Terms and Conditions

MEDIPAY LIMITED

Terms and Conditions (these "Terms and Conditions")

Medipay Limited is a company registered in England and Wales under company number 16145072, with its registered office at 72 Charteris Road, London, England, NW6 7EX ("Medipay").

1. Definitions and interpretation

1.1 In this Agreement, unless the context otherwise requires, the following terms shall have the following meanings:

"Access Date" the date on which the Merchant is able to use any of the Medipay Services for live Transactions;

"Account" the Merchant's workspace within the Medipay Platform through which the Merchant can access the Medipay Services and the settings relating to them;

"Acquirer" the financial institution to which the Merchant's Transaction instructions are routed for authorisation and settlement, as notified to Medipay by the Merchant or as introduced to the Merchant by Medipay;

"Acquirer Fees" the Fees payable by the Merchant to Medipay in respect of Medipay's integration with the Acquirer Services and the Acquirer to which the Merchant's Transaction instructions are routed, in accordance with the Order Form;

"Acquirer Services" the services provided by the Acquirer from time to time relating to the authorisation and settlement of Transactions;

"Acquirer Terms" the terms and conditions to which the Merchant has contractually agreed with the Acquirer in respect of the Acquirer Services from time to time;

"Agreement" these Terms and Conditions together with the relevant Order Form, the Schedules referred to in that Order Form and any document referred to in these Terms and Conditions, the Order Form or the Schedules;

"Alternative Payment Method" a payment method other than Cards (for example Apple Pay, Google Pay or Direct Debit) approved by Medipay in writing from time to time;

"Alternative Payment Provider" for each Alternative Payment Method, the provider of that payment method;

"Applicable Law" all laws and regulations (including the requirements of any Regulatory Authority) applicable to a Party (including a Party's rights or obligations) or to any Transaction or Refund for the time being in force in any jurisdiction;

"Authorisation" (A) in respect of Cards: the confirmation at the time of a Transaction from the relevant Card Issuer that the Card used to pay for the Transaction has not been blocked for any reason or listed as lost or stolen or as having had its security compromised and that there are sufficient funds available for the relevant Transaction; and (B) otherwise: authorisation of a Transaction, including, where applicable, the confirmation from the relevant Other Financial Institution or Alternative Payment Provider that adequate funds are available at the time of the Transaction to pay for the relevant Transaction; and "Authorise" and "Authorised" shall be construed accordingly;

"Business Day" a day (other than a Saturday, Sunday or public holiday in England) when banks in London are open for business;

"Card" a current and valid credit, debit, charge, purchase or other payment card issued by a Card Issuer under a Card Scheme whose payments Medipay may accept for processing by the Medipay Services under the terms of this Agreement;

"Card Issuer" a Person which issues Cards;

"Card Schemes" schemes governing the issue and use of Cards including Visa, Mastercard and American Express, or as may be approved and notified by Medipay to the Merchant in writing from time to time;

"Chargeback" either: (i) any circumstances where Card Issuers, Card Schemes and/or Third Party Servicers either refuse to Settle a Transaction or demand payment from Medipay in respect of a Transaction that has been Settled and/or in respect of which Remittance has been made to the Merchant; or (ii) (in respect of an Alternative Payment Method) any Reversed Payment; or (iii) any other circumstance where any Third Party Servicer (for example the Acquirer) either refuses to make a payment to Medipay (including a Payment) or demands payment from Medipay in respect of a disputed Payment or other payment made to Medipay in respect of a Transaction, or in respect of which Payment or other payment has been made to the Merchant; in each case notwithstanding any Authorisation;

"Commencement Date" the earlier of: (i) the date on which this Agreement has been signed by each of the Parties; and (ii) the date on which the Merchant is able to use any of the Medipay Services for live Transactions;

"Confidential Information" any information in any form or medium obtained by or on behalf of either Party from or on behalf of the other Party in relation to this Agreement which is expressly marked as confidential or which a reasonable person would consider to be confidential, whether disclosed or obtained before, on or after the Commencement Date, together with any reproductions of such information or any part of it;

"Control" or "Controlled" the exercise, or ability to exercise or entitlement to acquire, direct or indirect control over the Merchant or Medipay (as applicable), as defined in sections 449 and 450 of the Corporation Tax Act 2010, and a "Change of Control" shall be deemed to have occurred if any Person or Persons who control(s) Medipay or the Merchant at the Commencement Date subsequently cease to control Medipay or the Merchant, as the case may be;

"Controller" has the meaning set out in UK GDPR;

"Customer" the person (typically a patient) that holds a Card or Alternative Payment Method and orders products or services from the Merchant in respect of which payment shall be made using the Medipay Services;

"Data" documents, data and records of any kind relating to Transactions, Chargebacks, Representments, Retro-Charges or Refunds (including data relating to Cards and Customers) and shall include Transaction Personal Data and Sensitive Authentication Data;

"Data Protection Legislation" in relation to any Personal Data which is Processed in the performance of this Agreement, the Data Protection Act 2018 and the UK GDPR, in each case together with any national implementing laws, regulations, secondary legislation and any other applicable or equivalent data protection or privacy laws, as amended or updated from time to time, in the UK, and any successor legislation to such laws;

"Data Subject" has the meaning set out in UK GDPR;

"Data Transaction" the receipt or sending of Merchant Data to or from the Merchant, a Customer, a User or a Third Party Servicer on the Merchant's instructions via the Medipay Services;

"Fees" the fees payable by the Merchant to Medipay for the provision by Medipay of the Medipay Services, as set out in this Agreement (including the Order Form and the Schedules);

"Infrastructure" all necessary telecommunications devices, connections, third-party equipment, utilities and other requirements necessary for the use and performance of the Medipay Services (including networks, systems and Internet access as appropriate);

"Intellectual Property Rights" copyright and related rights, trade marks and service marks, trade names and domain names, rights under licences, rights in get-up, rights to goodwill or to sue for passing off or unfair competition, patents, rights to inventions, rights in designs, rights in computer software, database rights, rights in confidential information (including know-how and trade secrets) and any other intellectual property rights, in each case whether registered or unregistered and including all applications (or rights to apply) for, and renewals or extensions of, such rights and all similar or equivalent rights or forms of protection which subsist or will subsist now or in the future in any part of the world;

"Inward Payment" funds received by a Third Party Servicer, either originating from a Customer or otherwise, with a reference identifying the Merchant as the intended recipient and beneficiary;

"Lead User" a User that the Merchant has authorised to make Medipay Services selection preferences on behalf of the Merchant, activate and deactivate other Users and exercise administrative privileges in the Account (an "admin" role in the Medipay Platform);

"Medipay Platform" Medipay's cloud-based payments platform for healthcare practices, made available at portal.medipayuk.co.uk (and any successor address), including the merchant portal, the payment pages presented to Customers, the practice connector software and the application programming interfaces through which the Merchant accesses the Medipay Services;

"Medipay Services" the services that Medipay provides to the Merchant under this Agreement, as set out in the Order Form and the relevant Schedule(s), and which exclude the Acquirer Services;

"Merchant" the recipient of services from Medipay under this Agreement, as set out in the Order Form;

"Merchant Bank Account" an account in the name of the Merchant with a duly authorised credit institution acceptable to the Acquirer that is maintained by the Merchant for the purposes of receiving Remittances and paying Fees due to Medipay or other amounts to Third Party Servicers;

"Merchant Contact Data" Personal Data provided by the Merchant to Medipay, or otherwise collected by Medipay from the Merchant, in respect of the Medipay Services, relating to the management of this Agreement, use of the Medipay Services, and the relationship between the Merchant and Medipay, in respect of which Medipay acts as Controller;

"Merchant Data" data concerning Transactions or other Merchant or Customer activity available through the Medipay Services (i) from Medipay; or (ii) from a Third Party Servicer;

"Merchant Data Consent" the express consent granted by the Merchant for Medipay to collect, process and disclose Merchant Data in accordance with the terms of this Agreement, incorporated herein by reference and set out in the Merchant Data Consent Schedule at the end of this Agreement;

"Merchant Guide" any instructions, guidance or manuals made available by Medipay with respect to the Medipay Services (including the guides published within the Medipay Platform), as amended from time to time;

"Merchant Personal Data" Personal Data forming part of Merchant Data, and relating only to personal data, or any part of such personal data, of which the Merchant is the Controller and in relation to which Medipay is the Processor providing services under this Agreement;

"MID" the merchant identification number (being a unique code) allocated to the Merchant by the Acquirer in order for the Merchant to receive the Acquirer Services and process Transactions using the Medipay Services;

"Network Rules" all applicable rules, regulations and operating guidelines issued by the Card Schemes or any Alternative Payment Provider from time to time relating to Cards, Transactions, Alternative Payment Methods and any payments or processing of Data relating thereto (including those communicated to the Merchant in the Merchant Guide and such rules, regulations and guidelines posted on Card Scheme or Alternative Payment Provider websites from time to time, including www.visa.co.uk, www.mastercard.co.uk and www.americanexpress.co.uk, and such other URLs as Medipay may notify the Merchant about from time to time), and all amendments, changes and revisions made thereto from time to time, and any current waivers or exceptions agreed with the Card Schemes or any Alternative Payment Provider;

"Normal Business Hours" 09:00 to 17:30 on each Business Day;

"Order Form" the written document Medipay provides to the Merchant containing specific information relating to the particular services supplied or to be arranged to be supplied by Medipay to the Merchant;

"Other Financial Institution" a Third Party Servicer that is a financial institution;

"Other Payments Organisation" a Third Party Servicer that is in business or providing payment services or services in support of payment services;

"Outward Payment" a payment transaction whereby a Third Party Servicer transfers funds to the bank account designated by the Merchant in accordance with the Merchant's instructions;

"Parties" Medipay and the Merchant, and "Party" shall mean either of them;

"Payments" together, Inward Payments and Outward Payments;

"Person" any individual, company, body corporate, corporation sole or aggregate, government, state or agency of a state, firm, partnership, association, organisation or trust (in each case, irrespective of the jurisdiction in or under the law of which it was incorporated, formed or otherwise exists);

"Personal Data Breach" has the meaning given to it by UK GDPR;

"Personal Data" has the meaning given to it by UK GDPR;

"Privacy Policy" the Medipay privacy policy, published at https://portal.medipayuk.co.uk/privacy and incorporated herein by reference;

"Process" and "Processing" have the meaning given to them by UK GDPR;

"Processor" has the meaning set out in UK GDPR;

"Rates" Medipay's time and materials rates for providing services from time to time in force;

"Reason Code" a code or category used by any Card Scheme to classify a specific activity, act or omission, including any code in the Visa Merchant Alert Service, Mastercard Member Alert to Control High-Risk Merchants or an equivalent for any other Card Scheme, or a Regulatory Authority black list;

"Refund" a Transaction, in respect of an initiating Transaction, made wholly or partially to reverse that initiating Transaction;

"Regulatory Authority" any governmental or regulatory authority, and/or any self-regulatory authority, governmental department, agency, commission, board, tribunal, crown corporation, or court or other law, rule or regulation making entity having jurisdiction over any of the Parties and/or their businesses or any part or subdivision thereof in any territory in which the Medipay Services are made available or any local authority, district or other subdivision thereof (including, in respect of the United Kingdom, the Financial Conduct Authority, the Competition and Markets Authority and the Information Commissioner's Office) and any body which succeeds or replaces any of the foregoing;

"Remittance" any payment a Third Party Servicer or the Merchant makes under a Third Party Servicer Agreement (and "Remit" will be construed accordingly);

"Representment" a type of transaction that is undertaken to reverse a Chargeback by the re-execution of the original transaction, where the Merchant has successfully challenged the Chargeback;

"Restricted Person" a person that is (i) listed on, or owned or Controlled by a Person listed on any Sanctions list; (ii) located in, incorporated under the laws of, or owned or Controlled by, or acting on behalf of, a person located in or organised under the laws of a country or territory that is the target of country-wide Sanctions; or (iii) otherwise a target of Sanctions;

"Retro-Charge" a Transaction initiated by the Merchant to reverse a Refund to which the Customer was not entitled;

"Reversed Payment" an Inward Payment to the extent that it is fully or partially returned by an Alternative Payment Provider or a bank associated with the Inward Payment or to the extent that any Regulatory Authority requires the return of an Inward Payment, resulting in a financial liability to the Acquirer, which may include any circumstances where any of the foregoing persons either: (a) refuses to make the Inward Payment; or (b) demands repayment from the Acquirer of an Inward Payment due to a disputed corresponding Transaction, and in each case, notwithstanding: (i) any confirmation from an Alternative Payment Provider or bank that a Payment is authorised and/or in progress; and (ii) whether a corresponding Outward Payment has been made;

"Retail Prices Index" the Retail Prices Index excluding mortgage interest payments (RPIX) as published by the Office for National Statistics from time to time, or failing such publication, such other index as the Parties may agree most closely resembles that index;

"Sanctions" any economic sanctions laws, regulations, embargoes or restrictive measures administered, enacted or enforced by: (i) the United States government; (ii) the United Nations; (iii) the European Union; (iv) the United Kingdom; or (v) the respective governmental institutions and agencies of any of the foregoing, including without limitation the Office of Foreign Assets Control of the US Department of the Treasury, the United States Department of State, and His Majesty's Treasury;

"Schedule" a schedule containing a further description of a specific Medipay Service provided by Medipay to the Merchant, including further rights and obligations for the Parties in relation to that Medipay Service (at the date of these Terms and Conditions: the Platform Services Schedule and the Terminal Services Schedule);

"Sensitive Authentication Data" security-related information used to authenticate Cardholders and authorise Card transactions, including magnetic stripe data, PINs, PIN blocks and the three or four digit security code found on the front or back of a card;

"Settlement" the crediting to the Merchant of the value of a Transaction as determined by the relevant Card Scheme or Third Party Servicer as the case may be (and "Settle" and "Settled" shall be construed accordingly);

"Special Categories of Personal Data" those categories of data listed in Article 9(1) UK GDPR;

"Supervisory Authority" any regulatory authority responsible for the enforcement of Data Protection Legislation;

"Term" has the meaning given to it in Clause 10.1;

"Third-Party Gateway" a payment gateway provided by a third party other than Medipay through which Medipay routes Transactions to the Acquirer, as identified in the relevant Schedule and the Order Form;

"Third Party Servicer Agreement" an agreement between the Merchant and a Third Party Servicer concerning the supply of Third Party Servicer Services to or for the benefit of the Merchant;

"Third Party Servicer Service" the services of a Third Party Servicer;

"Third Party Servicer" a third-party service provider that has entered into an agreement with the Merchant, such as, for example, an Acquirer, a Card Issuer, an Alternative Payment Provider, or a practice management or accounting software provider connected to the Account;

"Transaction" any payment by a Customer for goods and/or services purchased by a Customer from and provided by the Merchant, using either: (A) a Card, a Card number or otherwise to debit or credit the applicable Card account; or (B) an Alternative Payment Method; in each case in accordance with the terms of the applicable Third Party Servicer Agreement (for example the Acquirer agreement) and in relation to which Medipay supplies any of the Medipay Services to the Merchant, or a reversal of the same. Unless the context requires otherwise, a reference to "Transaction" shall include a reference to a Refund, a Representment, a Retro-Charge, a recurring or instalment Transaction and a series of connected Transactions;

"UK GDPR" Regulation (EU) 2016/679 General Data Protection Regulation as it forms part of the law of England and Wales, Scotland, and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018 and amended by the Data Protection, Privacy and Electronic Communications (Amendments etc.) (EU Exit) Regulations 2019; and

"User" an employee or independent contractor of the Merchant who is authorised by the Merchant to use the Medipay Services on behalf of the Merchant.

1.2 References to "Clauses" are to clauses of this Agreement; references to "Paragraphs" are to paragraphs of a Schedule.

1.3 The headings are inserted for convenience only and shall not affect the construction or interpretation of this Agreement.

1.4 A "person" includes a natural person, corporate or unincorporated body (whether or not having separate legal personality).

1.5 A reference to a Party includes its personal representatives, successors or permitted assigns.

1.6 Words imparting the singular shall include the plural and vice versa. Words imparting a gender shall include the other gender and the neutral.

1.7 A reference to a statute or statutory provision is a reference to such statute or statutory provision as amended or re-enacted. A reference to a statute or statutory provision includes any subordinate legislation made under that statute or statutory provision, as amended or re-enacted.

1.8 Any phrase introduced by the terms "including", "include", "in particular" or any similar expression shall be construed as illustrative, shall not limit the sense of the words preceding or following those terms, and shall be deemed to be followed by the words "without limitation" unless the context requires otherwise.

1.9 A reference to "writing" or "written" includes electronic form and similar means of communication except where expressly stated.

2. Agreement

2.1 The terms of this Agreement apply to the exclusion of any terms and conditions submitted, proposed or stipulated by the Merchant in whatever form and at whatever time. These Terms and Conditions apply to all Medipay Services.

2.2 Save as expressly provided in this Agreement, this Agreement shall operate to the entire exclusion of any other agreement, understanding or arrangement of any kind between the Parties preceding the date of this Agreement and in any way relating to the subject matter of this Agreement and to the exclusion of any representations not expressly stated in this Agreement except for any fraudulent misrepresentations or any misrepresentation as to a fundamental matter. Each of the Parties acknowledges that it has not entered into this Agreement based on any representation that is not expressly incorporated into this Agreement.

2.3 This Agreement constitutes the whole agreement and understanding of the Parties as to the subject matter of this Agreement and there are no provisions, terms, conditions or obligations, whether oral or written, express or implied, other than those contained or referred to in this Agreement.

2.4 The Order Form shall be in the form that Medipay requires from time to time. This Agreement shall be legally formed and the Parties shall be legally bound when Medipay has received and accepted the Order Form that has been accepted by an authorised signatory of the Merchant and submitted by the Merchant to Medipay. Submission to Medipay by the Merchant of the Order Form as accepted by the Merchant shall be deemed to be an offer by the Merchant to purchase Medipay Services (as specified in the Order Form) from Medipay, subject to the provisions of this Agreement, and Medipay's counter-acceptance of the Order Form shall be considered acceptance of such offer, but the requirement for Medipay to perform any of its obligations under this Agreement shall be conditional upon Medipay's receipt from the Merchant of any advance payment of Fees as required under this Agreement.

2.5 If the Merchant provides to Medipay a purchase order for the Merchant's receipt of Medipay Services other than as set out in Clause 2.4, that purchase order (and any terms and conditions attached or referred to in it) shall be purely for the Merchant's administrative purposes and shall not form part of this Agreement.

2.6 In the event of a conflict between these Terms and Conditions, the Schedules and the Order Form, then:

2.6.1 the Order Form shall prevail over

2.6.2 these Terms and Conditions, which shall prevail over

2.6.3 a Schedule.

3. Medipay Services

3.1 Medipay will provide the Medipay Services to the Merchant as set out in the Order Form.

3.2 Medipay warrants that it shall provide the Medipay Services with reasonable skill, care and diligence using appropriately experienced and qualified personnel.

3.3 The Merchant shall be entitled to access the Medipay Services through the Account, or as otherwise set out in the Order Form and/or the relevant Schedule. In respect of the Account and/or any other Medipay Service in respect of which the Merchant obtains authentication credentials from Medipay for use and access (including sign-in credentials, two-factor authentication devices, API keys, webhook signing secrets and practice connector tokens) ("Authentication Credentials"), the Merchant must:

3.3.1 not share the Authentication Credentials with any third party;

3.3.2 keep the Authentication Credentials secure; and

3.3.3 use the Authentication Credentials as the Merchant's sole means of accessing the relevant Medipay Services.

Medipay reserves the right to revoke the Authentication Credentials immediately without notice if the Merchant breaches any term of this Agreement. The Merchant shall be responsible for ensuring that its Authentication Credentials are used solely for the purpose of accessing the relevant Medipay Services in accordance with this Agreement, and shall be responsible for any resulting use of the relevant Medipay Services, regardless of whether the Merchant authorised the corresponding use of its Authentication Credentials.

3.4 Medipay shall grant the Merchant a unique and private Account accessible through the Medipay Platform. The Account shall be a record of Data Transactions. Medipay shall provide the Merchant with access credentials for the Account. The Merchant shall not disclose such credentials or permit any third party to use them. The Merchant assumes full responsibility for the use of the Account.

3.5 From time to time, the Merchant will be invited to:

3.5.1 enter certain preferences and specifications within the Account that will apply to the Medipay Services (including role permissions, refund permissions, receipt branding, reminder schedules, integrations and payment-method settings); and/or

3.5.2 instruct Medipay in respect of such preferences and specifications, outside the Account.

The Merchant assumes exclusive responsibility for such selections even if they contain errors by the Merchant, or result in losses to the Merchant. Any additional terms and conditions posted to the Account or specific Medipay Services preferences selected by the Merchant by any media or method are incorporated into this Agreement by reference.

3.6 The Lead User may be granted administrative rights in the Account, including the right to allow more than one individual User from the Merchant organisation to access the Account. The Merchant is responsible for all acts and omissions of each individual User. The Merchant guarantees that each User shall comply with the terms of this Agreement. Each reference to the Merchant in this Agreement shall refer to both the Merchant and each of its Users.

3.7 The Merchant shall notify Medipay by email to support@medipayuk.co.uk immediately of any loss or disclosure, whether voluntary or otherwise, of any Account password, two-factor device, API key, webhook secret or connector token to a third party. Medipay may interrupt or refuse all access and any orders made using those credentials within one (1) Business Day following the receipt of the notification.

3.8 Medipay shall ensure that it:

3.8.1 has all necessary consents, rights and permission to enter into, and perform its obligations under, this Agreement; and

3.8.2 shall comply with all applicable laws, statutes, regulations and bye-laws in relation to the exercise of its rights and performance of its obligations under this Agreement.

3.9 Medipay is not responsible for any people, equipment, deliverables or services that it is not expressly stipulated to provide in this Agreement. The Merchant is responsible for any people, equipment, deliverables and services that it needs to obtain from someone other than Medipay. Except for any matter in relation to which Medipay specifically agrees in writing to advise or do, it shall not be responsible, or have any liability (subject to Clause 9.2), for advising on, or failing to advise on, or doing, or failing to do, anything else.

3.10 Subject to Clause 9.2, Medipay shall not have any liability for any delays or failures to accurately perform its obligations under this Agreement if caused by any failure or delay on the Merchant's part or on the part of the Merchant's employees, agents or subcontractors or by any breach by the Merchant of this Agreement or any other agreement. If there is any slippage in time, Medipay shall use its reasonable endeavours to reschedule delayed tasks to a mutually convenient time.

3.11 If Medipay is delayed or hindered in providing any Medipay Services as a result of any breach, delay or failure by the Merchant to perform any of its obligations under this Agreement or of any other agreement between the Parties, then Medipay may charge the Merchant at the Rates for any time reasonably incurred as a result of the hindrance or breach.

3.12 The Merchant acknowledges that:

3.12.1 Medipay's ability to provide the Medipay Services may be subject to the approval and acceptance of Third Party Servicers, including the Acquirer, that provide merchant-acquiring or other services to the Merchant;

3.12.2 any such Third Party Servicer Services are the responsibility and liability of the relevant Third Party Servicer and the Merchant acknowledges that the acts or omissions of any such third party may impact on Medipay's ability to perform the Medipay Services;

3.12.3 Medipay shall not have any liability (subject to Clause 9.2) for any delay in or non-performance of the Medipay Services which is caused by any Third Party Servicer;

3.12.4 where Third Party Servicer Services are indicated as being compatible with the Medipay Services within the Account, the Merchant may initiate Data Transactions with respect to such Third Party Servicers, the results of which are determined as per the terms of the applicable Third Party Servicer Agreement; however, Medipay shall not have any liability (subject to Clause 9.2) for any lack of compatibility, or any inability to initiate such Data Transactions;

3.12.5 Third Party Servicers may update Third Party Servicer Agreements at any time, and impose restrictions and/or conditions on or in respect of Third Party Servicer Services at any time, and Medipay shall not have any liability (subject to Clause 9.2) in respect of any updates, restrictions, conditions and/or changes, and/or for the acts or omissions of any Third Party Servicer, at any time; and

3.12.6 Medipay may, at its absolute discretion, add or remove integrations and compatibility of the Medipay Services with any or all Third Party Servicer Services without prior notice to or consent of the Merchant.

3.13 Medipay reserves the right to change the Medipay Services at any time, including making changes to the Medipay Services to comply with applicable laws and/or regulations, or changes which do not materially affect the functionality of the Medipay Services. In the event that such changes impact the way in which the Merchant uses the Medipay Services, Medipay will inform the Merchant in advance of the change.

3.14 Medipay shall not provide any training of personnel utilised by the Merchant as part of the Medipay Services, save to the extent set out in the Order Form.

3.15 Medipay:

3.15.1 does not warrant that the Merchant's use of the Medipay Services will be uninterrupted or error-free; and

3.15.2 is not responsible for any delays, delivery failures, or any other loss or damage resulting from the transfer of data over communications networks and facilities, including the Internet, and the Merchant acknowledges that the Medipay Services may be subject to limitations, delays and other problems inherent in the use of such communications facilities.

3.16 Whilst Medipay uses its reasonable endeavours to make the Medipay Services available, Medipay shall not have any liability (subject to Clause 9.2) if for any reason the Medipay Services are unavailable for any time or for any period.

3.17 Medipay does not guarantee that the Medipay Services will be free from faults. Subject to any other support made available in respect of a specific Medipay Service as set out in the Order Form or any Schedule, Medipay shall use its reasonable endeavours to:

3.17.1 provide technical support by email to support@medipayuk.co.uk, through the support chat within the Medipay Platform, and by telephone during Normal Business Hours; and

3.17.2 correct any errors or omissions in the Medipay Services as soon as practicable during Normal Business Hours after receiving full and clear information on them from the Merchant;

("Support Services"). Medipay shall respond to a request for Support Services within a reasonable time, but Medipay cannot guarantee any particular result or outcome nor within any particular time. In particular, without limitation, Medipay may need to obtain support in turn from a third party that assists Medipay with the provision of the Support Services.

3.18 Third Party Servicers of a particular Third Party Servicer Service may from time to time offer independent support services to the Merchant in respect of that service, for which the Merchant acknowledges that Medipay has no liability (subject to Clause 9.2); in such circumstances, the contact details for the Merchant to obtain such support shall be as set out in the Order Form, as notified to the Merchant by Medipay from time to time, or as otherwise made available to the Merchant by the relevant Third Party Servicer. To the extent any training charges are incurred by Medipay in respect of any Third Party Servicer Service and access to it by the Merchant, Medipay will invoice the Merchant in respect of such training costs, and any such invoice shall be payable by the Merchant in accordance with the payment terms contained in this Agreement.

3.19 The Support Services exclude the resolution of faults or defects that arise as a result of the Merchant's failure to comply with this Agreement or any other agreement between the Parties, or due to the act or omission of any third party. Medipay may provide those excluded services as part of the Support Services at its absolute discretion and at the Rates; subject to Clause 9.2, Medipay shall not have any liability for its provision of any of those excluded services to the Merchant.

3.20 Medipay may allow the Merchant to communicate payment links, receipts and reminders with Customers by SMS and email, using the Medipay Services. To the extent such functionality is offered by Medipay, it reserves the right to attach such conditions to the Merchant's use of such functionality as it considers appropriate from time to time (including in respect of the permitted geographical scope of such communications), and to charge for such functionality at such rate as it agrees in writing with the Merchant from time to time.

3.21 To the extent that integration kits, sandbox or demonstration workspaces and/or test environments are made available in respect of the Medipay Services, to assist the Merchant with integration with, and testing of, the Medipay Services, such availability is on an "as is" basis, and it is the Merchant's absolute responsibility to check the accuracy and suitability of such kits and/or environments in respect of integration with the Merchant's systems, and to maintain such integrations. The Merchant's use is at its own risk and Medipay shall not have any liability (subject to Clause 9.2) for any omissions, errors or inaccuracies in any integration kits, protocols, test environments and/or related advice.

3.22 The Merchant must ensure that it uses the most up-to-date protocols and algorithms made available by Medipay when integrating with the Medipay Services (including the current version of the practice connector software). Medipay:

3.22.1 may, at its absolute discretion, continue to make old protocols and algorithms available to the Merchant, without support, and the Merchant's continued use of any such protocols and algorithms is entirely at its own risk; and

3.22.2 may withdraw or cease to permit integrations with the Medipay Services using any such older protocols and algorithms at any time.

3.23 To the extent Medipay receives any complaint from a Customer, Medipay will direct the Customer to the Merchant; the Merchant is responsible for any complaints in respect of Customers and will work in good faith to promptly resolve any such complaints. If a Customer continues to contact Medipay regarding the Merchant's service, Medipay will use its reasonable endeavours to discuss this with the Merchant but reserves the right to:

3.23.1 suspend provision of all or part of the Medipay Services until such time as Medipay reasonably considers that the complaint has been resolved; and/or

3.23.2 terminate provision of all or part of the Medipay Services.

3.24 Except as specifically stipulated in this Agreement, Medipay:

3.24.1 shall not be responsible for providing or achieving any particular results or outcomes or within a particular time;

3.24.2 does not warrant that the Medipay Services, or any part of them, will meet the Merchant's requirements;

3.24.3 does not warrant that the Medipay Services will operate in conjunction with the Merchant's (or any User's) software or equipment;

3.24.4 does not warrant that any defect, error or bug in any software or hardware can be remedied; and

3.24.5 excludes all conditions, warranties, terms and obligations, whether express or implied by statute, common law or otherwise, to the fullest extent permitted by law in respect of this Agreement and the Medipay Services.

4. The Merchant's obligations

4.1 The Merchant shall:

4.1.1 ensure that any instructions it provides to Medipay for or in respect of the Medipay Services are complete, accurate and up-to-date;

4.1.2 ensure that Transaction information shared by the Merchant with Medipay in respect of the Medipay Services (including the Customer name and reference that must accompany every payment request) is complete, accurate and up-to-date;

4.1.3 comply with the Acquirer Terms and other Third Party Servicer Agreements; the Merchant acknowledges that any such Third Party Servicer Agreement forms a contract that is solely between the Merchant and the Third Party Servicer; the enforcement of any contractual obligations arising out of such Third Party Servicer Agreement is the responsibility of the Merchant and the relevant Third Party Servicer (being the parties to such Third Party Servicer Agreement), and, subject to Clause 9.2, Medipay shall not have any liability for the failure of either the Merchant or the Third Party Servicer to fulfil such obligations;

4.1.4 during the term of this Agreement and for such period as may be required following termination or expiry of this Agreement as may be reasonably necessary, open and maintain in its name a MID; to the extent that the Merchant does not subscribe to receive assistance services in respect of the MID under a separate contract from Medipay, the Merchant shall be responsible to undertake and/or receive equivalent services from an alternative source, and the Merchant will indemnify Medipay from and against any loss, damage, costs and expenses and other liabilities Medipay may incur as a consequence of the Merchant failing to undertake and/or receive such equivalent services from an alternative source;

4.1.5 have in place all Infrastructure;

4.1.6 be responsible for the security and integrity of the Infrastructure;

4.1.7 obtain the prior written authorisation of Medipay prior to moving the relevant Acquirer Services away from an Acquirer to another Acquirer;

4.1.8 provide Medipay with accurate and up-to-date information in respect of the Merchant's MID and the Merchant's access to and use of the Acquirer Services, on which information Medipay shall be entitled to rely in order to provide the Medipay Services;

4.1.9 for each Third Party Servicer Service that the Merchant wishes to be integrated with the Medipay Services, as indicated by preferences within the Medipay Services (including practice management software and accounting software connections), the Merchant shall: (i) ensure that the relevant Third Party Servicer agrees to such integration and send and accept Data Transactions drawn from them or provided to them through the Medipay Services as if they were requested or provided by the Merchant itself pursuant to the relevant Third Party Servicer terms; and (ii) acknowledge to each Third Party Servicer that all Data Transactions drawn or presented to a Third Party Servicer are deemed to be those of the Merchant under the applicable Third Party Servicer Agreement;

4.1.10 promptly provide to Medipay such data, information and assistance that will enable Medipay to carry out fully, accurately and promptly its obligations under this Agreement;

4.1.11 be responsible for any Chargebacks or other charges made to the Merchant by third parties, such as the Acquirer, as a result of or in connection with any Transaction and the Merchant's status; the Merchant acknowledges that Medipay has no visibility of Chargebacks or other charges beyond what the Acquirer reports to it and cannot offer advice or assistance in respect of them;

4.1.12 be responsible for making its own assessment of the Medipay Services before choosing to receive them and for ensuring that the Medipay Services (and their functionality) can be and are received and used by the Merchant in compliance with applicable law and regulation that applies to the Merchant in the countries and jurisdictions in which the Merchant is active; the Merchant shall be responsible for any fines, assessments, costs, damages or other consequence that may result or other losses that Medipay may suffer from unauthorised or prohibited practices and/or Transactions as a result of the Merchant's failure to comply with this Clause 4.1.12;

4.1.13 act with reasonable skill and care in connection with its activities as a merchant and/or its use of the Medipay Services, and not do anything (or omit to do anything) which may damage or bring Medipay's name, business and/or products into disrepute;

4.1.14 notify Medipay immediately if at any time the Merchant:

(a) becomes aware of or reasonably suspects that there has been or could be any breach of security in respect of Merchant Data, or the PCI DSS or other applicable law or regulation;

(b) becomes aware of any matter which might reasonably be considered to affect Medipay's ability to provide the Medipay Services in accordance with this Agreement, or applicable law or regulation;

(c) becomes aware of any errors or inaccuracies affecting its use of the Medipay Services or the Account; or

(d) is in dispute with the Acquirer;

4.1.15 have all rights, permissions and consents to enter into, and perform its obligations under, this Agreement, and to make use of the Medipay Services;

4.1.16 comply with all Network Rules applicable to it from time to time; and

4.1.17 comply with all applicable laws, statutes, regulations and bye-laws in relation to the exercise of its rights and performance of its obligations under this Agreement (including all PCI DSS standards and/or requirements applicable, or otherwise provided, to the Merchant from time to time).

4.2 The Medipay Services may enable electronic communication between the Merchant and its Customers. The Merchant acknowledges that any communication between the Merchant and a Customer via the Medipay Services occurs within the context of the relationship between the Merchant and its Customer for which the Merchant assumes exclusive liability; the Merchant shall ensure that it has put in place all necessary agreements, privacy consents and other disclosures necessary for any such communication by way of the Medipay Services.

4.3 The Merchant acknowledges that it requires a MID to access the Medipay Services, and that the Acquirer may at any time:

4.3.1 reject MID applications at its discretion; and/or

4.3.2 terminate the Merchant's merchant services agreement with the Acquirer in accordance with the Acquirer Terms.

4.4 In the event that Clause 4.3.1 or Clause 4.3.2 applies to the Merchant, Medipay may terminate this Agreement with immediate effect by giving notice to the Merchant; the Merchant shall be obligated to pay to Medipay the Fees that would otherwise have been payable by the Merchant to Medipay in respect of each Medipay Service, had this Agreement continued (and not terminated early) until the earliest date that each Medipay Service could otherwise have been terminated by the Merchant in accordance with this Agreement, together with the Acquirer Fees until the latest such date.

4.5 To the extent that the Merchant ceases receiving the Acquirer Services and/or does not otherwise have an account with an Acquirer at any time, such cessation shall not impact this Agreement and the Merchant's obligation to receive any Medipay Services and pay any Fees, until such Medipay Services have been terminated by the Merchant in accordance with this Agreement.

4.6 It is the Merchant's responsibility to ensure that the Medipay Services are sufficient and suitable for its purposes and meet its individual requirements. This responsibility includes ensuring that the Medipay Services, and any deliverables or other materials Medipay provides as part of the Medipay Services, are compliant with any regulatory regime to which the Merchant is subject (including, where applicable, the requirements of the Care Quality Commission, the General Dental Council and any other healthcare regulator). Medipay shall not be responsible or, subject to Clause 9.2, have any liability in the event that the Medipay Services are not suitable for the Merchant's purposes or do not meet the Merchant's individual requirements, including if they fail to comply with any laws or regulations to which the Merchant is subject.

4.7 The Merchant is responsible for ensuring that it provides Medipay with the information and assistance required to enable Medipay to properly provide the Medipay Services. Medipay shall not be responsible or, subject to Clause 9.2, have any liability for any failure to provide the Medipay Services to the extent caused by the Merchant's failure to properly ensure the provision of the relevant information and/or assistance, including as set out in Clause 4.1.

4.8 The Merchant shall notify Medipay immediately in the event that the Merchant becomes aware of any:

4.8.1 breach of applicable laws and/or regulations in respect of use of the Medipay Services;

4.8.2 matter which may impact the ability of Medipay to provide the Medipay Services in accordance with this Agreement and applicable laws and/or regulations;

4.8.3 errors in the Medipay Services or the Merchant's use of the Medipay Services, including in respect of Transactions; and/or

4.8.4 dispute between the Merchant and the Acquirer or any other Third Party Servicer.

4.9 The Merchant acknowledges that each Third Party Servicer has its own privacy policies and that Medipay does not accept any responsibility or liability (subject to Clause 9.2) for those policies.

4.10 Medipay reserves the right to refuse to provide (or to cease providing) all or part of the Medipay Services, or suspend the processing of any Transactions, at any time, if Medipay reasonably suspects that the Merchant has failed to comply with this Agreement or that there might be fraudulent or illegal activity in connection with the Merchant's use of the Medipay Services or the Account.

5. Acquirer Services

5.1 Medipay accepts liability in respect of the Medipay Services only. The Merchant's access to, and the availability of, Acquirer Services is subject to the relevant Acquirer Terms. The Merchant warrants that it has read and accepted the Acquirer Terms. Medipay shall not have any liability (subject to Clause 9.2) in respect of any Acquirer Terms, including any failure by the Merchant or the Acquirer to comply with the relevant Acquirer Terms or to honour the terms of any Transaction. Medipay is not a bank, does not hold Customer funds and is not a party to the Settlement of Transactions; Settlement is made by the Acquirer directly to the Merchant Bank Account.

5.2 Notwithstanding Clause 4.3, the Merchant acknowledges that the Acquirer may refuse to enter into any contract with the Merchant and/or integrate and provide the Acquirer Services in respect of the Merchant at any time; the Acquirer may also change the Acquirer Terms, or suspend and/or terminate the contract between the Acquirer and the Merchant, at any time, with or without notice. Any change to, or suspension or termination of, such contract:

5.2.1 does not affect the Merchant's obligation to pay the Acquirer Fees to Medipay for the duration of the current outstanding term of this Agreement; and

5.2.2 will not impact the continued provision by Medipay of the Medipay Services, save to the extent that such provision is not possible without the Merchant having an Acquirer in place, in which instance Medipay shall be entitled to terminate this Agreement immediately on notice to the Merchant, without affecting the Merchant's obligation to pay the Fees to Medipay for the duration of the current outstanding term of the Agreement had termination not taken effect.

5.3 The Merchant shall indemnify Medipay against all liabilities, costs, expenses, damages and losses (including any direct, indirect or consequential losses, loss of profit, loss of reputation and all penalties and legal costs (calculated on a full indemnity basis) and all other professional costs and expenses) suffered or incurred by Medipay arising out of or in connection with:

5.3.1 any breach, negligent performance or non-performance by the Merchant or the Acquirer of any Acquirer Terms or the Acquirer Services;

5.3.2 any claim made against Medipay by any third party arising out of the Acquirer Services in respect of any Transaction;

5.3.3 any claim made against Medipay arising from or out of any other Third Party Servicer Services;

5.3.4 any incorrect, inaccurate and/or outdated information the Merchant provides to the Acquirer; and/or

5.3.5 any failure by the Merchant to obtain, or maintain, a valid and current MID.

This indemnity shall apply whether or not Medipay has been negligent or at fault.

5.4 To the extent set out in the Order Form, Medipay will assist the Merchant in appointing an Acquirer from which it will receive Acquirer Services to integrate with the Medipay Services. Medipay provides such assistance on an as-is basis, without guarantee or liability (subject to Clause 9.2). The Merchant acknowledges that the choice, and appointment, of any Acquirer shall be at the Merchant's absolute discretion. Medipay may, at its absolute discretion, support the management of the Acquirer Services on behalf of the Merchant, on an ongoing basis, in which case Medipay:

5.4.1 may liaise with the Acquirer on the Merchant's behalf; and

5.4.2 will rely on information the Merchant has provided to the Acquirer in Medipay's provision of the Medipay Services.

5.5 The Merchant acknowledges that Medipay shall only share data and information with the Merchant's chosen Acquirer to the extent that the Merchant has provided the Merchant Data Consent.

6. Intellectual Property Rights

6.1 The Merchant acknowledges that all Intellectual Property Rights in the Medipay Services and the Medipay Platform belong and shall belong to Medipay or the relevant third-party owners (as the case may be), and the Merchant shall have no rights in or to the Medipay Services other than the right to use them in accordance with the terms of this Agreement.

6.2 The Merchant shall do all necessary acts and execute all documents that Medipay may reasonably request to perfect the right, title and interest of the Intellectual Property Rights in the Medipay Services.

6.3 Medipay acknowledges that the Merchant shall own and retain all rights, title and interest in and to the Merchant Personal Data. Medipay shall not have any rights to access, use or modify the Merchant Personal Data without the Merchant's prior written consent, except to the extent necessary for the Merchant to access the Medipay Services or as otherwise required by applicable law.

7. Data Protection

Data processor

7.1 The Parties acknowledge that, for the purposes of Data Protection Legislation, the Merchant is the Controller and Medipay is the Processor of any Merchant Personal Data, and that the scope, nature and purpose of Processing is set out below:

7.2 Medipay uses the following categories of sub-processor in providing the Medipay Services, each engaged under written terms that meet the requirements of Article 28(3) UK GDPR. The current list, with the role of each provider, is published in the Privacy Policy at https://portal.medipayuk.co.uk/privacy and is updated there when a provider is added or replaced:

• Payment gateway and acquiring: Elavon Financial Services DAC (UK Branch), which provides the Elavon Payment Gateway (including the Opayo gateway) and, where the Merchant has been introduced to Elavon by Medipay, the Acquirer Services. Card data is entered directly into fields hosted by the gateway and does not pass through Medipay's systems.
• Hosting: Vercel Inc. (application hosting, served from the London region).
• Database and authentication: Supabase Inc. (managed database and sign-in service, hosted in the EU (Ireland) region).
• Scheduled processing and backups: DigitalOcean LLC (a server operated by Medipay for collecting acquirer settlement reports and holding encrypted database backups).
• Email delivery: Resend (Plus Five Five, Inc.) for transactional email such as payment links, receipts and reminders.
• SMS delivery: Twilio Inc. for transactional SMS such as payment links and reminders.
• Card terminals: PAX Technology Limited (terminal software, application distribution and transaction reporting through the PAX terminal management platform) and Service Logistics Limited (terminal supply, configuration and support), where the Merchant receives Terminal Services.
• Support assistant: Anthropic, PBC, which powers the optional support chat within the Medipay Platform. Support conversations are processed only to answer the query and route it to Medipay's team and are not used to train AI models; the assistant has no access to card data or connected accounting software.
• Business email and documents: Microsoft Limited (Microsoft 365), used by Medipay's team for correspondence with the Merchant.
• On the Merchant's instruction only: where the Merchant connects its own software in the Account, Medipay shares payment data with that provider on the Merchant's instruction: Xero Limited, Sage Global Services Limited (Sage Accounting), Intuit Limited (QuickBooks Online), Salesforce UK Limited, Cliniko (Red Guava Pty Ltd), Dentally (Henry Schein One), Semble (Heydoc Limited) and GoCardless Ltd (Direct Debit).

7.3 Each Party confirms that it holds, and during the term of this Agreement will maintain, all registrations and notifications required in terms of the Data Protection Legislation which are appropriate to its performance of the obligations under this Agreement. Medipay is registered with the Information Commissioner's Office.

7.4 Each Party confirms that, in the performance of this Agreement, it will comply with Data Protection Legislation.

7.5 Medipay shall:

7.5.1 Process Merchant Personal Data only on documented instructions from the Merchant (which include the instructions given through the Account and the functionality of the Medipay Platform), unless required to do so by Data Protection Legislation or any other applicable law to which Medipay is subject; in such a case, Medipay shall inform the Merchant of that legal requirement before Processing, unless that law prohibits Medipay from so informing the Merchant;

7.5.2 ensure that persons authorised to Process the Merchant Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality;

7.5.3 ensure that it has in place appropriate technical and organisational measures to protect against unauthorised or unlawful processing of Merchant Personal Data and against accidental loss or destruction of, or damage to, Merchant Personal Data, appropriate to the harm that might result from the unauthorised or unlawful processing or accidental loss, destruction or damage and the nature of the data to be protected, having regard to the state of technological development and the cost of implementing any measures (those measures include encryption of data in transit, row-level access controls scoped to each Merchant's Account, role-based permissions, two-factor authentication for Users, an audit log of administrative actions, encrypted backups, and regular assessment of the effectiveness of the measures adopted);

7.5.4 notify the Merchant as soon as reasonably practicable before appointing any new subcontractor in respect of Processing of Merchant Personal Data (by updating the sub-processor list in the Privacy Policy and notifying the Merchant through the Account or by email), and ensure that any such subcontractor is subject to a contract for Processing that complies with Data Protection Legislation (or, as a minimum, the requirements set out in Article 28(3) of UK GDPR in respect of the obligations of Processors); if the Merchant (acting reasonably) objects to the appointment of the subcontractor for reasons relating to the Processing of Merchant Personal Data, the Merchant shall have the right to terminate the relevant impacted Medipay Services on 90 days' written notice; for the avoidance of doubt, by entering into this Agreement the Merchant provides its consent to Medipay using those subcontractors listed in Clause 7.2;

7.5.5 taking into account the nature of the Processing, assist the Merchant by putting in place appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of the Merchant's obligation to respond to requests for exercising the Data Subject's rights laid down in Data Protection Legislation, to the extent that such requests relate to this Agreement and Medipay's obligations under it (the Medipay Platform allows the Merchant to export or erase a Customer's data directly);

7.5.6 assist the Merchant, at the Merchant's cost, in responding to any request from a Data Subject and in ensuring compliance with the Merchant's obligations under Data Protection Legislation with respect to security, breach notifications, impact assessments and consultations with supervisory authorities or regulators;

7.5.7 at the Merchant's option, delete (to the extent practicable) or return all the Merchant Personal Data to the Merchant after termination of this Agreement or otherwise on the Merchant's request, and delete existing copies (to the extent practicable) unless applicable law requires Medipay's ongoing storage of the Merchant Personal Data (financial Transaction records are retained for the period required by UK law, and Customer contact details within them are anonymised on request);

7.5.8 not share the Merchant Personal Data with any other processors of personal data that the Merchant commissions without the Merchant's prior written consent;

7.5.9 make available to the Merchant all information necessary to demonstrate Medipay's compliance with this Clause 7.5, and allow for and contribute to audits, including inspections, conducted by the Merchant or another auditor mandated by the Merchant, provided that:

(a) Medipay is given reasonable notice of any such audit;

(b) any audit takes place during normal business hours and with no unreasonable disruption to Medipay's business;

(c) the Merchant (or its nominee) shall have access only to information relating to the Processing of Merchant Personal Data and Medipay's compliance with this Clause 7.5; and

(d) the Merchant (or its nominee) shall not have access to any information that is proprietary to Medipay, or confidential information that Medipay holds on behalf of third parties;

7.5.10 inform the Merchant immediately if, in Medipay's opinion, an instruction from the Merchant infringes (or, if acted upon, might cause the infringement of) Data Protection Legislation; and

7.5.11 not transfer any Merchant Personal Data outside of the United Kingdom and the European Economic Area unless the prior written consent of the Merchant has been obtained (which consent is given in respect of the sub-processors listed in Clause 7.2 to the extent their services involve such a transfer) and the following conditions are fulfilled:

(a) Medipay has provided appropriate safeguards in relation to the transfer;

(b) the Data Subject has enforceable rights and effective legal remedies;

(c) Medipay complies with its obligations under the Data Protection Legislation by providing an adequate level of protection to any Merchant Personal Data that is transferred; and

(d) Medipay complies with reasonable instructions notified to it in advance by the Merchant with respect to the Processing of the Merchant Personal Data.

7.6 Each Party will notify the other Party without undue delay if it becomes aware of a Personal Data Breach relating to either Party's obligations under this Agreement.

7.7 The Merchant shall undertake appropriate data protection impact assessments to ensure that Processing of Merchant Personal Data complies with Data Protection Legislation. Medipay will provide the Merchant with reasonable assistance, where necessary and upon the Merchant's request, in carrying out any data protection impact assessment and undertaking any necessary prior consultation of the Supervisory Authority.

7.8 As part of the Medipay Services, Medipay may allow the Merchant to set up and use certain functionality relating to recurring and instalment Transactions and stored payment methods, where the Merchant has appropriate authority from the Customer; the Merchant shall provide to Medipay all information it requires to enable Medipay to assist the Merchant in setting up and using any such functionality available.

7.9 It is the Merchant's responsibility to ensure that Merchant Personal Data is dealt with in a way that is compliant with the "data protection principles" set out in Data Protection Legislation. The Merchant shall ensure that:

7.9.1 the Merchant is able to justify the Processing of Merchant Personal Data in accordance with Data Protection Legislation (including, where applicable, obtaining any and all consents of Data Subjects required in order to commence the Processing), and that the Merchant has recorded or documented this in accordance with the record-keeping requirements of Data Protection Legislation;

7.9.2 where Merchant Personal Data falls within the Special Categories of Personal Data (including any health information contained in a payment reference or treatment description), the Processing of such Special Categories of Personal Data is justified as lawful under Data Protection Legislation;

7.9.3 where the Processing of Special Categories of Personal Data is not justified as lawful under Data Protection Legislation, no such Merchant Personal Data will be sent to Medipay; and

7.9.4 the Merchant has all necessary appropriate consents and notices in place to enable the lawful transfer of the Merchant Personal Data to Medipay for the Term for the purposes of this Agreement;

and the Merchant warrants that it shall not cause Medipay to be in breach of Data Protection Legislation.

7.10 Each Party agrees to indemnify, and keep indemnified and defend at its own expense, the other Party, against all costs, claims, damages or expenses incurred by the other Party or for which the other Party may become liable, due to any failure by the first Party or its employees or agents to comply with this Clause 7.

Data controller

7.11 Medipay may use the Merchant's data (including Merchant Contact Data) as provided in this Agreement and otherwise as made available during the provision of the Medipay Services (including the name, email address, telephone number, and financial information relating to the Merchant's business) to:

7.11.1 carry out Medipay's obligations arising from this Agreement and to provide the Merchant with the information, products and services that it requests from Medipay;

7.11.2 provide the Merchant with information about other products and services Medipay offers;

7.11.3 provide the Merchant, or permit selected third parties to provide the Merchant, with information about products or services Medipay feels may interest the Merchant. If the Merchant does not want Medipay to use data in this way, or to pass data on to third parties for marketing purposes, it should inform Medipay at engineering@medipayuk.co.uk; and

7.11.4 notify the Merchant about changes to the Medipay Services.

7.12 In respect of the Merchant's use of the Account and the Medipay Platform, Medipay may collect technical information about the Merchant and Users, including the Internet protocol (IP) address used to connect the computer to the Internet, login information, browser type and version, time zone setting, operating system and platform, and information about the Merchant's use of the Medipay Services:

7.12.1 to administer the Medipay Services and for internal operations, including troubleshooting, data analysis, testing, research, statistical and survey purposes;

7.12.2 to improve the Medipay Services to ensure that content is presented in the most effective manner for the Merchant and Users; and

7.12.3 as part of Medipay's efforts to keep the Medipay Services safe and secure (including sign-in security logs, brute-force lockout and IP allowlisting);

and Medipay may share any such data with the provider of a Third-Party Gateway for such purposes relating to that third party, at any time. Any Personal Data contained in such information shall be considered Merchant Contact Data.

7.13 Medipay may also disclose Merchant Contact Data to third parties:

7.13.1 in the event that Medipay sells or buys any business or assets, in which case Medipay will disclose the Personal Data to the prospective seller or buyer of such business or assets;

7.13.2 if Medipay or substantially all of its assets are acquired by a third party, in which case Personal Data held by Medipay about its merchants and customers will be one of the transferred assets; and

7.13.3 if Medipay is under a duty to disclose or share the Personal Data in order to comply with any legal obligation, or in order to enforce or apply this Agreement, or to protect the rights, property, or safety of Medipay, its merchants and customers, or others. This includes exchanging information with other companies and organisations for the purposes of fraud protection and credit risk reduction.

By entering into this Agreement, the Merchant acknowledges that Medipay may use the Merchant's (and Users') Personal Data in this way.

7.14 The Merchant agrees that Medipay may engage in Data Transactions with Third Party Servicers as per the Merchant's instructions provided through the Order Form, the Account or otherwise under this Agreement. The Merchant acknowledges that Medipay may use and share the Merchant's information with third parties (including Medipay's associated companies, Medipay's funders and any person to whom Medipay may assign its rights under this Agreement) to help Medipay and those third parties assess financial and insurance risks, recover debt, develop customer relationships, services and systems, and prevent and detect crime. That information may include information about Transactions.

8. Fees

8.1 In consideration of the Merchant obtaining the relevant Medipay Services from Medipay pursuant to this Agreement, the Merchant shall pay to Medipay the Fees.

8.2 Medipay will issue invoices to the Merchant for the Fees on a monthly basis in accordance with the Order Form (and otherwise as set out in this Agreement). Monthly subscription Fees are shown to the Merchant in the Account and on the monthly invoice; Transaction-based Fees and Acquirer Fees are invoiced separately in accordance with the Order Form. The Merchant shall pay the Fees to Medipay within seven days of the date of the invoice.

8.3 All sums due under this Agreement are exclusive of VAT or other sales, import or export duties or taxes (if applicable) which shall be payable in addition at the same time as payment of any sums due.

8.4 The Merchant shall pay to Medipay all sums due under this Agreement:

8.4.1 by any payment method that Medipay may stipulate from time to time; no payment shall be considered paid until Medipay has received it in cleared funds in full;

8.4.2 in pounds sterling; and

8.4.3 in full without any set-off, counterclaim, deduction or withholding (other than any deduction or withholding of tax as required by law).

8.5 Time is of the essence in respect of payment of the Fees by the Merchant.

8.6 Medipay reserves the right to increase the Fees:

8.6.1 on an annual basis, not more than once in any 12-month period, in line with the percentage increase in the Retail Prices Index in the preceding 12-month period; and

8.6.2 at any time by giving the Merchant not less than 30 days' notice of such increase taking effect; if, following receipt of such notice from Medipay, the Merchant intends to terminate this Agreement, the Merchant may terminate this Agreement by the provision to Medipay of 20 days' notice, to be served on Medipay no later than two Business Days following the Merchant's receipt of Medipay's notice in respect of the Fee increase.

8.7 If the Merchant is late in paying any part of any monies due to Medipay under this Agreement and such payment remains outstanding for seven days following Medipay providing notice to the Merchant of such outstanding payment, Medipay may (without prejudice to any other right or remedy available to Medipay whether under this Agreement or by any statute, regulation or bye-law) do any or all of the following:

8.7.1 charge a £10 administration fee, payable by the Merchant to Medipay in respect of the late payment (including where there has been a missed or bounced direct debit or other failed payment for any reason);

8.7.2 recover Medipay's costs and expenses and charges (including legal and debt collection fees and costs) in collecting the late payment; and/or

8.7.3 suspend and/or terminate performance of this Agreement (or the relevant Schedule) until payment in full has been made.

8.8 In the event that Medipay incurs any cost, charge, expense or otherwise from any supplier or provider it uses in delivering the Medipay Services to the Merchant (including Third Party Servicers), that has not been provided for in this Agreement (including SMS charges above any included allowance and payment tokens), Medipay will submit an invoice to the Merchant for payment of such amounts and Medipay's reasonable costs in so dealing, in accordance with the payment terms contained in this Agreement.

9. Limitation of liability

9.1 This Clause 9 prevails over all of this Agreement and sets forth the entire liability of Medipay, and the sole and exclusive remedies of the Merchant, in respect of:

9.1.1 performance, non-performance, purported performance, delay in performance or mis-performance of this Agreement or any services in connection with this Agreement; or

9.1.2 otherwise in relation to this Agreement or entering into this Agreement.

9.2 Neither Party excludes or limits its liability for:

9.2.1 its fraud; or

9.2.2 death or personal injury caused by its negligence; or

9.2.3 any breach of the obligations implied by Section 2 of the Supply of Goods and Services Act 1982; or

9.2.4 any other liability which cannot be excluded or limited by applicable law.

9.3 Subject to Clause 9.2, Medipay shall not be liable whether in tort (including for negligence or breach of statutory duty), contract, misrepresentation, restitution or otherwise, for any:

9.3.1 loss of profits;

9.3.2 loss of business;

9.3.3 loss of opportunity;

9.3.4 Chargebacks;

9.3.5 cost of equipment purchased or otherwise acquired by the Merchant in connection with this Agreement;

9.3.6 downtime;

9.3.7 depletion of goodwill and/or similar losses;

9.3.8 wasted management or staff time;

9.3.9 ex gratia payments;

9.3.10 loss or corruption of data or information;

9.3.11 cost of substitute products and/or services;

9.3.12 Transactions;

9.3.13 pure economic loss; and/or

9.3.14 special, indirect or consequential loss, costs, damages, charges or expenses;

howsoever arising under this Agreement.

9.4 Subject to Clause 9.2, Medipay's total aggregate liability, whether in tort (including for negligence or breach of statutory duty), contract, misrepresentation, restitution or otherwise, arising out of or in connection with:

9.4.1 a particular Medipay Service shall be limited to the extent set out in each relevant Schedule; and

9.4.2 all other claims in aggregate (including claims in respect of a Medipay Service for which a limit is not set out in that relevant Schedule or for which there is no Schedule) shall be limited to 110% of all amounts paid and total other sums payable, in aggregate, by the Merchant to Medipay under this Agreement in the 12 months prior to the date on which the claim first arose.

9.5 The limitation of liability under Clause 9.4 has effect in relation both to any liability expressly provided for under this Agreement and to any liability arising by reason of the invalidity or unenforceability of any term of this Agreement.

9.6 The Merchant acknowledges and accepts that:

9.6.1 Medipay only provides the Medipay Services on the express condition that Medipay will not be responsible, nor, subject to Clause 9.2, shall Medipay have any liability, directly or indirectly, for any act or omission of the Merchant, the Merchant's affiliates or its or their employees, agents, contractors or customers or any third party;

9.6.2 Medipay shall not have any liability, subject to Clause 9.2, for any claims of any third parties, relating to the Medipay Services or otherwise in respect of this Agreement; and

9.6.3 the Medipay Services are subject to the limitations and issues inherent in the use of the bank system and the Internet (including denial of service attacks and telephony connections) and Medipay is not responsible for and shall not be liable (subject to Clause 9.2) for:

(a) any problems or other damages resulting from such limitations or issues;

(b) any banks processing transactions or providing other services;

(c) any damage, contamination or corruption of any kind of Merchant Data or the Merchant's material, information, messages or other traffic, howsoever occurring;

(d) any losses, damages or expenses incurred by the Merchant as a result of a third party provider (including an Acquirer), including where that third party provider rejects or holds any Transaction processed as part of the Medipay Services; or

(e) the principal sum of any payment instruction received or processed by the Medipay Services.

9.7 Nothing in this Agreement shall restrict or limit either Party's general obligation at law to mitigate any loss it may suffer or incur as a result of an event that may give rise to a claim under this Agreement.

10. Term and termination

10.1 This Agreement shall commence on the Commencement Date and, unless terminated earlier in accordance with the termination provisions under this Agreement, shall continue in full force and effect until the latest of:

10.1.1 the completion of the provision of the Medipay Services under the last extant Schedule; or

10.1.2 the conclusion of payment of all Fees due under this Agreement;

(the "Term").

10.2 Unless set out otherwise in the Order Form or any particular Schedule, the term of each Medipay Service shall be the same as, and subject to the same termination rights as set out in, this Agreement. On termination of this Agreement for any reason, all Schedules then in force shall automatically terminate; the termination of any Schedule shall not affect any other Schedule or this Agreement.

10.3 The Merchant shall be entitled to provide Medipay with not less than 30 days' written notice to terminate any or all of the Medipay Services, to take effect at any time prior to the date falling 120 days after the Access Start Date (for the Platform Services), the Delivery Date (for the Terminal Services) and, for all other Medipay Services, the Commencement Date (the "Break Right"). The Merchant may only exercise the Break Right if it complies with the following conditions:

10.3.1 the Merchant has never contracted with Medipay prior to entry into this Agreement, and this Agreement is the first contract the Merchant has ever had with Medipay;

10.3.2 the Merchant has actively used the Medipay Services prior to the date of the termination notice and continues to use the Medipay Services through to the effective date of termination;

10.3.3 the Merchant has not been in breach of this Agreement at any time prior to serving notice to terminate, and then remains compliant with this Agreement until the effective date and time of termination;

10.3.4 the Merchant must comply with all instructions provided to it by Medipay in respect of this Agreement up to the effective date of termination;

10.3.5 the Merchant must provide to Medipay accurate information, timely cooperation, and access to reasonably necessary resources, in respect of this Agreement and each Party's performance of it; and

10.3.6 the Merchant must comply with Clause 17 in serving its notice to terminate.

In the event that any of the above conditions have not been met, the Break Right shall not apply and any notification by the Merchant to terminate this Agreement in accordance with the Break Right shall be void and not applicable.

10.4 In the event that the Merchant wishes to terminate the relevant Medipay Services without cause, otherwise than by using the Break Right, the Merchant shall be liable to pay the relevant Fees to Medipay for the remainder of the relevant term of those Medipay Services as if termination had not taken effect.

10.5 Without prejudice to any of Medipay's rights or remedies, Medipay may terminate this Agreement (or any Schedule) with immediate effect (or such other notice period as Medipay sees fit at its absolute discretion) by giving notice to the Merchant:

10.5.1 if the Merchant fails to pay any amount due under this Agreement on the due date for payment and such amount remains in default not less than 7 days after being notified to make such payment;

10.5.2 in accordance with Clause 4.4;

10.5.3 if the provision of the Medipay Services causes Medipay to be in violation of the PCI DSS or any applicable law or regulation;

10.5.4 if the Merchant breaches the Network Rules applicable to it (including where such breach is likely to adversely affect Medipay's reputation or cause Medipay to be in breach of applicable Network Rules);

10.5.5 if the Merchant does (or omits to do) anything which does or may reasonably be expected to put Medipay in breach of the PCI DSS or applicable law or regulation;

10.5.6 if the Merchant fails to adopt the most up-to-date protocols and algorithms or to comply with Medipay's current integration guidance in respect of the Medipay Services, within any timescales that Medipay notifies to the Merchant from time to time;

10.5.7 if Medipay reasonably suspects or has evidence that there might be fraudulent or illegal activity in connection with the Merchant's use of the Medipay Services or the Account;

10.5.8 if Medipay considers such termination to be reasonably necessary to safeguard the security of the Medipay Services and/or its users; and/or

10.5.9 if the Acquirer requires Medipay to do so.

10.6 Without affecting any other rights or remedies that it may be entitled to, either Party may give notice in writing to the other Party terminating this Agreement (or any Schedule) immediately if:

10.6.1 without prejudice to Clause 10.5, the other Party is in breach of any of its obligations under this Agreement (or in respect of that particular Schedule), and, where such breach is capable of remedy, the other Party fails to remedy such breach within a period of seven days of being notified of such breach by the Party;

10.6.2 the other Party gives notice to any of its creditors that it has suspended or is about to suspend payment or if it shall be unable to pay its debts within the meaning of Section 123 of the Insolvency Act 1986, or an order is made or a resolution is passed for the winding-up of the other Party or an administration order is made or an administrator is appointed to manage the affairs, business and property of the other Party or a receiver and/or manager or administrative receiver is appointed in respect of all or any of the other Party's assets or undertaking or circumstances arise which entitle the court or a creditor to appoint a receiver and/or manager or administrative receiver or administrator or which entitle the court to make a winding-up or bankruptcy order or the other Party takes or suffers any similar or analogous action in consequence of debt in any jurisdiction; and/or

10.6.3 the other Party suspends or ceases, or threatens to suspend or cease, to carry on all or a substantial part of its business.

10.7 Without prejudice to any of Medipay's rights or remedies, Medipay may terminate this Agreement (or any Schedule) at any time by giving not less than one month's notice to the Merchant.

10.8 Any provision of this Agreement that expressly or by implication is intended to come into or continue in force on or after termination or expiry of this Agreement (or in respect of the relevant terminated or expired Schedule) shall remain in full force and effect.

10.9 Termination or expiry of this Agreement (or any Schedule) shall not affect any rights, remedies, obligations or liabilities of the Parties that have accrued up to the date of termination or expiry, including the right to claim damages in respect of any breach of the Agreement (or in respect of a Schedule) which existed at or before the date of termination or expiry.

10.10 On termination or expiry of this Agreement (or in respect of any Schedule) for any reason:

10.10.1 Medipay shall cease to provide the Medipay Services under this Agreement (or that particular Schedule); and

10.10.2 the Merchant shall pay to Medipay all amounts owing to Medipay under this Agreement (or in respect of that Schedule), whether invoiced or not.

10.11 On termination (or expiry) of this Agreement, howsoever arising, each Schedule (and any Medipay Services) then in force at the date of such termination shall continue in full force and effect for the remainder of the term of such Schedule (and such Medipay Services), unless terminated earlier in accordance with the terms of such Schedule.

10.12 The termination of any Schedule (or any particular Medipay Service) shall not affect any other Schedule (or Medipay Service) or this Agreement.

11. Confidentiality

11.1 Each Party must keep the other Party's Confidential Information confidential and must not:

11.1.1 use such Confidential Information except for the purpose of exercising or performing its rights and obligations under this Agreement; or

11.1.2 disclose such Confidential Information in whole or in part to any third party, except as expressly permitted by this Clause 11.

11.2 Each Party must use adequate procedures and security measures to protect the other Party's Confidential Information from inadvertent disclosure or release to unauthorised persons.

11.3 A Party may disclose the other Party's Confidential Information to those of its employees, agents and subcontractors who need to know such Confidential Information provided that:

11.3.1 it informs such employees, agents and subcontractors of the confidential nature of the Confidential Information before disclosure; and

11.3.2 it does so subject to obligations equivalent to those set out in this Clause 11.

11.4 A Party may disclose the Confidential Information of the other Party to the extent such Confidential Information is required to be disclosed by law, by any governmental or other regulatory authority or by a court or other authority of competent jurisdiction provided that, to the extent it is legally permitted to do so, it gives the other Party as much notice of such disclosure as possible and, where notice of disclosure is not prohibited and is given in accordance with this Clause 11.4, it takes into account the reasonable requests of the other Party in relation to the content of such disclosure.

11.5 The obligations of confidentiality in this Clause 11 shall not extend to any matter which either Party can show:

11.5.1 is in, or has become part of, the public domain other than as a result of a breach of the confidentiality obligations of this Agreement; or

11.5.2 was independently developed by it; or

11.5.3 was independently disclosed to it by a third party entitled to disclose the same; or

11.5.4 was in its written records prior to receipt.

11.6 Each Party reserves all rights in its Confidential Information. No rights or obligations in respect of a Party's Confidential Information other than those expressly stated in this Agreement are granted to the other Party, or to be implied from this Agreement.

11.7 On termination of this Agreement, each Party must:

11.7.1 return to the other Party all documents and materials (and any copies) containing, reflecting, incorporating or based on the other Party's Confidential Information;

11.7.2 erase all the other Party's Confidential Information from its computer systems (to the extent possible) (or, in Medipay's case, in accordance with its data retention policy from time to time in force); and

11.7.3 certify in writing to the other Party that it has complied with the requirements of this Clause 11.7, provided that a recipient Party may retain documents and materials containing, reflecting, incorporating or based on the other Party's Confidential Information to the extent required by law or any applicable governmental or regulatory authority, or to otherwise maintain reasonable business records. The provisions of this Clause 11 shall continue to apply to any such documents and materials retained by a recipient Party following termination of this Agreement for any reason.

11.8 The provisions of this Clause 11 shall continue to apply after termination of this Agreement.

11.9 Medipay may identify the Merchant as Medipay's client and the type of services provided by Medipay to the Merchant, including the use by Medipay of the Merchant's brand and/or logo from time to time for marketing and sales purposes, provided that, in doing so, Medipay shall not reveal any of the Merchant's Confidential Information (without the Merchant's prior written consent).

12. Audit

12.1 Medipay and/or its nominee(s) may, during the term of this Agreement and for 12 months following its termination for any reason, conduct an audit of the Merchant for the following purposes:

12.1.1 to verify the accuracy of Fees (and proposed or actual variations to them in accordance with this Agreement);

12.1.2 to verify the Merchant's use of the Medipay Services; and

12.1.3 to review the Merchant's compliance with this Agreement.

12.2 The Merchant shall on demand provide Medipay (and/or its nominee(s)) with full co-operation and assistance in relation to each audit, including:

12.2.1 all information requested within the permitted scope of the audit;

12.2.2 access to any computer systems and databases;

12.2.3 access to any equipment and/or premises controlled by the Merchant; and

12.2.4 access to the Merchant's employees, agents and sub-contractors.

12.3 Medipay shall use its reasonable endeavours to provide at least 2 Business Days' notice of its intention to conduct an audit.

12.4 The Parties shall each bear their own respective costs and expenses incurred in respect of any audit, unless the audit identifies a material breach of the terms of the Agreement by the Merchant, in which case the Merchant shall reimburse Medipay for all its reasonable costs incurred in the course of the audit.

12.5 If an audit identifies that the Merchant has underpaid any Fees, the Merchant shall pay to Medipay the amount underpaid within seven days.

13. Force Majeure

Medipay shall not in any circumstances be in breach of this Agreement, nor, subject to Clause 9.2, have any liability for delay in performing, or failure to perform, any of its obligations under this Agreement, if such delay or failure results from events, circumstances or causes beyond its reasonable control, including strikes, lock-outs or other industrial disputes (whether involving the workforce of a Party or any third party), failure of a utility service or transport or telecommunications network, failure or outage of a hosting, database, gateway or acquiring provider, act of God, war, riot, civil commotion, malicious damage, compliance with any law or governmental order, rule, regulation or direction, accident, breakdown of plant or machinery, fire, flood, storm or default of suppliers or sub-contractors. In such circumstances Medipay shall be entitled to a reasonable extension of the time for performing such obligations, provided that if the period of delay or non-performance continues for one month, the Merchant may terminate this Agreement by giving 20 days' written notice to Medipay.

14. Variation

Medipay may, at any time, vary the terms of this Agreement by the provision of a minimum of 30 days' notice to the Merchant; in the event that the Merchant does not agree to the variation, it may terminate this Agreement on the provision to Medipay of not less than 20 days' notice to take effect at the end of the 30-day notice period in respect of the variation. No other change to this Agreement shall be binding unless it is agreed in writing signed by each of the Parties (and in such instance of a change agreed between the Parties, "writing" shall not include email) or otherwise achieved by the Merchant by using the functionality available through the Account.

15. Freedom to contract

The Parties declare that they each have the right, power and authority and have taken all action necessary to execute and deliver and to exercise their rights and perform their obligations under this Agreement.

16. Counterparts

This Agreement may be executed in any number of counterparts, each of which when executed shall constitute a duplicate original, but all the counterparts shall together constitute the one agreement.

17. Notices

17.1 Any notice given to either Party under or in connection with this Agreement shall be in writing, addressed to the relevant Party at its registered office or such other address as that Party may have specified to the other Party in writing, and shall be delivered personally, sent by pre-paid first-class post, recorded delivery, commercial courier or by email (where the relevant email address for service of notices for (i) the Merchant shall be as set out in the Order Form, and (ii) Medipay shall be support@medipayuk.co.uk).

17.2 A notice shall be deemed to have been received: if delivered personally, when left at the address referred to in Clause 17.1; if sent by pre-paid first-class post or recorded delivery, at 9.00 am on the second Business Day after posting; if delivered by commercial courier, on the date and at the time that the courier's delivery receipt is signed; or, if sent by email, at the time at which that email has been sent (where the confirmation of sending shall be conclusive evidence of proof that a notice was sent by email).

17.3 The provisions of this Clause 17 shall not apply to the service of any proceedings or other documents in any legal action.

18. Assignment

18.1 The Merchant must not assign, transfer, charge or otherwise encumber, create any trust over, or deal in any manner with, this Agreement or any right, benefit or interest under it, nor transfer, novate or sub-contract any of its obligations under it, without the prior written consent of Medipay (such consent not to be unreasonably withheld or delayed).

18.2 Medipay may, from time to time, assign or subcontract any or all of its rights and obligations under this Agreement to a member of its Group, where, for such purposes, "Group" means, in relation to Medipay, Medipay, any subsidiary or holding company from time to time of Medipay, and any subsidiary from time to time of a holding company of Medipay.

19. Severance

19.1 If any court or competent authority finds that any provision of this Agreement (or part of any provision) is invalid, illegal or unenforceable, that provision or part-provision shall, to the extent required, be deemed to be deleted, and the validity and enforceability of the other provisions of this Agreement shall not be affected.

19.2 If any invalid, unenforceable or illegal provision of this Agreement would be valid, enforceable and legal if some part of it were deleted, the provision shall apply with the minimum modification necessary to make it legal, valid and enforceable.

20. Waiver

20.1 A waiver of any right or remedy under this Agreement is only effective if given in writing and shall not be deemed a waiver of any subsequent breach or default. No failure or delay by a Party to exercise any right or remedy provided under this Agreement or by law shall constitute a waiver of that or any other right or remedy, nor shall it preclude or restrict the further exercise of that or any other right or remedy. No single or partial exercise of such right or remedy shall preclude or restrict the further exercise of that or any other right or remedy.

20.2 Except as expressly provided in this Agreement, the rights and remedies provided under this Agreement are in addition to, and not exclusive of, any rights or remedies provided by law.

21. Third party rights

A person who is not a Party shall not have any rights under or in connection with this Agreement.

22. No partnership

Nothing in this Agreement shall constitute a partnership or employment or agency relationship between the Parties.

23. Governing law and jurisdiction

23.1 This Agreement and any dispute or claim arising out of or in connection with it or its subject matter or formation (including non-contractual disputes or claims) shall be governed by and construed in accordance with the laws of England.

23.2 The Parties irrevocably agree that the courts of England shall have exclusive jurisdiction to settle any dispute or claim that arises out of or in connection with this Agreement or its subject matter or formation.

Merchant Data Consent Schedule

The Merchant has entered into an agreement (the "Agreement") with Medipay Limited ("Medipay") pursuant to which the Merchant has engaged Medipay to perform certain services related to the payment processing services it is procuring from a financial institution (the "Acquirer"). The purpose of this consent is for the Merchant to grant Medipay the right to collect, store and process data in the course of its performance under the Agreement.

Capitalised terms not defined in this consent have the meanings given to them in the Agreement.

The Medipay Privacy Policy, published at https://portal.medipayuk.co.uk/privacy, applies to all Data supplied or processed under this consent.

The Merchant hereby authorises:

1. Medipay;
2. any Other Financial Institution;
3. any Other Payments Organisation (including any Alternative Payment Provider or Card Scheme); and
4. any credit institution at which the Merchant maintains the Merchant Bank Account,

to use, share and release Data and any other information relating to the Merchant, including information relating to the Merchant which is held in connection with the provision of the Medipay Services and/or by the Card Schemes, Other Financial Institutions or Other Payments Organisations (or, if instructed by Medipay, the Merchant shall provide such Data or information or procure that such Data or information is provided), to any Person, including Medipay's affiliates and their respective officers, Card Issuers, Alternative Payment Providers, Card Schemes, the Acquirer, Regulatory Authorities, law enforcement agencies and fraud prevention agencies, and third parties:

(a) for the purpose of fulfilling Medipay's or any Other Financial Institution's obligations under this Agreement, the applicable Third Party Servicer Agreement or the Network Rules or requirements of an Other Payments Organisation (including a Card Scheme or Alternative Payment Provider) or otherwise as required by Applicable Law;

(b) to assess financial and insurance risks;

(c) in relation to any breach of, or to enforce, this Agreement or a Third Party Servicer Agreement;

(d) to recover debt or in relation to the Merchant's insolvency;

(e) to maintain and develop customer relationships, services and systems;

(f) to prevent and detect fraud or crime;

(g) in the course of any investigation by Medipay, any Other Financial Institution, Regulatory Authority, Card Scheme, Other Payments Organisation or any third party into any suspected criminal activity;

(h) regarding information security, the risk of fraud, sector risk and credit risk; and

(i) to enable the Card Schemes to assign a Reason Code to any undesirable act or omission.