Terms of Service

---

How these Terms work

These Terms set out how the WeTalk.ai AI Receptionist service works, what we promise, what we ask of you, and how we look after the information your callers give us.

Two documents sit alongside these Terms:

• Your Service Agreement — the document you sign. It names the version of these Terms that applies to you, and it holds everything specific to your practice: the term, the limits on liability, and the insurances we are required to hold.
• Your Statement of Work — the deal itself: your sites, your practice management system, what you pay, and any special terms we have agreed.

Where they disagree, the Statement of Work comes first, then your Service Agreement, then these Terms. The order of precedence, and the one exception to it, are set out in clause 1.6 of your Service Agreement.

This section is a summary and forms no part of the agreement between us.

---

Who these Terms apply to

These Terms apply to the supply of the Services to a customer that is:

(a) carrying on business in New Zealand; and

(b) a health agency for the purposes of the Health Information Privacy Code 2020.

We do not offer or supply the Services on these Terms to any other person, and these Terms are not an offer to any other person. If you are not a health agency, or you are not carrying on business in New Zealand, please contact us and we will discuss terms that suit you.

---

1. Providing the Services

1.1 We will perform the Services in accordance with your Statement of Work, all applicable law, and Good Industry Practice. In doing so we will:

1.1.1 comply with your reasonable directions, and keep you informed of the progress of the Services and of any change or possible change to their scope or timing;

1.1.2 hold every licence, consent and authorisation we need to provide the Services;

1.1.3 provide the equipment and resources needed to provide the Services;

1.1.4 in relation to the Deliverables — (a) subject to clause 5 (Intellectual property), supply them free of any security interest and so that you can possess and use them in accordance with the licence granted under clause 5.3; and (b) ensure they are, at delivery, fit for the purpose of enabling the AI Receptionist to operate as described in your Statement of Work, contain no Harmful Code, no hidden files and no illicit code, use no open-source components other than standard, widely-used libraries and frameworks ordinarily used in modern software platforms, and are free from material defects in workmanship and design;

1.1.5 not put your Intellectual Property or Confidential Information into any AI System other than our approved platform without your prior written consent;

1.1.6 not do anything likely to damage your reputation or goodwill;

1.1.7 provide the Services through our own personnel and the sub-processors listed in the Data Processing Schedule; and

1.1.8 hold the insurances required of us under your Service Agreement.

1.2 Putting things right. If any part of the Services falls short of clause 1.1, we will re-supply that part at our own cost, as soon as reasonably practicable after becoming aware of the shortfall. You may also require us to re-supply the affected Services by written request, and we will do so at our cost.

1.3 Telling callers they are speaking to an AI.

1.3.1 The AI Receptionist identifies itself as an artificial intelligence assistant at the beginning of every call, and says that the call may be recorded for quality assurance purposes. This applies to every call, without exception.

1.3.2 This disclosure is a fixed condition of the Services. It is not configurable by you, and you may not disable, shorten, delay or otherwise vary it. We do not supply the Services on any other basis.

1.3.3 The disclosure is made in this form, or in a form to substantially the same effect: "Hi, this is Jenny, your AI receptionist for [practice name]. This call may be recorded for quality assurance purposes."

1.3.4 This disclosure supports your obligations under Rule 3 of the Health Information Privacy Code 2020, under which a caller must be made aware that their information is being collected and why.

1.3.5 What you must still tell your patients. Our greeting does not discharge your own Rule 3 obligations. You remain responsible for making sure your patients are told, through your own patient-facing privacy notice and other communications: (a) that personal information, including health information, is collected during the call; (b) why it is collected — to handle the enquiry, book an appointment, or pass a message to a practitioner; (c) who receives it — you, and the third-party providers we engage to deliver the Services, listed in the Data Processing Schedule; and (d) that the caller may ask you for access to, and correction of, their information, as provided by rules 6 and 7 of that Code and by Information Privacy Principles 6 and 7 of the Privacy Act 2020.

1.4 Existing patient records. Where the AI Receptionist looks up an existing patient in your practice management system, it collects that information indirectly from you rather than from the patient. Rule 3A of the Health Information Privacy Code 2020 applies to that collection, and you remain responsible for the notices you give your patients about it. We process that information only as needed to identify the caller and complete the booking. Rule 3A applies only to health information you collected on or after 1 May 2026; it does not apply to health information you collected before that date.

1.5 Checking our compliance. We will, on your reasonable written request and no more than once in any 12-month period, give you written confirmation of how we are meeting our obligations under clause 7 (Privacy, data protection and security) and the Data Processing Schedule.

1.6 Health Information Privacy Code compliance. Your Service Agreement records your warranty that you are a health agency subject to the Health Information Privacy Code 2020. You are responsible for ensuring that:

(a) giving us access to patient health information for processing on your behalf is permitted, and that you have done everything reasonably within your power under Rule 5(1)(b) of that Code to prevent unauthorised use or unauthorised disclosure of it. We process that information as your agent under section 11 of the Privacy Act 2020, so giving it to us is not a disclosure by you (section 11(5)(a)); where any transfer is nonetheless treated as a disclosure, DPS 4 sets out the basis on which it is made;

(b) our access to patient health information through your practice management system is limited to what is necessary to provide the Services; and

(c) your obligations under Rule 5 (security safeguards) and Rule 12 (overseas disclosure) are met through the security controls and sub-processor arrangements set out in the Data Processing Schedule, which you confirm you have had the opportunity to review and, on the basis of what it describes, approve.

You also instruct us, as your agent under section 11 of the Privacy Act 2020, to make, store and retain call recordings and transcripts (which may contain health information) solely for quality assurance of the Services supplied to you, on the 30-day rolling basis set out in DPS 2, after which they are permanently deleted.

1.7 Biometric data. We warrant that the AI Receptionist platform does not use caller voice data to create voiceprints or biometric identifiers, or to identify, verify, or classify individual callers. Voice data processed during calls is used solely to convert the words spoken into text (real-time speech-to-text) and to conduct natural language conversation: the platform processes the content of what is said, and does not analyse the caller's voice characteristics (such as tone or pitch) to identify or classify the caller, and no voice data is retained in a form that constitutes a biometric identifier. On that basis, the platform's speech-to-text and text-to-speech processing falls outside the scope of biometric processing regulated by the Biometric Processing Privacy Code 2025. If we propose to introduce any feature that involves processing caller voice data as a biometric identifier, we will give you at least 30 days' prior written notice and obtain your written consent before enabling that feature.

1.8 Onboarding and hypercare. We will configure the AI Receptionist for your practice and support you closely through the period beginning on your Commencement Date. What that period covers, and how long it runs, is set out in your Statement of Work. We may extend it at our own cost; extending it does not change your Term, your End Date, your invoicing or any free Fortnights.

1.9 What the Services are, and what they are not.

1.9.1 The Services are administrative. The AI Receptionist takes bookings, answers questions about your practice, routes calls to the right person, and takes messages. The Services are administrative in nature and do not include the provision of health care services to any Caller. The AI Receptionist does not give clinical advice, does not assess symptoms, does not triage, and does not make or contribute to any clinical decision.

1.9.2 The AI is not guaranteed to be perfect. The parties acknowledge that the AI Receptionist is a machine-learning system whose individual call outcomes are probabilistic and are not guaranteed to be error-free. Our obligation in respect of live call handling is to exercise reasonable skill and care in accordance with clause 1.1 and Good Industry Practice.

1.9.3 It is not an emergency service. The AI Receptionist is not a medical helpline and is not monitored in real time. It may not recognise that a call is urgent, and it cannot summon help. A Caller who needs urgent medical assistance should call 111 or contact a health professional directly. You are responsible for making that clear to your patients through your own patient-facing communications, and for the arrangements you have in place for urgent contact outside the AI Receptionist.

1.9.4 This clause 1.9 describes the nature and the limits of the Services. It does not reduce the standard of skill and care we owe under clause 1.1 in performing them.

---

2. What we need from you

The AI Receptionist works because a few things stay in place at your end.

2.1 Call forwarding. You are responsible for setting up and keeping in place the forwarding of calls from your own number to the dedicated number we provide. The Services cannot operate if forwarding is switched off, and we are not responsible for calls that never reach us.

2.2 Access to your practice management system. You will maintain the access we need to your practice management system so that bookings can be delivered to it, and will tell us promptly if credentials change, access is revoked, or your provider changes the integration.

2.3 Keeping your details current. You will tell us promptly when something changes that the AI Receptionist relies on — your practitioners, the services you offer, your opening hours, your booking rules, or your Service Locations. We can only book what we have been told about. Where a booking is made on information you have not updated, that is not a failure of the Services.

2.4 Your contact address. You will keep the notice email address in your Service Agreement current, and tell us in writing if it changes. Notices we send under clause 12 are treated as received in accordance with clause 12.2, using the address we hold for you — so an address you have stopped monitoring is still an address we may validly use.

2.5 What the Services are used for. You will not use, or allow the use of, the Services other than as described in your Statement of Work — and in particular not for clinical triage, symptom assessment, emergency response, or any purpose described in clause 1.9 as outside the Services.

2.6 The AI disclosure. You will not ask us to suppress, shorten or omit the disclosure required by clause 1.3, and you will make sure your own patient-facing privacy information is consistent with it.

2.7 Lawful use. You will not use the Services in a way that breaches any law, infringes anyone's rights, or would put us in breach of an obligation we owe to a third party.

2.8 If you do not. Where, acting reasonably and on reasonable grounds, we consider that a failure to do any of the above has prevented or delayed the Services or caused a booking or call-handling error, we are not liable for the consequences of that failure and our obligations are suspended to the extent, and for so long as, they are affected. We will tell you promptly, give our reasons in writing, and work with you to put it right. If you disagree, clause 10 (Resolving a dispute) applies, and our reliance on this clause is not conclusive.

2.9 Your own systems and suppliers. Your practice management system — for example Gensolve, Cliniko, Nookal or Zanda (formerly Power Diary) — is supplied to you by a third party under your own arrangement with that supplier. We deliver bookings into it, but we do not control it, and it is not one of our Sub-processors. You are responsible for maintaining it, including your subscription, your credentials, and any integration settings it requires.

2.10 Where your practice management system, telephone provider, internet connection or any other system or supplier under your control fails, is unavailable, changes how it works, or withdraws access:

(a) that is not a breach of these Terms by us and is not a failure of the Services;

(b) it does not entitle you to relief under clause 9.6, which applies only where the AI Receptionist itself is unavailable; and

(c) we will tell you promptly if we become aware of it, and will use reasonable endeavours to work with you to restore the connection — but we cannot commit to a timeframe for a system we do not control.

2.11 Suspension in limited circumstances. We may suspend the Services, or the affected part of them, on written notice to you where we reasonably believe that continuing to provide them would:

(a) breach any law, or cause either of us to breach an obligation owed to a third party;

(b) expose Caller Data to a live and material security risk; or

(c) involve the Services being used for a purpose that clause 1.9 states is outside them, including clinical triage, symptom assessment or emergency response.

2.12 A suspension under clause 2.11 is subject to all of the following:

(a) we will tell you at the time we suspend, and give our reasons;

(b) we will suspend only so much of the Services, for only so long, as is reasonably necessary to address the cause;

(c) we will restore the Services as soon as the cause has been resolved, and will work with you to resolve it;

(d) where the cause is capable of being remedied by you and there is no immediate risk to Caller Data or of a breach of the law, we will give you a reasonable opportunity to remedy it before suspending;

(e) where the suspension was not the result of something you did or failed to do, you are not liable to pay for the period of suspension. What is credited is set out in the refund clause of your Service Agreement; and

(f) if you disagree that a ground in clause 2.11 exists, clause 10 (Resolving a dispute) applies, and our reliance on clause 2.11 is not conclusive.

2.13 Suspension under clause 2.11 does not terminate your Service Agreement, and does not limit either party's rights to terminate it.

2.14 If a suspension goes on. If a suspension under clause 2.11 continues for more than 10 consecutive Business Days, you may terminate your Service Agreement and each Statement of Work by written notice, without penalty and without liability for any agreed compensation on early termination. What is refunded is set out in the refund clause of your Service Agreement. This clause does not apply where the suspension results from something you did or failed to do.

---

3. If we do not get you live

3.1 You see the AI Receptionist working before you sign anything, so there is no separate acceptance-testing procedure after signing. Your protections instead are the deadlines in clause 3.2 of these Terms and our re-supply obligation in clause 1.2.

3.2 Your Statement of Work sets a date by which we must hand over your live number, and your Service Agreement sets a longer backstop for your first Go-Live Date. If either passes, you may end the affected Statement of Work — or, in the case of the backstop, everything ends automatically — and we refund what you are owed under the refund clause of your Service Agreement. No early-termination compensation, break fee or other exit charge is payable by you in either case. The periods, the notice required and the refund are set out in those documents.

3.3 Both periods are extended day for day by any delay caused at your end. We must tell you in writing that such a delay has started and what caused it, within the period your Statement of Work specifies; a delay we notify later than that counts only from the date of our notice.

3.4 If the Services fall short once you are live, clause 1.2 applies.

---

4. Changes to the Services

4.1 Neither of us may change the Services unilaterally. Any change must be agreed in writing by both of us. A change is proposed in writing, describing its extent and nature. We will each negotiate in good faith, and any agreed change will record its effect on the Service Fees before it takes effect. This clause does not limit DPS 5.

---

5. Intellectual property

5.1 What each of us already owns. Intellectual Property owned by or proprietary to one of us, which is not created under or in connection with your Service Agreement, stays owned by that party. We each call this our Background IP.

5.2 What we own. All Intellectual Property in our platform — the workflows, automation logic, call systems, reusable components, underlying software architecture, and any other technology or tools that form part of our platform or that we use to deliver our services generally (the Platform IP) — is and remains ours. You acknowledge that we operate the Platform IP across multiple clients, and that nothing in your Service Agreement transfers ownership of it to you.

5.3 Your licence to use it. We grant you a non-exclusive, non-transferable licence to use the Platform IP and any Deliverables, from the date your Service Agreement is signed by both of us until the end of the Term, solely for the purposes contemplated by that agreement and your Statement of Work. The licence ends automatically when your Service Agreement or the relevant Statement of Work expires or terminates, except that — where termination is for any reason other than your uncured material breach or an Insolvency Event — it continues for a wind-down period of up to 30 days, to the extent reasonably necessary to allow you to transition to another arrangement.

5.4 What we build for you, and what stays yours.

5.4.1 Yours stays yours. The information you give us — your services, your practitioners, your opening hours, your booking rules, your policies and your call-handling preferences — is and remains yours.

5.4.2 What we build from it is ours. Everything we design, build or configure for your practice, including the call flow as we map it into the platform, the prompts, the voice settings, the integrations and the related materials (the Customer Configuration), is and remains ours and forms part of the Platform IP. To the extent any Intellectual Property in it would otherwise vest in you, you assign it to us. In practice: the information you give us is yours and stays yours; the way we build it into a working receptionist is ours.

5.4.3 You may use it while you are a client. For as long as your Service Agreement is in force, you have the licence in clause 5.3 to use the Customer Configuration in your own practice for the purposes of that agreement and your Statement of Work.

5.4.4 You cannot take it to a replacement supplier. The licence in clause 5.3 does not permit you to access, copy, transfer or provide the Platform IP or the Customer Configuration to any third party, including any replacement supplier.

5.4.5 What we keep when you leave. When your Service Agreement ends we keep the Customer Configuration, the designs, the call flows, the policies and the know-how developed in providing the Services — in de-identified form only: stripped of all Caller Data, of your Confidential Information, and of anything identifying you. We may reuse what we have learned, in that de-identified form, in providing the Services to other clients. Caller Data is never reused for any purpose, de-identified or not, and is deleted in accordance with clause 7 and the Data Processing Schedule.

5.4.6 What you get back. On expiry or termination, and on request, we will give you within 10 Business Days, at no charge, a plain-text export of the underlying information you supplied — your services, practitioners, opening hours, booking rules and call-handling preferences.

5.5 Our licence to use yours. You grant us a limited, non-exclusive, non-transferable, non-sublicensable licence to use your Background IP, from the date your Service Agreement is signed until the end of the Term, for the sole purpose of performing the Services, including configuration and setup before the Term begins.

5.6 We will not infringe anyone else's rights. We warrant that providing the Services, and your receipt and use of any Service, Deliverable or Intellectual Property we supply, will not infringe any Intellectual Property or other right of any person. We indemnify you, your Related Companies, employees, agents, personnel, contractors and officers against all claims, losses, liabilities, demands, costs and expenses (including legal costs on a solicitor and own client basis) arising from a breach of this clause.

Our liability under this clause is limited as set out in your Service Agreement. The parties acknowledge and agree that this limit is fair and reasonable: it is set by reference to the insurances we are required to hold under your Service Agreement, where the cover, limits, exclusions and the conditions on which those insurances respond are set out, while reflecting that an unlimited intellectual-property indemnity would be disproportionate for a provider of our size.

As a condition of this indemnity, you will: (a) promptly notify us in writing of any claim to which it may apply; (b) allow us and our insurer to take conduct of the defence and settlement of the claim; and (c) give us reasonable assistance, and not admit liability for or settle the claim without our prior written consent, which we will not unreasonably withhold.

5.7 Survival. This clause 5 survives the expiry or termination of your Service Agreement. Clause 5.4.5 (what we keep when you leave) and clause 5.4.6 (what you get back) continue to apply after it ends.

---

6. Confidential information

6.1 Keeping things confidential. Each of us (as Receiving Party) must keep confidential, and not disclose, information obtained from the other (as Disclosing Party) under or in connection with your Service Agreement that is identified as confidential or that a reasonable person would understand to be confidential (Confidential Information). This includes the contents of your Service Agreement and Statement of Work — but not these Terms, which are published.

Our Confidential Information includes the Platform IP, our fees and pricing, and our systems, methods and know-how. Yours includes your patient and caller information, your business information, and your practice's operational information.

6.2 When disclosure is allowed. Confidential Information may be disclosed where:

(a) the law requires it;

(b) it is necessary to obtain the intended benefits of, or perform obligations under, your Service Agreement;

(c) the information is already public, other than through a breach of this clause or the law;

(d) the disclosure is to a lawyer, accountant or other professional adviser;

(e) your Service Agreement or Statement of Work expressly permits it, including any case study and marketing rights granted to us in a Statement of Work;

(f) the information was lawfully held before it was disclosed under your Service Agreement; or

(g) the information was independently developed without use of or reference to the other party's Confidential Information.

6.3 Disclosure required by law. Where disclosure is required under clause 6.2(a), the Receiving Party will first: notify the Disclosing Party in writing immediately, so that it may seek a protective order or other remedy; disclose only what is legally required; and use reasonable endeavours to obtain an undertaking that the information will be treated confidentially by whoever receives it.

6.4 Returning information. On expiry or termination, the Receiving Party must, at the Disclosing Party's option, destroy or return the Disclosing Party's Confidential Information, and confirm in writing that it has done so if asked. How we handle and delete your caller and patient information is governed by clause 7 and the Data Processing Schedule, not by this clause. Nothing in this clause requires us to destroy or return material we are entitled to retain under clause 5.4.5, which we hold only in de-identified form.

6.5 Survival. This clause 6 survives expiry or termination, and confidentiality obligations continue for 3 years afterwards — except for information that is a trade secret (including our pricing methodology, fees, and the Platform IP, methods and know-how), where they continue for as long as the information stays confidential.

---

7. Privacy, data protection and security

7.1 Security controls. We will keep in place appropriate technical and organisational measures to protect Caller Data and your Confidential Information against unauthorised or unlawful processing, accidental loss, destruction or damage.

7.2 We warrant that we maintain security controls in accordance with Good Industry Practice, including multi-factor authentication on every platform that holds Caller Data, patient health information, credentials or financial data; full-disk encryption on all devices; no retention of caller audio or transcripts on the AI voice processing platform (Vapi), on the basis set out in DPS 3; access-controlled call recordings; transient processing data purged on the basis set out in DPS 2; and quarterly security reviews. We will ensure that penetration testing of our service platform is completed. Where that testing has already been completed as at the Effective Date of your first Statement of Work, this obligation is satisfied without further action; where it has not, we will complete it within 12 months of that date or before the End Date, whichever is earlier.

7.3 Data protection law. Each of us will comply with the Privacy Act 2020, the Health Information Privacy Code 2020, and any other applicable data protection law.

7.4 Purpose limitation. We will not use or otherwise process any personal information you provide for any purpose other than providing the Services and performing our obligations under your Service Agreement.

7.5 Our role. We process caller personal information as your agent under section 11 of the Privacy Act 2020. You remain the agency responsible for that information.

7.6 What happens to caller information. Caller booking data is processed in transit and delivered to your practice management system in real time. Call recordings, transcripts and transient processing logs are retained only as set out in DPS 2 — in every case on a rolling basis for a maximum of 30 days, solely for quality assurance of the Services supplied to you, and never used for AI model training. We keep no copy of caller personal information other than those described in DPS 2.

7.7 Processing health information. In processing patient health information on your behalf, we will:

(a) process it only for the purpose of providing the Services;

(b) not disclose it to anyone except a sub-processor listed in the Data Processing Schedule, or as required by law;

(c) keep it secure in accordance with clause 7.1 and Rule 5 of the Health Information Privacy Code 2020;

(d) assist you in responding to any request by an individual to access or correct their information;

(e) notify you of any complaint or regulatory enquiry we receive about it; and

(f) delete it in accordance with the retention periods in DPS 2;

(g) engage Sub-processors only where they have agreed to privacy obligations materially equivalent to those required by these Terms; and

(h) on the expiry or termination of your Service Agreement, delete or return all patient health information we hold within 30 days.

7.8 Deletion is final. Every retention period in DPS 2 is a maximum, enforced by automated deletion. We do not offer a preservation, legal-hold or archiving service, and we cannot suspend, extend or reverse that deletion. Once an item has been deleted it cannot be recovered, by us or by anyone. This applies whatever the reason for the request and whenever it is made.

7.9 Security incidents. If we become aware of a Security Incident affecting Caller Data, we will:

7.9.1 notify you in writing within 24 hours, and provide the information you reasonably need to assess it within a further 5 Business Days, including the nature of the breach, the categories and approximate number of individuals affected, and the steps we have taken to contain it;

7.9.2 take corrective action promptly, at our cost, and keep you informed; and

7.9.3 co-operate with you in any notification or regulatory step you must take.

7.9.4 If you do not acknowledge our notification within 48 hours, or are otherwise unresponsive, we reserve the right to notify the Office of the Privacy Commissioner directly, to protect our own legal position and the interests of affected individuals. Any such notification will be made as soon as practicable after we become aware of the incident, consistent with the standard set by the Privacy Act 2020. Because we hold and process Caller Data as your agent under section 11 of the Privacy Act 2020, information we hold and a breach we know of are treated as held and known by you. As between us, you remain the agency responsible for notifying affected individuals and the Privacy Commissioner. This allocation is contractual and does not affect either party's own obligations under the Privacy Act 2020. We will tell you if we notify the Commissioner.

7.10 Complaints. WeTalk.ai is a health agency for the purposes of clause 4(2)(j) of the Health Information Privacy Code 2020, and the complaints procedure in clause 7(2) of that Code applies to us.

7.10.1 Our Privacy Officer, appointed under section 201 of the Privacy Act 2020, is Hamish Faulks, who is also our designated complaints person. Complaints may be sent to admin@wetalkai.co.nz.

7.10.2 If you, or a Caller, complain to us about a breach of that Code, we will: acknowledge the complaint in writing within 5 working days of receiving it, unless it has already been resolved to the complainant's satisfaction within that period; tell the complainant about any relevant internal and external complaints procedures; and document the complaint and our actions on it.

7.10.3 Within 10 working days of acknowledging the complaint, we will decide whether we accept that it is justified, or determine how much additional time we need. Where that additional time is more than 20 working days, we will tell the complainant and give our reasons.

7.10.4 As soon as practicable after deciding, we will tell the complainant the reasons for our decision, any actions we propose to take, any appeal procedure we have, and their right to complain to the Privacy Commissioner.

7.10.5 This clause does not limit your own obligations as a health agency to handle complaints from your patients, or either party's rights under Part 4 of the Privacy Act 2020.

7.11 Your own record-keeping obligations. The retention periods in DPS 2 govern our copies only. They do not affect, and are not intended to satisfy, any obligation you have to create or retain patient records under the Health (Retention of Health Information) Regulations 1996 or any other law.

7.11.1 The clinical record of a patient's care is created and held by you, in your own practice management system. Booking information is delivered to that system in real time, so it is in your possession from the moment it is taken.

7.11.2 Our call recordings and transcripts are a working copy of an administrative interaction, kept briefly for quality assurance of the Services. They are not your clinical record, and we do not hold them on your behalf for record-keeping purposes.

7.11.3 If you need a record of a call — for a complaint, an investigation, a legal proceeding, or your own record-keeping — you must not rely on us still holding it. Our retention periods are maximums enforced by automated deletion, we cannot suspend or reverse that deletion, and once an item has been deleted it cannot be recovered. Your own clinical record of the interaction is the record you keep in your practice management system.

---

8. Liability

8.1 To the maximum extent permitted by law, and subject to clause 8.3, neither of us is liable to the other under or in connection with your Service Agreement for any indirect or consequential loss or damage, including any indirect or consequential loss of revenue, profits, goodwill, business or anticipated business, anticipated savings, or business interruption. For the avoidance of doubt, this clause 8.1 does not exclude a party's direct loss, which remains recoverable subject to the limits set out in your Service Agreement.

8.2 Limit on our liability. Our liability under or in connection with your Service Agreement is limited. The limits, including every monetary cap, are set out in that agreement, which you receive in full before you sign anything. Those limits form part of the agreement between us and apply to these Terms as if they were set out here.

8.3 Liability that cannot be limited. Nothing in your Service Agreement or these Terms limits or excludes either party's liability for:

(a) fraud or fraudulent misrepresentation;

(b) death or personal injury caused by negligence;

(c) that party's wilful default or deliberate breach of your Service Agreement or these Terms;

(d) any liability under the Consumer Guarantees Act 1993 or the Fair Trading Act 1986 to the extent it is not validly excluded under your Service Agreement; or

(e) any other liability that cannot lawfully be limited or excluded.

8.4 Your remedies. If we breach, or fail to properly perform, any of our obligations to your reasonable satisfaction, and — where the breach or failure is capable of remedy — fail to remedy it within 10 Business Days of receiving written notice from you requiring it to be remedied, you may (without limiting any other right) withhold payment for the affected Services until the matter is resolved; require us to re-supply the affected Services at our cost; suspend the affected Services by written notice until the matter is resolved to your reasonable satisfaction; obtain the affected Services from another supplier; and recover from us any additional cost reasonably incurred in doing so.

8.5 Consumer Guarantees Act 1993.

8.5.1 These Terms do not contract out of the Consumer Guarantees Act 1993. Contracting out of that Act is permitted only by written agreement between parties who are all in trade and who all agree to it, and it is therefore dealt with in your Service Agreement, which you sign.

8.5.2 Where you acquire the Services in trade, your Service Agreement records what we have agreed about the Consumer Guarantees Act 1993, including any contracting-out under section 43(2) of that Act and the parties' acknowledgements supporting it.

8.5.3 Where the Consumer Guarantees Act 1993 applies despite clause 8 of your Service Agreement, our liability is limited as set out in clause 8.3 of that Agreement.

8.6 Fair Trading Act 1986.

8.6.1 Contracting out of the Fair Trading Act 1986 under section 5D of that Act is permitted only by written agreement between parties who are all in trade, and it is therefore dealt with in your Service Agreement, which you sign. Clause 9.1 of that Agreement records that the Act applies to the supply of the Services.

8.6.2 Any acknowledgement about what each party has relied on in entering into the agreement is given in your Service Agreement, not in these Terms.

8.6.3 Nothing in this clause 8 affects the unfair contract terms provisions of the Fair Trading Act 1986.

---

9. Events outside our control

9.1 Neither of us is liable for a failure or delay in performing an obligation if it arises directly from a Force Majeure Event and that party complies with clause 9.2. A Force Majeure Event does not include a strike or labour dispute involving the party relying on this clause (or its subcontractors), or a lack of funds for any reason.

9.2 A party relying on clause 9.1 must give the other written notice as soon as possible after becoming aware of the event, with details of its nature, expected duration and effect, keep the other informed of any change and of when it ends, and use reasonable endeavours to mitigate its effects and still perform on time.

9.3 Clause 9.1 does not excuse either party from paying money when it is due.

9.4 Platform outages. A Force Majeure Event includes any outage, failure, suspension or material degradation of a third-party artificial intelligence, voice processing, speech-to-text, cloud, hosting, workflow automation or telecommunications platform on which we depend — including the sub-processors listed in the Data Processing Schedule — to the extent it is beyond our reasonable control. A Force Majeure Event does not include any outage or degradation to the extent caused by our own act or omission, our choice of sub-processor plan or configuration, or our failure to maintain a commercially reasonable level of redundancy.

9.5 Getting the service back. Where a Force Majeure Event affects the AI Receptionist, we will take reasonable steps to restore the Services, or put a reasonable workaround in place, as soon as practicable.

9.6 If the AI Receptionist is unavailable. If the AI Receptionist is unavailable at our platforms for 3 consecutive Business Days, then from the fourth consecutive Business Day and for each further day of continuous unavailability:

9.6.1 you are not liable to pay one fourteenth of the Fortnightly Subscription for each such day, and if you have already paid it, that amount is credited against your next invoice;

9.6.2 despite clause 9.3, you may withhold the part of your next invoice referable to those days until the Services are restored; and

9.6.3 relief under this clause is given as a credit against or reduction of fees, never as a cash payment. Where no fee was payable for the period (for example during a free Fortnight under your Statement of Work), no credit is due, but that free Fortnight is extended by the length of the unavailability.

9.6.4 This clause applies only where the AI Receptionist is unavailable at our platforms. Unavailability caused by any system or supplier under your control is dealt with in clause 2.10 and never qualifies for relief under this clause.

9.7 If an outage continues for more than 10 Business Days. If the AI Receptionist is unavailable at our platforms for more than 10 consecutive Business Days, you may terminate the affected Statement of Work — or, if it affects all Services, your Service Agreement — by written notice, without penalty and with no early-termination compensation payable. The days of unavailability are credited under clause 9.6, and what is refunded is set out in the refund clause of your Service Agreement.

---

10. Resolving a dispute

10.1 If a dispute arises, the party raising it must give the other written notice as soon as reasonably practicable.

10.2 Within 10 Business Days of that notice, we will meet — in person or by video — and make genuine and reasonable efforts to resolve it in good faith.

10.3 If it is not resolved within 30 days of the notice, either of us may start court proceedings. Nothing in this clause prevents a claim in the Disputes Tribunal where the claim is within that Tribunal's jurisdiction.

10.4 Either of us may go to court at any time for urgent interlocutory relief.

---

11. Assignment and subcontracting

11.1 Assignment. Neither of us may assign or transfer rights or obligations under your Service Agreement without the other's prior written consent, not to be unreasonably withheld — except that we may, on written notice to you and without your consent, assign it to a Related Company, or to a purchaser of all or substantially all of our business or assets. A direct or indirect change in the ownership or control of WeTalk.ai is not an assignment requiring your consent. Where we do assign:

11.1.1 the Services you receive, and the terms on which you receive them, do not change;

11.1.2 the assignee must assume all of our obligations in writing, and we remain liable for them until it does; and

11.1.3 if you would rather not continue with the assignee, you may terminate your Service Agreement and each Statement of Work by written notice given within 30 days of our notice, without penalty and with no early-termination compensation payable.

11.2 Subcontracting. In providing the Services we may engage the sub-processors and third-party platform providers listed in the Data Processing Schedule, and use our own personnel and contractors. We will not otherwise subcontract a material part of the Services without your prior written consent, not to be unreasonably withheld. Your notice and objection rights for new or changed sub-processors are set out in the Data Processing Schedule. We remain responsible to you for the Services however they are performed.

---

12. Notices

12.1 Every formal notice under your Service Agreement must be in writing and sent by email — in the body or as an attachment — to the email address recorded in that agreement or, where none is recorded for a party, to the address that party has most recently used to correspond about the agreement.

12.2 An emailed notice is treated as received 2 hours after it is sent, or, where that falls outside 8:30am to 5:30pm on a Business Day, at 9:00am on the next Business Day — unless the sender receives an automated message saying it was not delivered.

12.3 If we send you a notice by email and have not had an acknowledgement or reply within 3 Business Days, we will send a follow-up copy. That is a courtesy to reduce the risk of a notice being missed and does not change when the original is treated as received.

12.4 Periods that run from a notice. Where a notice starts a period running in which you may object, terminate or exercise a right — including under clause 1.7 or clause 1.9 of your Service Agreement, clause 3.5.2 of your Service Agreement, or DPS 5.4 — that period runs from the later of the deemed receipt of the original notice under clause 12.2 of these Terms and the sending of the follow-up copy under clause 12.3 of these Terms.

---

13. General

13.1 Changes in writing. How your Service Agreement and Statement of Work may be amended, and how these Terms may change, are dealt with in your Service Agreement.

13.2 Counterparts and electronic signature. Your Service Agreement records the parties' consent to electronic signature. Electronic signatures and records are given legal effect by Part 4 of the Contract and Commercial Law Act 2017.

13.3 Entire agreement. The entire-agreement and non-reliance provisions are set out in clause 9.3 of your Service Agreement.

13.4 No partnership. Except as expressly provided in clause 7.5 and the Data Processing Schedule — under which we process Caller Data as your agent for the purposes of section 11 of the Privacy Act 2020 — nothing creates a partnership, joint venture, agency, trust, or employment relationship between us. Neither of us may represent that any such relationship exists, or act for or bind the other.

13.5 Severance. If a provision becomes unenforceable, illegal or invalid, it is severed without affecting the rest.

13.6 Rights cumulative. All rights and remedies are cumulative and may be exercised together or separately. Using one does not exclude another.

13.7 Waiver. A failure or delay in exercising a right is not a waiver of it. A waiver of a breach is effective only if in writing and signed by the party against whom it is claimed, and does not waive any other or later breach.

13.8 No third party rights. Except as expressly stated, nothing in these Terms is intended to confer a benefit on, or be enforceable by, any person who is not a party to your Service Agreement.

13.9 Order of precedence. The order in which these Terms, your Service Agreement and your Statement of Work rank, and the limited circumstances in which clauses 5 to 8 of these Terms and the Data Processing Schedule override a Statement of Work, are set out in clause 1.6 of your Service Agreement.

13.10 Governing law. The law governing your Service Agreement and these Terms, and the courts to which the parties submit, are set out in clause 12.3 of your Service Agreement.

13.11 Survival. Any provision of these Terms which by its nature is intended to continue after your Service Agreement ends does so. Without limiting that, the following survive the expiry or termination of your Service Agreement for as long as is necessary to give them effect:

(a) clause 5 (Intellectual property), in accordance with clause 5.7;

(b) clause 6 (Confidential information), in accordance with clause 6.5;

(c) clause 7 (Privacy, data protection and security) and the Data Processing Schedule — including our obligations to delete Caller Data within the applicable retention period and to notify you of a Security Incident affecting your Caller Data;

(d) clause 8 (Liability), including the limits set out in your Service Agreement;

(e) clause 10 (Resolving a dispute) and clause 13.10 (Governing law); and

(f) clause 1.9 (What the Services are, and what they are not), in respect of anything done while your Service Agreement was in force.

13.12 For the avoidance of doubt, our obligations in respect of Caller Data still held by us or a Sub-processor at the date your Service Agreement ends continue until that data has been deleted in accordance with the Data Processing Schedule, whether or not any other obligation has ended.

---

14. Definitions and interpretation

14.1 In these Terms:

"AI Receptionist" means the artificial-intelligence voice receptionist service supplied by us, as described in a Statement of Work.

"AI System" means any artificial intelligence or machine learning system, model, or service.

"Background IP" has the meaning given in clause 5.1.

"Business Day" means any day other than a Saturday, Sunday or public holiday in New Zealand.

"Caller" means a person who telephones a Service Location and is answered by the AI Receptionist.

"Caller Data" means personal information (including health information) about a Caller that is collected, received or processed by us in connection with the Services.

"Confidential Information" has the meaning given in clause 6.1.

"Customer Configuration" has the meaning given in clause 5.4.2.

"Data Processing Schedule" means the schedule of that name forming part of these Terms.

"Deliverable" means any deliverable, output, work product, configuration or material we supply under a Statement of Work.

"Commencement Date", "Effective Date", "End Date", "Fortnight", "Fortnightly Subscription", "Go-Live Date", "Service Fees" and "Term" each have the meaning given in your Service Agreement.

"Force Majeure Event" means an event beyond a party's reasonable control, including an act of God, natural disaster, epidemic or pandemic, war, terrorism, civil unrest, government action, failure of a utility or telecommunications service, and the platform outages described in clause 9.4.

"Good Industry Practice" means the degree of skill, care and diligence reasonably expected of a competent supplier of services of the same kind in New Zealand.

"Harmful Code" means any virus, worm, trojan, ransomware, logic bomb, or other code designed to disable, damage, or gain unauthorised access to a system or data.

"Insolvency Event" means a party becoming insolvent, having a liquidator, receiver, administrator or statutory manager appointed, entering a compromise with creditors, or ceasing to carry on business.

"Intellectual Property" means all intellectual property rights of any kind, whether registered or unregistered, including copyright, trade marks, designs, patents, trade secrets, know-how, and rights in databases and software.

"Platform IP" has the meaning given in clause 5.2.

"Related Company" has the meaning given in section 2(3) of the Companies Act 1993.

"Security Incident" means any actual or reasonably suspected unauthorised access to, or unauthorised or accidental disclosure, loss, alteration or destruction of, Caller Data or your Confidential Information held or processed by us.

"Service Location" means a location at which you receive the Services, as identified in a Statement of Work.

"Services" means the services described in a Statement of Work, provided in accordance with these Terms.

"Statement of Work" means a statement of work agreed and signed by both parties under your Service Agreement.

"Sub-processor" means a third party engaged by us that processes Caller Data, as listed in the Data Processing Schedule.

14.2 Interpretation. Headings are for convenience only. The singular includes the plural and vice versa. A reference to a person includes a body corporate. "Including" and similar words are not words of limitation. A reference to a statute includes it as amended or replaced. Where a word or expression is defined, its other grammatical forms have a corresponding meaning, whether or not capitalised. A reference to a clause or section is to a clause or section of these Terms unless stated otherwise.

---

Schedule — Data Processing Schedule

This Schedule forms part of these Terms. It sets out how caller information is handled, what is kept and for how long, who else processes it, and on what legal basis it leaves New Zealand.

DPS 1. Who is responsible for what

DPS 1.1 You are the agency responsible for the collection and use of Caller Data under the Privacy Act 2020. We process Caller Data as your agent under section 11 of the Privacy Act 2020, for the purpose of providing the Services and for no other purpose.

DPS 1.2 Where we access existing patient records from your practice management system, you are the indirect collector of that information for the purposes of Rule 3A of the Health Information Privacy Code 2020 (Information Privacy Principle 3A as it applies to health information), and you remain responsible for the notices you give your patients about it.

DPS 1.3 This agent characterisation applies to all Caller Data we process on your behalf, with one exception: Twilio, as the underlying telecommunications carrier, holds and uses a limited set of carrier and telephony metadata for its own purposes — the information any phone company necessarily holds to connect a call — so under section 11(3) of the Privacy Act 2020 it holds that information in its own right as well as on your behalf.

DPS 2. What is held, and for how long

DPS 2.1 Every retention period above is a maximum, enforced by automated deletion rather than by anyone remembering. Deleted recording media is unrecoverable. There is no exception: nothing is held outside the automated purge, and there is no legal-hold or preservation service.

DPS 2.2 These periods govern our copies only. Clause 7.11 of these Terms explains how they relate to your own record-keeping.

DPS 3. Sub-processors

This section lists the third parties that process information in connection with the Services: every third party that processes Caller Data, and every third party that holds your own business information. The first six process Caller Data. The remainder process only your own business information — your contact details, your billing records, or the contents of your agreement with us — and are listed so that you can see where your information is held.

DPS 3.1 You authorise us to engage the Sub-processors listed above. This list is current as at the version date of these Terms and is updated when arrangements change; you are notified of material changes under DPS 5 below.

DPS 4. Information that leaves New Zealand

DPS 4.1 Providing the Services requires Caller Data to be transferred to the United States and Germany. Your own business information may in addition be held in New Zealand, Australia, or globally, as shown in the table above.

DPS 4.2 Primary basis — agency under section 11 (no disclosure). We process Caller Data as your agent under section 11 of the Privacy Act 2020 (see DPS 1). Because the Sub-processors listed above process Caller Data solely on our and your behalf, and not for their own purposes, Caller Data continues to be treated as held by you, and its transfer to those Sub-processors is not a disclosure to a separate agency for the purposes of Information Privacy Principle 12 of the Privacy Act 2020 or Rule 12 of the Health Information Privacy Code 2020. The one exception is the limited band of carrier and telephony metadata that Twilio holds for its own purposes; the transfer of that metadata to Twilio in the United States is an overseas disclosure, for which we rely on the Rule 12 reasonable-grounds basis in DPS 4.3.

DPS 4.3 Alternative basis — Rule 12 of the Health Information Privacy Code 2020 (comparable safeguards). To the extent any transfer of Caller Data to a Sub-processor outside New Zealand is treated as a disclosure of health information rather than as processing by us as your agent, that disclosure is made in reliance on Rule 11(1)(c) of that Code — the disclosure is one of the purposes in connection with which the information was obtained, being the handling of the Caller's call and the booking they asked for. We rely on Rule 12(1)(f): we have reasonable grounds to believe each Sub-processor is required to protect the information in a way that, overall, provides comparable safeguards to those in the Privacy Act 2020 as modified by that Code. Those grounds are:

(a) data processing terms with each Sub-processor that impose contractual obligations to protect Caller Data — comprising signed Data Processing Agreements where the Sub-processor offers one (including n8n and Supabase), and data processing terms auto-incorporated into the Sub-processor's terms of service (including Twilio, Vapi and ElevenLabs), and Sub-processors accessed indirectly through the real-time voice platform, including Anthropic and Deepgram accessed via Vapi;

(b) technical and security controls maintained by each Sub-processor that processes Caller Data, including but not limited to SOC 2, ISO 27001 and PCI DSS certifications, encryption in transit and at rest wherever Caller Data is stored, and zero-data-persistence configurations where applicable; and

(c) where relevant, participation by a Sub-processor in frameworks such as the EU-US Data Privacy Framework, which is considered as one factor in the overall reasonable-grounds assessment but is not relied upon as independently satisfying Rule 12.

DPS 5. Notice of changes to Sub-processors

DPS 5.1 We may engage a new Sub-processor, or change an existing Sub-processor arrangement, without your prior approval.

DPS 5.2 Where such a change materially affects (i) the location at which Caller Data is processed, or (ii) the privacy safeguards applicable to Caller Data, we must give you written notice at least 30 days before the change takes effect, describing the change and the safeguards applying to the new arrangement, and must update this Schedule accordingly.

DPS 5.3 Urgent changes. Where a change described in DPS 5.2 must be made without delay in order to (i) respond to a security vulnerability, security incident, or failure or discontinuation of service affecting a Sub-processor, or (ii) comply with the law or the direction of a regulator, we may make the change immediately and must give the notice required by DPS 5.2 as soon as reasonably practicable and in any event within 5 Business Days after the change takes effect. The notice must state which ground in this DPS 5 we relied on.

DPS 5.4 You may, within 15 Business Days of receiving a notice under DPS 5.2 or DPS 5.3, object to the change on reasonable grounds related to the protection of Caller Data. If you object and we cannot resolve the objection within a further 15 Business Days, you may terminate the affected Statement of Work — or, if the change affects all Services, your Service Agreement — on not more than 10 Business Days' written notice, without penalty and without liability for any agreed compensation on early termination.

Version 1 — 9 September 2026  ·  © 2026 WeTalk.ai Limited

Previous versions

Your Service Agreement names the version of these Terms that applies to you. Every published version stays at its own address so you can always read the version you signed under.

• Version 1 — 9 September 2026 — current (this page)