Platform Services Schedule

Platform Services Schedule

This is a Schedule to the Terms and Conditions of Medipay Limited (company number 16145072). This Schedule applies to the Platform Services as stipulated in the Order Form.

Unless the context otherwise requires, the definitions used in the Terms and Conditions apply to this Schedule. Any other terms defined in this Schedule have that meaning for this Schedule only.

1. Interpretation

In this Schedule, the following terms shall have the following meanings unless the context requires otherwise:

"Access Period" the Initial Access Period together with all Renewed Access Periods;

"Access Start Date" the Access Date;

"API" the application programming interface (including the REST API, webhooks and the MCP server) through which the Merchant may access the Platform Services;

"API Integration" the integration between the Merchant's systems and the API;

"Content" content, material, information and/or documentation that the Merchant uploads (or permits to be uploaded) onto Medipay's (or any third party's) servers as part of Medipay's provision of the Platform Services, including practice logos, receipt branding, product and service lists and patient contact details;

"Hosted Payment Page" a Merchant-branded web page hosted by Medipay (or by the Third-Party Gateway on Medipay's instruction) through which, as part of the Platform Services, Customer, Card and Transaction information is collected in fields served by the Third-Party Gateway and submitted to the Acquirer on behalf of the Merchant;

"Initial Access Period" unless otherwise specified in the Order Form, 12 months from the Access Start Date;

"Instalment Plan" a series of connected Transactions in which the Customer pays a deposit and the remaining instalments are collected automatically on the dates set by the Merchant, using a stored payment method held by the Third-Party Gateway;

"Minimum Volume" the minimum number of Transactions the Merchant is to process using the Platform Services in any calendar month during the Access Period, as set out in the Order Form (if any);

"MPTV" maximum permitted transaction volume, as communicated by Medipay to the Merchant from time to time;

"Payment Link" or "Pay-by-Link" a web link created and hosted by Medipay, sent to a Customer by email, SMS or otherwise, through which a Customer is able to input Card and other Transaction Data that is submitted to the Acquirer as part of the Platform Services;

"Platform Fees" the fees paid and payable by the Merchant for use of the Platform Services, as set out in the Order Form;

"Platform Services" the services provided by Medipay to the Merchant for the processing of Data with respect to the authorisation and payment of Transactions through the Medipay Platform, together with the provision of the necessary interface through which authorisation and payment of Transactions takes place, including the merchant portal, Payment Links, the Hosted Payment Page, the Virtual Terminal, Instalment Plans, receipts and reminders, reporting and reconciliation, the API and the integrations with Third Party Servicers made available in the Account;

"Renewed Access Period" has the meaning given to it in Paragraph 2.1;

"Transaction Fees" the Fees payable by the Merchant to Medipay for each Transaction processed using the Platform Services, as set out in the Order Form; and

"Virtual Terminal" the function of the Medipay Platform through which a User keys a Customer's Card details, given by telephone or in person, into fields served by the Third-Party Gateway.

2. Access

2.1 Access to the Platform Services shall commence on the Access Start Date and shall continue, unless terminated earlier in accordance with this Agreement, for the Initial Access Period and shall automatically extend for 12 months ("Renewed Access Period") at the end of the Initial Access Period and at the end of each Renewed Access Period. Either Party may give written notice to the other Party, not later than 30 days before the end of the Initial Access Period or the relevant Renewed Access Period, to terminate the Platform Services at the end of the Initial Access Period or the relevant Renewed Access Period, as the case may be.

2.2 Through the Account, Medipay will allocate to the Merchant access information and functionality for use of the Platform Services; in order for Medipay to allocate such access, the Merchant must provide such information as Medipay may require from time to time.

3. Platform Services

3.1 The Merchant may access the Medipay Platform only:

3.1.1 with a device and browser that is; or

3.1.2 through the API to the extent that it is;

compatible with the Medipay Platform, including any security features that are part of the Medipay Platform (including two-factor authentication and any IP allowlist the Merchant configures).

3.2 Subject to compatibility of Merchant and Customer equipment, systems and browsers, each as determined by Medipay, the Platform Services shall provide for the secure transmission of Card and other Transaction Data from any of: (i) the Merchant; (ii) a Hosted Payment Page; or (iii) a Payment Link to the Acquirer, whilst maintaining records thereof accessible to the Merchant via the Account. Card details are entered directly into fields served by the PCI DSS certified Third-Party Gateway and do not pass through or rest on Medipay's systems.

3.3 The Platform Services are subject to technical specifications prescribed by Medipay; the Merchant shall ensure that its equipment, systems and browsers are within such specifications, such as they may be from time to time.

3.4 In relation to the Platform Services:

3.4.1 Medipay hereby grants to the Merchant a non-exclusive, non-transferable licence to allow Users to use the Platform Services solely for the Merchant's own business purposes and not for any third party;

3.4.2 the rights provided under this Schedule are granted to the Merchant only, and shall not be considered granted to any subsidiary or holding company of the Merchant; and

3.4.3 the Merchant shall not:

3.4.3.1 remove, obscure, or alter any proprietary notices (including copyright notices) affixed to or contained within the Medipay Platform;

3.4.3.2 attempt to copy, duplicate, modify, create derivative works from or distribute all or any portion of the Platform Services except to the extent expressly set out in this Agreement or as may be required by any applicable law;

3.4.3.3 attempt to reverse compile, disassemble, reverse engineer or otherwise reduce to human-perceivable form all or any part of the Platform Services, except as may be required by any applicable law;

3.4.3.4 circumvent any of the technical limitations of the Medipay Platform, or decompile or otherwise reconstruct the Medipay Platform;

3.4.3.5 use the Medipay Platform in a way that could damage, disable, overburden, impair or compromise the Medipay Platform;

3.4.3.6 collect or harvest any information or data from the Medipay Platform or attempt to decipher any transmissions to or from the Medipay Platform;

3.4.3.7 access all or any part of the Platform Services in order to build a product or service which competes with any part of the Platform Services; or

3.4.3.8 use the Platform Services to provide services to third parties other than Customers.

3.5 Medipay is not responsible for any connections, deliverables or services that Medipay is not expressly stipulated to provide in this Agreement.

3.6 Medipay does not warrant that the Platform Services, the Account and/or the Medipay Platform will be secure from unauthorised access. Due to the nature of the Internet, this cannot be guaranteed.

3.7 Medipay may, at Medipay's absolute discretion (subject always to Data Protection Legislation), from time to time either host the Medipay Platform on its own servers or use third-party suppliers to do so in whole or in part. The Merchant acknowledges that Medipay may from time to time without prior notice and without the need for prior agreement provide reasonable additional obligations or requirements on users or reasonably restrict users' rights due to the requirements of the third-party suppliers.

3.8 Medipay reserves the right, at any time, to carry out repairs, maintenance, or introduce new (and/or remove) facilities and functions in respect of all or any part of the Platform Services.

3.9 Medipay does not warrant that the Platform Services will be compatible with all Content.

3.10 Medipay shall be entitled to suspend the Platform Services (or any part thereof) at any time with immediate effect:

3.10.1 for operational reasons such as repair, maintenance or improvement, provided that Medipay shall endeavour to give the Merchant as much notice as is reasonably possible before doing so and shall restore the Platform Services as soon as reasonably practicable following any such suspension;

3.10.2 where Medipay reasonably believes that the continued access of the Platform Services represents a threat or potential threat to the operation, security or functionality of any or all of the following (or any part thereof):

3.10.2.1 the integrity of the Platform Services, including any software or hardware with which it is provided by Medipay;

3.10.2.2 the system or operation of any third party; or

3.10.2.3 any aspect of services provided to a third party by Medipay; and/or

3.10.2.4 where Medipay identifies or reasonably suspects any out-of-character traffic profile attributable or connected to the utilisation of the Platform Services by the Merchant (including MPTV). Medipay will promptly inform the Merchant that the MPTV is being exceeded, ahead of suspending the Platform Services.

The right for Medipay to suspend is designed to protect the Platform Services from risks such as denial of service attacks, and Medipay will take reasonable steps to maintain the Platform Services.

4. Merchant obligations

4.1 In order to use the Platform Services and process Transactions through the Medipay Platform, the Merchant must provide to the Medipay Platform such information as Medipay may require from time to time. The Merchant must ensure that all information is complete and accurate. In particular, every payment request must carry the Customer's name and a payment reference, and the Merchant is responsible for the accuracy of both.

4.2 The Merchant is able to configure API access through the Account. If the Merchant accesses the Platform Services through the API, the following shall apply:

4.2.1 Medipay hereby grants to the Merchant a non-exclusive, non-transferable right during the Access Period to permit the Merchant to use the API solely for the purposes of internally developing its systems to communicate and interoperate with the Platform Services through the API. The Merchant must not:

4.2.1.1 use the API in any manner or for any purpose that infringes, misappropriates, or otherwise infringes any Intellectual Property Right or other right of any person, or that violates any applicable law;

4.2.1.2 design or permit its systems to disable, override, or otherwise interfere with any of Medipay's implemented communications to end users, consent screens, user settings, alerts, warnings, or similar;

4.2.1.3 use the API to replicate or attempt to replace the user experience of the Platform Services;

4.2.1.4 attempt to cloak or conceal its identity or the identity of Users and/or its systems when requesting authorisation to use, or using, the API;

4.2.1.5 (and shall ensure each User does not) except to the extent expressly permitted under this Paragraph 4.2:

a) combine or integrate the API with any software, technology, services, or materials not approved in advance by Medipay;

b) pass or allow access to the API, API keys or webhook signing secrets to any third party; and/or

c) commercially exploit, sell, license or distribute any API or any products and/or services incorporating the results retrieved using the API.

4.2.2 The Merchant's sole means of using the API, for the purposes of Paragraph 4.2.1, shall be in accordance with the API documentation published by Medipay and any integration that Medipay puts in place, in collaboration with the Merchant, during Medipay's setup and integration of the Platform Services with the Merchant's systems.

4.2.3 The Merchant is solely responsible for its integration with the Platform Services through the API (including verifying webhook signatures and handling webhook deliveries idempotently), and Medipay shall not have any liability (subject to Clause 9.2 of the Terms and Conditions) for any failure by the Merchant to properly perform and/or maintain such integration.

4.2.4 Medipay operates a fair usage policy in respect of the Merchant's use of the API. To the extent that Medipay reasonably considers that the Merchant's use does, or is likely to, exceed the fair usage limits that Medipay has in place from time to time, Medipay shall be entitled to (at its absolute discretion):

4.2.4.1 suspend the Merchant's (and/or any User's) right to use and/or access the API, and the Platform Services, on written notice with immediate effect, until such time as Medipay is satisfied that the Merchant's use shall comply with Medipay's fair usage policy; and/or

4.2.4.2 charge the Merchant additional Fees in respect of the excess usage, calculated on the basis of Medipay's normal rates in force for such use from time to time.

4.2.5 Medipay may, at its absolute discretion, suspend the Merchant's or any User's access to and/or use of the API, on written notice with immediate effect, in the event of any breach of this Paragraph 4.2.

4.2.6 Medipay does not warrant that the API will be free from any thing or device (including any software, code, file or programme) which may: prevent, impair or otherwise adversely affect the operation of any computer software, hardware or network, any telecommunications service, equipment or network or any other service or device; prevent, impair or otherwise adversely affect access to or the operation of any programme or data, including the reliability of any programme or data (whether by re-arranging, altering or erasing the programme or data in whole or part or otherwise); or adversely affect the user experience, including worms, Trojan horses, viruses and other similar things or devices.

4.2.7 The Merchant must access and use the API in compliance with Medipay's instructions from time to time.

4.3 The Merchant must:

4.3.1 report any faults or suspected faults with or in the Platform Services to Medipay immediately upon discovery;

4.3.2 be responsible (at its own cost) for providing the telecommunications services and correctly configured hardware that is needed to connect to the Platform Services and the Medipay Platform;

4.3.3 provide details of a systems administrator (the Lead User) who, on behalf of the Merchant, will be familiar with the Platform Services and available to be contacted by Medipay, and provide details of any change to the contact details of the systems administrator;

4.3.4 be responsible for configuration and management of access to the Platform Services including configuration of network, firewall, DNS, routers and any personal computers as well as any integration of the Platform Services into a website, practice management system or call centre application as required by the Merchant (including in all cases the API, if applicable);

4.3.5 allow Medipay to incorporate information of the Merchant (including Transaction information) into the Medipay databases solely for the purpose of providing the Platform Services;

4.3.6 process the Minimum Volume (if any) in any calendar month during the Access Period;

4.3.7 not store Card details on its systems whether in plain text or encrypted form; where the Merchant, with the agreement of the Acquirer, needs to store card details on its systems whether in plain text or encrypted form, the Merchant agrees to notify Medipay in order to be assessed for adherence to PCI DSS requirements. In such a case, the Merchant will be authorised by Medipay to maintain a store of Card numbers only provided that the Merchant is able to provide to Medipay such information and proof of certification as Medipay may request in respect of such requirements in advance of such storage. Stored payment methods used for Instalment Plans and repeat charges are held by the Third-Party Gateway as tokens; the Merchant never receives the underlying Card number;

4.3.8 apply adequate security measures to protect any information accessible through the Medipay Platform. Such information is available to the Merchant for the Merchant's internal purposes only, and the Merchant must not copy or download, or otherwise make available to any third party, any such information for any purpose other than its own accounting, reconciliation and patient administration;

4.3.9 only send Payment Links, receipts and reminders to Customers who have a payment relationship with the Merchant, and never use the Platform Services to send unsolicited marketing; and

4.3.10 report to Medipay any abuse of the Internet (including spam, hacking and phishing) that the Merchant considers to have taken place through the use of the Platform Services and/or the Medipay Platform by any person, and the Merchant must include in such report as much information as the Merchant is able to provide to Medipay relating to the type of abuse that the Merchant has witnessed.

4.4 The Merchant must not in any way use the Medipay Platform, or submit to Medipay or the Medipay Platform, anything which in any respect:

4.4.1 is in breach of any law, statute, regulation or bye-law of any applicable jurisdiction;

4.4.2 is fraudulent, criminal or unlawful;

4.4.3 is inaccurate or out-of-date;

4.4.4 is obscene, indecent, vulgar, discriminatory, offensive, threatening, defamatory or untrue;

4.4.5 is in contravention of any applicable law, nor allow or assist any third party in doing so;

4.4.6 impersonates any other person or body or misrepresents a relationship with any person or body;

4.4.7 may infringe or breach the copyright or Intellectual Property Rights of any third party;

4.4.8 may be contrary to Medipay's interests;

4.4.9 is contrary to any specific rule or requirement that Medipay may stipulate for the Platform Services; or

4.4.10 involves the Merchant's use, delivery or transmission of any viruses, unsolicited communications, Trojan horses, trap doors, cancelbots, back doors, worms, easter eggs, time bombs or computer programming routines that are intended to damage, interfere with, surreptitiously intercept or expropriate any data, personal information or system.

4.5 Access to the Platform Services, the Account and/or the Medipay Platform may be suspended or withdrawn to or from the Merchant or all Users temporarily or permanently at any time without notice. Medipay may also impose restrictions on the length and manner of usage of any part of the Medipay Platform and/or the Platform Services or access for any reason. If Medipay imposes restrictions on the Merchant, the Merchant must not attempt to use the Platform Services, the Account or the Medipay Platform under any other name or user.

4.6 Medipay provides the Merchant with access to the Medipay Platform on an "as is" basis; the Merchant is responsible for maintaining appropriate records in connection with its business activities relating to the Platform Services (the Medipay Platform provides exports for this purpose). Following termination of the Platform Services, the Merchant acknowledges that Medipay will retain Transaction records only for the period required by applicable law and Clause 7 of the Terms and Conditions, and will not otherwise make such information available to the Merchant.

5. Fees

5.1 In consideration of the provision by Medipay to the Merchant of the Platform Services and access to the Medipay Platform, the Merchant shall pay to Medipay:

5.1.1 any setup Fees set out in the Order Form;

5.1.2 the Platform Fees on a monthly basis in arrears; and

5.1.3 the Transaction Fees on a monthly basis in arrears.

Medipay reserves the right to charge any such Fees in advance, at its absolute discretion.

5.2 If in any month the Merchant fails to process the Minimum Volume (where one is set out in the Order Form), the Merchant shall pay the Transaction Fees to Medipay as if the Minimum Volume had been achieved.

6. Termination

In the event that the Platform Services are terminated for any reason, the Merchant will cease to have access to the Platform Services, the Account and the Medipay Platform.

7. Liability

7.1 The Merchant acknowledges that Medipay cannot guarantee uninterrupted, timely or error-free access to the Platform Services and/or the Medipay Platform due to events beyond Medipay's control (including operation of public and private networks by Internet service providers, telecoms providers, hosting, database, gateway and acquiring providers and other third parties), and Medipay may also need to carry out maintenance (whether planned or unplanned, and routine or not) from time to time on the Platform Services and/or the Medipay Platform; however, Medipay shall use its reasonable endeavours to minimise downtime of the Platform Services and the Medipay Platform. Subject to Medipay having used such reasonable endeavours, Medipay does not warrant that the provision of the Platform Services and/or the Medipay Platform will be uninterrupted or error-free.

7.2 For the purposes of Clause 9.4 of the Terms and Conditions, Medipay's total aggregate liability arising out of or in connection with the Platform Services, the Medipay Platform, and otherwise arising under or in connection with this Schedule, shall be limited to 110% of the total amount of Fees paid and payable, in aggregate, by the Merchant to Medipay under this Schedule in the 12 months prior to the date on which the claim first arose.