Lummy Terms of Service

1. About these Terms

1.1 These terms (the "Terms") form a contract between Lummy Ltd, a company registered in England and Wales under number 15989826, registered office Lytchett House, 13 Freeland Park, Wareham Road, Poole, Dorset, BH16 6FA, United Kingdom ("Lummy", "we", "us"), and the business that accepts them (the "Client", "you"). The Terms, the Schedules and any Order together form the "Agreement".

1.2 The Services are supplied for business use only. You confirm that you are acting in the course of your business, trade or profession and not as a consumer.

1.3 You accept the Agreement by ticking a box or clicking to accept it, signing or confirming an Order, paying any Fees, or using the Services, whichever happens first. The person accepting confirms that they have authority to bind the Client.

1.4 If there is a conflict, the following order applies: (a) Schedule 2 (Data Protection), to the extent the law requires; (b) these Terms; (c) Schedule 1 (Product Schedules); (d) Schedule 3 (Acceptable Use and AI Policy); (e) the Order. An Order may set the products, Fees, billing period and start date, but it changes any other provision of these Terms only if it names the clause being changed and is confirmed in writing by Lummy.

1.5 The Agreement replaces all earlier terms, proposals and arrangements between you and Lummy, written or oral. It applies to all Services Lummy has provided to you, including Services provided before you accepted it, and to any claim relating to them, whenever it arises.

2. Definitions

2.1 In the Agreement:

• "AI Output" means any content generated by the Services, including spoken and written replies, summaries, transcripts, scripts, captions, ideas, drafts, edited videos and reports.
• "Client Content" means all information and material you or your personnel provide, upload, record or approve, including treatment, pricing and policy information, images, before-and-after photos, videos, documents and instructions.
• "Client Data" means personal data processed by Lummy on your behalf in providing the Services, as described in Schedule 2.
• "End User" means any person who interacts with the Services through your channels, including patients, prospective patients, callers and website visitors.
• "Fees" means the charges set out in the Order, as changed under clause 6.5.
• "Lummy Materials" means the Platform and all software, prompts, configurations, workflows, templates, scripts, designs, formats, know-how and documentation used or created by Lummy, including anything developed while providing the Services to you, but excluding Client Content.
• "Order" means any sign-up form, proposal, quote, checkout page, invoice or written confirmation that sets out the Services you have ordered and their Fees.
• "Platform" means app.lummy.ai and any other web application Lummy makes available to you.
• "Services" means the services described in the Order and Schedule 1, including the Platform.
• "Third-Party Providers" means the third parties whose technology or services Lummy uses to provide the Services, including providers of AI models, voice, telephony, messaging, hosting, email and payment services.
• "Working Day" means Monday to Friday, excluding public holidays in England.

3. The Services

3.1 Lummy will provide the Services described in your Order and the relevant Product Schedule.

3.2 The Services are built on technology supplied by Third-Party Providers. Lummy selects these providers and may add, replace or remove them at any time. Lummy is not responsible for any failure, outage, defect, change or act of a Third-Party Provider.

3.3 Lummy may change, update or withdraw any feature of the Services at any time. If Lummy permanently withdraws a feature that is a material part of the Services you pay for, you may terminate the affected Services by written notice within 30 days of being told. That is your only remedy.

3.4 Free trials, demos, pilots and beta features are provided "as is", may be ended at any time, and carry no liability for Lummy of any kind.

3.5 Before any Service goes live, you will review and test it. By approving go-live, or by using the Service live, you confirm that its configuration and information are accurate and suitable for your use.

3.6 Lummy will provide reasonable support by email during Working Days. No response times, service levels or availability commitments apply unless they are set out in your Order.

4. Nature of AI and limits of the Services

4.1 The Services use artificial intelligence. AI Output is generated automatically and may be inaccurate, incomplete, out of date, inappropriate or inconsistent with your instructions, even when the Services work as designed. Lummy does not guarantee the accuracy or suitability of any AI Output.

4.2 The Services are administrative and communication tools. They do not provide, and must not be used to provide, medical, dental or other clinical advice, diagnosis, triage, prescribing or treatment. They are not a medical device.

4.3 The Services are not an emergency service and are not monitored by Lummy in real time. Where the AI phone service identifies an emergency, it is designed to direct the caller to the emergency number of the relevant country. Any other urgent or out-of-hours routing must be specified by you in writing, and you are responsible for its adequacy. Lummy does not guarantee that any emergency or urgent situation will be recognised.

4.4 You are responsible for reviewing all summaries, transcripts, leads, messages and notifications, and for following up with End Users promptly. Lummy has no duty to monitor conversations, to alert you to any conversation, or to contact any End User.

4.5 You are solely responsible for any decision you make or action you take on the basis of AI Output, and for anything you publish, post or send.

4.6 Any statistics, results, case studies, estimates or projections provided by Lummy, including on its website, are illustrative only. Lummy does not guarantee any increase in patients, bookings, revenue or time saved.

5. Your responsibilities

5.1 You will provide, and keep accurate and current, the information the Services rely on, including treatments, prices, policies, opening hours, booking links, staff details and urgent-routing instructions. You will notify Lummy in writing of any change. Lummy will update the Services within a reasonable time after notice. Until then, the Services will use the last information you provided.

5.2 You are solely responsible for all Client Content and for all content you record, upload, approve, publish, post or send using the Services or AI Output, including videos, images, before-and-after photos, captions, scripts, website content, emails, review replies and messages. You are responsible for ensuring that this content is accurate, lawful, and compliant with all advertising, professional, regulatory and platform rules that apply to you. Lummy only provides tools to edit, generate and draft such content.

5.3 You are responsible for giving End Users all notices, and obtaining all consents and permissions, that the law requires for your use of the Services. This includes telling End Users that they are interacting with an AI system, that calls and chats may be recorded and transcribed and processed by your suppliers, and obtaining the consent of every person who appears in images or videos you provide. Annex A contains suggested wording, which you use at your own discretion and responsibility.

5.4 You remain solely responsible for patient care and for your professional, regulatory, licensing and confidentiality obligations.

5.5 You are responsible for your accounts on the Platform, for keeping access to them secure, for every person you invite, and for all activity under your accounts. You will notify Lummy promptly of any unauthorised access.

5.6 You will give Lummy the access, information and approvals it reasonably needs, on time. Lummy is not responsible for delays or failures caused by you or your suppliers.

5.7 You are responsible for your own systems and suppliers, including your website, cookie banner, phone lines, call forwarding, booking software and email. Lummy is not responsible if a change made by you or your suppliers stops the Services from working, reduces their performance, or prevents them from being shown.

5.8 If any law that applies to you requires a specific written agreement with a supplier that handles health information, in addition to Schedule 2, you must tell Lummy in writing before using the Services. Lummy has no obligation to enter into any such agreement. Unless one has been signed by Lummy, you must not use the Services in any way that would require it, and you are responsible for compliance with that law.

5.9 You will comply with Schedule 3 (Acceptable Use and AI Policy), and ensure that your personnel do so.

6. Fees and payment

6.1 You will pay the Fees set out in your Order. Fees are exclusive of VAT and any other applicable taxes, which you will also pay.

6.2 Fees are charged in advance for each billing period, which is monthly unless your Order states otherwise, by card or direct debit through Lummy's payment provider, or by invoice. Invoices are payable on receipt.

6.3 Any usage limits, and any charges for usage above them, are set out in your Order.

6.4 If any amount is unpaid 7 days after its due date, Lummy may suspend all or part of the Services without liability until it is paid in full. Fees remain payable during any suspension.

6.5 Lummy may change the Fees by giving at least 30 days' written notice by email or through the Platform. If you do not accept the change, you may terminate the Agreement by written notice before the change takes effect. Otherwise, the new Fees apply from the first billing period after the notice period ends.

6.6 All Fees are non-refundable, including for partial billing periods, unused features, periods of suspension, and termination for any reason. The only exception is termination by Lummy under clause 7.2, where Lummy will refund any Fees you have prepaid for the period after termination.

6.7 If you have paid in advance for a period longer than one month, that payment is non-refundable. Termination takes effect at the end of that prepaid period.

6.8 You will pay all amounts in full, without any set-off, deduction or withholding.

7. Term, suspension and termination

7.1 The Agreement starts on the earlier of your acceptance and the date Lummy first provides any Service to you. It continues on a rolling basis until terminated.

7.2 Either party may terminate the Agreement, or any individual Service, by giving at least 30 days' written notice to the other. Email is sufficient. Fees remain payable until the termination takes effect.

7.3 Lummy may suspend or terminate all or part of the Services immediately, by notice, if: (a) any amount is overdue; (b) you breach clause 5.2, 5.3, 5.8 or Schedule 3; (c) your use of the Services exposes Lummy, an End User or any third party to risk of harm, liability or legal action; (d) you become insolvent, enter administration or liquidation, or stop trading; (e) a Third-Party Provider stops providing something the Services depend on; or (f) a law, court or regulator requires it.

7.4 You may terminate the Agreement immediately by written notice if Lummy materially breaches it and fails to remedy the breach within 30 days of receiving written notice describing it.

7.5 On termination: (a) your right to use the Services ends; (b) all unpaid Fees become due immediately; (c) you are responsible for removing Lummy's code from your website and for changing any call forwarding, phone numbers and links that point to the Services; (d) for 30 days you may ask Lummy to provide a copy of Client Data that is still available, after which Lummy will delete or anonymise it as set out in Schedule 2, except where the law requires it to be kept or where it remains in backups until they are overwritten.

7.6 Any clause that by its nature should continue after termination will continue, including clauses 4, 8, 9, 10, 11, 12, 13 and 17.

8. Intellectual property

8.1 Lummy and its licensors own all intellectual property rights in the Lummy Materials and the Services. Nothing in the Agreement transfers them to you, except as set out for website code in Schedule 1.

8.2 During the Agreement, Lummy grants you a non-exclusive, non-transferable right to use the Services for your own business.

8.3 You own the Client Content. You grant Lummy a worldwide, royalty-free licence to use, copy, store, modify, edit and process the Client Content to provide, maintain, support and improve the Services, and as set out in clause 9.

8.4 As between you and Lummy, you may use the AI Output delivered to you for your own business. Lummy keeps all rights in the templates, styles, formats and other Lummy Materials used to create it. AI Output may be similar to output generated for other clients. Lummy does not promise that AI Output is unique or that it does not infringe the rights of others; you are responsible for checking it before you use or publish it.

8.5 Lummy may use any feedback or suggestions you give, without restriction or payment.

8.6 Lummy may name you as a client and display your name and logo on its website and marketing materials, during the Agreement and for 12 months after it ends. You may withdraw this permission by email at any time, and Lummy will remove your name and logo within 30 days. Lummy will use testimonials, quotes or recordings of you or your personnel only with your consent.

9. Data

9.1 For Client Data, you are the controller and Lummy is your processor. Schedule 2 applies.

9.2 Lummy will not use personal data about End Users for its own purposes and will not sell it. Lummy may create aggregated or anonymised data from the use of the Services, which does not identify any End User or, without your consent, you. Lummy may use that data for any purpose, including to operate, secure and improve the Services, for statistics and benchmarks, and in its marketing.

9.3 Lummy's Privacy Policy explains how Lummy, as controller, handles personal data about you and your personnel, such as account and billing contacts.

10. Confidentiality

10.1 Each party will keep confidential all non-public information it receives from the other about its business, and will use it only to perform or receive the Services. This does not apply to information that is or becomes public through no fault of the receiving party, that it already lawfully had, or that it must disclose by law. Each party may share confidential information with its personnel, Third-Party Providers and professional advisers who need to know it and are bound by confidentiality.

10.2 This clause continues for 3 years after the Agreement ends. Client Data is protected for as long as Lummy holds it, under Schedule 2.

11. Warranties and disclaimers

11.1 Lummy will provide the Services with reasonable skill and care.

11.2 If Lummy breaches clause 11.1 and you notify Lummy in writing, Lummy will, at its option, correct or re-perform the affected Service. If Lummy cannot do so within a reasonable time, you may terminate the affected Service immediately. This is your sole and exclusive remedy for breach of clause 11.1.

11.3 Except as expressly set out in the Agreement, the Services and AI Output are provided "as is" and "as available". All warranties, conditions and other terms implied by statute, common law or otherwise are excluded to the fullest extent permitted by law, including terms as to satisfactory quality, fitness for purpose, accuracy and non-infringement.

11.4 In particular, Lummy does not warrant that: (a) the Services will be uninterrupted, secure or error-free; (b) AI Output will be accurate, complete or appropriate; (c) every call or message will be answered, understood, recorded, transcribed, summarised or delivered; (d) the Services will be compatible with your systems; or (e) you will achieve any particular result.

11.5 You warrant that: (a) you have authority to enter into the Agreement; (b) you have all rights, licences, consents and permissions needed for Lummy to use the Client Content and Client Data as set out in the Agreement; and (c) your use of the Services complies with all laws and rules that apply to you.

11.6 You confirm that, in entering into the Agreement, you have not relied on any statement, representation, assurance, demonstration, marketing material, website content, statistic or promise that is not expressly set out in the Agreement. Nothing in this clause limits liability for fraudulent misrepresentation.

12. Limitation of liability

12.1 Nothing in the Agreement limits or excludes any liability for: (a) death or personal injury caused by negligence; (b) fraud or fraudulent misrepresentation; or (c) any other liability that cannot be limited or excluded by law. Clauses 12.2 to 12.4 do not limit your obligation to pay the Fees or your liability under clause 13.

12.2 Lummy will not be liable to you, whether in contract, tort (including negligence), breach of statutory duty or otherwise, for any of the following, each of which is a separate and severable exclusion:

• (a) loss of profits, revenue, business, patients, bookings, appointments, contracts or anticipated savings;
• (b) loss of goodwill or damage to reputation;
• (c) loss, corruption or destruction of data, except Lummy's obligation to restore data from any backup it holds;
• (d) wasted expenditure or management time;
• (e) any indirect, special or consequential loss;
• (f) loss arising from AI Output, or from your or any End User's reliance on it;
• (g) loss arising from any call, message, enquiry or emergency that is missed, not answered, misunderstood, misrouted or not followed up;
• (h) loss arising from Client Content or from content you publish, post or send;
• (i) loss caused by a Third-Party Provider, or by your systems, suppliers or changes;
• (j) fines, penalties or sanctions imposed on you by any regulator or authority.

12.3 Subject to clauses 12.1 and 12.2, Lummy's total aggregate liability arising out of or in connection with the Agreement, whether in contract, tort (including negligence), breach of statutory duty or otherwise, will not exceed the total Fees you paid to Lummy in the 12 months immediately before the event giving rise to the claim. During any free trial or pilot, it will not exceed £100.

12.4 You must notify Lummy in writing of any claim, with reasonable detail, within 12 months of the event giving rise to it. Any claim not notified within that period is waived.

12.5 Lummy's liability will be reduced to the extent any loss is caused or contributed to by you, your personnel, an End User or any third party.

12.6 Lummy's directors, officers, employees and contractors have no personal liability to you in connection with the Agreement. You agree not to bring any claim against any of them personally. Each of them may enforce this clause.

13. Your indemnity

13.1 You will indemnify Lummy and its directors, officers, employees and contractors against all losses, liabilities, damages, fines, costs and expenses (including reasonable legal fees) arising from or in connection with:

• (a) Client Content, or any content you record, upload, approve, publish, post or send;
• (b) your breach of the Agreement, or of any law or rule that applies to you, including data protection, consent, notice, call-recording, marketing, advertising and professional rules;
• (c) any claim by an End User, patient, regulator or other third party relating to your services, care or treatment, your use of the Services, or any AI Output provided through your channels, including any claim that alleges negligence by Lummy.

13.2 Clause 13.1 does not apply to the extent a loss is finally determined by a court to have been caused by Lummy's fraud or wilful misconduct.

13.3 Lummy will notify you of any claim covered by clause 13.1. Lummy may choose to conduct the defence itself at your cost, or ask you to conduct it, in which case you will not settle it without Lummy's written consent.

14. Events beyond Lummy's control

14.1 Lummy is not liable for any delay or failure caused by events beyond its reasonable control. These include failures or changes of Third-Party Providers, internet, telecommunications or power failures, cyberattacks, changes in law, and changes in the policies of AI, telephony or platform providers.

15. Notices

15.1 Notices to you may be sent to the email address of any account owner or billing contact, or through the Platform. Notices to Lummy must be sent to contact@lummy.ai. An email notice is treated as received on the next Working Day after sending.

16. Changes to these Terms

16.1 Lummy may change these Terms or any Schedule by giving at least 30 days' notice by email or through the Platform. Changes required for legal, regulatory or security reasons may take effect sooner if necessary.

16.2 If you do not accept a change, you may terminate the Agreement by written notice before the change takes effect. If you continue to use the Services after that date, you accept the change.

16.3 No other change to the Agreement is effective unless it is in writing and confirmed by Lummy.

17. General

17.1 Entire agreement. The Agreement is the entire agreement between the parties about its subject matter.

17.2 Assignment and subcontracting. Lummy may assign, transfer or subcontract any of its rights or obligations. You may not do so without Lummy's prior written consent.

17.3 Severability. If any provision, or part of one, is found invalid or unenforceable, it will be modified to the minimum extent needed to make it enforceable, or otherwise deleted. The rest of the Agreement is not affected.

17.4 Waiver. A delay or failure to exercise a right is not a waiver of it.

17.5 Third-party rights. Only the parties, and the persons named in clauses 12.6 and 13.1, may enforce the Agreement. The parties may vary or end it without anyone else's consent.

17.6 Relationship. Nothing in the Agreement creates a partnership, joint venture or agency between the parties.

17.7 Electronic acceptance. Acceptance by electronic means is as binding as a signature.

17.8 Language. The Agreement is written in English. If it is translated, the English version prevails.

17.9 Disputes. The parties will first try to resolve any dispute in good faith for 30 days after one of them gives written notice of it. This does not prevent either party from seeking urgent court relief.

17.10 Governing law and jurisdiction. The Agreement, and any dispute or claim arising out of or in connection with it (including non-contractual disputes or claims), is governed by the law of England and Wales. The courts of England and Wales have exclusive jurisdiction.

Schedule 1 — Product Schedules

Each part of this Schedule applies only to the products included in your Order. The Terms apply to every product.

Part 1 — AI Phone

1.1 The AI Phone answers calls that reach it under the call-forwarding or routing settings you control, for example when your team does not pick up or outside opening hours. You decide when calls are forwarded and are responsible for those settings.

1.2 The assistant identifies itself as an AI at the start of each call and can pass the caller's request to your team. Depending on configuration, it may send text messages with booking links, and send call summaries or transcripts to you by email or through the Platform.

1.3 Clause 4.3 of the Terms (emergencies) applies. You must tell Lummy in writing of any urgent-routing arrangement you want, such as an on-call number, and keep it current.

1.4 Call quality, recognition of speech and accents, caller identification, and the delivery of text messages and emails depend on networks and Third-Party Providers. Lummy does not guarantee them.

1.5 You are responsible for telling callers how their calls are handled, including that the assistant is an AI and that calls are transcribed. Lummy can add a short announcement to the greeting at your request.

1.6 Any phone number Lummy provides remains Lummy's or its provider's. It cannot be transferred to you unless Lummy agrees in writing. On termination, you are responsible for updating any place where that number is published.

Part 2 — AI Chatbot

2.1 The AI Chatbot answers website visitors' questions using the information you provide, and can capture enquiries and pass them to you by email or through the Platform.

2.2 You are responsible for installing the chatbot code on your website, or for giving Lummy the access needed to do so, and for keeping it installed and visible. This includes configuring your cookie banner and consent tools.

2.3 If you provide images for the chatbot to show, including before-and-after photos, you confirm that you have the consent of every person shown and that their use complies with the rules that apply to you.

Part 3 — Lummy Create

3.1 Lummy Create lets you upload videos you have recorded, and uses automated tools to edit them into short-form social media content, such as Reels, captions, covers and carousels. It may also suggest topics, ideas and scripts.

3.2 You are the sole author, owner and publisher of the content. Lummy provides editing tools only. Lummy does not publish or post anything on your behalf.

3.3 You must review all edited content before you publish it. Clause 5.2 of the Terms applies in full, including responsibility for medical and treatment claims, prices, before-and-after images, consents of everyone who appears, and the rules of each social media platform.

3.4 Topics, ideas and scripts are suggestions only. They may be similar to suggestions made to other clients.

3.5 Any third-party assets included in edited content, such as music, fonts or effects, may be used only in that content on your own channels.

3.6 Lummy does not guarantee how long uploaded videos and edited content are stored, and may delete them. You are responsible for downloading and keeping your own copies.

3.7 Where Lummy Create is charged in credits: (a) credits have no cash value and cannot be exchanged, transferred or refunded; (b) credits included in a plan expire at the end of each billing period, and credits bought as top-ups expire at the end of the period stated when they are bought; (c) all unused credits are cancelled, without refund, when the Agreement or Lummy Create ends; and (d) Lummy decides how many credits each action uses and may change this by notice through the Platform.

Part 4 — Platform

4.1 The Platform gives you access to Lummy products and to information about your Services, such as conversations, summaries, transcripts, enquiries and dashboards. Login is by one-time codes sent to email.

4.2 You decide who is invited to your account and what they can see. Every person you invite acts on your behalf.

4.3 Lummy does not guarantee that the Platform will be available at any time, or that any figures, dashboards or statistics shown in it are complete or accurate. Features marked as beta or preview are provided "as is".

Part 5 — Website Build

5.1 Lummy designs and builds your website for the one-off build fee, and hosts and maintains it for the monthly Fee, as set out in your Order.

5.2 You provide and approve all content on the website and are solely responsible for it, including its accuracy and its compliance with advertising, professional and regulatory rules. You are also responsible for the website's privacy notice, cookie notice and cookie consent settings.

5.3 Search engine optimisation, paid search and online advertising are not included. Lummy does not guarantee any search ranking, traffic or enquiries.

5.4 Minor changes requested by you are included in the monthly Fee, within reasonable limits set by Lummy. Larger changes, new pages or redesigns are charged separately at Lummy's rates, agreed in advance.

5.5 You own or control your domain name. If Lummy registers a domain on your behalf, it will transfer it to you on termination, once all Fees are paid.

5.6 Where hosting is set up in an account in your name, you are responsible for complying with that hosting provider's terms.

5.7 Lummy owns the website code during the Agreement. On termination, once all Fees are paid, Lummy will hand over the code specific to your website and your content, and transfer its rights in that code to you. Lummy keeps its rights in reusable components, templates and tools, and grants you a perpetual, non-exclusive licence to use them as part of your website.

Part 6 — Inbox and Review Tools

6.1 The inbox tools draft replies to emails you paste in or, where you choose to connect an email account, to emails in that account. Any access you grant is used only to provide this feature, and you may revoke it at any time. Drafts are not sent unless you send them.

6.2 The review tools draft replies to online reviews, and may send review requests to people you select. You must review each reply before posting it. You confirm that you are entitled to send each review request, and that your requests comply with the rules of the review platform, including rules against incentivised or selective requests.

6.3 Where you use a job post or CV upload page, you are the controller of applicants' data, and Schedule 2 applies to it.

Part 7 — AI Search Visibility

7.1 Lummy periodically checks how your clinic appears in answers given by AI search and chat tools, and may report its findings and suggest content.

7.2 These tools are operated by third parties that Lummy does not control. Their answers change over time and vary between users, so all findings are indicative only.

7.3 Lummy does not guarantee that your clinic will be mentioned, cited, recommended or ranked by any AI tool or search engine, or any resulting traffic or enquiries.

7.4 You decide whether to publish any suggested content, and clause 5.2 of the Terms applies to it.

Schedule 2 — Data Protection

This Schedule contains the terms data protection law requires between a controller and its processor. It applies whenever Lummy processes Client Data.

1. Roles and definitions

1.1 "Data Protection Laws" means all laws on the processing of personal data that apply to either party, including the UK GDPR, the EU GDPR and any equivalent law. "Controller", "processor", "personal data", "processing", "data subject" and "personal data breach" have the meanings given in those laws.

1.2 You are the controller of Client Data and Lummy is your processor. You are responsible for having a lawful basis for the processing, for giving data subjects the required information, and for ensuring that your instructions comply with Data Protection Laws.

1.3 You will configure and use the Services so that only the personal data needed for your purposes is collected.

2. Lummy's obligations

2.1 Lummy will:

• (a) process Client Data only on your documented instructions, which are the Agreement, the configuration of the Services, and any further written instructions agreed by Lummy, unless the law requires otherwise, in which case Lummy will tell you first unless the law prohibits it;
• (b) tell you if, in its opinion, an instruction infringes Data Protection Laws, and may suspend the affected processing until the instruction is changed;
• (c) ensure that its personnel who process Client Data are bound by confidentiality;
• (d) implement appropriate technical and organisational measures to protect Client Data, taking into account the state of the art, the cost, and the nature of the processing;
• (e) taking into account the nature of the processing, provide reasonable assistance to help you respond to data subjects' requests and to meet your obligations on security, breach notification, impact assessments and prior consultation, at your cost where the assistance goes beyond the normal operation of the Services;
• (f) notify you without undue delay after becoming aware of a personal data breach affecting Client Data, with the information reasonably available to it;
• (g) on termination, delete or anonymise Client Data after the 30-day period in clause 7.5 of the Terms, unless the law requires it to be kept, except for copies in backups, which are deleted in the ordinary course; and
• (h) make available the information reasonably necessary to demonstrate compliance with this Schedule, as set out in section 4.

2.2 If a data subject contacts Lummy directly about Client Data, Lummy will refer them to you and will not respond itself, unless the law requires otherwise.

3. Sub-processors and transfers

3.1 You give Lummy general authorisation to engage sub-processors, including the categories listed in the table below. Lummy will impose data protection obligations on each sub-processor that are consistent with this Schedule, and remains responsible for their performance under it, subject to the limits in clause 12 of the Terms.

3.2 You authorise Lummy and its sub-processors to transfer Client Data outside the UK and the European Economic Area, provided that a transfer mechanism recognised by Data Protection Laws is in place, such as an adequacy decision or approved standard contractual clauses.

4. Audits

4.1 Lummy will answer reasonable written questions about its compliance with this Schedule, no more than once in any 12-month period.

4.2 If written answers are not enough to demonstrate compliance, or a regulator requires it, you may carry out an audit, at your cost. You must give at least 30 days' notice, use an auditor bound by confidentiality who is not a competitor of Lummy, and limit the audit to Lummy's own records relating to Client Data, during Working Day business hours. Lummy may charge for its time at its reasonable rates.

5. Liability

5.1 Each party's liability under this Schedule is subject to clauses 12 and 13 of the Terms.

6. Details of processing

Schedule 3 — Acceptable Use and AI Policy

You, and anyone using the Services through your account, must not use the Services, or allow them to be used, to do any of the following.

1. Clinical and safety

• (a) Provide or appear to provide medical, dental or other clinical advice, diagnosis, triage, prescribing or treatment, or configure the Services to do so.
• (b) Present the Services as an emergency service, or as monitored by a person when they are not.
• (c) Remove or alter the Services' disclosure that the End User is interacting with an AI, or present the AI as a human.

2. Content

• (a) Upload, publish or send content that is unlawful, false, misleading, defamatory, discriminatory, harassing, obscene or harmful.
• (b) Make claims about treatments, results, prices or qualifications that you cannot substantiate, or that break the advertising, professional or regulatory rules that apply to you.
• (c) Upload or publish images, videos or information of any person without the consent the law requires, including patients, staff and children.
• (d) Infringe anyone's intellectual property, privacy or other rights.

3. Data and messaging

• (a) Use the Services to collect payment card numbers, bank details, government identification numbers or passwords.
• (b) Collect more personal data than you need, or use it for purposes your End Users have not been told about.
• (c) Send unsolicited marketing, spam, or messages to people you are not entitled to contact.
• (d) Post fake reviews, or offer incentives for reviews, or request reviews selectively in breach of platform rules.

4. Security and the Platform

• (a) Share login codes or accounts with anyone outside your organisation.
• (b) Attempt to access accounts, systems or data you are not authorised to access, or bypass any security or usage limit.
• (c) Copy, extract, reverse engineer or disclose the prompts, configurations or workflows behind the Services.
• (d) Resell, sublicense or provide the Services to third parties, or use them to build a competing product or service.
• (e) Introduce malicious code, overload the Services, or use automated means to access them, except as Lummy permits.

5. Enforcement

Lummy may, without liability, remove or disable any content, and suspend or terminate any Service or account, if it reasonably believes this policy has been breached. Lummy may report suspected unlawful activity to the relevant authorities.

Annex A — Suggested wording for clinics

Clinics are legally required to tell their patients that an AI answers their calls and chats and that a supplier processes the data. This annex gives them ready-made text to paste into their own privacy notice. Lummy provides it as a suggestion only (clause 5.3). The clinic decides whether it is adequate.

For the clinic's privacy notice

AI assistant on our phone line and website. When our team cannot answer, calls to [clinic name] and chats on our website may be handled by an AI assistant. It answers questions about our services, helps you book, and passes your enquiry to our team. It does not give medical advice. In an emergency, call [local emergency number]. Calls and chats with the assistant may be recorded and are transcribed so our team can follow up. We use a technology supplier, Lummy Ltd, and its service providers to run the assistant. They process your information only on our behalf and under a written agreement, and some of them may be located outside [the UK / the EEA], with appropriate safeguards in place. See the rest of this notice for how long we keep your information and your rights.

For the call greeting (optional)

"Hi, I'm [assistant name], [clinic name]'s AI assistant. This call may be recorded and transcribed so our team can follow up."

For anyone filmed for Lummy Create

Get written consent from every person who appears in a video, including patients and staff, covering its use on your social media channels. For patients, keep a record of that consent.