About these Terms

These Terms and Conditions (the "Terms") govern the provision of the Mole Clinic "Skin Clinic Day" service by Managed Self Ltd trading as Klarity ("Klarity"), a company incorporated and registered in England with company number 10696687, whose registered office is at Alum House, 5 Alum Chine Road, Westbourne, Bournemouth, BH4 8DT, United Kingdom.

Klarity will accept direction only from the Client contact named at booking, or such other Client personnel as the Client designates in writing.

1. The Service – the Skin Clinic Day

Klarity provides the Client with the number of Skin Clinic Days specified at booking. Each Skin Clinic Day comprises one senior skin cancer nurse specialist attending the Client's premises for one full day and delivering up to 13 individual 25-minute skin-check appointments to the Client's employees.

Each appointment includes:

• Full-body skin check by a senior skin cancer nurse specialist;
• Dermoscopy (magnified skin-surface examination) of any mole of concern;
• Digital dermoscopy images captured and reviewed, included in the Charges and not charged per image;
• Specialist tele-dermatology review of flagged lesions;
• A personal results summary and a documented referral pathway (NHS or private), where clinically appropriate; and
• Sun-safety and self-check education.

The Skin Clinic Day is a screening assessment, not a diagnosis. Nothing is removed or biopsied on the day; any mole of concern results in a referral, not treatment.

Individual clinical findings are confidential between Klarity and the employee and will not be shared with the Client. The Client will receive only an anonymised, aggregated summary report following each clinic day (for example, attendance levels), containing no individual clinical data (together, the "services").

2. Charges and payment

For each Booking, Klarity will apply the following charges:

• £1,750 per Skin Clinic Day (flat fee, up to 13 appointments per day). Skin cancer screening is exempt from VAT, so no VAT will be added to this Charge. Volume pricing for multi-day bookings is available on request.
• Payment is due, at the Client's option, either (i) in full at the time of booking, or (ii) by invoice payable within 30 days of the invoice date. In all cases, payment must be received in full before the first Skin Clinic Day takes place.
• The flat fee applies in full regardless of the number of appointment slots taken up by employees.

Schedule 1 – Appointments, Booking and Cancellation Policy

1. The Client books one or more Skin Clinic Days via Klarity's online booking tool, selecting the number of clinic days required and the dates on which they will take place. Clinic days must be booked at least six weeks in advance and take place on weekdays only.
2. Following booking, Klarity will send the Client a confirmation email together with an employee self-booking link and ready-to-send communications templates for distribution to eligible employees.
3. Eligible employees self-book a 25-minute appointment on a first-come, first-served basis, up to a maximum of 13 appointments per clinic day, per nurse.
4. Automated reminder emails are sent to booked employees seven days and one day before the clinic day. Klarity reserves the right to contact eligible employees with appointment confirmations and reminders.
5. The Client shall provide a private room with adequate lighting and Wi-Fi for the duration of each clinic day, ensure a named point of contact is available on the day for logistics, and distribute the self-booking link to eligible employees.
6. The Client may reschedule a clinic day free of charge and without penalty by giving Klarity at least 14 days' notice before the scheduled clinic day.
7. If the Client cancels a clinic day less than 14 days before the scheduled date, no refund will be payable. The Charge for the cancelled day will instead be held as a credit against a replacement clinic day taking place within six months of the cancelled date, after which the credit will lapse.
8. The Charge for each clinic day is a flat fee and is payable in full regardless of the number of appointment slots taken up by employees. Unfilled slots are not refundable and cannot be carried forward.
9. An employee may reschedule their appointment without penalty or fees, provided they notify Klarity (or rebook via the self-booking link) at least 24 hours before the scheduled appointment.
10. If an appointment is cancelled more than three times by an eligible employee, Klarity reserves the right to refuse additional bookings for that employee.
11. Klarity will refund the Client in full if a booked clinic day cannot be delivered by Klarity and an alternative arrangement is not agreed.

Terms of Business ("ToB")

1. Definitions and interpretations

1.1 In this Agreement, unless the context otherwise requires, the following definitions will apply:

Best Industry Practice

means the exercise of that degree of care, skill, diligence and prudence which would reasonably be expected from a skilled and experienced person engaged in the provision of equivalent and comparable services to the Services provided by Klarity under this Agreement.

Booking

means each booking of one or more Skin Clinic Days made by the Client via Klarity's online booking tool and confirmed by Klarity, which incorporates this ToB and Schedule 1 (Appointments, Booking and Cancellation Policy) (together, the "Agreement") and describes the Services to be provided by Klarity from time to time as agreed in accordance with Clause 3 of this Agreement. References in this Agreement to an "Order Form" are references to a Booking.

Brand Features

means the trade names, trademarks, logos and other distinctive brand features of the applicable party.

Charges

mean the charges for the Services set out in the Booking and in the "Charges and payment" section of these Terms.

Client

means the organisation accepting these Terms and making a Booking, as identified in the Booking.

Commencement Date

means the date on which Klarity confirms the Client's Booking.

Confidential Information

means information disclosed by (or on behalf of) one party to the other party in connection with or in anticipation of this Agreement or any Booking (including the content of this Agreement and all Bookings) that is marked as confidential or, from its nature, content or the circumstances in which it is disclosed, might reasonably be supposed to be confidential. It does not include information that the recipient already knew, that becomes public through no fault of the recipient, that was independently developed by the recipient, or that was lawfully given to the recipient by a third party.

Content

means any information, text, graphics, or other materials uploaded, downloaded or appearing as part of the Services.

Data Controller

means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data, as defined in Article 4(7) of the General Data Protection Regulation (EU) 2016/679.

Data Processor

means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the data controller, as defined in Article 4(8) of the General Data Protection Regulation (EU) 2016/679.

Denial of Service ("DoS")

means an attack on computer systems, networks, devices, services or other IT resources, causing disruption to the targeted resource and preventing legitimate users from partial or full access to that resource.

Developments

mean the improvements and further developments of Klarity's product.

External Data Providers

means any third party: institution, organisation, corporate entity or government agency responsible for the provision of data or information in relation to the Services.

Feedback

means any feedback or suggestions provided by the Client under this Agreement in relation to the Services.

Health Data

means health information collected directly from Users by Klarity as an Independent Data Controller.

Independent Data Controller

means a data controller that autonomously determines the purposes and means of processing personal data without instruction from, or joint control with, any other data controller, and bears sole responsibility for compliance with applicable data protection laws in respect of such processing.

Intellectual Property Rights

means all patents, rights to inventions, utility models, copyright and related rights, trademarks, service marks, trade, business and domain names, rights in trade dress or get-up, rights in goodwill or to sue for passing off, unfair competition rights, rights in designs, rights in computer software, database rights, topography rights, moral rights, rights in Confidential Information (including Know-How and trade secrets) and any other intellectual property rights, in each case whether registered or unregistered and including all applications for and renewals or extensions of such rights, and all similar or equivalent rights or forms of protection in any part of the world.

Know-How

means unpatented technical information (including information relating to inventions, discoveries, concepts, methodologies, models, research, development, and testing procedures; the results of experiments, tests, and trials; processes, techniques, and specifications; quality control data, analyses, reports, and submissions) that is not in the public domain.

Notice

has the meaning attributed to it in Clause 11.7.

Permitted Purpose

means legitimate, professional, informational, internal business operations purposes and not in any event for the reselling or otherwise making the Services available to any third parties.

Privacy Laws

means applicable data protection laws including but not limited to the General Data Protection Regulation (EU) 2016/679, the Data Protection Act 2018, and any successor legislation.

Registration Data

means information relating to Users for account creation purposes only, including name, email, phone, sex, birthdate, and country of residence.

Regulatory Body

means any government department and regulatory, statutory and other entity, committee and body which, whether under statute, rules, regulations, codes of practice or otherwise, is entitled by any applicable laws to supervise, regulate, investigate or influence the matters dealt with in this Agreement including in relation to the security of data, Personal Data and privacy or any other affairs of the parties to this Agreement including, but not limited to, the Financial Conduct Authority, the Prudential Regulation Authority, the Information Commissioner and any successor authority to those bodies.

Security Breach

means any breach of security involving facilities, networks or systems and any unauthorised access, disclosure, alteration, or destruction of personal data.

Services

means the services and/or products offered by Klarity from time to time under this Agreement and as more particularly detailed in the applicable Booking.

Software

means any software provided by Klarity and any Maintenance Release which is being made available to the Client as part of the Services.

Site

means klarity.health, and its subdomains.

User

means any individual who is using the Klarity app (iOS, Android or Web apps).

VAT

means value added tax chargeable under English law for the time being and any similar additional tax.

2. Commencement and duration

2.1 This Agreement will commence on the Commencement Date and will continue until completion of the final Skin Clinic Day booked under the applicable Booking and delivery of the associated summary report (the "Term"), unless terminated sooner in accordance with this Agreement.

3. Bookings and change

3.1 The Client will be permitted to enter into additional Bookings, in which case, subject to clause 8.4, each Booking will form a separate agreement between the Client and Klarity on the terms contained in this ToB and Schedule 1.

3.2 Where: (i) any External Data Provider increases an existing charge and/or changes the basis on which it provides information, or confirmation of qualifications or membership; and (ii) the cost of Klarity providing its service under this Agreement increases as a direct result (each a "Cost Increase"), Klarity may increase the agreed Charges set out in the Booking by the Cost Increase provided that Klarity will use reasonable endeavours to notify the Client of the Cost Increase before implementing the Cost Increase. Notwithstanding the foregoing, the Client is responsible for all Cost Increases provided that these are properly incurred by Klarity. If the Client does not wish to incur the cost increase that may arise under this provision, it will be permitted to terminate the Agreement in accordance with Clause 7.1(e).

4. Parties' obligations

4.1 Klarity will, during the Term:

1. Ensure it has the ability and capacity to provide the Services in accordance with Best Industry Practice;
2. Provide and allocate sufficient resources to provide the Services in accordance with the terms of this Agreement;
3. Ensure that its personnel involved in providing the Services are suitably qualified, skilled, and capable of providing the Services in respect of which they are engaged, and are adequately supervised to manage any risks arising from the performance of such Services;
4. Maintain a level of insurance as is reasonable, prudent and in accordance with Best Industry Practice and will provide certificates of such insurance to the Client upon request. Klarity shall maintain at all times during the term of this Agreement the following minimum insurance coverage amounts:
   • Employer's Liability cover of at least £10,000,000;
   • Public and Product Liability cover of at least £5,000,000; and
   • Professional Liability cover of at least £500,000.
   These amounts may be satisfied through any combination of primary coverage and umbrella/excess coverage.

4.2 The parties will provide each other with: (a) all necessary co-operation in relation to this Agreement and the Booking; and (b) access to such information as may be required to render and receive the Services, as set out in this Agreement.

4.3 Unless agreed otherwise in a Booking, the Client: (a) may use the Services for the Permitted Purpose only; (b) agrees that the Services, the Site/apps and Content may not be sold, transferred, sublicensed, commercially exploited or otherwise made available to, or used for the benefit of, any third party other than the Client; and (c) will not make the Services available or otherwise use the Services in any jurisdiction such that Klarity's provision of the Services would require Klarity to physically store data (of any kind) in that jurisdiction, without first obtaining Klarity's prior written consent.

4.4 The Client will comply with all applicable laws and regulations (including any obligation to seek prior regulatory review, approval, or similar) concerning its use of the Services and will not: (a) use the Services to discriminate against the User or in a manner that causes damage or injury to any person or property; (b) use the Services in a manner that could be reasonably expected to bring Klarity into disrepute or otherwise harm its reputation; (c) act or omit to act in a way which interferes with or compromises the integrity or security of the Services; (d) except as may be allowed by any applicable law which is incapable of exclusion by agreement between the parties: (e) attempt to copy, modify, duplicate, create derivative works from, frame, mirror, republish, download, display, transmit, or distribute all or any portion of the Services (as applicable) in any form or media or by any means to any individual or entity, including without limitation, Users; or (ii) attempt to reverse compile, disassemble, reverse engineer or otherwise reduce to human-perceivable form all or any part of the Services; or (f) attempt to access the Services other than through the means made available to the Client by Klarity. Any breach of this clause will be deemed to be a material breach.

4.5 The Client is responsible for maintaining the confidentiality of any password(s) or security routines it is given or set to access and use the Services, and is fully responsible for all activities that occur under the Client's password(s) or security routines. The Client agrees to notify Klarity immediately of any accidental or unauthorised access to or use of the Services, whether suspected or confirmed. In the event of a suspected or confirmed security incident impacting the Client's use of the Services or other exigent circumstances, Klarity reserves the right to immediately withdraw or suspend access to the Site or the Services and to alter the Client's password(s).

4.6 No conditions, warranties or other terms apply to any Services (including any Software) supplied by Klarity under this Agreement other than the conditions, warranties and terms expressly set forth herein. Klarity warrants that it will provide the Services with reasonable skill and care, maintain appropriate clinical governance and oversight, use AI models validated by expert NHS clinical and data science advisors, conduct testing through accredited laboratories meeting local standards, and maintain industry-standard certifications and regulatory compliance.

4.7 Both parties acknowledge that the Services provide risk assessments only and not medical diagnosis or advice, that employees must consult healthcare professionals for medical decisions, that AI predictions are informational and may be inaccurate, and that all screening tests may produce false results.

4.8 The Client will indemnify, defend, and hold harmless Klarity and its respective officers, shareholders, directors, and personnel, (and keep such individuals indemnified on a full indemnity basis), from and against any third party claims, suits, hearings, actions, damages, liabilities, fines, penalties, costs, losses, judgments or expenses (including reasonable attorneys' fees) arising out of or relating to the Client's use of the Services (collectively, "Claims"), provided and to the extent that such Claims are not due to any breach of this Agreement by Klarity.

4.9 Klarity will indemnify, defend, and hold harmless the Client and its respective officers, shareholders, directors, and personnel, (and keep such individuals indemnified on a full indemnity basis), from and against any third party claims, suits, hearings, actions, damages, liabilities, fines, penalties, costs, losses, judgments or expenses (including reasonable attorneys' fees) arising out of or relating to Klarity's provision of the Services (collectively, "Claims"), provided and to the extent that such Claims are not due to any breach of this Agreement by the Client.

5. Charges and payment

5.1 In consideration of the provision of the Services, the Client will pay the charges set out in the applicable Booking in the manner set out in this Agreement and/or the applicable Booking.

5.2 All charges quoted to the Client will be exclusive of VAT, which (where applicable) Klarity will add to its invoices at the appropriate rate. The Skin Clinic Day is a supply of medical care that is exempt from VAT, and no VAT will accordingly be added to the Charges for it. All payments due to Klarity will be in pounds sterling or such other currency as set out in the Booking.

5.3 Where the Client elects to pay by invoice, the Client will pay each invoice submitted to it by Klarity in full within 30 days of the date of the invoice, and in any event before the first Skin Clinic Day takes place, by wire or electronic bank transfer to Klarity's designated bank account (cheques not accepted). Time for payment will be of the essence. The Client may not withhold payment of any invoice or other amount due to Klarity because of any right of set-off or counterclaim which the Client may have, or allege to have, or for any reason whatsoever.

5.4 Klarity reserves the right, once per contract year, on the anniversary of the Commencement Date, to apply the annual rate of inflation (as published by the Office for National Statistics in the Retail Price Index or such other nationally recognised index as Klarity may reasonably designate) to the then-current Charges. Any such increased Charges shall be the new Charges, which may be subject to an increase in the next contract year.

6. Permitted use and proprietary rights

6.1 As between Klarity and the Client, all Intellectual Property Rights and all other rights in the Services (including the Site, the Software, the Content and the Reports) and any Feedback and/or Beta Features will be owned by Klarity. Klarity licenses all such rights to the Client free of charge during the Term on a non-exclusive, non-transferable, royalty-free worldwide basis to such extent as is necessary to enable the Client to make use of the Services in accordance with this Agreement and the Booking. The Client will leave in place (and not alter or obscure) all proprietary notices and licences contained in the Services. All rights in and to Intellectual Property Rights owned or controlled by Klarity not expressly granted herein are reserved.

7. Termination and exit

7.1 Without prejudice to any other rights or remedies which the parties may have, either party may suspend, terminate or partially terminate this Agreement and the applicable Booking without liability to the other party immediately on giving Notice to the other party if: (a) the other party fails to pay any amount due under this Agreement or the Booking on the due date for payment and remains in default not less than 30 days after being notified in writing to make such payment; or (b) (i) the other party is in material breach of this Agreement and/or the Booking where the breach is incapable of remedy; or (ii) the other party is in material breach of this Agreement and/or the Booking where the breach is capable of remedy and fails to remedy that breach within fourteen (14) days after receiving written Notice of such breach; or (c) it enters into an arrangement or composition with or for the benefit of its creditors, goes into administration, receivership or administrative receivership, is declared bankrupt or insolvent or is dissolved or otherwise ceases to carry on any Services; or (d) any analogous event happens to the other party in any jurisdiction in which it is incorporated or resident or in which it carries on business or has assets; (e) the circumstances in Clause 3.2 apply; (f) required pursuant to a change in applicable law. If Klarity terminates the Agreement and the Booking under this clause 7.1, then all sums outstanding will become payable immediately.

7.2 On termination of this Agreement and the applicable Booking: (a) the accrued rights and liabilities of the parties as at termination and the continuation of any provision expressly stated to survive or implicitly surviving termination, will not be affected; (b) to the extent relevant, Klarity will provide reasonable termination assistance to the Client, including completing all checks submitted before termination in accordance with the terms of this Agreement; (c) unless otherwise requested, Klarity will retain the Client's Registration Data within the Klarity Dashboard for at least 30 days to enable the orderly download of such Registration Data by the Client. Employees retain the right to request deletion of their Health Data at any time, independent of the Client's contract status. For Registration Data, deletion requests must be coordinated with the Client as Data Controller.

7.3 On termination of this Agreement and the applicable Booking, the accrued rights and liabilities of the parties as at termination and the continuation of any provision expressly stated to survive or implicitly surviving termination will not be affected.

8. Limitation of liability

8.1 Subject to the provisions of Clause 8.2, this Clause 8 sets out the entire financial liability of either party (including any liability for the acts or omissions of either party's employees, agents and sub-contractors) in respect of: (a) any breach of this Agreement or any Booking; and (b) any use made by the Client of the Services (including the Reports, the Content and the Site) or any part of them; and (c) any representation, statement or tortious act or omission (including negligence) or breach of statutory duty arising under or in connection with the Agreement and any Booking.

8.2 Nothing in this Agreement or any Booking limits or excludes either party's liability: (a) for death or personal injury; or (b) for fraud or fraudulent misrepresentation; or (c) for wilful misconduct; (d) payment of sums properly due and owing to the other in the course of normal performance of this Agreement and all Bookings.

8.3 Subject to Clauses 8.1 and 8.2, neither party will be liable under or in connection with this Agreement or any Booking (whether in contract, tort or otherwise) for any: (a) loss of profit; (b) loss of anticipated savings; (c) loss of business opportunity; (d) loss of or corruption of data; (e) loss of reputation or goodwill; or (f) special, indirect or consequential losses.

8.4 Liability limitations do not apply to claims arising from health screening advice, recommendations, or AI risk assessments provided to employees; suffered or incurred by the other party (whether or not such losses were within the contemplation of the parties at the date of this Agreement and/or the applicable Booking). Klarity will not be liable for loss suffered by the Client to the extent Klarity cannot independently substantiate a claim because the Client has instructed Klarity to delete the underlying Registration Data.

8.5 Either party's total aggregate liability in contract, tort (including negligence or breach of statutory duty), misrepresentation, restitution or otherwise arising in connection with the performance or contemplated performance of this Agreement and all applicable Bookings will be limited to the total amount paid and payable by the Client under the applicable Booking for the 12 months immediately preceding the event giving rise to the claim.

8.6 Subject to clause 8.2, the Client assumes sole responsibility for conclusions drawn from the use of the Services (including the Reports, the Content and the Site).

9. Confidentiality

9.1 The recipient of any Confidential Information will not disclose that Confidential Information, except to (i) employees, affiliates and/or professional advisors who need to know it and who have agreed in writing (or in the case of professional advisors are otherwise bound) to keep such information confidential and (ii) third party service providers where and only to the extent required to fulfil the purpose of the Agreement. The recipient will ensure that those people and entities: (a) use such Confidential Information only to exercise rights and fulfil obligations under this Agreement and the applicable Booking; and (b) keep such Confidential Information confidential. The recipient may also disclose Confidential Information when required by law after giving reasonable notice to the discloser, such notice to be sufficient to allow the discloser to seek confidential treatment, a protective order or similar remedies or relief before disclosure.

10. Data protection

10.1 Personal data. Klarity will not receive any data from the Client. Instead, the Client will share a link with its employees, who will access Klarity's services directly. Klarity will collect health information directly from Users as an Independent Data Controller ("Health Data"), determining its own purposes and means of processing.

Processing details. The subject matter of Registration Data processing is user account creation and authentication. The duration is for the Term of this Agreement plus any retention period required by law. The nature and purpose is to enable Users to access Klarity's health assessment platform. The categories of personal data are identification and contact information. The categories of data subjects are the Client's employees and authorised users.

10.2 Klarity responsibilities. Klarity will:

1. Process Registration Data only for account creation and user authentication purposes and in accordance with documented instructions from the Client;
2. Inform the Client if, in its opinion, an instruction from the Client infringes any Privacy Laws;
3. Unless required by applicable law, not disclose or otherwise make available any Registration Data to any third party without first imposing contractual obligations on the third party recipient that are substantially similar to those imposed on Klarity under this Agreement;
4. Disclose the Client's name and contact information to any User seeking to exercise their data protection rights relating to Registration Data, so the User may directly exercise such rights with the Client as Data Controller. For Health Data, Klarity will handle data subject rights directly as an Independent Data Controller;
5. Enable the Client to amend, correct, or delete Registration Data;
6. Where requested by the Client and required under Privacy Laws, provide such assistance as the Client reasonably requires (taking into account the nature of the processing and the information available to Klarity) for the Client to (i) conduct data protection impact assessments; and (ii) consult with data protection supervisory authorities relating to Registration Data;
7. Ensure that all Registration Data residing in the European Economic Area is not transferred out of the European Economic Area to data recipients in third countries which do not ensure an adequate level of data protection as determined by the European Commission or the Information Commissioner's Office, unless the parties have entered into European Commission approved Standard Contractual Clauses or other data protection safeguards in compliance with Privacy Laws;
8. Provide other reasonably necessary assistance for the Client to meet its compliance obligations under Privacy Laws concerning Registration Data;
9. Not share any Health Data with the Client or any third party except as required by law, and may only provide the Client with anonymous aggregated insights that cannot identify individual Users;
10. Ensure that persons authorised to process Registration Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality;
11. Delete or return all Registration Data to the Client after the end of the provision of services relating to processing, and delete existing copies unless applicable law requires storage of the Registration Data.

10.3 Security safeguards. Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons and in accordance with a comprehensive information security policy, Klarity will establish, maintain and comply with administrative, physical, technical and organisational safeguards designed to ensure the security and confidentiality of Registration Data and Health Data and to prevent the unauthorised disclosure of, or access to, Registration Data and Health Data. Klarity's Information Security Policy will: (i) implement back-up and disaster recovery systems; (ii) continuously assess risks to the security of Registration Data and Health Data by (1) assessing the likelihood and potential damage of such risks, taking into account the sensitivity and risk of the Registration Data and Health Data, (2) identifying internal and external threats that could result in a Security Breach, and (3) conducting penetration testing; and (iii) take appropriate steps to protect against such risks.

10.4 Audits. Klarity will keep at its normal place of business detailed, accurate and up-to-date records relating to the processing of Registration Data and Health Data by Klarity. Upon the provision of sixty (60) days' written notice (save that such notice shall not be required in the case of a Security Breach or an audit by a Regulatory authority where it specifies otherwise), Klarity agrees to, during normal Business Hours, provide any Regulatory authority and the Client with: (i) full (Klarity accompanied) access to the full range of devices, systems, networks and data used for providing Services relating to Registration Data only; (ii) unrestricted rights of inspection and auditing related to the Services relating to Registration Data only; and (iii) a written explanation of the technical and organisational measures implemented by Klarity to ensure the safe and proper execution of the Services, in each case at the Client's cost and expense (save where a Security Breach is revealed) and subject to Klarity's obligations under Privacy Laws and with respect to confidentiality to its other clients.

10.4.2A The Client acknowledges that Health Data processing is subject to Klarity's Independent Data Controller obligations and audit rights relating to Health Data are not available to the Client under this Agreement.

10.4.2B The parties agree that audit rights will be subject to the following stipulations: (i) audits will be exercised in a risk-based and proportionate manner, taking into account the legal requirements, the context and the nature of the Services; (ii) if the Client appoints a third party auditor, the Client must verify that it and any third party's personnel performing the audit have acquired the right skills and knowledge to perform effective and relevant audits and assessments of Klarity's Services; (iii) if the audit could, in Klarity's reasonable opinion, create a risk for another Klarity customer's environment, Klarity and the Client will agree on an alternative way to provide the Client with a similar level of assurance; (iv) where sufficient, the Client should exercise audit rights by requesting Klarity to provide confidential copies of audit certifications and reports, or through a pooled audit conducted in cooperation with other Klarity customers and Klarity.

10.4.3 Klarity shall promptly resolve all data protection and security issues discovered by the Client or Regulatory authority that reveal a breach or potential breach by Klarity of any of its obligations under this Agreement or Privacy Laws relating to Registration Data.

10.4.4 Klarity will monitor its sub-processors to confirm their compliance with their contractual security obligations, and upon the Client's request, once per contract year, it will provide compliance reports to the Client with respect to each sub-processor handling Registration Data.

10.5 Security Breach. In the event Klarity confirms a Security Breach, Klarity will (i) without undue delay promptly notify the Client of any Security Breach relating to Registration Data, and (ii) provide all reasonable help for the Client to investigate and remedy any Registration Data Security Breach. Klarity will handle Health Data security breaches in accordance with its obligations as an Independent Data Controller.

10.6 Indemnity. Klarity will indemnify, defend, and hold harmless the Client and its respective officers, shareholders, directors, and personnel, (and keep such individuals indemnified on a full indemnity basis), from and against any claims, suits, hearings, actions, damages, liabilities, fines, penalties, costs, losses, judgments or expenses (including reasonable attorneys' fees) arising out of Klarity's breach of this Section 10 relating to Registration Data.

10.7 Business continuity and disaster recovery. Klarity will have in place, implement and maintain from the date of this Agreement and for the Term a Business Continuity and Disaster Recovery Plan which: (a) is in accordance with Best Industry Practice for the Services; (b) shall be developed in such a way as to ensure recovery of all Services as soon as reasonably possible in the event of a significant business interruption, and it will outline such Business Continuity and Disaster Recovery Plan to the Client upon request. Klarity shall test the Business Continuity and Disaster Recovery Plan regularly (and, in any event, not less than once in every 12 months) and will: (a) communicate test results to the Client upon request; (b) implement any actions or remedial measures which it considers to be reasonably necessary as a result of those tests. A failure by Klarity to remediate any material shortcomings revealed during testing of the Business Continuity and Disaster Recovery Plan within a reasonable period will be deemed to be a material breach of this Agreement.

11. General

11.1 Without prejudice to Clauses 3.2 or 5.4, no variation of this Agreement or any Booking will be valid unless it is agreed in writing by both parties. Failure or delay in exercising any right or remedy under this Agreement or any Booking will not constitute a waiver of such (or any other) right or remedy.

11.2 If any provision of this Agreement or a Booking (or part of any provision) is found by any court or other authority of competent jurisdiction to be invalid, illegal or unenforceable, that provision or part-provision will, to the extent required, be deemed not to form part of the Agreement or Booking as applicable and (a) the parties will immediately commence good faith negotiations to remedy such invalidity; and (b) the validity and enforceability of the other provisions of the Agreement or Booking as applicable will not be affected.

11.3 This Agreement and the applicable Booking constitute the whole agreement between the parties and supersede any previous arrangement, understanding or agreement between them relating to the subject matter of this Agreement and the applicable Booking. Each party acknowledges that in entering into this Agreement or any Booking it has not relied upon any oral or written statements, collateral or other warranties, assurances, representations or undertakings which were made by or on behalf of the other party in relation to the subject matter of this Agreement or a Booking at any time before its acceptance other than those which are set out in this Agreement or any Booking. Furthermore, and for the avoidance of doubt, the Client understands its business needs and has determined independently that the Services will meet its needs.

11.4 Neither party will be liable for any delay or non-performance of its obligations under this Agreement or any Booking to the extent that such delay or non-performance is a result of any condition beyond its reasonable control (a "Force Majeure Event"). To the extent that a Force Majeure Event occurs, the Client acknowledges that Klarity may be required (and will be permitted) to change how it provides the Services.

11.5 Except as expressly stated otherwise, nothing in this Agreement or any Booking will create an agency, partnership or joint venture of any kind between the parties. Neither party will have the authority to act in the name of or on behalf of the other, or to enter into any commitment or make any representation or warranty or otherwise bind the other in any way.

11.6 Neither party may assign any of its rights or obligations under this Agreement without the prior written consent of the other, such consent not to be unreasonably withheld, save that either party can, provided not to a direct competitor, assign this Agreement by operation of law, or in connection with a merger, change of control, sale of assets or other similar transaction.

11.7 All notices must be in English, in writing, addressed to the other party's primary contact and sent by (a) email to the email address notified by the Client to Klarity (or such other address as either party has notified the other in accordance with this clause); and (b) in the case of Klarity, delivered by email to notices@getklarity.io (each a "Notice").

11.8 The parties will: (i) comply with all applicable Anti-Corruption Laws; (ii) promptly report to the other party any request or demand for any undue financial or other advantage of any kind received by it in connection with the performance of this Agreement; (iii) cooperate regarding investigations by the other party into any matters related to bribery and corruption in connection with this Agreement.

11.9 Charges specified in this Agreement are exclusive of any sales or consumption taxes. The Client will be responsible for, and agrees to pay, all applicable sales or consumption taxes on the services (or goods) provided hereunder (including sales tax, use tax, excise tax, services tax, value added tax, goods and services tax) imposed by any governmental authority having jurisdiction on all items, goods and/or Services being paid for by the Client hereunder. Any payments or reimbursements made hereunder shall be made free and clear of and without deduction for any taxes, levies, imports, deductions, charges or withholdings. If the Client is required by law to deduct such taxes from or in respect of any sum payable hereunder to Klarity then the sum payable hereunder shall be increased as may be necessary so that, after all deductions are made, Klarity receives an amount equal to the sum it would have received had no such deductions been made. The parties will cooperate and take all steps reasonably and lawfully available to them to minimise such taxes and to obtain double taxation relief. If the Client withholds any such amounts from the fees, the Client will provide Klarity with a statement of withholding tax within 30 days from the withholding. Klarity confirms to the Client that it is a resident of the United Kingdom. Unless otherwise agreed, the party that is liable for payment of any tax upon which interest and penalties are imposed shall bear such interest and penalties. In the event Klarity suffers any fines, penalties or charges due to the Client's non-compliance with this Clause, or the Client fails to comply with the relevant tax legislation and regulations in respect of the Charges, the Client will indemnify Klarity for such costs.

11.10 Except in respect of any transfer of staff under applicable law, neither party shall (except with the prior written consent of the other party) directly or indirectly solicit or entice away (or attempt to solicit or entice away) from the employment of the other party any person employed or engaged by such other party in the provision of the Services or (in the case of the Client) in the receipt of the Services at any time during the Term or for a further period of 3 months after the termination of this Agreement, other than using a national advertising campaign open to all comers and not specifically targeted at any of the staff of the other party.

11.11 The Client will comply with all applicable export control and sanctions laws and regulations of any applicable governmental authority ("Export Control and Sanctions Laws"). The Client will not engage in any transactions with: (i) any User, entity, or country prohibited by Export Control and Sanctions Laws, including, without limitation, the prohibition against transactions with: (A) a national or resident of any country subject to U.S. sanctions or similar restrictions (currently, Cuba, Iran, Syria, North Korea and the region Crimea), or (B) anyone on the U.S. Treasury Department's list of Specially Designated Nationals or other sanctions lists ("OFAC Lists"). The Client represents and warrants that it is not a person on an OFAC List and that it is not located in a country subject to sanctions.

11.12 Any claims for loss arising under this Agreement will be subject to a general obligation of the parties to use all reasonable efforts to mitigate such losses.

11.13 Except as expressly stated otherwise, nothing in this Agreement will create or confer any rights or other benefits in favour of any person other than the parties to this Agreement.

11.14 This Agreement and all Bookings and all disputes and claims arising out of or in connection with them are governed by English law. With the sole exception of any application for injunctive relief, the parties irrevocably agree that the courts of England have exclusive jurisdiction to settle any dispute or claim (whether contractual or non-contractual) arising out of or in connection with this Agreement and the Booking (including their subject matter or formation).

Schedule 2 – Technical Specification and Support

Klarity will provide support to solve incidents and make coding modifications required for the Services to function as intended in accordance with the escalation procedure and severity of the issue set out below, provided always that the Client must provide substantiation by use cases and as much information as reasonably possible, including a description of a scenario leading up to the problem being encountered so that Klarity can understand how the incident occurred.

Escalation procedures & severity levels. Service response times and definitions are as follows:

All performance indicators are subject to and dependent on adherence to the API documentation. Performance indicators are exclusively related to Klarity's performance, and Klarity does not assume responsibility for the performance of any External Data Providers. Service uptime is exclusive of maintenance windows and emergency maintenance as described below. Response times in this Schedule exclude any internet latency, internet outage, DDoS, or other reasons outside of Klarity's control.

Maintenance window

A maintenance window will be used for corrective maintenance. Klarity reserves the right to perform three hours of maintenance per month, but from time to time may require longer. Klarity will use reasonable endeavours to notify the Client in advance of any upcoming maintenance windows. The service may not be available at all or in part during the time of the maintenance window. The maintenance window will only be utilised if Klarity considers this necessary or desirable to maintain the performance of the Services.

Klarity may conduct emergency maintenance on its network or servers with no prior notice in order to resolve server security issues or other emergency issues. Klarity will notify the Client at the beginning and end of such maintenance and will provide details on the nature of the work being performed.

Any tests, automated scans and/or probing or penetration tests, or attempts to breach any security or authentication measures used by Klarity ("Testing") performed by the Client will be conducted against the Klarity test environment, subject to 48-hour notice. The Client is not permitted to conduct Testing against Klarity's live production environment.

Contact

Account management: Joe Cannon · Joe@getklarity.io · 07874 208473

Client service: clientsupport@getklarity.io

Notices: notices@getklarity.io