Back to signup
Arete Medical · Terms of Service

Terms of Service

Draft — not reviewed legal content. This is a comprehensive working draft of the Terms of Service, written to structure and substantially cover what the final document needs to say. It is not legal advice and has not been reviewed by a solicitor. Bracketed items such as [Sole trader's full legal name pending] mark facts only Mitch can supply. This draft must be reviewed by a qualified solicitor before this product is promoted publicly or used for real customer sign-ups. See docs/features/ideas/terms-privacy-policy-legal-content.md.

Last updated: [date]. These Terms of Service ("Terms") form a legal agreement between [Sole trader's full legal name pending], trading as Arete Medical ("we", "us", "our"), of [business address pending], and the aesthetic practice or clinician registering for an account ("Customer", "you", "your"). Arete Medical is operated as a sole trader, not a registered company — there is no Companies House registration or company number; the individual proprietor is personally the contracting party and data controller/processor described in these Terms. By creating an account for Arete Medical Practice Management Software ("the Service"), you agree to be bound by these Terms. If you do not agree, do not create an account or use the Service.

1. Definitions

  • "Authorised User" means an individual your practice permits to access the Service under your account (e.g. clinicians, front-desk staff).
  • "Practice Data" means data your practice or its Authorised Users submit to the Service, including account and billing details.
  • "Patient Data" means personal data (including Special Category health data under Article 9 UK GDPR, such as medical history, consent records, and clinical photographs) that your practice enters into the Service about its own clients/patients.
  • "DPA" means the Data Processing Agreement at Section 4 and Schedule 1, governing our processing of Patient Data on your behalf.

1a. Your account

To use the Service, you create an account using your name, work email address, and a password. For this account information, Arete Medical acts as data controller: we decide why and how it's processed (operating and securing your account, billing, and communicating service updates to you), on the legal basis of performing our contract with you (Article 6(1)(b) UK GDPR) and, for essential service/security communications, our legitimate interest in operating the Service safely (Article 6(1)(f)). You are responsible for keeping your login credentials confidential and for all activity under your account, including that of any Authorised Users you add.

2. Subscription, fees & payment

The Service is offered on a single flat-rate subscription tier — Standard, £25/month — billed monthly to the payment method you provide at signup. New accounts start with a 30-day free trial; you will not be charged until the trial ends unless you cancel first. If a payment fails, your subscription enters a 7-day grace period during which access continues; if payment is not resolved within that window, access to the Service is locked until payment succeeds or you contact us. You can update your payment method or cancel your subscription at any time from the billing management screen in your account. [Placeholder — price change notice period to be confirmed.]

3. Your practice's use of the Service

You agree to use the Service only for lawful purposes connected with operating your aesthetic practice, and to ensure every Authorised User complies with these Terms. In particular you agree not to: use the Service to store data you are not legally entitled to hold; attempt to gain unauthorised access to any part of the Service or another practice's data; interfere with the Service's operation (e.g. through scraping, load testing without consent, or introducing malicious code); or use the Service in a way that breaches applicable law, including UK GDPR, the Data Protection Act 2018, or professional/clinical regulatory obligations that apply to your practice.

4. Processing your patients' data (Data Processing Agreement)

Once you use the Service to record Patient Data, your practice is the data controller for that data — you decide what is collected and why, and you are responsible for having a lawful basis for processing it (typically Article 9(2)(h) UK GDPR, health/social care purposes, or explicit consent for uses such as marketing photography). Arete Medical acts only as a data processor, processing Patient Data solely on your documented instructions, as set out in this DPA and Schedule 1 (to be attached). In that capacity, we undertake to:

  • process Patient Data only on your documented instructions, including with regard to international transfers, unless required otherwise by law;
  • ensure people authorised to process Patient Data are subject to confidentiality obligations;
  • implement appropriate technical and organisational security measures (see Section 5 of the Privacy Policy) in line with Article 32 UK GDPR;
  • not engage a sub-processor for Patient Data without your general or specific authorisation, and remain liable for any sub-processor's performance;
  • assist you, so far as reasonably possible, in responding to data subject rights requests and in meeting your security, breach-notification, and Data Protection Impact Assessment obligations;
  • notify you without undue delay after becoming aware of a Patient Data breach;
  • at your choice, delete or return all Patient Data to you at the end of the relationship, except where UK law requires continued storage; and
  • make available information necessary to demonstrate compliance with this DPA and allow for audits.

A full Schedule 1 (subject matter, duration, nature and purpose of processing, categories of data subjects and Patient Data, and the current sub-processor list) is required before this DPA is contractually complete — see the Privacy Policy's Data Processor section for the current sub-processor detail we can confirm today.

5. Intellectual property

We own all rights in the Service itself (software, design, and branding). You and your practice retain all rights in Practice Data and Patient Data you submit; you grant us only the limited licence needed to host, process, and display that data back to you in order to provide the Service.

6. Service availability & changes

We aim to keep the Service available and will give reasonable notice of planned maintenance where practical, but we do not currently offer a contractual uptime service level agreement. [Placeholder — revisit once real usage/SLA commitments are decided.] We may update the Service over time; we'll give reasonable notice of changes that materially reduce its functionality.

7. Confidentiality

Each party will keep the other's confidential information (including Practice Data and Patient Data) confidential, and use it only to perform obligations under these Terms, except where disclosure is required by law.

8. Limitation of liability

[Placeholder — liability cap and exclusions need legal drafting appropriate to a product handling Special Category health data. Nothing in these Terms will exclude or limit liability that cannot lawfully be excluded, including for death or personal injury caused by negligence, or fraud. Note: as a sole trader (Section 0, above), the proprietor's liability is personal and unlimited by law — a contractual liability cap limits what can be *claimed*, but does not convert this into limited-company-style liability. Worth weighing incorporation before this carries real customer/patient data at scale.]

9. Term, suspension & termination

These Terms apply for as long as you hold an account. Either party may terminate as set out in the subscription terms (Section 2, once finalised). We may suspend or terminate your account immediately if you materially breach these Terms (including the acceptable-use restrictions in Section 3) or if suspension is necessary to protect the security of the Service or other customers' data. On termination, Section 4's data-return/deletion commitments apply to Patient Data.

10. Governing law & jurisdiction

These Terms are governed by the laws of England and Wales, and the courts of England and Wales have exclusive jurisdiction over any dispute arising from them.

11. Changes to these Terms

We may update these Terms from time to time; where changes are material, we'll give you reasonable notice before they take effect (e.g. by email to your account address).

12. Contact

Questions about these Terms can be sent to [contact email pending — see brand-identity.md; aretemedical.co.uk is not yet a live mailbox].