Document reference: VP-SIAAS-SA-2026-DRAFT-0.1 · Status: SPECIMEN / DRAFT for review — not legal advice, and not
to be issued to a client until a solicitor has reviewed it and every [DECISION] below has been answered.
Annex to: SIAAS — Technical Specification (VP-SIAAS-TS-2026-V3.0),
whose defined terms and measured facts this agreement relies on.
The Service Provider: VeriPath Ltd ("VeriPath", "we").
The Client: the GP practice, dental practice or pharmacy named in Schedule A ("the Client", "you"), which is the
data owner for the records held on its client-vps.
(A) VeriPath supplies and operates software for GP practices, dental practices and pharmacies, and runs it on infrastructure
it controls — the primary server and the app engine.
(B) The Client's records are not held on that infrastructure. They live on a client-vps: a virtual private server held
under the Client's own hosting account, connected to VeriPath's application only by a tunnel the client-vps itself opens.
(C) The parties want the terms on which VeriPath supplies and maintains the software, and the terms on which the Client
holds its own data and infrastructure, set out in one agreement.
(D) The technical detail — what runs where, how the connection works, what each party holds — is in the Technical
Specification, which forms part of this agreement.
Terms defined in the Technical Specification §2 have the same meaning here. In addition:
2.1 VeriPath will provide: the application, its user interfaces and background workers; the platform's reference data
(clinical terminology and medicines reference); updates, fixes and new versions of the software; and the maintenance of the
client-vps described in clause 7.
2.2 VeriPath will not hold Client Data on its own infrastructure. The application relays Client Data between the Client's
browser and the client-vps, and does not persist it. The Client's records remain on the client-vps.
2.3 The client-vps itself, and the hosting account it runs in, are the Client's. VeriPath does not host the Client's data
and is not the Client's hosting provider.
2.4 Support arrangements, hours and response targets are in Schedule B. [DECISION — support hours and response targets.]
3.1 This Agreement begins on the date it is signed and has two phases: the Build and Handover phase (clause 4 and
clause 5) and the Service term (clause 3.2).
3.2 The Service term begins at Handover and continues for the period in Schedule A, renewing automatically unless either
party gives notice under clause 15. [DECISION — initial term and renewal period.]
3.3 The Build and Handover phase has no charge unless Schedule E says otherwise. [DECISION — whether setup is charged.]
4.1 At the Client's request VeriPath will procure the client-vps on the Client's behalf: the hosting account is opened
in the Client's name, and the Client is the account holder from the outset.
4.2 VeriPath acts only as the Client's agent for procurement and installation. VeriPath acquires no ownership interest in
the account, the server or the data, and has no authority to terminate the account.
4.3 During the Build and Handover phase VeriPath holds the account's initial credentials, solely to provision the server and
install the software. It will not use them for any other purpose.
4.4 The Client will pay the hosting charges directly, or reimburse VeriPath if Schedule E records that VeriPath pays them on
the Client's behalf. [DECISION — who pays the hosting provider, and how it is recharged.]
4.5 If the Client already holds a suitable account, this clause 4 does not apply and VeriPath will install into it.
5.1 Handover follows the sequence in Technical Specification §5.1. In this Agreement, the parties agree that VeriPath will:
(a) install the stack — database, object store, image server where applicable, client tunnel and maintenance agent;
(b) run the handover checks in Schedule F with the Client or its representative present;
(c) ensure the first inventory has reported and is visible in the Client's own maintenance view;
(d) hand over the hosting account credentials and the database credentials;
(e) remove any access key of its own and verify the removal by a failed login attempt;
(f) record the handover as a Maintenance Record, stating that the temporary credential was issued and terminated.
5.2 The Client will, at or immediately after Handover, change the hosting account password and the database password to
values VeriPath has never seen, and will keep them confidential.
5.3 From the completion of clause 5.1(e), VeriPath holds no login on the client-vps. VeriPath warrants that it holds no
standing credential that would allow it to log in to the client-vps, and the parties agree that the only remaining path is
the tunnel the client-vps opens itself, carrying the database protocol.
5.4 If the Client later asks VeriPath to carry out work on the machine itself, that access is a separate, written,
time-limited grant, recorded as a Maintenance Record, and terminated at the end of that work. No such grant may become
standing by default.
5.5 VeriPath will not ask the Client for the hosting account password, and the Client should not send it.
6.1 The Client owns its data. Nothing in this Agreement transfers any right in Client Data to VeriPath.
6.2 The Client is the Controller of Personal Data in Client Data. VeriPath is a Processor to the extent it processes
Personal Data in providing the Service. Schedule C (Data Processing) applies.
6.3 The Client is responsible for its own DSPT/DTAC position as data controller, and for its own hosting provider
relationship. VeriPath will provide the technical information a controller needs for those assessments, and the Technical
Specification is written to be used for that purpose.
6.4 VeriPath is responsible for its own DSPT position as a supplier and processor, and will maintain it.
6.5 VeriPath will not access Client Data except where necessary to provide the Service and within the Client's documented
instructions. Because VeriPath holds no login on the client-vps, day-to-day access happens only through the Client's
application session; any deeper access requires the separate grant in clause 5.4.
7.1 VeriPath will maintain the client-vps as set out in Technical Specification §3.7, summarised as:
(a) security updates to the operating system, continuously, automatically;
(b) the rest of the operating system, monthly, in the client-vps's own quiet slot;
(c) packaged software (the database engine, and the radiograph store where used), quarterly, planned and staggered.
7.2 No restart is silent. A restart that the Client would notice is notified in advance. A security-critical update that
cannot take effect without a restart proceeds in a quiet window after 7 days' notice. Anything else requiring a restart
proceeds after 30 days, with a second notice. The Client may veto a specific window by replying to the notice.
7.3 Each run produces a Maintenance Record. The Client can read them in the application and export them as CSV. Those
records are the evidence of maintenance, and the Client may rely on them for audit.
7.4 VeriPath will not use the unavailability caused by maintenance to suspend the Service, and maintenance windows are not
counted against availability in Schedule B.
7.5 VeriPath will announce material changes to the maintenance cadence at least 30 days in advance. The current cadence
is Schedule B.
8.1 VeriPath will: keep the application layer patched; keep the client-vps's operating system and packaged software
patched as clause 7 requires; hold no standing login to the client-vps after Handover; keep the app engine's connection
pooling credentials separated so that the web process cannot administer the pooler; and log connections.
8.2 The Client will: keep the hosting account credentials confidential and change them at Handover; control who in its
organisation has access to the application; tell VeriPath promptly of anything that looks wrong on its side; and not
disable the tunnel, the maintenance agent or the automatic update service without telling VeriPath.
8.3 Incident notification. Each party will notify the other without undue delay, and in any event within 72 hours, of
any incident affecting the Service or Client Data, and will co-operate on investigation, containment, notification to
regulators and data subjects, and remediation. Where the Client is the Controller, the Client decides on regulatory
notification; VeriPath will supply what the Client needs to do so. [DECISION — whether 72 hours is the agreed threshold, and
whether a shorter one applies to suspected unauthorised access.]
8.4 Right to verify, not to enter. The Client may verify that VeriPath holds no login on the client-vps by attempting to
confirm that our key is absent, and by requiring the Maintenance Record for Handover. The Client may also ask VeriPath for
the evidence behind any security claim in the Technical Specification, and VeriPath will provide it.
9.1 VeriPath will use reasonable skill and care to keep the application available, subject to planned maintenance under
clause 7 and to events outside its control.
9.2 Availability target and service credits: [DECISION — whether an uptime figure is given, and whether credits apply.]
The Technical Specification deliberately states no figure, because none is currently measured and published.
9.3 Support is through the channels in Schedule B. [DECISION — channels, hours, severity definitions.]
10.1 Fees for the Service are in Schedule E. [DECISION — fee basis: per client, per user, per site; billing period; VAT;
annual uplift.]
10.2 Hosting charges are the Client's (clause 4.4).
10.3 Invoices are payable within [DECISION — 14/30] days. VeriPath may suspend the Service for non-payment only after
14 days' written notice and must not delete or obstruct access to Client Data in any circumstances.
11.1 The Client will: nominate an administrator; keep its contact details current for maintenance notices; ensure its staff
use the application as intended; hold its own backups if it wants a second copy (see clause 12.4); and comply with its own
regulatory obligations.
11.2 The Client acknowledges that, because it holds the server and the credentials, it can also break the Service — for
example by removing the tunnel. VeriPath will help restore it, and may charge for work caused by changes the Client made.
12.1 The Client may extract its data at any time, without asking VeriPath: it holds the database credentials and the server,
so a complete extract is a pg_dump on the client-vps plus a copy of the object and image stores from the same machine.
12.2 VeriPath holds no copy of Client Data, so there is nothing for VeriPath to return and nothing for VeriPath to delete on
termination. VeriPath will confirm in writing on termination that it holds no Client Data.
12.3 On termination VeriPath will, for [DECISION — 30/60] days, provide reasonable assistance with transition, charged at
[DECISION — rate], limited to the application layer.
12.4 Backups: the client-vps's backup arrangement is the Client's, under its own storage account, unless Schedule E records
otherwise. [DECISION — whether VeriPath configures and monitors backups as part of the Service, and what recovery point and
recovery time are promised.]
13.1 VeriPath uses sub-processors only in the application layer — hosting of the app engine, the identity provider, and
distribution of reference data. They are listed in Schedule C.
13.2 The client-vps's hosting provider is not VeriPath's sub-processor: the Client contracts with it directly.
13.3 VeriPath will give 30 days' notice of a new sub-processor and the Client may object on reasonable data-protection
grounds.
14.1 Each party will keep the other's confidential information confidential, use it only for this Agreement, and return or
destroy it on termination. Client Data is the Client's confidential information and VeriPath will not disclose it.
14.2 VeriPath may name the Client as a customer only with the Client's written consent. [DECISION — reference rights.]
15.1 Either party may terminate for material breach not remedied within 30 days of notice.
15.2 The Client may terminate for convenience on [DECISION — 30/60/90] days' notice, taking effect at the end of a
billing period.
15.3 VeriPath may terminate if the Client's conduct makes the Service unsafe to continue — for example a legal prohibition on
processing — giving the Client time to extract its data.
15.4 On termination: the Client keeps its server and its data; VeriPath stops the application from serving that tenant; and
clauses 6, 12, 14 and 16 survive.
15.5 VeriPath will not suspend the Service in a way that prevents the Client reaching its own server or its own data.
16.1 Nothing in this Agreement limits liability for death or personal injury caused by negligence, fraud, or anything else
that cannot lawfully be limited.
16.2 Subject to 16.1, VeriPath's total liability in a contract year is limited to [DECISION — fees paid, or a stated sum],
and neither party is liable for indirect or consequential loss.
16.3 VeriPath is not liable for loss caused by the Client's own acts on its server, by its hosting provider, or by the Client
failing to apply a maintenance window the Client was notified of and did not veto.
16.4 Insurance: [DECISION — professional indemnity and cyber cover, and the limits to be warranted.]
17.1 This Agreement, the Technical Specification and each Schedule are versioned. A change to the Technical Specification
that alters an obligation in this Agreement takes effect only by written agreement.
17.2 Where the Technical Specification and this Agreement conflict on a technical fact, the Technical Specification prevails
and the Agreement will be corrected.
17.3 Notices are given by email to the addresses in Schedule A and are effective on the next Business Day.
18.1 This Agreement is governed by the law of England and Wales, and the courts of England and Wales have exclusive
jurisdiction. [DECISION — confirm, or Scotland/Northern Ireland if any client base requires it.]
| Client legal name | |
| Sector | GP / dental / pharmacy |
| Sites covered | |
| Client administrator | |
| Notice email addresses | |
| Client-vps hosting account holder | (must be the Client) |
| Initial term / renewal | [DECISION] |
| Commencement date | |
| Handover date | (recorded at clause 5) |
Maintenance cadence (from Technical Specification §3.7): continuous security updates; monthly full run in the
client-vps's own slot; quarterly packaged software refresh. Restart rules in clause 7.2.
What the Client sees: the maintenance view and two CSV exports, read-only.
Support: hours [DECISION], channels [DECISION], severity and response targets [DECISION].
Availability: target [DECISION]; measurement method to be published if a figure is promised.
To be drafted as its own document (the next in this series). It will state: the subject matter and duration of processing;
the nature and purpose; the categories of Personal Data and Data Subjects; the Client's instructions; confidentiality;
security measures by reference to the Technical Specification; sub-processors (application layer only); assistance with Data
Subject rights; breach notification per clause 8.3; deletion and return (nothing to return — clause 12.2); and audit rights.
To be drafted as its own document. It will be the Client's standalone procedure: how to take a pg_dump, how to copy the
object and image stores, how to confirm the application has stopped serving the tenant, and what VeriPath will and will not
do after termination.
[DECISION — the whole schedule: fees, billing period, VAT, uplift, hosting recharge, whether setup is charged, transition
rate.]
| Step | Evidence | Recorded by | Date |
|---|---|---|---|
| Account opened in the Client's name | account confirmation | ||
| Stack installed | install record | ||
| Handover checks run | §7 checks, results | ||
| First inventory visible to the Client | Maintenance Record reference | ||
| Credentials handed over | handover note | ||
| Client changed hosting and database passwords | Client confirmation | ||
| VeriPath access removed | failed login attempt result | ||
| Handover recorded as a Maintenance Record | record reference |