Terms of Service

Effective 19 June 2026.

These Terms and Conditions govern access to and use of Cogent Clinic, a Class I medical device under the UK Medical Devices Regulations 2002 (registered with the MHRA) supplied as a software service by Cogent Clinic Ltd.

1. Parties

These Terms are between:

Provider and Manufacturer: Cogent Clinic Ltd, operating the Cogent Clinic service and acting as the legal manufacturer of the Cogent Clinic medical device under UK MDR 2002 Company number: SC887432 Registered address: Mearns Castle Golf Academy, Waterfoot Road, Glasgow, G77 5RR ICO data-controller registration: ZC132394 Privacy contact: privacy@cogent.clinic Vigilance contact: support@cogent.clinic, 0141 471 3632 Website: www.cogent.clinic

and

Customer: the individual clinician, practice, or organisation that purchases or uses the Service.

2. The Service

2.1 Cogent Clinic is a documentation tool for UK HCPC-registered practitioner psychologists. It is classified as a Class I medical device under the UK Medical Devices Regulations 2002 (as amended) ("UK MDR 2002") and is registered with the MHRA. Registration on the MHRA register does not represent MHRA approval or certification. The Service's full intended purpose is published in the in-product Intended Purpose statement at the Trust Centre and in the Instructions for Use in the in-product Help corpus.

2.2 The Service supports the clinician across a small set of connected surfaces within the registered intended purpose: drafting clinical and administrative documentation, managing per-client folders, maintaining a treatment-plan record, preparing for supervision, capturing a live session transcript in the browser, running a folder-scoped reflective-thinking chat, and running a documentation-completeness review on a finished draft.

2.3 The Service is, by intended purpose and architectural design, a documentation tool only. It does not diagnose, screen for, or rule out any condition. It does not recommend, evaluate, or rank treatment options. It does not predict, score, or stratify clinical risk. It does not interpret psychometric, neuropsychological, or other assessment data. It does not map symptoms or observations onto diagnostic criteria. It does not generate clinical reasoning, formulation, or opinion of its own. It does not alert, notify, or escalate. It does not replace clinical judgement at any point.

2.3A For the avoidance of doubt, where the Service computes a headline score, band, or subscale total deterministically from values the clinician has entered, it does so as an arithmetic function only. It does not clinically interpret, weight, or draw inferences from those values, which remains the work of the responsible clinician.

2.4 All outputs are drafts. The Customer remains solely responsible for reviewing, editing, validating, and approving any output before clinical, legal, professional, administrative, or other use. The clinician is the author of record on every output produced through the Service. A draft is not part of the clinical record until the responsible clinician has reviewed, edited, and signed it off.

2.5 The Provider may update, improve, modify, or withdraw features from time to time, provided this does not materially deprive the Customer of the core contracted service without reasonable notice. Material changes affecting the intended purpose, the function list, the limits, or the safety profile of the Service trigger a new conformity assessment under UK MDR 2002 and are communicated to the Customer in advance.

2.6 The following features may be reachable in the same product surface but are not part of the registered Class I medical device and are operated under separate arrangements:

• Neurodevelopmental assessment report drafting (ADHD, autism, and combined types), operated as a separate, gated code path behind an in-product notice that it is not part of the registered Class I medical device
• The general clinical-knowledge chat (a chat that answers general clinical-knowledge questions not tied to a specific client folder), where offered, operated as a separate feature outside the Class I medical device
• Expert witness report drafting (Cogent Witness), supplied as a separate product under medico-legal regulatory arrangements

The Customer's use of any such feature is outside the registered conformity declaration for the Cogent Clinic device.

2.7 The Service bears UKCA marking as a Class I medical device and the Provider maintains a Declaration of Conformity and technical documentation under UK MDR 2002. The current Declaration of Conformity and Intended Purpose statement are available through the Trust Centre.

2.8 The Customer must use the Service in accordance with its labelling, Intended Purpose statement, and Instructions for Use. The Customer must not modify, adapt, or interfere with the Service, or combine it with components or inputs in a manner not described in the Instructions for Use, where doing so could affect the device's conformity, safety, or performance.

2.9 The regulatory classification of the Service, and the conformity assessment route applicable to it, may change as a result of new or amended legislation (including any future amendment to UK MDR 2002). Where such a change affects the classification, intended purpose, or conformity status of the Service, the Provider will undertake any required re-assessment and will notify the Customer in advance in accordance with clauses 2.5 and 15.

2.10 Acknowledgement of limits. The Customer acknowledges and accepts that the Service is a documentation tool within its registered intended purpose only, and that it is not a diagnostic, screening, risk-prediction, triage, or treatment-recommendation tool and is not a substitute for the clinician's professional judgement. The Customer has read and understood the Intended Purpose statement and the Instructions for Use, and accepts the limitations described in clauses 2.3, 2.3A, and 10, before using the Service.

3. Eligibility and permitted users

3.1 The Service is intended exclusively for HCPC-registered practitioner psychologists in the United Kingdom registered under one of the seven protected practitioner-psychologist titles: clinical, counselling, forensic, health, educational, occupational, and sport and exercise psychologists. The audience scope may be broadened in a future version of these Terms to include adjacent regulated professions, where each such broadening is reflected in an updated intended purpose statement and a re-issued Declaration of Conformity where required. Use by individuals who are not appropriately regulated, or who are not within the current eligible audience, is outside the registered intended purpose of the Service. The Customer enters into these Terms in the course of its business or profession and not as a consumer; the Service is not offered to consumers.

3.2 The Customer must ensure that all users of the Service are properly authorised and trained on the intended use of the device, including the requirement to review, edit, and sign off every draft before it becomes part of a clinical record.

3.3 The Customer is responsible for all activity occurring under its accounts.

4. Customer responsibilities

The Customer must:

• use the Service lawfully, professionally, and within the registered intended purpose
• ensure it has an appropriate lawful basis for any personal data processed through its use of the Service
• ensure any special category data is processed under an appropriate Article 9 condition
• review every output before any clinical use, and personally sign off the output as author of record before it is entered into the clinical record
• avoid entering unnecessary identifying information
• follow the product's de-identification and review workflow
• obtain any client consent required by the Customer's own professional, legal, or ethical framework before using the live session-transcription feature
• where the Customer shares with a client any material that was prepared with the assistance of the Service (a draft note, a session summary, a formulation diagram, a printed PDF, or similar), disclose to that client that AI was used in preparing the first draft, in line with the Customer's own professional and ethical transparency obligations to clients
• keep login credentials secure, and enable two-factor authentication where the Customer's account supports it
• ensure no user shares accounts inappropriately
• comply with applicable professional, ethical, confidentiality, and record-keeping obligations
• promptly report to the Provider any event affecting, or that could have affected, the safety of patient care or the confidentiality of patient data while using the Service, in accordance with clause 18 below

The Customer warrants that, before processing any special category data through the Service, it has identified and has in place an appropriate condition for processing under Article 9 of the UK GDPR and, where it relies on explicit consent under Article 9(2)(a), that it has obtained and can demonstrate valid explicit consent from the relevant data subject. The Customer warrants that it has the lawful basis required under Article 6 of the UK GDPR for such processing. These warranties are in addition to, and do not limit, the responsibilities set out above.

The Customer must not:

• use the Service as a substitute for professional judgement
• rely on outputs without human review and personal sign-off
• use the Service outside its registered intended purpose
• use the Service in emergency, crisis, or acute-care contexts
• use the Service for unlawful, harmful, discriminatory, or misleading purposes
• upload malware or interfere with the Service
• attempt to reverse engineer the Service except where such restriction is prohibited by law

5. Data protection and confidentiality

5.1 The parties acknowledge that, in relation to clinician-submitted content, the Customer is generally the controller and the Provider is generally the processor.

5.2 The parties agree that the Data Processing Agreement forms part of these Terms where applicable.

5.3 The Provider's handling of personal data is described in the Privacy Policy, retention schedule, incident response plan, and related compliance documents.

5.4 The Customer remains responsible for determining whether use of the Service is appropriate within its own professional and organisational framework.

5.5 The Customer acknowledges that certain processing, including the live speech-to-text transcription of consented session audio, involves audio being streamed directly from the Customer's browser to the Provider's speech-to-text sub-processor operating at its European Union endpoint (AWS eu-west-1, Dublin). Because that processing takes place within the European Economic Area (EEA), it benefits from the UK's adequacy regulations for the EEA and does not require additional international transfer safeguards. Any other transfers of personal data outside the United Kingdom are carried out under an appropriate transfer mechanism, as described in the Data Processing Agreement.

5.6 References in these Terms to "de-identification" describe the Service's in-browser masking of identifiers. The Customer acknowledges that, because this masking is reversible, it constitutes pseudonymisation rather than anonymisation for the purposes of UK data protection law, and the resulting data remains personal data.

6. Security

6.1 The Provider will maintain appropriate technical and organisational measures to protect the Service and personal data processed within it, consistent with the cybersecurity requirements applicable to a Class I medical device.

6.2 The Customer is responsible for safeguarding its account credentials and is strongly encouraged to enable the security features the Service provides, including two-factor authentication, which the Service makes available on every account.

6.3 The Customer must notify the Provider promptly if it becomes aware of any suspected unauthorised access, credential compromise, or misuse.

7. Fees and payment

7.1 The Customer must pay the fees specified in the relevant order, pricing page, or agreed commercial proposal.

7.2 Unless otherwise stated, fees are payable in advance for the billing cycle stated in the order or pricing page (typically monthly or annually) and are non-refundable except where required by law, where this clause 7 expressly provides otherwise, or where the Customer is entitled to a service credit under the Service Level Agreement.

7.3 The Provider issues a statement of charges by email or through the in-product account area each billing cycle. The statement records the charges applied to the payment method on file and is not a request for further payment.

7.4 If a payment is declined or otherwise not received on time, the Provider may charge interest on overdue amounts at the rate set by the Late Payment of Commercial Debts (Interest) Act 1998 where the Customer is a business, or at the maximum rate otherwise permitted by applicable law.

7.5 The Provider may suspend access for non-payment after giving the Customer at least 7 days' written notice and a reasonable opportunity to pay. During a suspension for non-payment the Provider will retain the Customer's data in accordance with the DPA retention provisions and will restore access promptly on payment of the outstanding amount, unless the agreement has by then been terminated under clause 11.

7.6 The Provider may change pricing for future billing periods. Material changes to fees or to the payment terms will be notified to the primary administrative contact on the Customer's account at least 30 days before the change takes effect, and will not apply to a billing period already paid for. The Customer's continued use of the Service after a notified fee change takes effect constitutes acceptance of the revised fee for subsequent billing periods.

7.7 All fees are exclusive of VAT and of any other tax, duty, or levy that may be due. Where VAT or another tax is applicable, the Provider will add it to the invoice or statement at the rate in force on the date of supply.

7A. Cancellation and refunds

7A.1 How to cancel. A Customer may cancel a subscription at any time:

• through the "Cancel subscription" control in the in-product account area, or
• by email to support@cogent.clinic from the email address on the account, stating the intention to cancel.

The Provider will confirm the cancellation by email and stop further billing at the end of the then-current billing period.

7A.2 Effect of cancellation on access. Unless the parties agree otherwise, the Customer's access to the Service continues until the end of the billing period that the Customer has already paid for. The Service is not suspended on the day of cancellation. This gives the Customer time to export drafts, finalise notes, and download anything they need to keep.

7A.3 Monthly subscriptions. Fees paid for a monthly subscription period are non-refundable. The Customer's monthly subscription will not renew once cancelled.

7A.4 Annual subscriptions. Fees paid for an annual subscription period are non-refundable, save that the Provider may, at its discretion, refund the unused portion of an annual subscription where:

• the cancellation is for the Provider's material breach of these Terms,
• the cancellation follows the Customer's objection to a new sub-processor under clause 9.3 of the DPA,
• the cancellation follows a continuing force majeure event under clause 13A.3,
• the cancellation follows a material adverse change to the Terms or the Service that the Provider has notified under clause 15, where the Customer objects within the notice period,
• a service credit under the Service Level Agreement falls due where the cancellation has already taken effect, or
• the Provider is otherwise required to refund by law (including statutory cancellation rights, where they apply).

Where a refund is due under this clause 7A.4, the Provider will calculate it on a pro-rata basis from the date of cancellation to the end of the then-current annual period and will pay it within 30 days of acknowledging the refund request.

7A.5 Business and professional customers only; no consumer rights. The Service is offered only to customers acting in the course of a business or profession (an individual practitioner psychologist's practice, a clinic, or an organisation). By subscribing, the Customer confirms that it is not a "consumer" within the meaning of the Consumer Rights Act 2015. The statutory consumer cancellation rights under the Consumer Contracts (Information, Cancellation and Additional Charges) Regulations 2013 do not apply to this contract. Nothing in these Terms purports to exclude any statutory right that does apply by law notwithstanding this clause.

7A.6 What happens to data on cancellation. Termination of the subscription does not by itself delete the Customer's data. The Customer's existing data is handled under the Data Processing Agreement and the Retention Schedule, including the Customer's choice of return or deletion within 30 days of the end of the provision of services under clause 7.7 of the DPA. The Customer should export anything they wish to keep before requesting deletion.

7A.7 No reactivation guarantee after deletion. If the Customer requests permanent deletion under the DPA, that action is final. The Provider cannot reinstate deleted folders, drafts, formulations, or session-transcript ciphertext after the deletion has taken effect.

7A.8 Refunds method. Refunds are paid by the original payment method. Where that is no longer available, the parties will agree an alternative method (typically bank transfer to the Customer's nominated account).

8. Intellectual property

8.1 The Provider and its licensors retain all intellectual property rights in the Service, excluding Customer data.

8.2 The Customer retains rights in its own input data and in its own reviewed and adopted outputs, subject to any third-party rights and the limitations of applicable law.

8.3 The Customer grants the Provider a limited right to process Customer data only as necessary to provide the Service, comply with law, maintain security, and enforce these Terms.

8.4 Where the Customer voluntarily provides the Provider with feedback, suggestions, feature requests, or bug reports about the Service ("Feedback"), the Customer grants the Provider a perpetual, irrevocable, worldwide, royalty-free, sub-licensable licence to use, modify, and incorporate that Feedback into the Service and into the Provider's other products. The Provider may act on Feedback without obligation to the Customer and without compensation. This clause does not give the Provider any right to use Customer clinical content, draft bodies, formulation text, chat messages, transcripts, or other operational data for development, training, or product-improvement purposes; those data are governed by the DPA and the Privacy Policy and are not Feedback.

8.5 Any improvement, modification, derivative work, or new functionality the Provider develops in connection with the operation of the Service (including improvements that draw on aggregated, fully de-identified usage metrics, but excluding any use of Customer clinical content) remains the Provider's intellectual property.

8.6 Subject to these Terms and to payment of the applicable fees, the Provider grants the Customer a limited, non-exclusive, non-transferable, non-sub-licensable, revocable licence to access and use the Service for the Customer's internal business purposes within the registered intended purpose during the subscription term. The Customer obtains no rights in the Service other than this licence.

8.7 All rights not expressly granted to the Customer are reserved to the Provider and its licensors. Nothing in these Terms transfers to the Customer any ownership of, or any intellectual property right in, the Service or any part of it, and no licence is granted by implication, estoppel, or otherwise.

8.8 "Cogent Clinic", the Provider's logos, and the Provider's other names and marks are the property of the Provider. These Terms do not grant the Customer any right to use them except as expressly permitted in writing by the Provider.

8.9 For the avoidance of doubt, the Customer's rights in its reviewed and adopted outputs under clause 8.2 do not extend to, and the Customer acquires no rights in, the underlying models, prompts, model configuration, identifier-detection rules, formulation structures, templates, or other components of the Service that are not Customer data.

8.10 The Provider may create and use aggregated data that has been de-identified so that it no longer identifies the Customer, any user, or any data subject, for the purposes of operating, securing, analysing, and improving the Service and the Provider's other products. All such aggregated data, and all intellectual property rights in it, belong to the Provider. This clause is subject to, and does not override, the Data Processing Agreement or the Privacy Policy.

8.11 The Provider will defend the Customer against any third-party claim that the Customer's authorised use of the Service infringes that third party's intellectual property rights, and will indemnify the Customer against damages finally awarded in respect of such claim, subject to the liability cap in clause 13.3. This obligation does not apply to any claim arising from: (a) Customer data or other content provided by the Customer; (b) use of the Service outside the registered intended purpose or otherwise in breach of these Terms; (c) modification of the Service by anyone other than the Provider; or (d) combination of the Service with items not supplied or authorised by the Provider. This clause states the Customer's sole remedy for intellectual property infringement by the Service.

9. Availability and support

9.1 The Provider will use reasonable care and skill in providing the Service but does not guarantee uninterrupted or error-free availability.

9.2 Planned maintenance, security actions, supplier failures, and events outside the Provider's reasonable control may affect availability.

9.3 Support is provided through the channels and hours communicated by the Provider.

9.4 The Provider operates a post-market surveillance programme for the device. Material safety events, field safety corrective actions, and field safety notices are communicated to active Customers through the channels described in the in-product Instructions for Use.

9.5 The Provider's commitments on availability, planned-maintenance windows, support response targets, breach-notification timing, and service credits are set out in the Service Level Agreement published on the Trust Centre. The Service Level Agreement forms part of these Terms.

10. Acceptable use and restrictions

This clause is the Acceptable Use Policy that applies to the Service. It works alongside the responsibilities at clause 4 and the registered intended purpose of the device. A longer, clinical-judgment-oriented companion document, "Acceptable Use", is published on the Trust Centre and forms part of these Terms by reference.

10.1 Within-scope use. The Service is supplied for documentation work within the registered intended purpose described at clauses 2.1 to 2.3. Within that scope, the Customer is expected to draft, transform, edit, organise, and review clinical and administrative content; to manage a per-client folder and treatment plan; to use the live-transcription feature with appropriate consent; and to use the reflective-thinking chat to think through cases out loud.

10.2 Out-of-scope use. The Customer must not use the Service:

• as a substitute for professional clinical judgement;
• to make, screen for, rule out, score, stratify, or rank a diagnosis or clinical risk;
• to recommend, evaluate, or rank treatment options;
• to interpret psychometric, neuropsychological, or other assessment data clinically;
• in an emergency, crisis, or acute-care context;
• outside the eligible audience described at clause 3;
• without reviewing and personally signing off every output before it enters a clinical record.

10.3 Prohibited conduct. The Customer must not:

• use the Service in a way that infringes another person's rights;
• use the Service to generate knowingly false, misleading, or fraudulent records;
• use the Service for spam, harassment, or unlawful surveillance;
• input the personal data of an individual the Customer has no professional relationship with, except to the minimum extent necessary to draft a document about a client;
• interfere with the integrity or performance of the Service, including by uploading malware, scraping, automated abuse, or attempting to bypass rate limits or daily caps;
• attempt to extract, copy, or republish the Provider's prompts, model configuration, identifier-detection rules, or other components of the Service that are not Customer data;
• use any output of the Service to develop, train, fine-tune, benchmark, evaluate, or improve a competing artificial-intelligence model or product;
• attempt to manipulate, coerce, or otherwise drive the Service into producing a clinical diagnosis, a differential-diagnosis list, a treatment recommendation, a risk score, a triage decision, or any other clinical reasoning that the Service is by design not built to produce, including by prompt-injection, role-play framing, or instruction overrides;
• test the Service for vulnerabilities without written permission from the Provider's responsible disclosure address (security@cogent.clinic);
• share user accounts or credentials, or transfer access to a person not on the Customer's account.

10.4 Provider response. The Provider may suspend or terminate access where reasonably necessary to protect the Service, comply with law, investigate misuse, or where continued use would pose a clinical-safety risk inconsistent with the Service's intended purpose. The Provider will give notice and a reasonable opportunity to remedy where it is safe to do so; where it is not safe (for example a confirmed credential compromise), the Provider may act immediately and notify after the fact.

10.5 Monitoring. The Provider may, but is not obliged to, monitor and log use of the Service to the extent reasonably necessary to detect, investigate, and prevent breaches of this clause 10, including attempts to drive the Service outside its intended purpose by prompt-injection or similar means, to protect the security and integrity of the Service, and to comply with law. Any such monitoring is carried out in accordance with the Data Processing Agreement and the Privacy Policy.

11. Suspension and termination

11.1 Either party may terminate in accordance with the agreed commercial arrangement or any minimum subscription term.

11.2 The Provider may suspend or terminate access immediately where:

• the Customer materially breaches these Terms
• non-payment persists after notice
• use of the Service creates a security, legal, operational, or clinical-safety risk
• continued provision would likely breach law or third-party obligations
• the Customer is demonstrably using the Service outside its registered intended purpose in a way that creates a clinical-safety concern

11.3 On termination, the Provider will handle Customer data in accordance with the DPA, Privacy Policy, and retention schedule.

12. Warranties and limitations

12.1 The Provider warrants that it will provide the Service with reasonable care and skill, and that the Service is supplied as a Class I medical device in conformity with UK MDR 2002 within the registered intended purpose.

12.2 Except as expressly stated, the Service is provided on an "as available" basis.

12.3 The Service is supplied as a documentation tool within the meaning of its registered intended purpose. The Provider does not warrant that:

• outputs will always be accurate, complete, or fit for a particular purpose other than as a draft for the Customer's review and sign-off
• the Service will meet every Customer requirement
• the Service is suitable for use outside its registered intended purpose, including (without limitation) use as a diagnostic tool, a treatment recommendation tool, a risk-prediction tool, or a substitute for the clinician's professional judgement

12.4 The Customer acknowledges the inherent limitations of AI-generated text and the requirement, under the Service's intended use, to personally review and sign off every draft before it is entered into a clinical record or otherwise relied upon.

13. Liability

13.1 Nothing in these Terms excludes or limits liability for death or personal injury caused by negligence, fraud, fraudulent misrepresentation, or any liability that cannot lawfully be excluded, including any liability that cannot be excluded under the Consumer Protection Act 1987 in relation to defective products.

13.2 Subject to clause 13.1, the Provider will not be liable for:

• indirect or consequential loss
• loss of profit, revenue, goodwill, or anticipated savings
• loss arising from the Customer's failure to review and sign off outputs as required under clause 4
• loss arising from Customer use of the Service outside its registered intended purpose
• loss arising from Customer misuse or unlawful use of the Service
• loss caused by third-party systems outside the Provider's reasonable control

13.3 Subject to clause 13.1, the Provider's aggregate liability arising out of or in connection with the Service shall be capped at the greater of (a) the fees paid by the Customer in the 12 months preceding the event giving rise to the claim and (b) £10,000, unless a different cap is agreed in writing.

13.4 Customer indemnity. The Customer shall indemnify the Provider against all losses, liabilities, claims, damages, costs, and expenses (including reasonable legal costs) arising out of or in connection with: (a) the Customer's use of the Service outside its registered intended purpose; (b) the Customer's breach of clause 4 or clause 10 (including any prohibited conduct or out-of-scope use); (c) any third-party or patient claim arising from the Customer's failure to review, edit, and sign off an output as required under these Terms; or (d) the Customer's breach of its professional, legal, ethical, or data-protection obligations in connection with the Service. This clause is subject to clause 13.1.

13A. Force majeure

13A.1 Neither party is liable for any delay in performing, or any failure to perform, any obligation under these Terms (other than an obligation to pay money) that is caused by an event beyond that party's reasonable control. Such events include, without limitation:

• act of government, regulator, or other public authority, including new or amended legislation,
• act of war, terrorism, civil unrest, or sanctions,
• failure of a public telecommunications network or of public utility supply,
• failure of, or significant outage in, a third-party infrastructure provider on which the Service materially depends, including but not limited to AWS regions and availability zones, content delivery networks, DNS resolvers, certificate authorities, payment networks, transactional email providers, and large-language-model inference providers,
• significant cyber-attack on the Provider's or a sub-processor's infrastructure where the affected party has taken reasonable preventive measures consistent with its security commitments,
• fire, flood, severe weather, earthquake, or other natural event,
• pandemic, epidemic, or public-health emergency declared by a competent authority,
• labour dispute affecting the affected party or a sub-processor, other than one confined to its own workforce.

13A.2 The party affected by a force majeure event will notify the other party as soon as reasonably practicable, describe the nature and likely duration of the event, and take reasonable steps to mitigate its effects and to restore performance.

13A.3 If a force majeure event prevents the Provider from substantially providing the Service for a continuous period of 30 days or more, either party may terminate the affected Service on written notice, and the Provider will refund any fees paid in advance for the unused portion of the then-current billing period. The DPA, the confidentiality obligations, and the Customer's right to the return or deletion of personal data continue to apply on termination.

13A.4 Force majeure does not relieve the Provider of its obligations under UK MDR 2002 in respect of safety-critical events, including the obligation to investigate and where applicable report to the MHRA under clause 18 of these Terms.

14. Confidentiality

14.1 Each party shall keep the other party's confidential information confidential and use it only as necessary to perform or receive the Service.

14.2 This does not apply to information that is already public, lawfully received from another source, independently developed, or required to be disclosed by law.

15. Changes to the Service or Terms

15.1 The Provider may update these Terms from time to time.

15.2 Material adverse changes will be notified with reasonable notice before they take effect, unless immediate changes are required for legal, regulatory, or security reasons. Changes affecting the intended purpose or the safety profile of the device will be communicated in advance, in accordance with the post-market surveillance and vigilance procedures referenced in clause 18.

16. Governing law and jurisdiction

These Terms are governed by the law of Scotland. The courts of Scotland have exclusive jurisdiction, unless mandatory law requires otherwise.

17. Order of precedence

If there is a conflict between these Terms and the Data Processing Agreement on data protection matters, the Data Processing Agreement prevails for those matters.

18. Manufacturer identification, vigilance, and reporting

18.1 The Provider is the legal manufacturer of the Cogent Clinic medical device under UK MDR 2002. Manufacturer identification, including registered office, Companies House number, and the regulatory and vigilance contact, is set out in clause 1.

18.2 The Customer must report to the Provider, without undue delay, any event involving the Service that has caused, or could have caused, the safety of patient care or the confidentiality of patient data to be affected. Reports may be made by email to support@cogent.clinic or by telephone to 0141 471 3632, or through the in-product "Report a problem with this device" link.

18.3 The Provider will acknowledge the report, triage it, investigate, and where the event meets the relevant MHRA thresholds, report it to the MHRA in accordance with the manufacturer's vigilance obligations under UK MDR 2002. The Provider's incident response plan and post-market surveillance approach are summarised on the Trust Centre.

18.4 The Customer is independently entitled to report any adverse incident involving any medical device, including the Service, directly to the MHRA through the Yellow Card scheme at https://yellowcard.mhra.gov.uk/. Direct reporting to MHRA does not replace, but supplements, reporting to the Provider.

18.5 Field Safety Notices issued by the Provider in connection with the Service will be sent to active Customer accounts by email and displayed as a persistent in-app notice until acknowledged. The Customer must read and act on any Field Safety Notice received.

19. General

19.1 Entire agreement. These Terms, together with the documents they incorporate (including the Data Processing Agreement, Service Level Agreement, and Acceptable Use), constitute the entire agreement between the parties and supersede all prior representations, understandings, and agreements relating to their subject matter. The Customer acknowledges that it has not relied on any statement or representation not expressly set out in these Terms. Nothing in this clause limits liability for fraud or fraudulent misrepresentation.

19.2 Third-party rights. Except as expressly stated, a person who is not a party to these Terms has no right under the Contract (Third Party Rights) (Scotland) Act 2017 to enforce any of its terms.

19.3 Assignment. The Customer may not assign, transfer, or sub-contract any of its rights or obligations without the Provider's prior written consent. The Provider may assign or transfer these Terms, and may sub-contract performance, including in connection with a reorganisation, merger or sale of its business, provided the Customer's rights are not materially prejudiced.

19.4 Notices. Formal notices under these Terms must be in writing and sent to the Provider at the contact details in clause 1, and to the Customer at the primary administrative contact and email address on the Customer's account. Notice is deemed received on the next business day after sending by email, or two business days after posting by pre-paid first-class post.

19.5 Severability and waiver. If any provision of these Terms is held to be invalid or unenforceable, the remaining provisions continue in full force, and the parties will replace the affected provision with a valid one that most closely reflects its intent. No failure or delay by a party in exercising any right is a waiver of that right, and no single or partial exercise prevents any further exercise.

19.6 Survival. The provisions of these Terms that by their nature should survive termination, including clauses 5 (data protection), 8 (intellectual property), 13 (liability), 14 (confidentiality), 18 (vigilance and reporting), 16 (governing law), and this clause 19, continue in effect after termination or expiry.