Last Modified: [insert publication date] · Replaces the version dated 29 December 2023
This Terms of Service agreement ("Agreement") governs your ("you", "Customer", or "User") use of the services provided by DeepInfinity ("Company", "we", "us"), including but not limited to the website ("Site"), web applications, APIs, clinical AI agents, and Microsoft Office add-ins (collectively referred to as the "Services"). By accessing or using the Services, you agree to be bound by this Agreement.
The Services are professional clinical support tools intended for use by qualified healthcare professionals and healthcare institutions. They are not intended for use by patients or members of the public. Section 2 sets out mandatory conditions of clinical use and is an essential part of this Agreement.
1.1 Eligibility. You must be at least 18 years old and have the legal capacity to enter into this Agreement. By using the Services, you represent and warrant that you meet these eligibility requirements and that you satisfy the user eligibility conditions in Section 2.1.
1.2 Licence. The Company grants you a limited, non-exclusive, non-transferable, and revocable licence to use the Services for your internal professional or business purposes, strictly within the intended use described in Section 2 and subject to compliance with this Agreement.
1.3 Subscription. Licences for the Services are granted on a subscription basis and expire at the end of the applicable subscription period, unless renewed.
1.3.1 All subscriptions renew automatically unless cancelled by the Customer before the end of the then-current period.
1.3.2 If a Customer cancels a subscription, they will retain access to the Services until their currently paid subscription period has finished. Except where a refund is required by applicable law, no refunds will be provided for cancelled subscriptions.
1.4 Subscription Purchase on Behalf of Another. Where a subscription is purchased on behalf of another individual or organisation ("End User"), the purchaser agrees to inform the End User of this Agreement, including the clinical conditions in Section 2, and to ensure their agreement to comply with it before using the Services.
1.4.1 The purchaser assumes responsibility for the End User's compliance with this Agreement.
1.4.2 Any breach of this Agreement by the End User shall be considered a breach by the purchaser.
1.5 Restrictions. Except as expressly permitted in this Agreement or by applicable law, you must not:
1.5.1 Copy, modify, reverse engineer, decompile, or disassemble any part of the Services, or attempt to do so.
1.5.2 Install or use any third-party software or technology in any way that would subject the Company's intellectual property or technology to any other licence terms.
1.5.3 Work around any technical limitations in the Services or restrictions in the documentation, including any control that requires clinician review or approval of an output.
1.5.4 Separate and run parts of the Services on more than one device except as permitted by your subscription.
1.5.5 Use the Services, or any output of the Services, for any unlawful purpose.
1.5.6 Distribute, sublicense, rent, lease, or lend any part of the Services, in whole or in part, or use them to offer hosting or reporting services to a third party, except as expressly agreed in writing.
1.5.7 Use outputs of the Services to train, fine-tune, or benchmark any competing artificial intelligence system without the Company's prior written consent.
1.6 Feedback. Any feedback, comments, ideas, improvements, or suggestions ("Feedback") provided by you to the Company regarding the Services are voluntary and non-confidential. By submitting Feedback, you grant the Company a non-exclusive, royalty-free, worldwide, perpetual, irrevocable licence to use, reproduce, modify, adapt, publish, and distribute such Feedback for any purpose. Feedback must not contain personal data or patient-identifiable information.
1.7 Service Modifications and Discontinuation. The Company may modify or update the Services at any time. Where a change materially reduces the functionality or clinical performance of a Service in active clinical use, the Company will give the Customer at least [30 / 60 / 90 — choose a period consistent with your enterprise contracts] days' prior written notice, other than where an urgent change is required for safety, security, or legal compliance.
2.1 Intended Users. The Services are intended solely for use by qualified radiologists, licensed physicians, and other credentialled healthcare professionals acting within their scope of practice, and by healthcare institutions and their authorised staff acting on their behalf. You warrant that you are such a person or institution, that you hold and will maintain all registrations and credentials required by your professional regulator, and that you will notify the Company promptly of any change to your registration status.
2.2 Not for Patient Use. The Services are not intended for, and must not be made available to or used by, patients or members of the general public. Nothing produced by the Services constitutes medical advice, diagnosis, or treatment. No doctor-patient or clinician-patient relationship is created between the Company and any patient by use of the Services. The Company does not practise medicine and does not provide clinical care.
2.3 Decision Support Only. The Services are clinical decision-support and documentation tools. All outputs of the Services — including draft reports, transcriptions, summaries, findings, measurements, flags, and prioritisation signals — are preliminary, unvalidated, and provisional until reviewed and approved by a qualified clinician in accordance with Section 2.4.
2.4 Mandatory Clinician Review. The User shall ensure that every output of the Services is independently reviewed, verified, corrected where necessary, and expressly approved by a qualified clinician before it is finalised, signed, issued, entered into a patient's medical record, communicated to a patient, or relied upon for any clinical purpose. The reviewing clinician retains sole and final professional and clinical responsibility for the content, accuracy, and completeness of the finalised report or record. The Company does not review, verify, or approve any clinical output and accepts no responsibility for outputs that are used without the review required by this clause.
2.5 No Sole Reliance. Outputs of the Services must not be used as the sole or determinative basis for any diagnosis, treatment decision, triage decision, or discharge decision. The Services are not designed, validated, or supplied for autonomous or unsupervised operation, and are not intended for emergency or time-critical triage [amend if a specific product is cleared for triage — state which].
2.6 Known Limitations. The User acknowledges and accepts that:
2.7 Validation Scope. Details of the intended clinical purpose, validated modalities, body regions, and populations for each Service are set out in the applicable product documentation or Instructions for Use. Use outside that documented scope is off-label use, is undertaken entirely at the User's own risk, and is not covered by the Company's warranties in Section 8.
2.8 Regulatory Status. [REQUIRED — do not publish without completing. State, for each Service and each market you sell into, whether it is registered or certified as a medical device and under which framework (e.g. UKCA / MHRA, EU MDR, US FDA, CDSCO India, Health Canada), or state plainly that it is not a regulated medical device and is supplied as documentation and workflow support software only. Do not use ambiguous wording such as "compliant with" — regulators read this clause first.]
2.9 Institutional Responsibilities. Where the Services are deployed within a hospital, Trust, diagnostic centre, or other healthcare organisation, that organisation is responsible for: local clinical governance and risk assessment of the Services; ensuring the deployment is covered by its own clinical safety processes [for NHS deployments, reference DCB0129/DCB0160 and name who holds the Clinical Safety Officer role on each side]; training its staff on the correct use of the Services and on the review requirement in Section 2.4; and obtaining any patient consents or fair-processing notifications required by applicable law.
2.10 Audit Trail. The Services maintain a record of outputs generated and of the clinician approval applied to them. The Customer shall not disable, circumvent, or alter this record. On reasonable request, and subject to applicable data protection law, each party will make the relevant records available to the other in connection with an incident investigation, complaint, or regulatory enquiry.
2.11 Safety Incident and Adverse Event Reporting. The Customer shall notify the Company without undue delay, and in any event within [24 / 48 / 72] hours, of any suspected malfunction, clinically significant error, near miss, or adverse event involving the Services. Reports must be sent to [create and publish a dedicated address, e.g. [email protected] — a general enquiries inbox is not adequate]. Nothing in this Agreement limits either party's obligation to report to a regulator or to cooperate with a regulatory investigation.
2.12 Model Changes. The Company may update the models underlying the Services to improve performance or safety. Material changes to clinical performance characteristics will be notified to the Customer in advance in accordance with Section 1.7, together with any revised product documentation.
3.1 Privacy Policy. Your use of the Site is also subject to our Privacy Policy, which governs personal data collected through the website.
3.2 Roles of the Parties. In respect of patient data processed through the Services, the Customer (or the healthcare institution it acts for) is the controller and the Company acts as processor, acting only on the Customer's documented instructions. [Confirm this reflects your actual arrangements for every product — DeepPatient Registration and any product where you set the purposes may sit differently.]
3.3 Data Processing Agreement. Processing of patient data is governed by the Company's Data Processing Agreement, which is incorporated into this Agreement by reference and available at [publish the DPA and insert the URL]. Where required, the parties will also execute a Business Associate Agreement or equivalent local instrument.
3.4 No Training on Customer Data. The Company will not use Customer data, patient data, images, or reports to train or improve its models except [state your actual position: "never", or "only where the Customer has given specific written consent and the data has been irreversibly de-identified". Silence or ambiguity here will stop hospital procurement.]
3.5 Security. The Company maintains technical and organisational measures appropriate to the risk, described at deepinfinity.ai/compliance, and will notify the Customer without undue delay on becoming aware of a personal data breach affecting the Customer's data.
3.6 Sub-processors and Transfers. A current list of sub-processors and the locations from which data is accessed is available on request [strongly recommended: publish this list — it is asked for in every hospital DPIA]. International transfers are protected by the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or another lawful transfer mechanism.
3.7 Retention and Return. On termination, the Company will delete or return Customer data in accordance with the Data Processing Agreement and applicable law. Retention periods are set out in that agreement.
3.8 Patient Requests. Patients wishing to exercise data protection rights in respect of their clinical record should contact the healthcare institution responsible for their care. The Company will provide reasonable assistance to the Customer in responding to such requests.
4.1 Confidential Information. "Confidential Information" means any non-public information that is designated as confidential or that reasonably should be understood to be confidential, including user data, service usage data, the terms of this Agreement, and account authentication credentials.
4.2 Protection and Use. Each party will take reasonable steps to protect the other's Confidential Information from unauthorised use or disclosure, and will use it only to fulfil the purposes of the parties' relationship under this Agreement.
4.3 Disclosure Required by Law. If a party is legally compelled to disclose the other party's Confidential Information, it will give prior notice to the other party to the extent legally permitted.
4.4 Duration. These obligations remain in effect for five years after termination of this Agreement, except that patient data and personal data remain protected for as long as they are held and in accordance with Section 3.
5.1 General Use. You agree to use the Services in compliance with all applicable laws, professional obligations, and this Agreement.
5.1.1 You agree not to use the Services for any unlawful or unauthorised purpose.
5.1.2 You agree not to interfere with or disrupt the integrity or performance of the Services.
5.1.3 You agree not to attempt to gain unauthorised access to any portion of the Services or any related systems or networks.
5.2 Maintenance of Professional Standing. Use of the Services requires the professional designations and regulatory registrations described in Section 2.1. You agree to maintain that registration and to notify the Company promptly of any suspension, condition, or change.
5.3 Account Security. You are responsible for maintaining the confidentiality of your credentials and for all activity under your account. Credentials must not be shared. You must notify the Company promptly of any suspected unauthorised access.
6.1 Reservation of Rights. The Company retains all rights, title, and interest in and to the Services, including all associated intellectual property rights. You may not use the Company's trademarks, logos, or other proprietary information without prior written consent.
6.2 Rights Not Expressly Granted. The Company reserves all rights not expressly granted in this Agreement. The Services are protected by copyright and other intellectual property laws and international treaties.
6.3 Customer Data and Outputs. As between the parties, the Customer retains all rights in the data it submits to the Services and in the finalised clinical reports and records produced using them. The Company claims no ownership of patient records.
7.1 Compliance Audits. The Company may, at its own expense and on reasonable notice, verify your compliance with this Agreement. You agree to cooperate by providing reasonably requested information and documents.
7.2 Unlicensed Use. If an audit reveals use of the Services not covered by your licensed rights, you must promptly acquire the necessary licences.
7.3 Data Protection Compliance. On request, the Company will provide the information reasonably necessary to demonstrate compliance with applicable data protection law, including UK GDPR and the Data Protection Act 2018.
7.4 Confidentiality. All information obtained during an audit is Confidential Information.
8.1 The Company represents and warrants that:
8.2 Disclaimer. Except as expressly provided in this Agreement, and subject to Section 10.5, the Services are provided "as is" and "as available". To the maximum extent permitted by applicable law, the Company disclaims all other warranties, express or implied, including implied warranties of merchantability, fitness for a particular purpose, and non-infringement.
8.3 No Clinical Warranty. The Company gives no warranty that any output of the Services is clinically accurate, complete, or suitable for any individual patient, and no warranty as to any specific diagnostic sensitivity or specificity beyond that stated in the applicable product documentation. Nothing in this Section limits liability that cannot be limited by law.
9.1 Indemnification by the User. Subject to Section 10.5, the User agrees to defend, indemnify, and hold harmless the Company, its affiliates, officers, directors, employees, and agents from and against third-party claims arising from:
9.2 Procedure. The Company will give the User prompt written notice of any claim for which indemnification is sought, and the User will not settle any claim in a way that imposes an obligation on the Company without its written consent.
9.3 Indemnification by the Company. [Enterprise customers will require a reciprocal IP infringement indemnity from you. Add one — its absence will be raised in every negotiation.]
10.1 General Limitation. Subject to Section 10.5, and to the fullest extent permitted by law, the Company shall not be liable for any indirect, incidental, special, consequential, or exemplary damages, including damages for loss of profits, goodwill, use, data, or other intangible losses, arising out of or in connection with your use of the Services.
10.2 Free Services. Subject to Section 10.5, for Services provided free of charge the Company shall have no liability arising out of or in connection with the use of such Services.
10.3 Maximum Liability. Subject to Section 10.5, the Company's total aggregate liability for all claims arising out of or in connection with this Agreement shall not exceed the amount paid by the Customer for the Services during the twelve (12) months immediately preceding the date of the first such claim.
10.4 Exceptions. The limitations and exclusions in this Section do not apply to liability arising from the Company's gross negligence, wilful misconduct, or fraud.
10.5 Liabilities That Cannot Be Excluded. Nothing in this Agreement excludes or limits either party's liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, or for any other liability that cannot lawfully be excluded or limited.
11.1 Termination by Either Party. Either party may terminate this Agreement for material breach that remains uncured 30 days after written notice, or on the expiry of the then-current subscription period.
11.2 Immediate Suspension. The Company may suspend access immediately where necessary to address a security incident, a suspected patient-safety risk, unlawful use, or non-payment, and will notify the Customer of the reason as soon as reasonably practicable.
11.3 Continuity of Care. Other than under Section 11.2, the Company will not terminate or suspend a Service in active clinical use without at least [30 / 60 / 90] days' written notice, so that the Customer can transition safely.
11.4 Data Export. For [30 / 60 / 90] days after termination, the Company will make the Customer's data available for export in a commonly used format, after which it will be deleted in accordance with Section 3.7.
11.5 Survival. Sections 2, 3, 4, 6, 8, 9, 10, 12 and 13 survive termination.
[REQUIRED — the previous version of this page said Canada / Alberta / Canadian Arbitration Association, while the Privacy Policy is UK GDPR with an ICO registration and a London registered office. These contradict each other and procurement teams will find it. Choose one and make it consistent across all pages. If you sell to the NHS, England & Wales with the courts of England & Wales is the expected position; Alberta arbitration is likely to be struck out in any Trust contract.]
12.1 This Agreement shall be governed by and construed in accordance with the laws of [jurisdiction].
12.2 The parties submit to the exclusive jurisdiction of the courts of [jurisdiction], save that either party may seek injunctive relief in any competent court.
12.3 Nothing in this Section affects a patient's or consumer's statutory rights, or the jurisdiction of any healthcare or data protection regulator.
13.1 Entire Agreement. This Agreement, together with the Data Processing Agreement and any signed order form or enterprise agreement, constitutes the entire agreement between the parties on its subject matter and supersedes all prior understandings and representations.
13.2 Notices. All notices must be in writing and addressed to the Company at [email protected]. Safety and adverse event notifications must additionally be sent in accordance with Section 2.11.
13.3 Force Majeure. Neither party shall be liable for any failure or delay in performing its obligations caused by circumstances beyond its reasonable control, including acts of God, flood, fire, earthquake, explosion, war, terrorism, or change of law. This does not excuse a failure to pay.
13.4 Severability. If any provision is held invalid, illegal, or unenforceable, the remaining provisions remain in full force and effect.
13.5 Waiver. Failure to exercise a right is not a waiver of that or any further right.
13.6 Order of Precedence. Where there is a conflict, the following order applies: (a) a signed enterprise agreement or order form; (b) the Data Processing Agreement; (c) this Agreement; (d) product documentation.
13.7 Government Procurement Rules. Users that are government or public sector entities affirm that they have complied and will comply with all applicable procurement laws and regulations.
13.8 Publicity. The Company may identify the Customer as a user of the Services, and use the Customer's name and logo in its customer list, press releases, and website, only with the Customer's prior written consent, which may be withdrawn on reasonable notice.
13.9 Assignment. Neither party may assign this Agreement without the other's written consent, except to an affiliate or in connection with a merger or sale of substantially all assets.
The Company may modify this Agreement. We will notify you of changes by posting the updated Agreement on the Company's website and updating the "Last Modified" date. Material changes, including any change to Section 2 (Intended Use and Clinical Responsibility) or Section 3 (Data Protection and Patient Data), will be notified to Customers in writing at least [30 / 60] days before they take effect. Your continued use of the Services after the effective date constitutes acceptance of the revised Agreement.
General and contractual queries: [email protected]
Data protection queries: [email protected]
Clinical safety and adverse events: [create and publish a dedicated address]
Registered office: 1 Benton Road, Ilford, IG1 4AT, United Kingdom. ICO registration reference: ZC195380.