Healthcare Terms & Conditions Addendum

These Health Information Terms form part of, and are incorporated by reference into, the LeadSmith Assistant Terms of Service available at https://leadsmithassist.com/terms-of-service.html (the "Agreement") between TriLoch Solutions Limited ("TriLoch") and the customer identified at account registration ("Customer"). These Health Information Terms are presented for acceptance whenever Customer identifies as a healthcare organisation during signup. By checking the acceptance box presented at that step, Customer agrees to these Health Information Terms in addition to, and without limiting, the rest of the Agreement. Capitalised terms not defined here have the meaning given in the Agreement.

1. Applicability

These Health Information Terms apply while Customer's account is configured to process Health Information and Customer has identified itself as a healthcare organisation or TriLoch has otherwise approved that configuration. A signup classification does not determine whether Customer is legally a health agency, health service provider, APP entity, covered entity, business associate, or equivalent regulated person; that status depends on applicable law and Customer's activities. Customer must promptly update TriLoch if its status, locations, or intended data use changes.

2. Definitions

(a) "Personal Information" and "Health Information" have the meanings given in the Privacy Act 2020 and Health Information Privacy Code 2020 (NZ), and/or the Privacy Act 1988 (Cth) (AU), as applicable to Customer.

(b) "Applicable Privacy Law" means the privacy and health-information legislation that applies to a party's performance of these Health Information Terms, including, as applicable, the Privacy Act 2020 and Health Information Privacy Code 2020 (New Zealand); the Privacy Act 1988 (Cth) and Australian Privacy Principles; and the Health Records and Information Privacy Act 2002 (NSW), Health Records Act 2001 (Vic), and Health Records (Privacy and Access) Act 1997 (ACT).

(c) "Notifiable Privacy Breach" and "Eligible Data Breach" have the meanings given in Part 6 of the Privacy Act 2020 (NZ) and Part IIIC of the Privacy Act 1988 (Cth) (AU) respectively.

3. TriLoch's Commitments

Subject to Sections 6–9 below (No Warranty, Limitation of Liability, Indemnification, and Statutory Rights), and for as long as Customer's account is configured as a healthcare organisation, TriLoch will use commercially reasonable efforts to:

(a) Maintain the technical and organisational security safeguards set out in Section 4 below;

(b) Use and disclose Health Information only to provide the Service, as instructed by Customer, or as required by law, and not for TriLoch's own purposes;

(c) Bind any subcontractor that will access Health Information to confidentiality and security obligations at least as protective as those in these Health Information Terms;

(d) Notify Customer without undue delay and, where reasonably practicable, within 3 business days after becoming aware of an actual or reasonably suspected privacy or security incident involving loss of, unauthorised access to or disclosure of, or material interference with the availability or integrity of Personal Information or Health Information, and provide information reasonably available to support Customer's assessment and notification obligations under Applicable Privacy Law;

(e) Provide reasonable assistance to Customer in responding to individuals exercising access or correction rights, and in assessing and, where necessary, notifying a Notifiable Privacy Breach or Eligible Data Breach to the New Zealand Privacy Commissioner and/or the Office of the Australian Information Commissioner and affected individuals;

(f) On closure of Customer's account, return or securely delete all Health Information held on Customer's behalf within a reasonable period, unless retention is required by law;

(g) Where a foreign subprocessor stores or processes information, impose written purpose limitation, confidentiality, security, onward-transfer, return or deletion, and incident-notification obligations and provide information reasonably required for Customer's assessment under IPP 12 or HIPC rule 12 and APP 8. The parties acknowledge that the NZ and Australian tests differ and that describing TriLoch as a processor or agent does not, by itself, determine whether a transfer is a disclosure under Applicable Privacy Law.

4. Security Safeguards

• Encryption of data at rest (AES-256) and in transit (TLS 1.2+)
• Role-based access control and multi-factor authentication for administrative access
• Audit logging of access to, and modification of, records containing Health Information
• Automatic session timeout after a period of inactivity (15 minutes for healthcare-organisation accounts)
• Documented risk analysis and risk management process
• Workforce privacy and security training
• Written incident response and breach notification procedures

5. Customer's Acknowledgements

(a) Customer remains responsible, as the health agency or APP entity, for its own compliance with Applicable Privacy Law, including its own notifications to affected individuals and regulators;

(b) Customer will only submit Health Information to the Service that is necessary for Customer's use of the Service;

(c) TriLoch's assistance under Section 3(e) does not transfer Customer's own statutory notification obligations to TriLoch;

(d) Customer has read and accepts the No Warranty, Limitation of Liability, and Indemnification provisions in Sections 6–8 below as part of the basis on which TriLoch offers the Service to healthcare organisations at no additional charge beyond the standard subscription fee.

6. No Warranty

Except as expressly stated in these Health Information Terms, the Service and any assistance provided under these Health Information Terms are provided on an "as is" and "as available" basis. To the maximum extent permitted by law, TriLoch disclaims all warranties, express or implied, including any implied warranty of merchantability, fitness for a particular purpose, or non-infringement, and does not warrant that the Service will be uninterrupted, error-free, or immune from unauthorised access.

7. Limitation of Liability

To the maximum extent permitted by law:

(a) TriLoch's total aggregate liability arising out of or in connection with these Health Information Terms, whether in contract, tort (including negligence), equity, or otherwise, is limited to the total subscription fees paid by Customer to TriLoch in the 12 months immediately preceding the event giving rise to the claim;

(b) TriLoch is not liable for any indirect, special, incidental, consequential, or punitive damages, or for loss of profits, revenue, business, or goodwill, even if TriLoch has been advised of the possibility of such loss; and

(c) Nothing in this Section 7 limits TriLoch's liability for fraud, wilful misconduct, or any other liability that cannot lawfully be limited or excluded.

8. Indemnification

Customer will indemnify TriLoch and its officers, directors, employees, and agents against third-party claims, and resulting losses and reasonable legal expenses, to the extent caused by Customer's unlawful collection or provision of Personal Information or Health Information, material breach of these Health Information Terms or the Agreement, material failure to comply with Applicable Privacy Law, negligence, or wilful misconduct. The indemnity does not apply to the extent the claim was caused by TriLoch's breach, negligence, wilful misconduct, or violation of law.

9. Statutory Rights

Nothing in these Health Information Terms excludes, restricts, or modifies any right or remedy that cannot lawfully be excluded, restricted, or modified — including, where applicable, rights under the Consumer Guarantees Act 1993 or Fair Trading Act 1986 (New Zealand), or the Australian Consumer Law under the Competition and Consumer Act 2010 (Cth). Where such legislation applies to Customer's acquisition of the Service and permits TriLoch to limit the manner or extent of its liability, TriLoch's liability is limited as set out in Section 7.

10. Governing Law

These Health Information Terms, and the Agreement they form part of, are governed by the laws of New Zealand. Each party irrevocably and unconditionally submits to the non-exclusive jurisdiction of the courts of New Zealand. This clause does not exclude any mandatory privacy, health-records, consumer, or other law that applies to a party or to the information because of the relevant activities or location.

11. Term

These Health Information Terms apply for as long as Customer's account is configured as a healthcare organisation and form part of the Agreement for that period. Sections 3(f) (return/deletion), 5, and 6–9 survive closure of Customer's account.

12. Requesting a Bilaterally Executed Agreement

Some organisations — larger clinics, dental groups, or health boards — have procurement processes that require a separately signed contract rather than relying on these clickwrap terms. TriLoch maintains a standing Data Processing & Health Information Agreement, pre-approved and signed on TriLoch's behalf, available on request at [email protected]. That Agreement takes a more mutual approach to liability than Sections 6–8 above, including a mutual limitation of liability and a mutual indemnity, reflecting the negotiated nature of that relationship. These Health Information Terms continue to apply until, and except to the extent, superseded by an executed copy of that Agreement.

13. Amendment of These Health Information Terms

TriLoch may amend these Health Information Terms at any time, for any reason, including to reflect changes to the Service, changes in Applicable Privacy Law or regulatory guidance, or changes in our business operations. Amendments are made on the same basis as amendments to the Terms of Service under Section 14.4 of those Terms, which applies to these Health Information Terms as if set out here in full — in summary:

(a) Non-material amendments take effect on publication;

(b) Material amendments that adversely affect Customer take effect after at least 30 days' notice;

(c) Customer may cancel before a material amendment takes effect, penalty-free and with a pro-rata refund of prepaid fees; and

(d) Amendments required by law, a regulator's direction, or to address a security risk may take effect immediately, with notice as soon as reasonably practicable afterwards.

14. Acceptance and Records

Customer accepts these Health Information Terms by checking the separate acceptance box presented at signup after identifying as a healthcare organisation.

Version 1.1 · Last updated: 21/10/2026