SaaS Terms of Service (historical archive)

PLINICAL | EXECUTION VERSION SaaS Terms of Service Business subscription terms for the Plinical clinic-management service SUPPLIER MTX STUDIO Ltd (trading as Plinical) COMPANY Company no. 15856187 REGISTERED OFFICE Princess House The Square, 3rd Floor, Shrewsbury, Shropshire, England, SY1 1JZ CUSTOMER The clinic or other healthcare business identified in the Order EFFECTIVE DATE The date of the last signature, electronic acceptance or first authorised use, whichever occurs first GOVERNING LAW England and Wales Built for business clinics These terms govern business use of Plinical. They are not consumer terms and are not intended for patients. The Order records the commercial subscription details; the Data Processing Agreement governs clinic personal data. Version 1.1 | 4 September 2026

Order and electronic acceptance The parties may complete this panel, use a separate order form, or accept these Terms through a recorded online process. Monthly subscriptions run month-to-month and may be cancelled at any time for the end of the current paid month. Annual subscriptions have a 12-month term and renew automatically only where the Order expressly selects automatic renewal. A separate Order may add or replace commercial details but does not amend legal terms unless it expressly identifies the clause changed and is agreed by both parties. Customer legal name Registration number (if any) Registered or principal office Account and notices email Subscription plan Initial Subscription Term Subscription Fee (exclusive of VAT) Billing interval Subscription Start Date Included users / usage (if applicable) Annual renewal arrangement (automatic / manual) Additional commercial notes (if any) For the Customer For MTX STUDIO Ltd Authorised signatory full name Authorised signatory full name Title / role Title / role Electronic signature Electronic signature Date (DD/MM/YYYY) Date (DD/MM/YYYY) By signing or accepting electronically, each party confirms its authority and intention to be bound. Counterparts together form one instrument. The Supplier signature and date are intentionally left blank for proper execution.

SaaS Terms of Service These SaaS Terms of Service (the Terms) are between MTX STUDIO Ltd, trading as Plinical, company no. 15856187, with registered office at Princess House The Square, 3rd Floor, Shrewsbury, Shropshire, England, SY1 1JZ (Plinical or the Supplier), and the business identified in an Order (Customer). The Terms, each Order and the DPA form the Agreement. The Customer is entering the Agreement wholly or mainly for its trade, business, craft or profession. It must not accept these Terms as a consumer or on behalf of a patient. 1. Definitions and interpretation 1.1 Account means the Customer's organisation account and tenant. Authorised User means a member of the Customer's workforce whom it permits to use the Service. Customer Data means data, records, files, content and instructions submitted to, stored in, generated through or transmitted using the Service by or for the Customer, excluding Supplier Materials. 1.2 DPA means the Plinical Data Processing Agreement applicable to the Service. Documentation means user guidance made available by Plinical. Fees means charges in the Order. Initial Subscription Term and Renewal Term have the meanings in clause 15. Order means an order panel, online checkout, proposal or order form accepted by both parties. 1.3 Service means the hosted Plinical clinic-management software and features stated in the Order. Supplier Materials means the Service, Documentation, software, workflows, designs, templates, know-how and related intellectual property supplied by or for Plinical, excluding Customer Data. 1.4 Headings do not affect interpretation. 'Including' is illustrative and does not limit the words before it. Writing includes email and durable electronic communications. If documents conflict, the order is: the DPA for personal-data processing; an Order for expressly identified commercial terms; these Terms; then the Documentation. 2. Formation and authority 2.1 The Agreement takes effect on the earliest of: the last signature; recorded electronic acceptance; the Subscription Start Date; or the Customer first allowing an Authorised User to use the Service. The individual accepting warrants that they have authority to bind the Customer. 2.2 An Order is subject to these Terms unless Plinical expressly agrees otherwise in writing. Customer purchase-order terms, procurement portals and similar documents are administrative only and do not add to or replace the Agreement. 2.3 No patient, Authorised User or other third party is a customer or contracting party merely because their information is held in the Service. 3. Subscription and permitted use 3.1 Subject to payment and compliance with the Agreement, Plinical grants the Customer a non-exclusive, non-transferable, non-sublicensable right during the Subscription Term for its Authorised Users to access and use the Service for the Customer's internal clinic administration and delivery of its own healthcare services. 3.2 The Customer may assign Admin, Clinician and Receptionist permissions. It is responsible for choosing appropriate roles, for all activity under its Account and for ensuring that Authorised Users comply with the Agreement. Patient accounts and patient self-service booking are not included unless an Order expressly says otherwise. 3.3 The Customer must not: resell, rent, timeshare or commercially exploit the Service for a third party; copy or create derivative works from Supplier Materials; reverse engineer or attempt to obtain source code except where law prohibits that restriction; bypass security or usage controls; conduct unapproved penetration testing; or use the Service to build or benchmark a competing product. 3.4 The Customer shall use the Service only in the United Kingdom (England, Scotland, Wales and Northern Ireland) unless Plinical approves another territory in writing. Affiliates require their own Order unless expressly included. The Customer must stay within any user, storage, messaging or other usage limits in the Order. 4. Accounts and access security 4.1 Authorised Users sign in using the Customer's clinic code, their email address and password. Accounts are individual and must not be shared. The Customer shall verify user identity, use strong unique credentials, protect clinic codes, promptly disable leavers and notify Plinical without undue delay of suspected compromise. 4.2 The Customer controls access to its tenant. Plinical may require password resets, suspend credentials or take other proportionate steps where reasonably necessary to protect the Service, Customer Data or other customers.

4.3 The Customer is responsible for compatible devices, browsers, internet access, endpoint security, lawful workforce monitoring and secure handling of exports or downloaded files. 5. Implementation, imports and configuration 5.1 The Customer shall provide timely, accurate information and cooperation reasonably needed for onboarding. Dates depend on that cooperation and are estimates unless an Order expressly makes them binding. 5.2 The Customer may import supported historic CSV data, including exports produced by third-party systems such as Fresha. The Customer is responsible for its right to obtain and import the data, mapping accuracy and pre-import backups. Plinical may reject malicious, corrupted, excessive or unsupported files. 5.3 Unless an Order includes bespoke migration services, imports use standard tools and the Customer must validate the result before relying on it. Plinical is not responsible for defects already present in source data or caused by the source format. 5.4 Configuration choices, templates and clinical forms remain the Customer's responsibility. Generic content supplied with the Service is operational assistance only and must be reviewed for the Customer's clinical, professional and legal requirements. 6. Fees, invoicing and taxes 6.1 The Customer shall pay the Fees at the interval and by the method in the Order. Unless stated otherwise, Fees are payable in advance, non-cancellable and non-refundable except where the Agreement expressly provides a refund or the law requires one. 6.2 Fees exclude VAT and similar taxes. The Customer shall pay properly chargeable taxes in addition. It must maintain complete and accurate billing details and authorise the payment method selected in the Order. 6.3 If an undisputed amount is overdue, Plinical may charge interest at 4% a year above the Bank of England base rate, accruing daily, and recover reasonable collection costs. Plinical may suspend under clause 14 after at least 7 days' written notice if the amount remains unpaid. 6.4 The Customer must raise a good-faith invoice dispute within 14 days after receipt, identifying the amount and reasons, and pay all undisputed sums on time. The parties shall work promptly to resolve the dispute. 6.5 Plinical may change Fees on at least 30 days' notice. For a monthly subscription, the change takes effect at the first monthly renewal after the notice period; the Customer may cancel before that renewal. For an annual subscription, the change takes effect only if the Customer renews after the current 12-month term. This clause does not override a fixed-price commitment expressly recorded in the Order. 7. Service operation, support and changes 7.1 Plinical shall provide the Service with reasonable skill and care and substantially in accordance with the Documentation. The Service is delivered over the internet and is not guaranteed to be uninterrupted or error-free. 7.2 Plinical may perform maintenance and will, where reasonably practicable, give advance notice of planned work expected to cause material interruption. Emergency maintenance may occur without advance notice. No service-level credits apply unless an Order contains an express service-level agreement. 7.3 Plinical may improve, modify or discontinue features to maintain security, comply with law, respond to supplier changes or develop the Service. It shall not materially reduce the core paid functionality during a committed Subscription Term without reasonable notice. If such a reduction causes material detriment and is not remedied within 30 days after notice, the Customer may terminate the affected Order and receive a pro-rata refund of prepaid Fees for the unused period. 7.4 Support is provided through the channels and hours published by Plinical or stated in the Order. Response times are targets unless expressly stated to be binding. 8. Customer's clinical and legal responsibilities 8.1 The Service is an administrative record and workflow tool. It does not provide medical advice, diagnosis, clinical decision support, emergency monitoring or a substitute for professional judgement. Plinical does not practise medicine or assume a duty of care to patients. 8.2 The Customer remains solely responsible for patient care, clinical decisions, informed consent, professional registration, staffing, safeguarding, record content, prescribing, treatment suitability, referral decisions and compliance with healthcare laws, professional standards and regulator requirements applicable to it.

8.3 The Customer must independently verify critical information before acting, maintain appropriate downtime and emergency procedures, and use normal clinical channels for urgent or life-threatening matters. It must not represent that Plinical has reviewed or approved a clinical decision. 8.4 The Customer is responsible for setting lawful retention periods, recording information accurately and contemporaneously, correcting errors through appropriate audit-preserving workflows, and ensuring exports or printed records are stored and disclosed securely. 8.5 The Customer shall ensure that invoice descriptions, email subject lines and SMS messages do not contain unnecessary health information. Patients pay clinics outside Plinical; the Service may record external payments but does not itself process patient payments. 9. Acceptable use 9.1 The Customer must not use the Service unlawfully, fraudulently or harmfully; infringe rights; upload malware; attempt unauthorised access; interfere with availability; send spam or unlawful marketing; impersonate others; or submit content that is defamatory, discriminatory, abusive or otherwise unlawful. 9.2 The Customer shall not upload data that it is prohibited from processing, use signature images for biometric identification, place live patient data in demonstrations or public screenshots, or use the Service for high-risk automated decisions about individuals without Plinical's prior written agreement and appropriate safeguards. 9.3 Plinical may investigate suspected misuse and preserve evidence. It may remove or disable access to specific content where reasonably necessary to comply with law, protect people or systems, or enforce the Agreement, giving notice where lawful and practicable. 10. Customer Data and data protection 10.1 As between the parties, the Customer retains its rights in Customer Data. The Customer grants Plinical and its sub-processors a limited right to host, copy, transmit, display, modify and otherwise process Customer Data only as needed to provide, secure, support and improve the Service in accordance with the Agreement and DPA. 10.2 The Customer warrants that it has all permissions, notices, lawful bases and rights needed for Customer Data and Plinical's instructed processing. For personal data processed for the Customer, each clinic is the controller and Plinical is the processor, as described in the DPA. 10.3 The DPA is incorporated into the Agreement. If no separately signed DPA exists, the then-current Plinical DPA supplied with or linked from the Order applies from the Effective Date. The DPA prevails over these Terms on its subject matter. 10.4 Plinical may process account contacts, billing records, fraud-prevention information, service-security evidence and legally required business records as an independent controller, as explained in its privacy notice. 10.5 Plinical shall not sell Customer Data, use it for advertising, contact patients for its own marketing or use Customer Data to train general-purpose artificial-intelligence models. Plinical may create aggregated or irreversibly anonymised information that does not identify the Customer, an Authorised User or a patient, and use it to operate, secure and improve its services and produce statistics. 11. Confidentiality 11.1 Each recipient shall protect the other party's non-public business, technical and commercial information using at least reasonable care, use it only for the Agreement and disclose it only to personnel, professional advisers and contractors who need to know and are bound by confidentiality duties. 11.2 Confidential information excludes information the recipient can demonstrate was lawfully known without restriction, becomes public without breach, is received lawfully from a third party, or is independently developed without use of the information. 11.3 A recipient may disclose information where law, a regulator or court requires it, but shall, where lawful, give prompt notice and reasonable assistance to limit disclosure. This clause survives for five years after termination; duties protecting personal data and trade secrets continue for so long as the information retains that character. 12. Intellectual property 12.1 Plinical and its licensors retain all rights in Supplier Materials and all improvements to them. Except for the limited subscription right in clause 3, no intellectual-property rights transfer to the Customer. 12.2 The Customer may provide suggestions and feedback. It grants Plinical a perpetual, worldwide, royalty-free right to use them without identifying the Customer or disclosing Customer Data.

12.3 If a final court judgment, or a settlement approved by Plinical, determines that authorised use of the Service infringes a UK third party's intellectual-property right, Plinical shall, at its option and expense: obtain continued use rights; modify or replace the affected part without material loss of function; or terminate it and refund prepaid Fees for the unused period. 12.4 Clause 12.3 does not apply to claims caused by Customer Data, instructions, unauthorised modifications, combination with items not supplied or approved by Plinical, continued use after notice, or use outside the Agreement. It states Plinical's entire liability for third-party intellectual-property infringement. 13. Third-party services and communications 13.1 The Service relies on hosting, database, storage, communications, security and monitoring providers. Relevant personal-data providers are addressed as sub-processors in the DPA. Plinical remains responsible for its contractual obligations but is not responsible for a third-party service chosen, contracted or integrated directly by the Customer. 13.2 Email and SMS delivery depends on networks and recipients outside Plinical's control and is not guaranteed. The Customer is responsible for lawful content, recipient details, opt-outs where applicable and having an alternative communication method for urgent or critical messages. 13.3 Time-limited invoice links are for convenient patient access. The Customer must verify destination details and should not treat a link as a substitute for identity verification where disclosure creates a material risk. 13.4 Optional features such as SMS, monitoring-assisted support, beta functions or third-party connectors may carry additional terms or charges disclosed before activation. 14. Suspension 14.1 Plinical may suspend all or part of the Service where reasonably necessary because: undisputed Fees remain overdue after clause 6 notice; use creates a material security or legal risk; the Customer materially breaches clauses 3, 4, 8 or 9; a regulator or law requires suspension; or a critical supplier suspends a dependency. 14.2 Where practicable and lawful, Plinical shall give advance notice and an opportunity to remedy. It shall limit the suspension to what is reasonably necessary and restore access promptly after the cause is resolved. Suspension does not waive Fees, except to the extent caused by Plinical's breach. 14.3 Plinical may preserve read-only or export access during suspension where safe and lawful, but is not obliged to do so if it would undermine the reason for suspension. 15. Term, renewal and termination 15.1 The Agreement begins on the Effective Date. A monthly subscription has an Initial Subscription Term of one month and renews automatically for successive one-month Renewal Terms. The Customer may cancel at any time by written notice; cancellation takes effect at the end of the current paid monthly term, with no further renewal or minimum commitment. 15.2 An annual subscription has an Initial Subscription Term of 12 months. It renews for successive 12-month Renewal Terms only if the Order expressly selects automatic renewal. Where automatic renewal is selected, either party may prevent renewal by giving at least 30 days' written notice before the current term ends. Where it is not selected, the annual subscription expires unless the parties agree a further term. 15.3 Either party may terminate an affected Order immediately by written notice if the other party commits a material breach and, where capable of remedy, does not remedy it within 30 days after written notice; or becomes insolvent, enters liquidation or administration, ceases business or is subject to an analogous event, except for a solvent restructuring. Plinical may also terminate immediately for unlawful use, deliberate security compromise, repeated serious misuse, or non-payment continuing 14 days after a suspension notice. The Customer may terminate under clauses 7.3 or 18.5 where their conditions are met. 15.4 A Trial may be ended by either party at any time unless the Order says otherwise. Expiry or termination of one Order does not automatically terminate another. 16. Consequences of expiry or termination 16.1 On expiry or termination, subscription rights end and the Customer shall stop using the affected Service. Accrued rights and amounts remain due. Termination does not entitle the Customer to a refund except where the Agreement expressly says so. 16.2 For 30 days after termination, unless an Order allows longer, Plinical shall make standard export functionality reasonably available if the Account is not suspended for unlawful activity and undisputed Fees are paid. The Customer is responsible for completing and validating its export within that period.

16.3 After the retrieval period, Plinical shall delete or return Customer personal data as stated in the DPA. Active copies are deleted without undue delay and protected backups through the normal cycle, no later than 90 days after active deletion unless law requires longer retention. 16.4 Clauses which by nature should survive do so, including payment, confidentiality, intellectual property, liability, dispute and interpretation provisions. 17. Warranties and disclaimers 17.1 Each party warrants that it has authority to enter the Agreement. Plinical warrants that it will provide the Service with reasonable skill and care. If Plinical breaches that warranty, the Customer must notify it with reasonable detail and Plinical shall use reasonable efforts to correct the non-conformity; if it cannot do so within a reasonable period, either party may terminate the affected Service and Plinical shall refund prepaid Fees for the unused period. 17.2 The Customer acknowledges that software and internet services may contain defects and that outcomes depend on Customer Data, configuration and use. Plinical does not warrant that the Service will be uninterrupted, error-free, meet every requirement, preserve data indefinitely, or ensure the Customer's compliance with laws or professional standards. 17.3 To the fullest extent permitted by law, all warranties, conditions and other terms implied by statute or common law are excluded, including implied terms of satisfactory quality, fitness for a particular purpose and non-infringement, subject always to clause 18.1. 17.4 Trials, beta features and demonstration environments are provided 'as is', may use synthetic data only, may be changed or withdrawn at any time and are excluded from service commitments. Production patient data must not be placed in a demonstration environment. 18. Liability 18.1 Nothing in the Agreement excludes or limits liability for death or personal injury caused by negligence; fraud or fraudulent misrepresentation; breach of the obligations implied by section 12 of the Sale of Goods Act 1979 or section 2 of the Supply of Goods and Services Act 1982 where applicable; or any liability that cannot lawfully be excluded or limited. 18.2 Subject to clause 18.1, neither party is liable for: loss of profit, revenue, business, contracts, anticipated savings, goodwill or reputation; wasted management time; or indirect or consequential loss. This exclusion applies whether the loss is direct or indirect, but does not exclude Fees properly due or the reasonable cost of restoring Customer Data from the Customer's own current backup. 18.3 Subject to clauses 18.1 and 18.4, each party's total aggregate liability arising out of or in connection with an Order in any rolling 12-month period shall not exceed 100% of Fees paid or payable under that Order for that period. If the event occurs during a free Trial, the cap is GBP 1,000. 18.4 For breach of confidentiality, breach of the DPA, Plinical's infringement obligation under clause 12.3, or a party's indemnity under clause 19, the aggregate cap is 200% of Fees paid or payable under the affected Order in the relevant 12-month period. The Customer's obligation to pay Fees and liability for deliberate infringement or misuse of Supplier Materials are not subject to clause 18.3. 18.5 The parties agree that these allocations reflect the Fees, available insurance and each party's ability to control risk. A party must take reasonable steps to mitigate loss. If the Customer reasonably requires higher limits, the parties may agree them in an Order with an associated Fee adjustment. 19. Indemnities and claims 19.1 The Customer shall indemnify Plinical against third-party claims, damages, liabilities and reasonable legal costs to the extent arising from: Customer Data infringing rights; the Customer's unlawful communications or instructions; or the Customer's clinical services, negligence or breach of professional duty. The indemnity does not apply to the extent caused by Plinical's breach, negligence or wilful misconduct. 19.2 Plinical shall defend the Customer against a third-party claim that authorised use of the Service infringes a UK patent, copyright or registered trade mark and pay damages finally awarded or settlement amounts approved by Plinical, subject to clauses 12.4, 18 and 19.3. 19.3 An indemnified party must give prompt notice, reasonable cooperation at the indemnifying party's expense, and control of defence and settlement. Delay reduces liability only to the extent it materially prejudices the defence. No settlement may admit fault by, impose non-monetary duties on, or fail to release the indemnified party without its consent, not to be unreasonably withheld. 20. Force majeure

20.1 Neither party is liable for delay or failure caused by events beyond its reasonable control, including widespread internet or cloud failures, utility interruption, natural disaster, epidemic, war, terrorism, civil disorder, government action or labour dispute not limited to its own workforce. 20.2 The affected party shall notify the other, use reasonable efforts to reduce impact and resume performance. Payment obligations already accrued are not excused. If material disruption continues for more than 30 consecutive days, either party may terminate the affected Order on written notice and Plinical shall refund prepaid Fees for the unused period. 21. Notices 21.1 Notices under the Agreement must be in writing. Notices to the Customer must be sent to its notice address in the Order. Notices to Plinical must be sent to support@mtxstudio.com, or to a replacement address notified in writing. A notice is received when it enters the recipient's mail server without an automated failure message, provided that notices received outside 09:00-17:00 on a business day in England are deemed received at 09:00 on the next business day. 21.2 Notices of termination, material breach, indemnity claims or legal proceedings must also be sent by tracked prepaid post to the registered or principal office in the Order. This clause does not govern service of court proceedings where procedural rules require another method. 21.3 Routine support, operational notices, invoices and product messages may be sent to Account contacts or displayed within the Service. 22. Changes to these Terms 22.1 Plinical may update these Terms to reflect law, security, technology, supplier requirements or reasonable development of the Service. It shall give at least 30 days' notice of a material adverse change, except where urgent law or security needs require shorter notice. 22.2 For a monthly subscription, a material adverse change ordinarily takes effect at a renewal after the notice period. For an annual subscription, it ordinarily takes effect only if the Customer renews after the current term. If a change must take effect earlier and materially prejudices the Customer, the Customer may terminate the affected Order before the change takes effect and receive a pro-rata refund of prepaid Fees for the unused period. Continued use after the effective date constitutes acceptance. 22.3 Changes made by mutual written agreement, to Fees under clause 6.5, or to the DPA under its own change mechanism are governed by those provisions.

23. General 23.1 Neither party may assign or transfer the Agreement without the other's prior written consent, not to be unreasonably withheld or delayed. Either party may assign it on written notice as part of a merger, reorganisation or sale of substantially all relevant business or assets, provided the assignee is not a direct competitor of the other and can perform the obligations. 23.2 Plinical may subcontract performance and remains responsible for its obligations. Sub-processing of personal data is governed by the DPA. Nothing creates a partnership, joint venture, employment or agency relationship, and neither party may bind the other. 23.3 The Agreement is the entire agreement about its subject matter and supersedes prior proposals, statements and understandings. Each party acknowledges that it has not relied on a statement not set out in the Agreement, without excluding liability for fraud. 23.4 If a provision is invalid or unenforceable, it is modified to the minimum extent necessary or deleted, and the rest continues. A delay or failure to enforce is not a waiver. Rights and remedies are cumulative. 23.5 Except as expressly stated in an indemnity, a person who is not a party has no right under the Contracts (Rights of Third Parties) Act 1999 to enforce the Agreement. The parties may vary or end the Agreement without any third party's consent. 23.6 The Agreement may be signed in counterparts and electronically. An electronic acceptance record, typed signature or signature-platform record is evidence of intention to authenticate, subject to applicable law. 23.7 Nothing requires either party to breach law. If a legal change materially affects the Service, the parties shall cooperate in good faith on a compliant solution; if none is reasonably available, either may terminate the affected part on notice. 24. Governing law and disputes 24.1 The Agreement and any non-contractual obligations arising from it are governed by the law of England and Wales. The courts of England and Wales have exclusive jurisdiction, subject to any mandatory forum in the DPA or incorporated transfer clauses. 24.2 Before starting proceedings, a party shall give written details of the dispute and request escalation. An authorised senior representative of each party shall meet remotely or in person within 10 business days and attempt in good faith to resolve it. This does not prevent urgent injunctive relief, protect a limitation period or restrict debt recovery for undisputed Fees.

Schedule 1 | Service description and responsibility map This Schedule records the baseline scope. The Order controls any plan-specific inclusions and limits. Area Baseline service / allocation Organisation Separate clinic tenant; staff roles for Admin, Clinician and Receptionist; clinic configuration and audit information. Patient records Contact and demographic details, appointments, medical histories, medications, allergies, assessments, plans, notes and communication records entered by authorised clinic staff. Documents Treatment and informed-consent forms, in-person signature capture, referral letters, clinic documents and PDFs, subject to plan and storage limits. Diary and operations Appointment diaries, rooms, therapists and services. No patient account, patient portal or self-booking unless expressly added by an Order. Billing records Invoice creation and recording of cash, card or bank-transfer payments received outside Plinical. Plinical does not process patient payments under these Terms. Communications Clinic-instructed transactional email and optional SMS. Delivery is not guaranteed and sensitive information must be minimised. Imports and exports Supported historic CSV imports, standard reports and data exports. Customer validates imported and exported data. Hosting model Cloud service using selected infrastructure and specialist suppliers. Data-processing locations and sub-processors are governed by the DPA. Excluded responsibility Medical advice, diagnosis, clinical decision-making, emergency monitoring, professional compliance, patient identity verification and the Customer's business continuity. Shared responsibility essentials Plinical Customer Operates and secures the hosted service using reasonable skill and care. Controls lawful use, users, roles, devices, endpoints and clinic procedures. Maintains platform-level safeguards and supplier arrangements. Maintains lawful bases, privacy information, clinical governance and retention decisions. Provides standard export capability during service and the retrieval period. Runs and validates exports, maintains appropriate independent contingency records and meets professional retention duties. Investigates service incidents and communicates under the Agreement and DPA. Reports suspected incidents promptly and handles patient/regulator decisions for its role as controller and healthcare provider.

Schedule 2 | Security and operational baseline These controls describe the contractual baseline at the version date. Plinical may replace a control with an equivalent or stronger control and may update technical implementation without reducing overall protection. Control area Baseline commitment Tenant and access controls Separate organisation context; role-based access; individual staff credentials; administrative ability to manage authorised users. Infrastructure Hosted application, managed database and object storage selected for appropriate availability and security; production locations and transfers addressed in the DPA. Transport and storage Encrypted network transport using current industry-standard protocols; storage protections and access controls appropriate to the service and data risk. Monitoring and logging Operational and security logging, audit information and optional error/performance monitoring configured to minimise capture of clinical content. Availability and recovery Managed infrastructure capabilities, protected backup/recovery processes where applicable, and incident procedures proportionate to a business SaaS service. No zero-data-loss warranty. Secure development Controlled code changes, dependency and vulnerability management, secrets handling, review and remediation proportionate to risk. Personnel Need-to-know access, confidentiality obligations and appropriate security/data-protection instruction. Communications Time-limited, access-controlled patient invoice links; regional email dispatch where configured; optional SMS; no intentional clinical content in anti-bot, rate-limit or monitoring payloads. Incident response Investigation, containment, remediation, evidence preservation and customer notification consistent with the Agreement and DPA. Customer-side controls Strong unique passwords; prompt leaver removal; least privilege; secure devices and networks; verified recipients; sensitive-content minimisation; secure exports and downtime procedures. Document control Version 1.1 | 4 September 2026. Legal and security notices: support@mtxstudio.com. End of Terms