the extent the loss was caused by us. We will tell you promptly about any claim, let you take conduct of it, and take reasonable steps to mitigate.

16. Suspension and ending the agreement

Either of us may end this agreement if the other materially breaches it and does not fix the breach within 14 days of being asked to in writing.

We may suspend or end your access immediately, without that 14-day period, only where you have not paid after we have given you notice and a reasonable chance to fix it, where your use is causing a genuine security risk to the service or to other practices, or where the law requires us to. If we do, we will tell you why and what you need to do.

We may withdraw the service entirely on 60 days written notice. If we do, we refund the unused portion of anything you have paid, and you can export your data during the notice period.

Clauses 9, 10, 13, 14 and 15 and both Schedules survive the end of this agreement for as long as they are relevant.

17. Changes to these terms

We may update these terms. For a change that materially affects your rights, we will give you at least 30 days written notice by email before it takes effect, and you may cancel before then without penalty. Continuing to use the service after the change takes effect means you accept it.

If you give notice that you reject a material change and cancel before it takes effect, the previous terms continue to apply until your cancellation becomes effective. The changed terms do not apply to a subscription period you have already paid for.

We may make minor changes, such as correcting an error, clarifying wording or reflecting a change in the law, with notice but without a 30-day wait, provided the change does not reduce your rights.

Each version is numbered. We keep a record of which version you accepted and when.

18. General

We may use subcontractors and third-party providers to deliver the service, and we remain responsible for what they do for us. Neither of us may transfer this agreement without the other's consent, except that we may transfer it to a buyer of our business on notice to you.

Neither of us is liable for failing to perform because of something genuinely outside our reasonable control, but this does not excuse a failure to pay.

Notices to you go to the email address on your account, which you must keep current. Notices to us go to the email address in clause 12. An email notice is treated as received on the next business day after it is sent unless the sender receives a delivery-failure message.

If part of these terms is unenforceable, it is severed and the rest continues. A delay in enforcing a right is not a waiver of it. These terms are the entire agreement between us about the service and replace anything said or written before, but nothing in them limits liability for fraud or fraudulent misrepresentation.

No one other than you and us has any right to enforce these terms, whether under the Contracts (Rights of Third Parties) Act 1999 or otherwise.

The parties are independent contractors. These terms do not create an employment, partnership, agency, fiduciary or joint-venture relationship between them, and neither party may bind the other except as these terms expressly allow.

19. Governing law and disputes

These terms, and any dispute or claim arising out of or in connection with them or their subject matter, including non-contractual disputes or claims, are governed by the law of England and Wales.

The courts of England and Wales have exclusive jurisdiction to settle any such dispute or claim, except that we may bring a claim for unpaid fees in the courts of the place where you are established.

Before starting proceedings, both of us agree to first raise the issue in writing and try in good faith to resolve it. This does not stop either of us seeking urgent injunctive relief.

20. Contact

Elite Allied Health Pty Ltd, a company registered in Australia (ACN 645 070 579), trading as Clinic Chimp

Address: 4/40 Wilson Avenue, Woombye QLD 4559, Australia

Email: reports@clinicchimp.com

For data protection questions or complaints, see our Privacy Policy, which also explains how to complain to the Information Commission.

Schedule 1: Data processing

This Schedule sets out the terms Article 28 of the UK GDPR requires for our processing of Customer Personal Data as your processor. Words defined in the UK GDPR have the same meaning here.

1. Instructions. We process Customer Personal Data only on your documented instructions, which are these terms, your configuration and use of the service, and any other written instructions you give us that are consistent with them, including for transfers to a third country. If the law requires us to process it otherwise, we will tell you before doing so, unless the law prohibits that. We will tell you promptly if we believe an instruction infringes data protection law.

2. Details of the processing.

• Subject matter: providing the Clinic Chimp service to your practice.
• Duration: for as long as these terms apply, and afterwards until the data is deleted under paragraph 10.
• Nature and purpose: reading records from your practice-management system, storing and organising them, calculating and displaying analytics, goals, patient audits and reports, writing treatment notes where an Authorised User confirms one, producing anonymised statistics under clause 11, and securing and supporting the service.
• Types of personal data: practice-management system identifiers; patient dates of birth, first and last visit dates; appointment dates, times, types, statuses, practitioners and locations; invoices, payments, services and products; patient and case details retrieved for a patient audit, and its recorded outcomes and note text; practitioner and staff names, roles and email addresses; and any content users enter.
• Special category data: data concerning health, which can be inferred from appointment types, invoices and treatment-note text.
• Data subjects: your patients, your practitioners and staff, and your Authorised Users.

3. Confidentiality. Everyone we authorise to process Customer Personal Data is bound by a duty of confidentiality, whether by contract or by law.

4. Security. We implement appropriate technical and organisational measures under Article 32, including: encryption in transit and at rest; database-level row security separating each practice and restricting each role; server-side handling of integration credentials; individual, authenticated access for our personnel, limited to those who need it; logging of sync and security events; and regular review of these measures.

5. Sub-processors. You give us general written authorisation to engage sub-processors. Those we use are Supabase Pte. Ltd. (database and authentication, hosted in London, with operational logs in the European Economic Area), Vercel Inc. (application hosting and delivery, with functions configured in London) and Plus Five Five, Inc., trading as Resend (email delivery, in the United States; we do not intentionally send patient records by email). We will give you at least 30 days notice, by email or in the service, before adding or replacing a sub-processor. If you object on reasonable data protection grounds, we will discuss it with you, and if we cannot resolve it you may end these terms before the change takes effect and we will refund any fees paid for the period after that. We impose on each sub-processor, by written contract, data protection obligations that give the same level of protection as this Schedule, and we remain liable to you for their performance.

6. Your practice-management provider. Your practice-management provider processes your data under its own agreement with you. It is not our sub-processor; we read from and write to it on your behalf, using the credential you give us.

7. Data subject rights. Taking into account the nature of the processing, we will assist you by appropriate technical and organisational measures, so far as possible, to respond to requests from individuals exercising their rights. If we receive such a request, or a complaint, about Customer Personal Data, we will pass it to you promptly and will not respond to it ourselves except on your instructions or as the law requires.

8. Assistance. Taking into account the nature of the processing and the information available to us, we will assist you in meeting your obligations under Articles 32 to 36, including security, notifying personal data breaches, data protection impact assessments and prior consultation with the Information Commission.

9. Personal data breaches. We will notify you without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data. We will give you the information you reasonably need to meet your own obligations, including, as far as we know them, the nature of the breach, the categories and approximate numbers of individuals and records concerned, its likely consequences and the measures taken or proposed, and we will update you as we learn more.

10. End of the processing. When these terms end, you can export your data as clause 7 describes. Customer Personal Data then remains recoverable for 90 days in case your practice wishes to return, after which we delete it, unless you ask us in writing to delete it sooner or the law requires us to keep it. Copies in our providers' backups are overwritten under their normal cycles and are not used for any other purpose meanwhile. If an administrator uses the service's Delete account action, the same 90-day recovery window applies from that date.

11. Information and audits. We will make available to you all information necessary to demonstrate compliance with Article 28 and will allow for and contribute to audits, including inspections, by you or an auditor you appoint. Unless a personal data breach or a regulator requires otherwise, you will give us at least 30 days notice, an audit will take place no more than once a year, during business hours, at your cost, and under a duty of confidentiality; we will first offer written answers and documentation, which may be enough on their own.

Schedule 2: International data transfers

We are established in Australia, and our personnel administer and support the service from there. Where your provision of Customer Personal Data to us, or our access to it from outside the United Kingdom, is a restricted transfer under the UK GDPR, you (as exporter) and we (as importer) enter into the International Data Transfer Agreement issued by the Information Commission (the "IDTA"). The IDTA is incorporated into these terms by reference, with its Part 4 being:

"Part 4: Mandatory Clauses of the Approved IDTA, being the template IDTA A.1.0 issued by the ICO and laid before Parliament in accordance with s119A of the Data Protection Act 2018 on 2 February 2022, as it is revised under Section 5.4 of those Mandatory Clauses."

Table 1 (Parties and signatures). Exporter: the Customer, as identified in its Clinic Chimp account, with the manager who accepted these terms as its key contact. Importer: Elite Allied Health Pty Ltd, a company registered in Australia (ACN 645 070 579), trading as Clinic Chimp, of 4/40 Wilson Avenue, Woombye QLD 4559, Australia, whose key contact is reachable at the email address in clause 20. Each party signs the IDTA by accepting or offering these terms.

Table 2 (Transfer details).

• UK country's law that governs the IDTA: England and Wales.
• Primary place for legal claims to be made by the Parties: England and Wales.
• The status of the Exporter: controller. The status of the Importer: the Exporter's processor.
• Whether UK GDPR applies to the Importer: UK GDPR applies to the Importer's processing of the Transferred Data.
• Linked Agreement: these terms, including Schedule 1.
• Term: the IDTA continues for as long as the Linked Agreement, and afterwards while the Importer holds any Transferred Data.
• Ending the IDTA before the end of the Term: neither Party may end the IDTA before the end of the Term, except as the IDTA allows for a breach.
• Ending the IDTA when the Approved IDTA changes: neither Party.
• Can the Importer make further transfers of the Transferred Data: yes, to the sub-processors in Schedule 1, paragraph 5, as changed under that paragraph, and as the Exporter instructs.
• Specific restrictions when the Importer may transfer on the Transferred Data: only for the Purpose, and only to a recipient bound by written terms that give the same level of protection as Schedule 1.
• Review Dates: at least once a year, and whenever a sub-processor is added or replaced.

Table 3 (Transferred Data). The Transferred Data, the special category data, the data subjects and the Purpose are those described in Schedule 1, paragraph 2. Table 3 updates automatically when Schedule 1 changes.

Table 4 (Security requirements). The measures in Schedule 1, paragraph 4. Table 4 updates automatically when Schedule 1 changes.

Part 2 (Extra protection clauses). Technical: the data stays hosted in London and is encrypted in transit and at rest, and our personnel reach it only through individual, authenticated sessions. Organisational: access is limited to personnel who need it to operate, secure or support the service, all bound by confidentiality. Contractual: if a public authority asks us for Transferred Data, we will tell you where the law allows, disclose only the minimum the law requires, and challenge a request where we have reasonable grounds to consider it unlawful.

Part 3 (Commercial clauses). The rest of these terms.

We will give you the information you reasonably need to assess, under the UK GDPR, whether the protection for this transfer is not materially lower than in the United Kingdom.