A2Z CareHub Platform Terms of Use

1. About these terms

These Platform Terms of Use ("Terms") govern access to and use of the A2Z CareHub platform (also marketed under the formal commercial name A2Z CareSuite, together "the Platform"), provided by A2Z IT Limited ("A2Z IT", "we", "us", "our").

These Terms are the platform-specific operational layer of A2Z IT's contractual framework. They sit alongside, and are incorporated by reference into:

• The Master Services Agreement ("MSA") between A2Z IT and the customer organisation, which sets the commercial and legal framework for the relationship
• The applicable Statement of Work or Order Form ("SoW") between A2Z IT and the customer organisation, which sets the specific commercial deal — pricing, term length, modules, start date
• The Data Processing Agreement ("DPA") between A2Z IT and the customer organisation, which governs data processing where A2Z IT acts as processor on behalf of the customer
• Our Privacy Policy at a2zcarehub.co.uk/privacy, which describes how we handle personal data
• Our Sub-Processors page at a2zcarehub.co.uk/sub-processors, which lists the third parties that support delivery of the Platform

Where these Terms conflict with a signed MSA or SoW, the MSA or SoW prevails. Where these Terms conflict with the DPA, the DPA prevails for matters of personal data processing.

If you have questions about these Terms, please contact us at legal@a2zit.ai.

2. Definitions

In these Terms:

"Authorised User" means an individual to whom the Customer has granted access to the Platform under its licence, including carers, registered managers, nominated individuals, back-office staff, and administrators.

"Customer" means the organisation that has entered into an MSA and SoW with A2Z IT for use of the Platform.

"Customer Data" means data that the Customer or its Authorised Users submit to or generate within the Platform, including governance event records, policy acknowledgements, training compliance records, audit responses, and survey responses.

"AI Output" means content produced by the Platform's AI agents in response to Customer or Authorised User inputs, including rewritten care notes, agent responses, generated documents, and analytical outputs.

"Platform" means the A2Z CareHub software-as-a-service platform, comprising the products described in the Platform Description (section 3), as updated from time to time.

"Platform IP" means all intellectual property rights in and to the Platform, including software, agent prompts, audit templates, knowledge base content, designs, documentation, and the Platform's underlying methodologies.

3. Platform description

The Platform is a software-as-a-service platform for the United Kingdom adult social care sector. It comprises a suite of integrated products which, at the date of these Terms, includes:

• A2Z CareNotes — AI-powered care note quality checking
• A2Z CareIQ — AI agent suite for managers, registered managers, and back-office staff
• A2Z Oversight — governance dashboard
• A2Z CareTrack — governance event capture
• A2Z CareVoice — anonymous survey programme
• A2Z CareComply — policy distribution and training compliance management
• A2Z CareAudit — audit execution platform with pre-built templates

The specific products available to a Customer are set out in the applicable SoW. We may add, modify, or retire products and features over time. Material reductions in functionality available to a Customer will be notified in advance in line with section 16.

4. Grant of access

Subject to the MSA, the SoW, and these Terms, A2Z IT grants the Customer a non-exclusive, non-transferable, non-sublicensable right to access and use the Platform for the Customer's internal business purposes during the term set out in the SoW.

The Customer may permit Authorised Users to access the Platform within the scope of this right. The Customer is responsible for the acts and omissions of its Authorised Users as if they were the Customer's own.

5. Acceptable use

The Customer and its Authorised Users must not:

• Use the Platform for any unlawful purpose, or in any way that breaches applicable law or regulation
• Submit to the Platform any content that is unlawful, defamatory, obscene, or that infringes the rights of any third party
• Submit to the Platform any data the Customer does not have a lawful basis to process
• Attempt to access, probe, or test the security of the Platform other than as expressly permitted
• Reverse engineer, decompile, or disassemble the Platform, or attempt to extract its source code, except to the extent permitted by applicable law
• Use the Platform to build, train, or improve a competing product or service
• Resell, sublicense, or otherwise make the Platform available to any third party other than Authorised Users
• Use automated means (including bots, scrapers, or scripts) to access the Platform other than via the documented interfaces and within reasonable use limits
• Submit content that is intended to manipulate, deceive, or destabilise the Platform's AI agents, including prompt injection attempts directed at Platform infrastructure
• Use the Platform in any way that interferes with its operation or with other customers' use of it
• Share access credentials between individuals; each Authorised User must use their own credentials

The Customer is responsible for ensuring that its Authorised Users comply with these acceptable use rules.

6. Customer responsibilities

The Customer is responsible for:

• Managing the lifecycle of its Authorised Users — adding, modifying, and removing access rights as the Customer's workforce changes
• Ensuring that Authorised Users have the necessary training, qualifications, and authorisations to use the Platform appropriately
• The accuracy, lawfulness, and quality of all Customer Data submitted to the Platform
• Establishing and maintaining the lawful basis for processing personal data submitted to the Platform, including any special category data condition under Article 9 of the UK GDPR
• Determining the appropriateness of AI Outputs for the Customer's purposes, in line with section 7
• Compliance with the Customer's own regulatory obligations, including those imposed by the Care Quality Commission, the Information Commissioner's Office, and any other applicable regulator
• Maintaining the security of credentials issued to its Authorised Users
• Backing up any Customer Data the Customer wishes to retain outside the Platform, where the Platform's standard data handling does not meet the Customer's specific needs

7. AI Outputs — advisory only

This section is central to how the Platform should be used and is the basis on which A2Z IT provides the AI capabilities of the Platform.

The Platform uses AI to assist care professionals. The AI Outputs generated by the Platform — rewritten care notes, agent responses to questions about compliance, governance, care planning, workforce, safeguarding, tenders, HR, and any analytical outputs over Customer Data — are advisory and informational. They are not professional advice, regulatory determinations, clinical judgements, legal opinions, or authoritative statements of fact.

All decisions affecting service users, staff, regulatory submissions, contractual matters, employment matters, or compliance outcomes must be made by qualified human professionals, on the basis of the Customer's own judgement and, where appropriate, with input from suitably qualified external advisers. The Platform does not replace the professional judgement of registered managers, nominated individuals, clinicians, HR professionals, legal advisers, or any other qualified person.

A2Z IT does not warrant that AI Outputs are accurate, complete, current, free from error, or fit for any particular purpose. AI Outputs may contain factual inaccuracies (including statements that appear authoritative but are not), may reflect outdated information, and may not account for the specific circumstances of the Customer or any individual.

The Customer is responsible for reviewing AI Outputs before relying on them or acting on them. Where AI Outputs are incorporated into care records, regulatory submissions, policy documents, HR documentation, tender responses, or any other operational artefact, that incorporation is the Customer's act and the Customer's responsibility, regardless of how the AI Output was generated.

A2Z IT's responsibilities in respect of AI Outputs are limited to the operational obligations set out in section 9 (operating the Platform and the AI agents in line with their documented behaviour).

8. Data handling

Personal data processed in connection with the Platform is handled as described in our Privacy Policy and, where A2Z IT acts as processor on behalf of the Customer, in the DPA. In particular:

• A2Z IT does not retain the content of care notes or AI agent conversations after a session ends
• Audit logs of platform activity are retained for the periods set out in the Privacy Policy
• Customer Data submitted through CareTrack, CareComply, CareAudit, and CareVoice is retained as configured by the Customer or per the defaults documented for each product
• Sub-processors are listed at a2zcarehub.co.uk/sub-processors

The Customer acknowledges and agrees that, under Microsoft's current default configuration of Azure OpenAI, prompts and AI Outputs may be retained by Microsoft for up to 30 days for abuse-monitoring purposes and may be reviewed by authorised Microsoft personnel where automated systems flag potential policy violations. This is described more fully in the Privacy Policy. We are working to apply for a zero-data-retention configuration with Microsoft and will update the Privacy Policy when that configuration is in place.

9. Operational commitments

A2Z IT will:

• Provide the Platform substantially in line with its published description
• Use commercially reasonable efforts to maintain Platform availability of at least 99.5% per calendar month, excluding scheduled maintenance, force majeure events, and outages caused by third parties on which the Platform depends (including Microsoft Azure)
• Notify the Customer in advance of scheduled maintenance windows where these will affect availability
• Provide support during UK business hours (Monday to Friday, 9:00 to 17:00 UK time, excluding English public holidays), with the following response targets:
  • Priority 1 (Platform unavailable to all Authorised Users): acknowledge within 1 business hour
  • Priority 2 (Significant feature unavailable, no workaround): acknowledge within 4 business hours
  • Priority 3 (General issue or query): acknowledge within 1 business day
• Maintain the security controls described in our Privacy Policy
• Comply with our obligations under the DPA in respect of personal data we process on behalf of the Customer

The availability target and support response targets in this section are operational targets, not financial commitments. Service credits, if any, are addressed in the MSA or SoW.

Out-of-hours support, named support contacts, dedicated response times, and service credits are available where agreed in the MSA or SoW.

10. Suspension

A2Z IT may suspend access to the Platform, in whole or in part, where:

• Continued access poses a security risk to the Platform or to other customers
• The Customer or an Authorised User is in material breach of these Terms, including the acceptable use rules in section 5
• Suspension is required by law or by direction of a competent authority
• Suspension is required to perform emergency maintenance

Where reasonably possible, we will give advance notice of suspension and an opportunity to remedy the cause. Suspension to address an active security risk may be implemented without notice; we will inform the Customer as soon as reasonably practicable thereafter.

Suspension does not constitute termination. Where suspension is the result of Customer breach, the Customer remains liable for fees during the period of suspension as set out in the SoW.

11. Intellectual property

Platform IP. All Platform IP is and remains the property of A2Z IT or its licensors. Nothing in these Terms transfers ownership of any Platform IP to the Customer.

Customer Data. All Customer Data is and remains the property of the Customer (or of the data subjects to whom it relates, where applicable). The Customer grants A2Z IT a non-exclusive, royalty-free licence to process Customer Data solely as necessary to provide the Platform and to perform A2Z IT's obligations under the MSA, SoW, DPA, and these Terms.

AI Outputs. As between A2Z IT and the Customer, the Customer owns the AI Outputs generated for the Customer through the Customer's use of the Platform, subject to A2Z IT's continuing rights in the underlying Platform IP. The Customer may use AI Outputs for any lawful purpose related to its business, subject to section 7.

Audit templates and knowledge base content included in the Platform are licensed to the Customer for use within the Platform only. The Customer may not extract, copy, redistribute, or repurpose audit templates or knowledge base content outside the Platform.

Feedback. If the Customer or an Authorised User provides feedback or suggestions about the Platform, A2Z IT may use that feedback freely without obligation, including to improve the Platform.

12. Confidentiality

Each party will keep the other's confidential information confidential, will use it only for the purposes of the relationship, and will protect it with at least the standard of care it applies to its own confidential information of a similar nature.

This obligation does not apply to information that is or becomes publicly available without breach, was already known to the receiving party without obligation of confidence, is independently developed without reference to the other party's confidential information, or is required to be disclosed by law or by a competent authority. Heavier confidentiality protections, where required, are addressed in the MSA.

13. Termination — data extraction

Termination of access to the Platform is governed by the MSA and SoW. The following operational provisions apply on termination, regardless of the reason for termination:

• A2Z IT will, for a period of 30 days following termination, make available to the Customer the standard data export tools provided by the Platform, so that the Customer can extract its Customer Data
• Standard-format exports are provided at no additional charge. Bespoke export work, where requested, is chargeable on a time-and-materials basis as agreed
• After the 30-day extraction period, A2Z IT will permanently delete Customer Data, subject to:
  • Retention of audit logs, billing records, and other data required for legal, regulatory, or contractual purposes, in line with the Privacy Policy
  • Standard backup retention cycles, after which residual copies in backups expire automatically

It is the Customer's responsibility to extract its Customer Data within the 30-day window. A2Z IT is not responsible for Customer Data not extracted within that window.

14. Disclaimers

To the maximum extent permitted by law, the Platform is provided "as is" and "as available". Except as expressly stated in these Terms, the MSA, the SoW, or the DPA, A2Z IT makes no warranties of any kind, whether express, implied, statutory, or otherwise, including but not limited to:

• Warranties of merchantability, fitness for a particular purpose, or non-infringement
• Warranties that the Platform will meet the Customer's specific requirements
• Warranties that the Platform will be uninterrupted, timely, secure, or error-free
• Warranties that AI Outputs are accurate, complete, current, or fit for any particular purpose
• Warranties that any defects will be corrected within any specific timeframe

The Platform is not a substitute for professional advice, professional judgement, regulatory compliance assessments, or qualified human decision-making. The Customer's use of the Platform does not transfer to A2Z IT any of the Customer's regulatory or professional responsibilities.

Limitations and exclusions of liability are addressed in the MSA. Nothing in these Terms excludes or limits liability for death or personal injury caused by negligence, for fraud, or for any other liability that cannot be excluded or limited under English law.

15. Sub-processors and third-party services

The Platform depends on third-party services, principally Microsoft Azure. A2Z IT is not responsible for the acts or omissions of third parties beyond what is required of A2Z IT under the DPA. Outages, defects, or changes in third-party services may affect the Platform; A2Z IT will use commercially reasonable efforts to mitigate the impact of such events on the Customer.

The current list of sub-processors is published at a2zcarehub.co.uk/sub-processors. A2Z IT will notify the Customer of material changes to the sub-processor list as set out in the DPA.

16. Changes to these Terms

A2Z IT may update these Terms from time to time.

Material changes — including changes to the acceptable use rules, the AI Outputs section, the operational commitments, or the data extraction provisions — will be notified to the Customer at least 30 days before the effective date of the change, by email and through a notice on the Platform. Continued use of the Platform after the effective date constitutes acceptance of the updated Terms. If the Customer does not accept a material change, the Customer's remedy is set out in the MSA.

Non-material changes — including typographical corrections, clarifications, and updates to the sub-processor list at section 15 — take effect on publication.

The "Last updated" date at the top of these Terms reflects the most recent change.

17. General

Governing law. These Terms are governed by and construed in accordance with the laws of England and Wales.

Jurisdiction. The courts of England and Wales have exclusive jurisdiction over any dispute arising out of or in connection with these Terms.

Entire agreement. These Terms, together with the MSA, the SoW, the DPA, the Privacy Policy, and the Sub-Processors page, constitute the entire agreement between the parties in relation to the Platform and supersede any prior representations or understandings on the subject matter.

No waiver. Failure or delay by either party to enforce any provision of these Terms is not a waiver of that provision.

Severability. If any provision of these Terms is held to be invalid or unenforceable, the remaining provisions remain in full force and effect.

No third-party rights. A person who is not a party to these Terms has no right under the Contracts (Rights of Third Parties) Act 1999 to enforce any of their provisions.

Assignment. The Customer may not assign or transfer its rights under these Terms without A2Z IT's prior written consent. A2Z IT may assign or transfer its rights and obligations to a successor in connection with a corporate reorganisation, merger, acquisition, or sale of all or substantially all of its business.

Notices. Notices to A2Z IT under these Terms should be sent to legal@a2zit.ai. Notices to the Customer will be sent to the contact details recorded in the SoW.

18. Contact