Terms and Conditions

Document purpose and contractual structure

These Terms and Conditions govern access to and use of the public WorkCura website and the WorkCura domiciliary care management platform supplied by ExcelTTC Limited. They are drafted primarily for organisations that subscribe to WorkCura for business purposes and for the authorised users whom those organisations permit to use the platform.

The contractual relationship may also include an Order Form, plan or pricing page, invoice, Data Processing Agreement, Privacy Notice, Acceptable Use Policy, Subprocessor information, service-specific notices, and any written addendum agreed by the parties. If there is a direct conflict, the documents apply in the order of precedence stated in clause 3.5 below.

Contents

1. Definitions and interpretation

Account: an account through which a Customer or Authorised User accesses the Platform.

Agency: a domiciliary care agency, care provider or other organisation subscribing to the Services; also referred to as the Customer where appropriate.

Authorised User: an individual whom the Customer has authorised to use the Platform, including managers, administrators, care workers, employees, workers, contractors, client users and family-portal users.

Business Day: a day other than Saturday, Sunday or a public holiday in the jurisdiction stated in the Order Form.

Customer: the organisation that contracts with ExcelTTC Limited for the Services.

Customer Data: data, content, records, documents, messages, images and information entered, uploaded, generated or stored by or for the Customer in the Platform, excluding WorkCura’s own system data and intellectual property.

Data Protection Laws: the UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 and the Data (Use and Access) Act 2025, in each case as amended, replaced or supplemented, plus other applicable data-protection law.

Documentation: user manuals, help materials, technical instructions and service descriptions supplied or published by WorkCura.

Order Form: an order, checkout, subscription selection, written proposal or other document that identifies the purchased plan, billing cycle, fees and any special commercial terms.

Platform: the WorkCura hosted domiciliary care management application, including its dashboards, portals, APIs if enabled, mobile/PWA experience and associated features.

Services: the Platform, website, hosting, support, maintenance and related services purchased or made available by WorkCura.

Special Category Data: personal data falling within the special-category provisions of applicable Data Protection Laws, including data concerning health.

Subscription Term: the period for which the Customer is entitled to access the paid Services.

Website: the public WorkCura website, including workcura.net and any replacement or additional domain operated for the same service.

WorkCura: the WorkCura service supplied by ExcelTTC Limited.

Headings are for convenience only. Words in the singular include the plural and vice versa. “Including” means “including without limitation”. A reference to legislation includes amendments, re-enactments and subordinate legislation in force from time to time.

2. About WorkCura and scope of service

WorkCura is a software platform intended to assist organisational customers with the administration and coordination of domiciliary care operations. Features may include workforce management, client and service-user records, assessments, care plans, medication-support records, visit scheduling, recurring visits, rota management, visit monitoring, incident and safeguarding workflows, timesheets, payroll-support calculations, client invoicing, reports, secure communications, notifications, subscription management, public website content and demonstration-request management.

The exact functionality available to a Customer depends on its plan, configuration, enabled modules, technical environment and any separately agreed Order Form. WorkCura may add, improve, retire or replace functionality in accordance with clause 25, provided that it does not materially reduce the core paid service during a committed Subscription Term without a reasonable operational reason or an agreed alternative.

The Platform is an administrative and workflow tool. It is not a care provider, staffing agency, medical device, emergency service, clinical decision-maker, regulated healthcare professional, payroll bureau, accountant, insurer, legal adviser or substitute for the Customer’s own policies, professional judgement and statutory obligations.

3. Contract formation and order of precedence

3.1 A contract is formed when WorkCura accepts an Order Form, activates a paid subscription, confirms registration where a contract is intended to arise, or otherwise confirms in writing that the Customer may use the paid Services, whichever occurs first.

3.2 By submitting an Order Form, registering an organisation or using the Platform on behalf of an organisation, the person doing so confirms that they have authority to bind that organisation.

3.3 Public website browsing does not of itself create a paid subscription contract. Specific website activities such as requesting a demo, creating an account or submitting information may create separate obligations under these Terms and the Privacy Notice.

3.4 No purchase order, supplier onboarding form or Customer standard terms will amend these Terms unless WorkCura expressly agrees in writing.

3.5 If documents conflict, the following order applies unless expressly agreed otherwise: (a) signed bespoke addendum; (b) Order Form; (c) Data Processing Agreement or Schedule 1 for data-processing matters; (d) these Terms; (e) plan/pricing description; (f) Documentation and website notices.

4. Eligibility and authority

The Customer must be legally capable of entering into the contract and must use the Services for lawful business or organisational purposes. The Customer must ensure that every Authorised User has a legitimate role-based need to access the Platform and is appropriately trained, supervised and authorised.

Where a user is under 18 or lacks legal capacity, the Customer must not create access unless lawful, appropriate, supported by the necessary authority and expressly permitted by WorkCura’s service design. The Platform is not intended for unsupervised use by children.

5. Accounts, credentials and user administration

5.1 The Customer is responsible for creating, approving, maintaining and removing Authorised User access in accordance with least-privilege principles and its own employment, safeguarding and information-governance policies.

5.2 Each user must use their own credentials. Shared accounts are prohibited unless a specific shared-access feature has been expressly provided by WorkCura for that purpose.

5.3 Credentials, access links, password-reset links, one-time codes and session tokens must be kept confidential. The Customer must promptly disable access for leavers, suspended personnel or anyone who no longer requires access.

5.4 The Customer must notify WorkCura promptly of suspected account compromise, unauthorised access, credential disclosure or anomalous activity. WorkCura may require password resets, session revocation or other protective action.

5.5 WorkCura may implement password rules, session timeouts, multi-factor authentication or additional controls. The absence of a particular optional security feature does not reduce the Customer’s responsibility to operate its accounts securely.

6. Subscription plans, trials and service entitlements

6.1 Plans, included features, usage limits, user limits, storage limits, modules and billing frequency are those displayed at purchase or stated in the applicable Order Form.

6.2 If WorkCura offers a free or discounted trial, the trial duration, included functionality and conversion arrangements are those shown at registration or in the Order Form. Unless expressly stated otherwise, a trial is for evaluation only, may be limited to one per organisation, and may be withdrawn where there is abuse, duplication or misuse.

6.3 Trial or promotional functionality may differ from paid functionality. Customer Data entered during a trial remains subject to the data-protection provisions of these Terms.

6.4 WorkCura may enforce plan limits technically. If the Customer exceeds an entitlement, WorkCura may require an upgrade, charge an agreed overage, restrict the relevant feature or provide a reasonable period to reduce usage, depending on the plan rules.

7. Fees, billing, taxes and payment

7.1 The Customer must pay the fees, usage charges, add-on charges and taxes set out in the Order Form, pricing page or checkout. Unless stated otherwise, fees are exclusive of VAT and similar taxes.

7.2 Payments may be processed by Stripe or another authorised payment provider. The Customer authorises recurring charges where the selected plan renews automatically. WorkCura does not ordinarily store full card details where a payment provider handles them.

7.3 Usage-based fees, where applicable, are calculated using Platform records and the applicable commercial metric. Customer should review relevant usage information before renewal or invoice finalisation and promptly raise genuine billing queries.

7.4 If payment is overdue, WorkCura may issue reminders, restrict access, suspend paid functionality or terminate in accordance with these Terms. Interest and recovery costs may be charged only where lawful and stated in the Order Form or invoice.

7.5 The Customer is responsible for maintaining accurate billing contacts, payment methods and tax information.

8. Renewal, plan changes, cancellation and refunds

8.1 Unless the Order Form says otherwise, subscriptions renew for successive periods matching the selected billing cycle until cancelled in accordance with the cancellation mechanism available in the Platform or by another accepted method.

8.2 Upgrades may take effect immediately and may result in prorated or immediate charges where supported by the payment provider. Downgrades normally take effect from the next renewal unless otherwise stated, and may cause loss of access to features or capacity above the lower plan limit.

8.3 Cancellation prevents future renewal but does not automatically erase Customer Data or reverse fees already incurred. The effective end date is shown in the billing interface or cancellation confirmation.

8.4 Refunds, cooling-off arrangements or cancellation windows, if offered, are governed by the specific cancellation/refund policy displayed at purchase or incorporated into the Order Form. Nothing in these Terms limits rights that cannot lawfully be limited.

8.5 The Customer should export information it must retain before access ends. WorkCura is not responsible for the Customer’s failure to retain legally required records where reasonable export or access facilities were available.

9. Licence and permitted use

Subject to payment and compliance with these Terms, WorkCura grants the Customer a limited, non-exclusive, non-transferable, non-sublicensable right during the Subscription Term to permit its Authorised Users to access and use the Services for the Customer’s internal business operations.

The licence does not transfer ownership. The Customer may not resell, white-label, commercially exploit, copy, frame, mirror or make the Platform available as a service bureau unless WorkCura has expressly agreed in writing.

10. Acceptable use and prohibited conduct

The Customer and Authorised Users must comply with Schedule 3. In particular, they must not:

• use the Services unlawfully, fraudulently, deceptively or to facilitate abuse, harassment, discrimination or harm;
• attempt to bypass authentication, tenant separation, permissions, subscription controls, rate limits or security features;
• probe, scan, exploit or interfere with vulnerabilities except under a written authorised security-testing arrangement;
• upload malicious code, ransomware, spyware, destructive content or material designed to impair the Services;
• reverse engineer, decompile or derive source code except to the limited extent such restriction is prohibited by law;
• use automated scraping, extraction or high-volume requests that materially impair the Service or violate rights;
• enter data that the Customer has no lawful basis or authority to process;
• use the Platform as the sole means of delivering urgent, life-critical or emergency communication;
• misrepresent records, signatures, attendance, medication support, timesheets, incidents or other regulated care information;
• allow unauthorised persons to use another user’s account or device session.

11. Agency responsibilities

The Customer remains responsible for its care service, workforce, service users, regulatory registration, policies, professional supervision, staffing decisions, scheduling decisions, payroll decisions, invoicing, tax, insurance, health and safety, safeguarding, medication governance, information governance and compliance with applicable law and regulator requirements.

The Customer must configure the Platform accurately, including job roles, visit types, rates, monitoring thresholds, invoice settings, user permissions and client/care information. WorkCura is not responsible for decisions based on inaccurate, incomplete or outdated information supplied by the Customer or its users.

The Customer must maintain appropriate contingency processes for outages, lost devices, internet failures and emergencies, including access to essential care information through lawful backup or downtime procedures.

12. Employee and authorised-user responsibilities

Authorised Users must use the Platform honestly and in accordance with Customer policies, professional duties and instructions. Where the Platform captures check-in/out, care-task confirmations, notes, medication records, incident reports, timesheets, signatures, location-related information or cancellation requests, users must ensure entries are accurate and made at the appropriate time.

An Authorised User must not treat the Platform as permission to perform a task they are not trained, competent, authorised or legally permitted to perform. Where information in the Platform conflicts with an immediate safety concern, the user must follow emergency, safeguarding and escalation procedures and notify the Customer.

13. Client, service-user and family-portal access

If the Customer enables client or family access, the Customer is responsible for determining who may see information, establishing lawful authority, checking identities and revoking access when appropriate. WorkCura provides technical access controls but does not determine family relationships, capacity, consent, best interests or disclosure rights.

Portal users must not share credentials or use information for unlawful, abusive or unauthorised purposes. Access may be limited to the records and functionality configured by the Customer.

14. Care delivery, clinical responsibility and safeguarding

WorkCura does not provide domiciliary care and does not direct clinical or professional practice. The Customer retains responsibility for care assessments, care plans, risk assessments, visit duration, staffing levels, continuity of care, missed-visit procedures, escalation thresholds, safeguarding decisions and emergency response.

Automated alerts, reminders, status changes or monitoring outputs are decision-support and workflow aids only. They may depend on connectivity, configuration, user input and system availability. The Customer must maintain human oversight and cannot assume that an alert proves an event did or did not occur.

Safeguarding and incident functionality is not a substitute for statutory reporting, police contact, emergency services, regulator notification or local safeguarding procedures. Customers must make required external reports independently.

15. Medication, care records and professional judgement

Medication records and medication-support features are administrative records. WorkCura does not prescribe, dispense, verify clinical suitability, check interactions or determine whether medication should be administered. The Customer must ensure that medication information is verified from appropriate authoritative sources and that only suitably trained and authorised personnel perform medication-related tasks.

Care records should be factual, contemporaneous, relevant and professionally written. The Customer is responsible for record-retention periods, correction procedures, access controls, legal holds and disclosure obligations. The Platform’s audit history may record changes, but it does not replace professional governance or statutory recordkeeping requirements.

16. Scheduling, visits, location and time records

Scheduling and rota functions assist with allocation and coordination but do not guarantee staff availability, travel feasibility, regulatory staffing compliance or punctuality. The Customer must review conflicts, travel time, competence, authorisation, working-time requirements and continuity considerations.

Where location, check-in, journey or device-derived information is used, accuracy may be affected by device settings, GPS availability, browser permissions, connectivity and other technical factors. Such data should not be treated as infallible proof of attendance or misconduct without appropriate investigation.

17. Timesheets, payroll and invoicing functions

Timesheet, pay, mileage, expense, payroll-report and client-invoice functionality is intended to assist administration. The Customer remains responsible for validating hours, rates, deductions, holiday treatment, tax, National Insurance, pension obligations, employment status, invoicing, VAT and all payroll/accounting decisions.

Rate snapshots, scheduled-duration calculations, mileage calculations and invoice values may depend on configuration and user input. The Customer must verify financial outputs before payment, filing, submission or issue to third parties. WorkCura is not an accounting or payroll advisory service.

18. Electronic communications, notifications and messaging

Email, SMS, push notifications and in-app messages may be delayed, blocked, filtered, routed incorrectly or unavailable because of third-party providers, mobile networks, user settings, spam controls, invalid contact details or service outages. They must not be used as the sole channel for emergencies or urgent safeguarding.

The Customer is responsible for ensuring that contact details are current and that it has a lawful basis for communications sent through the Platform. Message content may be retained in accordance with Customer configuration and applicable law.

19. Public website, Book a Demo and visitor submissions

Website visitors may browse public information and may submit contact or demo requests. Visitors must provide accurate information and must not submit unlawful, abusive or malicious content. A requested demo date/time is a preference only and is not confirmed until WorkCura expressly confirms it.

Where a visitor requests an on-site demonstration, the visitor is responsible for supplying a safe and accurate location and any access instructions. WorkCura may decline or propose an alternative meeting format or time.

Website content is general information and may change. Pricing, feature descriptions and marketing statements are subject to the specific plan and Order Form actually purchased.

20. Data protection and privacy

20.1 Each party must comply with applicable Data Protection Laws. The Privacy Notice explains how WorkCura processes personal data for its own purposes, such as account administration, website enquiries, billing, service security and business communications.

20.2 For personal data that the Customer places in the Platform about staff, clients, service users, relatives or other individuals for the Customer’s care operations, the Customer will ordinarily act as controller and WorkCura will ordinarily act as processor, subject to the factual circumstances and applicable law.

20.3 Where WorkCura acts as processor, Schedule 1 applies and is intended to satisfy the mandatory controller-processor contract requirements. The parties acknowledge that controller/processor status is determined by law and actual processing activities, not labels alone.

20.4 The Customer is responsible for transparency notices, lawful bases, special-category conditions, data minimisation, accuracy, retention instructions, data-subject rights handling and determining which individuals should be entered into the Platform.

20.5 WorkCura may process limited service metadata, billing data, security logs and usage information as controller where necessary for operating, securing, improving, billing for or complying with law in relation to the Services, as described in the Privacy Notice.

21. Information security

WorkCura will maintain technical and organisational measures appropriate to the risk, taking into account the nature of the Services and Customer Data. Core measures are summarised in Schedule 2 and may evolve as technology, threats and service architecture change.

No internet-based service can be guaranteed completely secure. The Customer must implement appropriate endpoint security, device management, account governance, staff training and local safeguards, and must avoid placing unnecessary data into free-text fields or messages.

The Customer must promptly report suspected security incidents involving the Service and cooperate with reasonable investigation and containment steps.

22. Subprocessors and third-party services

WorkCura may use hosting, payment, email, SMS, monitoring, content-delivery, mapping, analytics or other service providers to operate the Services. Where those providers process Customer personal data on WorkCura’s behalf, WorkCura will manage them as subprocessors in accordance with Schedule 1 and applicable Data Protection Laws.

Third-party services may have their own terms, availability and privacy practices. WorkCura is not responsible for third-party services that the Customer independently chooses or connects, except to the extent WorkCura has expressly agreed responsibility in writing.

23. Intellectual property rights

All intellectual property rights in the Services, Website, software, source code, object code, database structure, interfaces, branding, Documentation, design elements and WorkCura-created materials belong to ExcelTTC Limited or its licensors. No rights are granted except the limited licence expressly stated in these Terms.

The Customer must not remove proprietary notices or use WorkCura names, logos or marks in a way that suggests endorsement, ownership or partnership without permission.

24. Customer Data and feedback

As between the parties, the Customer retains its rights in Customer Data. The Customer grants WorkCura the limited rights necessary to host, copy, transmit, back up, display, process and otherwise handle Customer Data solely to provide, secure and support the Services, comply with law and exercise rights expressly set out in these Terms.

If the Customer provides suggestions or feedback, WorkCura may use them without restriction or payment, provided that WorkCura does not thereby acquire ownership of the Customer’s confidential information or Customer Data.

25. Service availability, maintenance and change

WorkCura aims to provide a reliable service but does not guarantee uninterrupted or error-free availability unless a specific service level has been agreed in writing. Planned maintenance may be performed where reasonably necessary. Emergency maintenance may occur without advance notice.

WorkCura may modify interfaces, workflows and technical architecture to improve security, reliability, performance, legal compliance or usability. Material changes that significantly affect paid functionality will be communicated where reasonably practicable.

Features dependent on browsers, operating systems, devices or third-party providers may behave differently or cease to be supported as external technology changes.

26. Support, incidents and error reporting

Support channels, response targets and hours are those stated in the applicable plan or Documentation. Unless a formal SLA is expressly included in the Order Form, response or resolution times are targets rather than guarantees.

WorkCura may generate error references, audit entries and diagnostic logs to investigate faults. Customers should provide the reference, affected workflow, approximate time and non-sensitive reproduction steps when reporting an issue. Customers must not include unnecessary special-category data in support tickets.

27. Backups, business continuity and customer exports

WorkCura may maintain operational backups and recovery procedures appropriate to the service architecture. Backups are primarily for disaster recovery and are not a substitute for the Customer’s own statutory record-retention, export and continuity obligations.

The Customer should periodically test its ability to export or otherwise access records required for continuity, audits and legal retention. Restoration from backup may restore a system state rather than individual records and may be subject to technical limitations.

28. Suspension

WorkCura may suspend all or part of the Services where reasonably necessary to: protect security or integrity; prevent unlawful or harmful use; respond to an actual or suspected incident; comply with law, court order or regulator instruction; address serious breach of these Terms; or deal with overdue payment.

Where practicable and lawful, WorkCura will give notice and an opportunity to remedy before suspension. Immediate suspension may be used where delay could materially increase risk. WorkCura will seek to limit suspension to what is reasonably necessary.

29. Term and termination

The contract begins as described in clause 3 and continues for the Subscription Term unless terminated earlier. Either party may terminate for material breach that is not remedied within a reasonable written cure period where the breach is capable of remedy. A party may terminate immediately for insolvency events to the extent permitted by law, serious unlawful use, or other grounds stated in an Order Form.

Customer cancellation of renewal is governed by clause 8. Termination does not affect rights and liabilities accrued before the termination date.

30. Consequences of termination and data return/deletion

On termination or expiry, the Customer’s access may cease. Subject to Schedule 1, applicable law and the Order Form, WorkCura will make Customer Data available for return/export for any stated exit period and will thereafter delete or anonymise it in accordance with documented retention and backup processes, unless law requires retention.

The Customer remains responsible for exporting records it must retain and for ensuring continuity of care. WorkCura may retain billing, contract, security, audit or legal records where it acts as controller and has a lawful basis to do so.

31. Warranties and disclaimers

Each party warrants that it has authority to enter into the contract. WorkCura warrants that it will provide the Services with reasonable skill and care consistent with a professionally operated SaaS service.

Except as expressly stated and to the fullest extent permitted by law, implied warranties or conditions are excluded. WorkCura does not warrant that the Services will meet every Customer-specific requirement, prevent every error or security incident, identify every care risk, guarantee regulatory compliance, or be continuously available.

The Customer acknowledges that regulated care delivery requires professional judgement, supervision, training, policies, human review and contingency arrangements independent of the Platform.

32. Liability

32.1 Nothing in these Terms excludes or limits liability for death or personal injury caused by negligence, fraud or fraudulent misrepresentation, or any other liability that cannot lawfully be excluded or limited.

32.2 Subject to clause 32.1 and to the extent permitted by law, neither party will be liable to the other for indirect or consequential loss, loss of profit, loss of anticipated savings, loss of business opportunity, loss of goodwill or reputational loss, except where such loss forms part of a direct third-party claim that is expressly covered by an indemnity.

32.3 Subject to clause 32.1, WorkCura’s aggregate liability arising out of or in connection with the Services in any twelve-month period should be capped at an amount to be confirmed in the final commercial contract, commonly by reference to fees paid or payable during a defined preceding period. The final cap must be reviewed for reasonableness in light of the service, insurance and risk allocation.

32.4 WorkCura is not liable for losses caused by the Customer’s unlawful processing, inaccurate configuration, failure to follow professional or emergency procedures, unauthorised account sharing, unsupported integrations, third-party services selected by the Customer, or failure to maintain reasonable continuity arrangements, except to the extent WorkCura itself caused or contributed to the loss and liability cannot lawfully be excluded.

33. Indemnities

The Customer will indemnify WorkCura against third-party claims, regulatory costs and reasonable losses arising from the Customer’s unlawful Customer Data, infringement caused by Customer-provided materials, or use of the Services in material breach of these Terms, except to the extent caused by WorkCura’s breach, negligence or unlawful conduct.

Any indemnity is subject to reasonable notice, cooperation, mitigation and control of defence/settlement, and does not permit settlement that admits fault or imposes obligations on the indemnified party without consent. The final indemnity wording should be reviewed with the liability framework and insurance arrangements.

34. Confidentiality

Each party must keep the other party’s confidential information confidential and use it only for the contract, except where disclosure is required by law or to professional advisers, employees or subcontractors who need to know and are bound by confidentiality obligations.

Confidential information does not include information lawfully in the public domain, already known without restriction, independently developed, or lawfully received from another source without confidentiality duty.

Customer Data containing personal, health, safeguarding or commercially sensitive information must be treated as confidential regardless of whether it is marked confidential.

35. Compliance with laws and regulatory responsibilities

Each party must comply with laws applicable to its own activities. The Customer is responsible for laws and regulatory requirements applicable to the care service it operates, its workforce, employment practices, medicines management, safeguarding, health and safety, care records, service-user rights, invoicing and professional obligations.

WorkCura does not represent that using the Platform alone makes a Customer compliant with the requirements of the Care Quality Commission, Regulation and Quality Improvement Authority, Care Inspectorate, Care Inspectorate Wales, NHS bodies, local authorities or any other regulator or commissioner. The Customer must determine which requirements apply to it and configure/use the Service accordingly.

36. Anti-bribery, sanctions and misuse

Neither party may use the Services to facilitate bribery, corruption, money laundering, sanctions evasion, fraud or other unlawful activity. WorkCura may refuse, restrict or terminate service where reasonably necessary to comply with applicable sanctions, financial-crime or legal obligations.

37. Changes to these Terms

WorkCura may update these Terms to reflect changes in law, security, technology, service functionality or business operations. Material changes will be communicated by reasonable means, such as the Website, account notice or email. Where a material change adversely affects a committed paid term, the Customer may have any termination right expressly stated in the notice or Order Form.

The version and effective date should be displayed on the Website. Changes do not retrospectively remove accrued rights or obligations unless the law requires otherwise or both parties agree.

38. Notices

Formal legal notices must be sent to the addresses stated in the Order Form or the completed company details in this document. Routine operational notices may be sent through the Platform or to account email addresses. A party must keep its contact details current.

39. Assignment and subcontracting

The Customer may not assign or transfer the contract without WorkCura’s prior written consent, not to be unreasonably withheld where appropriate. WorkCura may assign the contract as part of a bona fide reorganisation, financing, sale of business or transfer of the WorkCura service, provided that the successor assumes the relevant obligations.

WorkCura may subcontract performance but remains responsible for subcontracted obligations to the extent required by the contract and law. Subprocessors handling personal data are governed by Schedule 1.

40. Force majeure

Neither party is liable for delay or failure caused by events beyond its reasonable control, such as widespread telecommunications failure, cloud-provider outage, natural disaster, war, civil disorder, epidemic, industrial action outside its workforce, government action or major cyberattack, provided the affected party takes reasonable steps to mitigate and resume performance. Payment obligations already due are not excused by this clause.

41. General legal provisions

If any provision is invalid or unenforceable, it will be modified to the minimum extent necessary or severed, and the remainder will continue. Delay in enforcing a right is not a waiver. Rights and remedies are cumulative unless stated otherwise.

Nothing creates a partnership, joint venture, fiduciary relationship or employment relationship between WorkCura and the Customer or between WorkCura and the Customer’s workers. No person other than the contracting parties has a right to enforce these Terms except where expressly stated or required by law.

The contract, including incorporated documents, constitutes the entire agreement regarding its subject matter and supersedes prior discussions, subject to liability that cannot lawfully be excluded for fraud or fraudulent misrepresentation.

42. Governing law and jurisdiction

These Terms and any non-contractual obligations arising from them are governed by the law specified in the Order Form. If the Order Form does not specify a governing law, the following selection must be completed before publication: [INSERT: ENGLAND AND WALES / NORTHERN IRELAND / SCOTLAND].

The courts with exclusive or non-exclusive jurisdiction must likewise be stated consistently with the provider’s registered office, commercial strategy and legal advice: [INSERT JURISDICTION CLAUSE].

Schedule 1 - Data Processing Terms

This Schedule applies where WorkCura processes personal data on behalf of the Customer as a processor. It is intended to form part of the contract and to address the written-contract requirements applicable to controllers and processors under UK data-protection law.

S1.1. Roles and instructions

The Customer is the controller and WorkCura is the processor for Customer personal data except where the factual processing activity makes either party a separate controller. WorkCura will process Customer personal data only on documented instructions from the Customer, including these Terms, the Order Form, configuration choices and lawful written instructions, unless UK law requires otherwise.

If WorkCura believes an instruction infringes applicable Data Protection Laws, it may inform the Customer and suspend the affected processing while the parties clarify the instruction, unless prohibited by law.

S1.2. Processing particulars

S1.3. Confidentiality

WorkCura will ensure that persons authorised to process Customer personal data are bound by confidentiality obligations and receive appropriate security and privacy instructions.

S1.4. Security

WorkCura will implement measures appropriate to the risk, taking account of the state of the art, implementation costs, processing context and likely impact on individuals. Schedule 2 summarises expected controls. The Customer acknowledges that security measures may evolve and may be replaced with controls providing materially equivalent or improved protection.

S1.5. Subprocessors

The Customer gives general authorisation for WorkCura to engage subprocessors required to provide the Services. WorkCura will impose written data-protection obligations that are materially consistent with applicable processor requirements and remains responsible for its subprocessors to the extent required by law.

WorkCura will maintain or publish a current subprocessor list or otherwise make it available. Where applicable law requires notice of a new subprocessor, WorkCura will provide reasonable notice and consider a Customer’s documented data-protection objection in good faith.

S1.6. International transfers

WorkCura will not make a restricted transfer of Customer personal data outside the UK unless a lawful transfer mechanism or applicable adequacy regulation is in place and any required supplementary measures are implemented. The Customer authorises transfers necessary for approved subprocessors subject to these safeguards.

S1.7. Data-subject rights

Taking into account the nature of processing, WorkCura will provide reasonable technical and organisational assistance to enable the Customer to respond to valid requests to exercise data-protection rights. If WorkCura receives a request relating primarily to Customer-controlled Platform data, it may direct the requester to the Customer unless law requires otherwise.

S1.8. Assistance and compliance

WorkCura will provide reasonable assistance, taking account of the nature of processing and information available, with security obligations, personal-data-breach management, data-protection impact assessments and prior consultation obligations applicable to the Customer. Additional substantial assistance outside normal service operations may be chargeable if agreed in advance.

S1.9. Personal-data breaches

WorkCura will notify the Customer without undue delay after becoming aware of a personal-data breach affecting Customer personal data and will provide information reasonably available to support the Customer’s assessment and notification obligations. WorkCura’s notice is not an admission of fault or legal liability.

S1.10. Audit information

WorkCura will make available information reasonably necessary to demonstrate compliance with its processor obligations. The parties should first use security documentation, certifications, questionnaires and remote evidence. On-site audits may be permitted where legally required or where documentary evidence is insufficient, subject to confidentiality, security, reasonable notice, non-disruption and cost arrangements.

S1.11. Return and deletion

At the Customer’s choice and subject to technical feasibility, legal retention obligations and the agreed exit process, WorkCura will return or delete Customer personal data after the Services end. Data in backups may remain until overwritten in the ordinary backup cycle and will remain protected and not restored except for legitimate recovery purposes.

S1.12. Customer instructions and lawful data

The Customer warrants that its instructions and provision of Customer personal data comply with applicable Data Protection Laws and that it has provided required notices and established lawful bases and special-category conditions. WorkCura does not independently determine whether the Customer is permitted to create a particular care, medication, safeguarding or workforce record.

Schedule 2 - Security and organisational measures

The following measures describe the intended security framework at a contractual level. They should be reconciled with the live production architecture and security documentation before publication so that the contract does not promise controls that are not actually implemented.

Schedule 3 - Acceptable Use Policy

The following rules apply to all users of the Website and Platform. The Customer must communicate them to Authorised Users and enforce them through its own policies where appropriate.

1. Use only for authorised business, care-management, employment, finance, communication and related operational purposes.
2. Access only the records and functions reasonably required for the user’s role.
3. Keep login details and devices secure and log out or lock devices when unattended.
4. Do not falsify care notes, timesheets, check-in/out records, medication records, signatures, incidents or safeguarding information.
5. Do not upload unlawful, defamatory, discriminatory, threatening, abusive, infringing or malicious content.
6. Do not use the Platform to stalk, harass, intimidate or improperly monitor any person.
7. Do not attempt unauthorised access, privilege escalation, vulnerability exploitation, code injection, scraping or denial-of-service activity.
8. Do not upload malware or use the Platform to distribute spam or unsolicited unlawful communications.
9. Do not circumvent subscription, licensing, billing, security, logging or tenant-isolation controls.
10. Do not export personal data to personal devices, consumer messaging apps or unapproved storage unless authorised by the Customer and lawful.
11. Do not place passwords, bank card data, unrelated medical information or other unnecessary high-risk information in free-text notes.
12. Immediately report suspected security, privacy, safeguarding or data-quality concerns through the appropriate Customer process and, where relevant, to WorkCura.

Schedule 4 - Service, billing and operational principles

Schedule 5 - Legal and regulatory reference points

This schedule records the principal official legal materials considered when preparing this draft. It is not an exhaustive statement of law and should not replace professional legal advice.

Official sources consulted during preparation included the Information Commissioner’s Office, GOV.UK and legislation.gov.uk. Legal requirements may change after the effective date; the published Terms should be reviewed periodically and after material legal or service changes.

Schedule 6 - Publication checklist and fields to complete

Acceptance and version control

Where these Terms are accepted electronically, WorkCura should record the version accepted, acceptance timestamp, organisation/account identifier and user responsible for acceptance where technically appropriate. Updated versions should carry a new version number and effective date.

For negotiated enterprise contracts, the parties may sign an Order Form or addendum incorporating these Terms by reference. Electronic signatures and electronic acceptance may be used where lawful and appropriate.

END OF TERMS AND CONDITIONS