Service agreement

Version 0.2 (draft for legal review). Once your practice is set up, its administrator reads and signs this in Striva, under Settings › Agreement, and is emailed a signed copy.

Striva service agreement

This agreement is between Calderwell Group Ltd, trading as Striva, a company registered in England and Wales with company number [●], whose registered office is at Suite A, 82 James Carter Road, Mildenhall, IP28 7DE (“Striva”, “we”, “us”), and the practice named on the signature page (the “Practice”, “you”). It applies from the date it is signed, or from when the Practice first used Striva if that was earlier.

Part A sets out the terms on which we provide the service. Part B sets out how we handle the personal data the Practice keeps in Striva, as UK data protection law requires. The schedules at the end form part of this agreement. If Part A and Part B conflict on anything to do with personal data, Part B wins.

Part A: Terms of service

1. Definitions

Service: the Striva practice-management software, provided online at the Practice’s own address on striva.uk, together with its updates, documentation and our support.
Practice Data: everything the Practice, its staff or its patients put into the Service, including patient records, appointments, clinical notes, documents, questionnaires and invoices.
Users: the people the Practice allows to sign in to the Service, such as its clinicians, reception staff and administrators.
Subscription: the plan the Practice has chosen and pays for through our billing provider, Stripe.
Data Protection Law: the UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003, and any law that replaces or adds to them.

2. The Service

We will provide the Service with reasonable skill and care, and keep it available as much as we reasonably can. We do not promise it will never be interrupted. We will tell the Practice in the Service in advance of planned maintenance where we can.
We may improve and change the Service over time. We will not remove a feature that is central to how practices keep their records or bill without giving the Practice at least 30 days’ notice.
We will provide support by the in-app support page and by email on working days. We aim to reply within one working day.
The Practice’s data is kept in its own database, separate from every other practice’s.

3. The Practice’s responsibilities

The Practice is responsible for the care it provides. The Service is a tool for keeping records, booking and billing. It does not diagnose, treat or give clinical advice. Anything it shows, such as outcome scores, reminders or flags drawn from a patient’s answers, is there to support the clinician’s own judgement and is not a substitute for it.
The Practice is responsible for the content and accuracy of its records, and for keeping them for as long as its professional body, insurers and the law require (Clause 9 explains what happens when the Practice leaves).
The Practice will decide who is a User and what each User can do, keep the list up to date, and remove a User’s access promptly when they leave. It is responsible for what its Users do in the Service.
The Practice will make sure its Users keep their sign-in details secure and tell us promptly if it believes an account has been misused.
The Practice will not use the Service unlawfully, try to get round its security, or use it to send messages that the recipient has not agreed to receive.
The Practice is responsible for the settings it chooses, including its prices, VAT settings and the messages it sends. The Service follows the rules it is set up with; it is for the Practice, with its accountant where needed, to check those settings are right for it.

4. Fees and payment

The Practice pays the fees for its Subscription, as shown when it signed up or as later changed under this clause. Fees are charged in advance each month to the card or account held by Stripe, and are exclusive of VAT, which is added where it applies.
A new practice has a free trial for the period shown at sign-up. Nothing is charged until the trial ends, and the Practice can cancel before then without charge.
If the Practice adds clinicians beyond what its plan includes, its plan moves to the one that covers them, and the difference is charged pro rata. The Service warns before this happens.
We may change our fees by giving at least 30 days’ notice by email. The Practice can end the agreement before the change takes effect if it does not accept it.
If a payment fails and is not put right within 14 days of our telling the Practice, we may put its account on hold. While on hold, the Practice can still see and export its records but cannot add to or change them, and no messages are sent. Nothing is deleted while an account is on hold.

5. Ownership and use of data

The Practice owns the Practice Data. We do not acquire any rights in it, except the right to use it to provide the Service under this agreement.
We will not sell Practice Data, use it for advertising, or use it to train or improve any product other than by fixing faults the Practice reports to us.
We own the Service, its software and its documentation. The Practice has the right to use the Service for its own business while this agreement lasts. It may not copy, resell or reverse-engineer the Service.

6. Confidentiality

Each party will keep confidential any information about the other’s business that it learns under this agreement, and use it only for the purpose of this agreement. This does not apply to information that is already public, or that the law or a regulator requires to be disclosed.
Our staff and contractors who could see Practice Data are bound by duties of confidentiality.

7. Liability

Nothing in this agreement limits either party’s liability for death or personal injury caused by its negligence, for fraud, or for anything else the law does not allow to be limited.
Neither party is liable to the other for loss of profit, revenue, business or goodwill, or for any indirect or consequential loss.
Subject to 7.1, each party’s total liability to the other under or in connection with this agreement in any 12-month period is limited to the greater of the fees paid and payable by the Practice in the 12 months before the event giving rise to the claim, and [£●]. [For review: whether a separate, higher cap should apply to breaches of Part B.]
We are not responsible for the clinical decisions the Practice makes, for the content of its records, or for loss caused by the Practice’s own settings, its Users, or its equipment and internet connection.

8. Term and ending the agreement

This agreement continues month to month until either party ends it.
The Practice can end it at any time by cancelling its Subscription in the Service (Settings, Subscription). It ends at the close of the period already paid for.
We can end it by giving at least 90 days’ notice, or straight away if the Practice materially breaches it and does not put the breach right within 30 days of our asking, or if it becomes insolvent.

9. What happens when the agreement ends

When the agreement ends, the Practice’s account becomes read-only for 90 days. During that time its administrators can see everything and export all of the Practice Data, as patient records, documents and spreadsheets, with an explanation of what each file contains.
We will remind the Practice’s owner by email 30 days and 7 days before the 90 days end.
After the 90 days we delete the Practice’s database and documents. Copies in our backups expire in the normal course, and in any event within 12 months; until then they are kept secure and are not used.
The Practice remains responsible for keeping its records for as long as its professional obligations require, so it must export them before the 90 days end. We can help with moving records to another system.
Clauses 5, 6, 7, 9 and 11, and Part B for as long as we hold any Practice Data, continue after the agreement ends.

10. Changes to this agreement

We may update this agreement, for example to reflect a change in the law or in the Service. We will give at least 30 days’ notice of any change that is not in the Practice’s favour, and ask the Practice’s administrator to review and sign the new version in the Service. If the Practice does not accept it, it may end the agreement before the change takes effect.
Changes to the list of sub-processors in Schedule 2 follow the process in clause B6 instead.

11. General

This agreement is the whole agreement between the parties about the Service, and replaces anything said or written before it. Each party confirms it has not relied on anything not set out in it.
Neither party is liable for delay or failure caused by events beyond its reasonable control, provided it tells the other and takes reasonable steps to limit the effect.
Neither party may transfer this agreement without the other’s consent, except that we may transfer it to a company that takes over the Service, if it agrees to be bound by it.
Notices under this agreement are given by email: to us at [support@striva.uk], and to the Practice at its owner’s email address held in the Service.
Nobody other than the parties has any right to enforce this agreement.
This agreement is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.
Signing this agreement electronically in the Service has the same effect as signing a paper copy.

Part B: Data processing terms

This Part sets out the terms required by Article 28 of the UK GDPR. For the Practice Data, the Practice is the controller and Striva is its processor. For the details of Users and of the Practice’s own account and billing, Striva is a controller in its own right, as described in its privacy statement.

B1. Instructions

We will process Practice Data only on the Practice’s documented instructions, which are this agreement and the Practice’s use of the Service, unless the law requires otherwise. In that case we will tell the Practice first, unless the law forbids it.
We will tell the Practice straight away if we think an instruction breaks Data Protection Law.
The details of the processing are in Schedule 1.

B2. Confidentiality

We will make sure that anyone we authorise to process Practice Data is bound by a duty of confidentiality, and that they access it only where they need to in order to provide or support the Service.
Striva support does not need, and will not ask for, access to patient records to answer most questions. Where it is needed to fix a fault, we will access only what is necessary, and the access is recorded.

B3. Security

We will take appropriate technical and organisational measures to protect Practice Data, taking into account that it includes health data. The measures in place are described in Schedule 3. We may change them, but not so as to reduce the overall level of protection.

B4. Personal data breaches

We will tell the Practice without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Practice Data.
We will give the Practice the information it reasonably needs to assess the breach and meet its own obligations, including reporting to the Information Commissioner within 72 hours and telling patients where that is required, and we will keep it informed as we learn more.
We will take reasonable steps to contain the breach and stop it happening again.

B5. Helping the Practice

The Service lets the Practice respond to requests from patients exercising their rights, including subject access, correction and erasure, and keeps a record of those requests. Where the Practice needs more help, we will provide it.
We will give the Practice reasonable help with data protection impact assessments and with any consultation with the Information Commissioner, so far as they relate to the Service.
If we receive a request from a patient directly, we will pass it to the Practice and not answer it ourselves, unless the Practice asks us to.

B6. Sub-processors

The Practice gives its general authorisation for us to use the sub-processors listed in Schedule 2.
We will give the Practice at least 30 days’ notice by email before adding or replacing a sub-processor that will process Practice Data. If the Practice objects on reasonable data protection grounds, we will discuss the objection in good faith; if it cannot be resolved, the Practice may end this agreement without charge before the change takes effect.
We will put in place with each sub-processor a written contract giving Practice Data the same protection as this Part, and we remain responsible to the Practice for their work.

B7. Transfers outside the UK

Practice Data is held in the United Kingdom. We will not transfer it outside the UK except as described in Schedule 2, and then only where the transfer is lawful under Data Protection Law, for example to a country the UK has found adequate, or under the UK International Data Transfer Agreement or Addendum.

B8. Deletion and return

When the agreement ends, the Practice can export all of its Practice Data, and we delete it, as set out in clause 9 of Part A, unless the law requires us to keep it.

B9. Audit and information

We will make available to the Practice the information it reasonably needs to show that this Part is being complied with, including our security measures and any certifications we hold.
We will allow for and contribute to audits, including inspections, by the Practice or an auditor it appoints, on reasonable notice, during working hours, no more than once a year unless there has been a breach or a regulator requires it, and subject to reasonable confidentiality terms. Each party bears its own costs.

B10. The Practice’s obligations

The Practice confirms that it has a lawful basis, and where needed a condition for processing health data, for the processing it asks us to carry out; that it gives its patients the privacy information the law requires; and that it is registered with the Information Commissioner where the law requires.
The Practice is responsible for the decisions it makes in the Service about Practice Data, including what is recorded, who can see it, what is sent to patients and when records are destroyed.

Schedule 1: Details of the processing

Subject matter	Providing the Service: practice management for an MSK clinic.
Duration	For as long as this agreement lasts, then until deletion under clause 9 of Part A.
Nature and purpose	Storing, organising, displaying, exporting and deleting records; booking and reminding; sending messages and links to patients on the Practice’s behalf; invoicing and taking payments; producing reports for the Practice.
Types of personal data	Names, contact details, dates of birth, addresses; appointments and attendance; funding and insurance details; invoices and payments; and the communications the Practice records.
Special category data	Health data: clinical notes, assessments, diagnoses, outcome measures, questionnaires, body charts, consent records, red-flag screening and clinical documents.
Data subjects	The Practice’s patients and their representatives (such as parents and guardians), referrers, other health professionals and insurers’ contacts, and the Practice’s staff.

Schedule 2: Sub-processors

Sub-processor	What it does	Where
Contabo GmbH	Hosts the servers and databases that hold Practice Data.	United Kingdom data centre
Backblaze, Inc.	Stores off-site backups. Backups are encrypted before they leave our servers, and Backblaze has no key to read them.	European Union (Amsterdam), covered by the UK’s adequacy regulations
SmarterASP.NET	Sends emails on the Practice’s behalf, such as appointment confirmations, reminders and links.	United States, under the UK International Data Transfer Addendum [to confirm]
Smarty (Hutchison 3G UK Ltd)	Carries text messages, such as appointment reminders, from Striva’s own SMS gateway.	United Kingdom
Microsoft Ireland Operations Ltd	Signs in the Practice’s Users (Microsoft Entra ID). Holds User details only, not patient records.	EU and UK, with some processing in the United States under the UK Extension to the EU-US Data Privacy Framework
Stripe Payments Europe Ltd	Bills the Practice’s Subscription. Holds the Practice’s billing details only, not patient records.	EU and UK, with some processing in the United States under the UK Extension to the EU-US Data Privacy Framework

Payment providers the Practice connects to take its patients’ card payments (for example SumUp or Stripe) are chosen by the Practice and contract with it directly; they are not our sub-processors.

Schedule 3: Security measures

Separation. Each practice’s data is in its own database, with its own database login, never mixed with another practice’s.
Encryption. Every connection is encrypted (HTTPS, with HSTS). Clinical notes, contact details and other sensitive fields are encrypted again before they are stored (AES-256-GCM), with keys kept apart from the database, so a copy of a database on its own cannot be read. Documents are stored encrypted. Off-site backups are encrypted before they leave our servers.
Access. Users sign in through Microsoft Entra ID. What each User can see and do is limited by their role and permissions, set by the Practice. Sessions are checked every minute, so a User removed by the Practice loses access within a minute.
Records of access. Every change to the records is written to an audit trail in the same step as the change, and every opening, viewing or export of a patient’s record is logged with who and when.
Patient links. Links sent to patients are long random tokens, stored only in hashed form, limited to one purpose, and expire. Codes sent to confirm a patient’s identity are limited in attempts and time.
Backups. Databases are backed up every 15 minutes and in full daily, with each backup checked, and copied off-site to a different provider. Monthly backups are kept for up to 12 months.
Infrastructure. Database servers are not reachable from the internet. Server access is by key only. Software updates are applied promptly. Access logs that could contain patient links are not kept.
People. Access to production systems is limited to those who need it, under confidentiality duties.
Messages. Emails and texts to patients carry no clinical detail; they link back to the Service.