Skip to content
All legal documents

Terms of Service

The agreement between your clinic and HealthCoreSecurity AI: what we provide, what the subscription costs and how it renews, what each side is responsible for, and what happens if things go wrong.

Draft — no effective date set

Draft — not yet in force

This document has not been finalised and does not create binding obligations. It still needs company details that only we can supply, and review by Canadian privacy counsel. Anything shown as [[LIKE THIS]] is a blank, not a value.

Outstanding: entityName, entityJurisdiction, registeredAddress, privacyOfficerEmail, securityEmail, supportEmail, generalEmail, governingProvince, effectiveDate.

1. This agreement

These Terms form a contract between [[ENTITY NAME]] ("we", "us") and the organisation that subscribes to the HealthCoreSecurity AI service ("you", "your clinic"). They take effect when you first subscribe or use the service, whichever is earlier.

If you are accepting on behalf of a clinic, you are confirming you have authority to bind it.

Three other documents form part of this agreement: the Privacy Policy, the Data Processing Addendum, and any order form or quotation we have both signed. Where a signed order form conflicts with these Terms, the order form wins.

2. Who can subscribe

The service is sold to organisations for business use. It is not offered to consumers, and it is not offered to anyone under 18. We currently sell in Canada; if your clinic operates elsewhere, talk to us before subscribing rather than after.

3. What we provide

We provide the managed cybersecurity service for the plan you select. Plans and what each includes are described on the Pricing page, and the plan on your order form is the one you get.

The service typically involves deploying security software to your clinic's computers and servers, monitoring the signals it produces, investigating what looks wrong, and — depending on plan — isolating a device that is under attack.

We may improve, change or replace the underlying technology we use to deliver the service. What we will not do is materially reduce the protection you are paying for during a term you have already paid for. If we need to make a materially adverse change, you may cancel and receive a pro-rata refund of the unused portion.

Service levels

Availability targets, response times and any service credits are set out in your order form or a separate service level agreement, if you have one. Nothing on our website or in this document creates a service level commitment. If a specific response time matters to your clinic, get it written into the order form — that is what it is for.

4. Your account

You are responsible for the accounts you create and for what is done with them. That means keeping credentials confidential, using multi-factor authentication where we offer it, keeping your contact details current so we can reach you during an incident, and telling us promptly at [[SECURITY EMAIL]] if you believe an account has been compromised.

We are not liable for loss arising from someone using your credentials before you tell us.

5. What you are responsible for

The service only works if we can actually see your environment. You agree to:

  • let us install and keep the security software running on the devices in scope, and not disable, block or uninstall it;
  • give us the access and the information we reasonably need to deliver and support the service;
  • have the authority to authorise monitoring of the devices you put in scope, and to have told the people who use them, as employment and privacy law requires;
  • keep your own systems reasonably maintained — supported operating systems, applied updates, sensible passwords;
  • respond when we contact you about an active incident.

If you disable the software, put devices out of scope, or do not respond during an incident, we cannot protect what we cannot see, and we are not responsible for what happens on those devices.

6. Fees, renewal and cancellation

Fees. You pay the fee for your plan at the interval shown at checkout and on your order form. Fees are in Canadian dollars unless stated otherwise, and exclusive of applicable taxes, which we add where required.

Payment. Subscriptions are billed through Stripe. You authorise us to charge your payment method for each renewal.

Automatic renewal. Your subscription renews automatically at the end of each billing period, at the then-current rate for your plan, and continues to renew until cancelled. We will remind you before an annual renewal.

Cancelling. You may cancel at any time from your dashboard or by writing to [[SUPPORT EMAIL]]. Cancellation takes effect at the end of the current billing period. You keep the service until then. We do not refund the remainder of a period you have already paid for, except where these Terms say otherwise (section 3) or the law requires it.

Price changes. We may change prices for a renewal term by giving you at least 30 days' notice before the renewal date. If you do not want the new price, cancel before the term renews. We will not change the price mid-term.

Late or failed payment. If a payment fails we will retry and contact you. If an invoice remains unpaid 14 days after we have told you, we may suspend the service. Suspension is not termination: your data is retained through the suspension, and section 15 governs what happens if the agreement then ends.

Taxes. You are responsible for applicable sales taxes, other than taxes on our income.

7. Trials, pilots and assessments

Anything we provide free of charge — a trial, a pilot, a free clinic assessment — is provided as-is, may be changed or withdrawn at any time, and carries no warranty or service level. Sections 12, 13 and 14 apply to it in full.

8. Acceptable use

You may not use the service, or let anyone use it, to:

  • break any law, or infringe anyone's rights;
  • attack, probe, scan or disrupt systems you are not authorised to test — including ours, other than under our Vulnerability Disclosure Policy;
  • interfere with or circumvent the service's own security, rate limits or access controls;
  • resell, sublicense or provide the service to anyone outside your clinic without our written agreement;
  • reverse engineer the service except where the law says you may;
  • upload malicious code to our infrastructure, other than as our own detection legitimately handles it in the course of protecting you;
  • monitor individuals for a purpose unrelated to securing the clinic's systems. The service is a security tool, not an employee surveillance tool, and using it to monitor staff conduct generally is a breach of these Terms.

If you breach this section we may suspend the service, with notice where it is safe and practical to give it.

9. Your data

You keep ownership of your data. We do not acquire rights in it beyond what we need to deliver the service to you.

Our handling of personal information is governed by the Privacy Policy and, where we process personal information or personal health information on your behalf, by the Data Processing Addendum, which is incorporated into this agreement.

We may produce and use aggregated, de-identified statistics — threat trends, detection performance — provided they cannot identify you, your staff or your patients. We do not use your data to train machine-learning models.

10. Our intellectual property

We keep all rights in the service, our software, our detection content and our documentation. You get a non-exclusive, non-transferable right to use the service during the term, for your clinic's own internal business purposes. Nothing here transfers ownership.

Feedback you give us we may use freely, without obligation to you. We would rather have your feedback than protect you from the possibility that we use it.

11. Confidentiality

Each of us may learn things about the other that are not public. Each of us agrees to protect the other's confidential information with at least reasonable care, use it only for this agreement, and not disclose it except to people who need it and are bound to keep it confidential. This does not cover information that is public, already known, independently developed, or that the law compels us to disclose — and where the law compels it, we will tell the other side if we are allowed to.

Your security telemetry, incidents and configuration are your confidential information. We treat them that way.

12. What a security service can and cannot promise

We will deliver the service with reasonable skill and care, using qualified personnel and generally accepted industry practices. That is a real commitment and we stand behind it.

We do not guarantee that your clinic will not be breached. No security provider can, and one that tells you otherwise is selling you something that does not exist. Attackers innovate, software has flaws nobody has found yet, and people click things. What the service does is reduce the likelihood of a successful attack and shorten the time to detect and contain one. It does not eliminate the risk, and buying it does not transfer your legal obligations as a health information custodian to us.

Except as stated in this section, and to the fullest extent the law allows, the service is provided as is, and we disclaim all other warranties, express, implied or statutory, including merchantability, fitness for a particular purpose and non-infringement.

Some jurisdictions do not allow certain warranties to be excluded. Where that is so, this section applies to the extent permitted, and nothing here limits a warranty that cannot lawfully be limited.

13. Limitation of liability

To the fullest extent the law allows:

Neither of us is liable for indirect, incidental, special, consequential or punitive damages, or for lost profits, lost revenue, lost business or lost goodwill, even if told such damages were possible.

Each party's total liability arising out of or relating to this agreement is limited to the fees you paid us in the twelve months before the event giving rise to the claim.

These limits do not apply to: your obligation to pay fees; either party's breach of confidentiality; our indemnity in section 14; or liability that cannot be limited by law, including fraud, fraudulent misrepresentation, and death or personal injury caused by negligence.

We accept that this allocation of risk is part of the price. If your clinic needs a higher limit, tell us before you subscribe — it is a commercial conversation, not an impossible one.

14. Indemnities

We will defend you against a third-party claim that the service as supplied by us infringes that third party's Canadian intellectual property rights, and pay damages finally awarded, provided you tell us promptly, let us control the defence, and cooperate.

You will defend us against a third-party claim arising from your breach of section 8 (acceptable use), or from your use of the service in a way this agreement does not permit, on the same terms.

15. Term, termination and what happens to your data

This agreement runs while you have an active subscription.

Either of us may terminate for material breach if the other has not fixed it within 30 days of written notice. We may terminate or suspend immediately if required by law, or if your use presents an imminent risk to other customers or to our infrastructure.

When the agreement ends:

  • your right to use the service stops;
  • fees accrued up to that point remain payable;
  • for 30 days you may ask us to export your data, and we will provide it in a structured, machine-readable format;
  • after that window we delete or de-identify it on the schedule in the Privacy Policy, except where law requires us to keep it;
  • sections 9, 10, 11, 12, 13, 14, 16 and 17 survive.

We will not hold your data hostage over a commercial dispute.

16. Governing law and disputes

This agreement is governed by the laws of the Province of [[GOVERNING PROVINCE]] and the federal laws of Canada that apply there, without regard to conflict-of-laws rules. The United Nations Convention on Contracts for the International Sale of Goods does not apply.

We each submit to the exclusive jurisdiction of the courts of [[GOVERNING PROVINCE]], except that either of us may seek injunctive relief wherever necessary to protect confidential information or intellectual property.

Before filing anything, talk to us. Most disputes are a misunderstanding about scope, and escalating to a named contact on each side resolves them faster and cheaper than a court will.

17. The rest

Changes. We may update these Terms. For material changes we will give account holders at least 30 days' notice before they take effect, and continuing to use the service after that is acceptance. If you do not accept, cancel before the change takes effect and we will refund the unused portion of your current term.

Notices. To us: [[GENERAL EMAIL]], and for anything legal, [[REGISTERED ADDRESS]]. To you: the email address on your account — so keep it current.

Assignment. Neither of us may assign this agreement without the other's consent, except to a successor of substantially all of its business, on notice.

Subcontracting. We may use the sub-processors listed at Sub-processors and remain responsible for their performance.

Force majeure. Neither of us is liable for a failure caused by something genuinely beyond our reasonable control. This does not excuse paying money that is owed.

Severability. If a provision is unenforceable, the rest stands and the provision is read down to the minimum extent necessary.

No waiver. Not enforcing something once does not mean giving it up.

Entire agreement. This agreement, the documents it incorporates and any signed order form are the whole agreement, and replace anything said before.

Independent contractors. Nothing here creates a partnership, joint venture, agency or employment relationship between us.

Language. The parties have requested that this agreement and all related documents be drawn up in English. Les parties ont demandé que cette convention ainsi que tous les documents qui s'y rattachent soient rédigés en anglais.

18. Contact

[[ENTITY NAME]] [[REGISTERED ADDRESS]] [[GENERAL EMAIL]]