This Agreement forms a legally binding contract between Legal Analytics Ltd ("Legal Analytics", "Company", "we") and the clinician or authorised healthcare professional ("User", "you") accessing the Legal Analytics AI platform ("Platform"). By clicking "Accept" or accessing the Platform, you enter a legally enforceable agreement.

1. REGULATORY CONTEXT

The Platform processes highly sensitive health and medical data and operates within regulated environments including:

• UK GDPR

• Data Protection Act 2018

• Common law duty of confidentiality

• NHS Data Security & Protection Toolkit standards

• Clinical risk management frameworks

• Professional regulator standards (GMC, NMC, HCPC etc.)

The Platform is designated as a high-risk information system.

2. PLATFORM ROLE AND LIMITATIONS

Legal Analytics:

• provides AI analytical software

• provides secure data infrastructure

• does NOT provide clinical decision authority

• does NOT assume clinician responsibility

Users retain full responsibility for:

• patient decisions

• clinical interpretation

• lawful data processing

3. ELIGIBILITY

You confirm:

• you are a clinician or authorised medical professional

• you are permitted to access patient data

• you act under lawful authority

• you comply with professional duties

4. DATA PROTECTION ROLES

Where personal data is processed:

• User / employer organisation = Data Controller

• Legal Analytics = Data Processor

Legal Analytics processes data solely to provide platform services.

Users remain responsible for:

• lawful basis

• consent

• data minimisation

• retention

• patient rights

5. UK GDPR ARTICLE 28 PROCESSOR COMPLIANCE

Legal Analytics commits to:

• processing only on documented instruction

• implementing technical and organisational safeguards

• ensuring staff confidentiality

• enabling audits

• supporting controller compliance

• assisting with regulatory obligations

6. STRICT ACCESS CONTROL OBLIGATIONS

Access credentials are personal, non-transferable, and security-critical.

You must NEVER:

• share credentials

• allow colleagues access

• use shared accounts

• permit third-party login

• bypass authentication

Any activity from your account is legally attributed to you.

Credential sharing constitutes:

• material breach

• professional misconduct risk

• contractual liability trigger

7. SECURITY RESPONSIBILITIES

You must:

• secure devices

• prevent screen exposure

• use secure networks

• maintain password integrity

• prevent unauthorised viewing

Negligent security is treated as breach.

8. CONFIDENTIALITY

You must:

• protect patient confidentiality

• access records only for legitimate clinical purposes

• avoid curiosity access

• prevent disclosure

These obligations continue indefinitely.

9. NHS DATA SECURITY & PROTECTION ALIGNMENT

Where NHS data is involved, Users must comply with:

• Data Security & Protection Toolkit standards

• Caldicott principles

• NHS information governance policies

Non-compliance is a contractual breach.

10. CLINICAL SAFETY POSITION (DCB0129 / DCB0160)

Legal Analytics operates as an analytical support system and:

• does not replace clinical judgment

• does not diagnose

• does not prescribe treatment

• does not provide clinical decision authority

Users retain responsibility for:

• interpretation

• clinical validation

• patient safety

Failure to exercise clinical oversight is solely the User's responsibility.

11. MANDATORY INCIDENT & BREACH REPORTING

You must report within 24 hours:

• suspected data breach

• credential compromise

• unauthorised access

• confidentiality incident

• device loss involving access

Failure to report constitutes gross breach.

12. INCIDENT COOPERATION

Users must:

• assist investigations

• provide information

• support regulatory response

• preserve evidence

13. FINANCIAL LIABILITY

Users are financially liable for losses resulting from:

• credential sharing

• negligent data handling

• misuse of the Platform

• failure to report incidents

• unlawful disclosure

• confidentiality breach

Recoverable losses include:

• ICO penalties

• litigation costs

• patient claims

• investigation costs

• cyber incident response

• operational losses

• remediation costs

14. UNLIMITED LIABILITY TRIGGERS

Liability is uncapped where breach involves:

• medical data misuse

• confidentiality breach

• deliberate misconduct

• negligent security

• failure to report breach

• unauthorised disclosure

15. INDEMNITY

Users indemnify Legal Analytics against:

• regulatory enforcement

• claims and litigation

• financial penalties

• reputational damage

• remediation costs

arising from User breach or misuse.

16. ICO ENFORCEMENT DEFENCE POSITION

Users acknowledge:

• Legal Analytics provides infrastructure and safeguards

• regulatory liability may arise from user conduct

• misuse, negligence, or unlawful processing by Users may result in regulatory reporting

Legal Analytics reserves the right to:

• cooperate with the ICO

• disclose relevant activity logs

• pursue recovery of regulatory costs

17. MONITORING AND AUDIT

Legal Analytics may:

• log all system interactions

• audit clinician behaviour

• investigate anomalies

• perform compliance reviews

Users consent to monitoring.

18. BREACH COST RECOVERY SCHEDULE

Where breach arises from User actions, Legal Analytics may recover:

• forensic investigation costs

• regulatory response costs

• incident containment expenses

• legal defence costs

• remediation expenditure

• contractual damages

19. SUSPENSION

Access may be immediately revoked where:

• security risk identified

• breach suspected

• misuse detected

• regulator requires

20. CYBERSECURITY EXPECTATION

Users must maintain:

• secure endpoints

• updated systems

• professional IT hygiene

Negligence triggers liability.

21. LIMITATION OF COMPANY LIABILITY

To the maximum extent permitted by UK law:

Legal Analytics is not liable for:

• clinician negligence

• credential misuse

• unlawful data processing

• professional decisions

• internal organisational breaches

22. INSURANCE EXPECTATION

Users should maintain:

• professional indemnity insurance

• cyber liability insurance

23. GOVERNING LAW

England and Wales.

24. SURVIVAL

The following continue after termination:

• confidentiality

• indemnity

• financial liability

• regulatory cooperation

25. CLICK-ACCEPT REGULATORY DECLARATION

Before accessing Legal Analytics, you must confirm:

By clicking "Accept" you confirm:

• You are authorised to access medical data

• You will NOT share login credentials

• You will report any breach within 24 hours

• You accept monitoring and audit

• You accept financial liability for misuse

• You accept indemnity obligations

• You understand regulatory consequences

Failure to comply may result in:

• access termination

• ICO reporting

• employer notification

• legal action

• financial recovery proceedings