Terms of Service

---

How these Terms work

These Terms set out how WeTalk.ai services work, what we promise, what we ask of you, and how we look after the information we handle for you.

They are in two Parts and a schedule:

• Part A (clauses 1 to 14) applies to everything we supply to you, whatever the product.
• Part B (clauses 15 to 20) applies as well if your Statement of Work is for the AI Receptionist. A Part applies only to the product it names.
• The Data Processing Schedule sets out how information is handled, who else handles it and how we tell you of a change. Each of its sections says which Part it goes with.

Two documents sit alongside these Terms:

• Your Service Agreement: the document you sign. It names the version of these Terms that applies to you, and it holds everything specific to your practice: the term, the limits on liability, and the insurances we are required to hold.
• Your Statement of Work: the deal itself: your sites, what you pay, and any special terms we have agreed.

Clause 1.6 of your Service Agreement sets out the order of precedence, including the provisions protected from unintended changes.

This section is a summary and forms no part of the agreement between us.

---

Who these Terms apply to

These Terms apply to the supply of the Services to a customer that is:

(a) carrying on business in New Zealand; and

(b) a health agency for the purposes of the Health Information Privacy Code 2020.

We do not offer or supply the Services on these Terms to any other person, and these Terms are not an offer to any other person. If you are not a health agency, or you are not carrying on business in New Zealand, please contact us and we will discuss terms that suit you.

---

Part A: Terms for every product

Part A applies to everything we supply to you under your Service Agreement. It does not depend on any one product.

---

1. Providing the Services

1.1 We will perform the Services in accordance with your Statement of Work, all applicable law, and Good Industry Practice. In doing so we will:

1.1.1 comply with your reasonable directions, and keep you informed of the progress of the Services and of any change or possible change to their scope or timing;

1.1.2 hold every licence, consent and authorisation we need to provide the Services;

1.1.3 provide the equipment and resources needed to provide the Services;

1.1.4 supply the agreed service functionality and authorised Deliverable/report access under clause 6.9 of the Service Agreement, fit for the purposes described in your Statement of Work and free from material defects at delivery. We will use reasonable skill and care to prevent Harmful Code or malicious backdoors and ensure third-party and open-source components are properly licensed for their use. This does not require code or build handover;

1.1.5 use an AI System for your Intellectual Property or Confidential Information only through the providers and for the purposes expressly permitted in the Data Processing Schedule, or with your prior written consent. The patient-data restrictions in that Schedule still apply;

1.1.6 not do anything likely to damage your reputation or goodwill;

1.1.7 provide the Services through our own personnel and contractors and the Sub-processors listed in the Data Processing Schedule; and

1.1.8 hold the insurances required of us under your Service Agreement.

1.2 Putting things right. If any part of the Services falls short of clause 1.1, we will re-supply that part at our own cost, as soon as reasonably practicable after becoming aware of the shortfall. You may also require us to re-supply the affected Services by written request, and we will do so at our cost.

1.3 Checking our compliance. On your reasonable written request, no more than once in any 12-calendar-month period, we will give you a written explanation of how we meet clause 7 and the Data Processing Schedule. This is not a scheduled security audit, certification or unrestricted inspection or source-code access right, and does not permit disclosure of other customers' data. Legal regulator, access and discovery duties remain.

1.4 Health Information Privacy Code compliance. Your Service Agreement records your warranty that you are a health agency subject to the Health Information Privacy Code 2020. You are responsible for ensuring that:

(a) giving us access to patient health information for processing on your behalf is permitted, and that you have done everything reasonably within your power under Rule 5(1)(b) of that Code to prevent unauthorised use or unauthorised disclosure of it. We process that information as your agent under section 11 of the Privacy Act 2020, so giving it to us is not a disclosure by you (section 11(5)(a)); where any transfer is nonetheless treated as a disclosure, the Data Processing Schedule sets out the basis on which it is made;

(b) our access to patient health information through your practice management system is limited to what is necessary to provide the Services; and

(c) you assess your Rule 5 security and Rule 12 overseas-disclosure responsibilities using the Data Processing Schedule and the information reasonably available. Your approval does not replace our duty to establish applicable safeguards or either party's actual legal obligations.

1.5 Product support. Any onboarding, introductory or support period applies only to the Services identified in the relevant Statement of Work. It does not apply to another product unless that product's Statement of Work provides for it.

---

2. What we need from you

The Services work because a few things stay in place at your end. The things that apply whatever the product are below. The Part of these Terms for your product lists the rest.

2.1 Your contact address. You will keep the notice email address in your Service Agreement current, and tell us in writing if it changes. Notices we send under clause 12 are treated as received in accordance with clause 12.2, using the address we hold for you, so an address you have stopped monitoring is still an address we may validly use.

2.2 What the Services are used for. You will not use, or allow the use of, the Services other than as described in your Statement of Work, or for any purpose that these Terms describe as outside the Services.

2.3 Lawful use. You will not use the Services in a way that breaches any law, infringes anyone's rights, or would put us in breach of an obligation we owe to a third party.

2.4 If you do not. Where, acting reasonably and on reasonable grounds, we consider that a failure to do any of the above, or anything else that the Part of these Terms for your product asks of you, has prevented or delayed the Services or caused an error in them, we are not liable for the consequences of that failure and our obligations are suspended to the extent, and for so long as, they are affected. We will tell you promptly, give our reasons in writing, and work with you to put it right. If you disagree, clause 10 (Resolving a dispute) applies, and our reliance on this clause is not conclusive.

2.5 Suspension in limited circumstances. We may suspend the Services, or the affected part of them, on written notice to you where we reasonably believe that continuing to provide them would:

(a) breach any law, or cause either of us to breach an obligation owed to a third party;

(b) expose Customer Data to a live and material security risk; or

(c) involve the Services being used for a purpose that these Terms state is outside them.

2.6 A suspension under clause 2.5 is subject to all of the following:

(a) we will tell you at the time we suspend, and give our reasons;

(b) we will suspend only so much of the Services, for only so long, as is reasonably necessary to address the cause;

(c) we will restore the Services as soon as the cause has been resolved, and will work with you to resolve it;

(d) where the cause is capable of being remedied by you and there is no immediate risk to Customer Data or of a breach of the law, we will give you a reasonable opportunity to remedy it before suspending;

(e) where the suspension was not the result of something you did or failed to do, you are not liable to pay for the period of suspension. What is credited is set out in clause 5.9 of your Service Agreement; and

(f) if you disagree that a ground in clause 2.5 exists, clause 10 (Resolving a dispute) applies, and our reliance on clause 2.5 is not conclusive.

2.7 Suspension under clause 2.5 does not terminate your Service Agreement, and does not limit either party's rights to terminate it.

2.8 If a suspension goes on. If a suspension under clause 2.5 continues for more than 10 consecutive Business Days through no fault of yours, you may end the affected Statement of Work by written notice without penalty or early-exit compensation. You may end the whole Service Agreement only if the suspension affects all Services or an independent whole-agreement termination ground exists. Clause 5.9 of the Service Agreement governs credits and refunds.

---

3. Delivery and acceptance

3.1 The relevant Statement of Work states delivery requirements, any acceptance procedure and any deadline or assurance. No product-specific delivery event or support period is implied for another product.

3.2 Where a delivery-assurance provision permits termination, the affected Statement of Work ends as it provides. Refunds are governed only by clause 5.9 of the Service Agreement. The separate service remedies in clause 8.4 remain available.

---

4. Changes to the Services

4.1 Agreed changes. Neither party may change the Services unilaterally. Record a proposed change and its scope and fee effects in writing, and negotiate in good faith. A change requires agreement under clause 12.1 of the Service Agreement. Listed plan choices and additional-clinic email orders made under the signed Statement of Work's express process follow that process and do not otherwise amend the Contract. DPS 5 governs permitted Sub-processor changes.

---

5. Intellectual property

5.1 Clause 6 of the Service Agreement governs ownership of all new work, supplier reuse, client information, supplied report-use rights, identified existing-method permissions and the absence of code/build handover. Clause 10.5 of the Service Agreement and its financial schedule govern the specified IP warranty, indemnity and limit. These Terms grant no additional ownership or licence.

---

6. Confidential information

6.1 Confidential Information. Each of us (as Receiving Party) must keep confidential, and not disclose, information obtained from the other (as Disclosing Party) under or in connection with your Service Agreement that is identified as confidential or that a reasonable person would understand to be confidential (Confidential Information). This includes the contents of your Service Agreement and Statement of Work, but not these Terms, which are published.

Our Confidential Information includes the Platform IP, our unpublished fees and pricing, and our systems, methods and know-how. Yours includes your patient and customer information, your business information, and your practice's operational information.

6.2 When disclosure is allowed. Confidential Information may be disclosed where:

(a) the law requires it;

(b) it is necessary to obtain the intended benefits of, or perform obligations under, your Service Agreement;

(c) the information is already public, other than through a breach of this clause or the law;

(d) the disclosure is to a lawyer, accountant or other professional adviser;

(e) your Service Agreement or Statement of Work expressly permits it, only within the scope of that express permission;

(f) the information was lawfully held before it was disclosed under your Service Agreement; or

(g) the information was independently developed without use of or reference to the other party's Confidential Information.

6.3 Disclosure required by law. A Receiving Party may disclose only what the law requires. To the extent legally permitted, it must notify the Disclosing Party before disclosure, or promptly afterwards if advance notice is unlawful or not practicable, and reasonably assist lawful steps to limit disclosure.

6.4 Ending and retained records. On request or when the relevant engagement ends, return or securely destroy the other party's confidential property and supplied client documents from working/internal files, subject to clause 6 of the Service Agreement and the Data Processing Schedule. Ordinary business emails, contract/billing evidence and records reasonably needed to administer the relationship or meet legal duties may be retained only for their lawful purpose and period. Patient service emails follow the separate rolling-year rule in DPS 2; this is no general right to keep patient files. Protect retained information, limit access/use and delete it when its lawful purpose or duty ends. An express continuing licence or permission applies only to its agreed scope; other secrets remain confidential.

6.5 Survival. This clause 6 survives expiry or termination, and confidentiality obligations continue for 3 years afterwards, except for information that is a trade secret (including our pricing methodology, any fees we have not published, and the Platform IP, methods and know-how), where they continue for as long as the information stays confidential.

---

7. Privacy, data protection and security

7.1 Security controls. We will keep in place appropriate technical and organisational measures to protect Customer Data and your Confidential Information against unauthorised or unlawful processing, accidental loss, destruction or damage.

7.2 Security measures. We must maintain controls in accordance with Good Industry Practice, including multi-factor authentication on platforms holding Customer Data, health information, credentials or financial data; and full-disk encryption on staff computers. These security obligations continue throughout the Services.

7.3 Data protection law. Each of us will comply with the Privacy Act 2020, the Health Information Privacy Code 2020, and any other applicable data protection law.

7.4 Purpose limitation. We process Customer Data only to provide the Services on your instructions and perform legal duties. We do not use it for our own marketing, model training or unrelated purposes. Our separate processing of business contacts, contracts and billing records is described in DPS 1 and DPS 3 and is not represented as processing solely on your behalf.

7.5 Our role. Where we hold Customer Data solely on your behalf, section 11 of the Privacy Act 2020 applies. If we use or disclose personal information for our own purposes, our own agency obligations apply as the law requires. The labels in this Contract do not displace either party's statutory responsibilities.

7.6 Data schedule. The Data Processing Schedule states data categories, purposes, providers, locations, retention and the overseas-processing basis. Product clauses describe operating responsibilities without creating competing retention periods.

7.7 Processing health information. In processing patient health information on your behalf, we will:

(a) process it only for the purpose of providing the Services;

(b) disclose it only to you and personnel authorised for that clinic and information, a Sub-processor listed in the Data Processing Schedule for its permitted purpose, or as required by law;

(c) keep it secure in accordance with clause 7.1 and Rule 5 of the Health Information Privacy Code 2020;

(d) assist you in responding to any request by an individual to access or correct their information;

(e) notify you of any complaint or regulatory enquiry we receive about it;

(f) delete it in accordance with the retention periods that apply to it under these Terms;

(g) engage a Sub-processor only after verifying and recording that its applicable terms and enabled settings meet these privacy obligations; and

(h) on expiry or termination, delete or return patient health information in accordance with the applicable retention periods and legal duties in the Data Processing Schedule; termination does not restart a retention period.

7.8 Retention and legal duties. The Data Processing Schedule governs retention and legal preservation. Tell us promptly of an access request or binding requirement affecting information we may still hold. On your authorised request we will delete QA recordings or transcripts earlier where lawful; a legal preservation duty prevails. We do not provide an optional archive. Neither your request nor termination restarts a retention period.

7.9 Security incidents. If we become aware of a Security Incident affecting Customer Data or your Confidential Information, we will:

7.9.1 notify you in writing within 24 hours, and provide the information you reasonably need to assess it within a further 5 Business Days, including the nature of the breach, the categories and approximate number of individuals affected, and the steps we have taken to contain it;

7.9.2 take corrective action promptly, at our cost, and keep you informed; and

7.9.3 co-operate with you in any notification or regulatory step you must take.

7.9.4 If you do not acknowledge our notification within 48 hours, or are otherwise unresponsive, we reserve the right to notify the Office of the Privacy Commissioner directly, to protect our own legal position and the interests of affected individuals. Any such notification will be made as soon as practicable after we become aware of the incident, consistent with the standard set by the Privacy Act 2020. Because we hold and process Customer Data as your agent under section 11 of the Privacy Act 2020, information we hold and a breach we know of are treated as held and known by you. As between us, you remain the agency responsible for notifying affected individuals and the Privacy Commissioner. This allocation is contractual and does not affect either party's own obligations under the Privacy Act 2020. We will tell you if we notify the Commissioner. Neither the 48-hour acknowledgement period nor the dispute process permits either party to delay a notification or other action required by law.

7.10 Complaints. WeTalk.ai is a health agency for the purposes of clause 4(2)(j) of the Health Information Privacy Code 2020, and the complaints procedure in clause 7(2) of that Code applies to us.

7.10.1 Our Privacy Officer, appointed under section 201 of the Privacy Act 2020, is Hamish Faulks, who is also our designated complaints person. Complaints may be sent to admin@wetalkai.co.nz.

7.10.2 If you, or an individual who deals with you through the Services, complain to us about a breach of that Code, we will: acknowledge the complaint in writing within 5 working days of receiving it, unless it has already been resolved to the complainant's satisfaction within that period; tell the complainant about any relevant internal and external complaints procedures; and document the complaint and our actions on it.

7.10.3 Within 10 working days of acknowledging the complaint, we will decide whether we accept that it is justified, or determine how much additional time we need. Where that additional time is more than 20 working days, we will tell the complainant and give our reasons.

7.10.4 As soon as practicable after deciding, we will tell the complainant the reasons for our decision, any actions we propose to take, any appeal procedure we have, and their right to complain to the Privacy Commissioner.

7.10.5 This clause does not limit your own obligations as a health agency to handle complaints from your patients, or either party's rights under Part 4 of the Privacy Act 2020.

---

8. Liability

8.1 To the maximum extent permitted by law, and subject to clause 8.3, neither of us is liable to the other under or in connection with your Service Agreement for any indirect or consequential loss or damage, including any indirect or consequential loss of revenue, profits, goodwill, business or anticipated business, anticipated savings, or business interruption. For the avoidance of doubt, this clause 8.1 does not exclude a party's direct loss, which remains recoverable subject to the limits set out in your Service Agreement.

8.2 Limit on our liability. Our liability under or in connection with your Service Agreement is limited. The limits, including every monetary cap, are set out in that agreement, which you receive in full before you sign anything. Those limits form part of the agreement between us and apply to these Terms as if they were set out here.

8.3 Exceptions to exclusions and limits. Nothing in your Service Agreement or these Terms limits or excludes either party's liability for:

(a) fraud or fraudulent misrepresentation;

(b) death or personal injury caused by negligence;

(c) that party's wilful default or deliberate breach of your Service Agreement or these Terms;

(d) any liability under the Consumer Guarantees Act 1993 or the Fair Trading Act 1986 to the extent it is not validly excluded or limited under your Service Agreement; or

(e) any other liability that cannot lawfully be limited or excluded.

8.4 Your remedies. If we breach, or fail to properly perform, any of our obligations as described in these Terms, your Service Agreement and your Statement of Work, and, where the breach or failure is capable of remedy, fail to remedy it within 10 Business Days of receiving written notice from you requiring it to be remedied, you may (without limiting any other right) withhold payment for the affected Services until the matter is resolved; require us to re-supply the affected Services at our cost; suspend the affected Services by written notice until the matter is resolved to your reasonable satisfaction; obtain the affected Services from another supplier; and recover from us any additional cost reasonably incurred in doing so.

8.5 Consumer Guarantees Act 1993.

8.5.1 Clause 8 of the Service Agreement records any business contracting-out of the Consumer Guarantees Act 1993 and its statutory safeguards.

8.5.2 These Terms do not independently exclude the Consumer Guarantees Act 1993.

8.5.3 If the Consumer Guarantees Act 1993 applies, clause 8.3 of the Service Agreement preserves rights and remedies that cannot lawfully be excluded or restricted.

8.6 Fair Trading Act 1986.

8.6.1 Clause 9 of the Service Agreement records any contracting-out under section 5D of the Fair Trading Act 1986 and its statutory safeguards.

8.6.2 Any acknowledgement about what each party has relied on in entering into the agreement is given in your Service Agreement, not in these Terms.

8.6.3 Nothing in this clause 8 affects the unfair contract terms provisions of the Fair Trading Act 1986.

---

9. Events outside our control

9.1 Neither of us is liable for a failure or delay in performing an obligation if it arises directly from a Force Majeure Event and that party complies with clause 9.2. A Force Majeure Event does not include a strike or labour dispute involving the party relying on this clause (or its subcontractors), or a lack of funds for any reason.

9.2 A party relying on clause 9.1 must give the other written notice as soon as possible after becoming aware of the event, with details of its nature, expected duration and effect, keep the other informed of any change and of when it ends, and use reasonable endeavours to mitigate its effects and still perform on time.

9.3 Clause 9.1 does not excuse money properly due. It does not remove express rights to withhold affected fees, credits, refunds or relief for unprovided Services under the Contract.

9.4 Platform outages. A Force Majeure Event includes any outage, failure, suspension or material degradation of a third-party platform on which we depend, such as an artificial intelligence, cloud, hosting, workflow automation or telecommunications platform, including the Sub-processors listed in the Data Processing Schedule, to the extent it is beyond our reasonable control. A Force Majeure Event does not include any outage or degradation to the extent caused by our own act or omission, our choice of sub-processor plan or configuration, or our failure to take commercially reasonable continuity and recovery precautions. This does not promise automatic multi-provider failover.

9.5 Getting the service back. Where a Force Majeure Event affects the Services, we will take reasonable steps to restore them, or put a reasonable workaround in place, as soon as practicable.

---

10. Resolving a dispute

10.1 If a dispute arises, the party raising it must give the other written notice as soon as reasonably practicable.

10.2 Within 10 Business Days of that notice, we will meet, in person or by video, and make genuine and reasonable efforts to resolve it in good faith.

10.3 Mediation. If the dispute is not resolved within 30 days of the notice, either party may request mediation by written notice. Before starting ordinary court proceedings, the party proposing them must request mediation. We must each make genuine and reasonable efforts to arrange and participate in mediation with an independent mediator agreed between us. Mediation takes place in New Zealand or by an agreed remote method. Each party pays its own costs and half the mediator's fees unless we agree otherwise. Neither party is required to accept a settlement.

10.4 If mediation does not resolve it. Either party may start proceedings if the dispute remains unresolved 20 Business Days after the mediation request, the mediation ends without agreement, or the other party declines or fails to participate. We may agree in writing to extend that period. A failure to agree on a mediator does not prevent proceedings after that period.

10.5 Preserved rights. Nothing in this clause prevents urgent interlocutory relief, a claim within the Disputes Tribunal's jurisdiction, or a statutory complaint or notification. Either party may obtain advice or involve a lawyer at any stage. The settlement and insurance requirements are in Schedule 2 of the Service Agreement.

---

11. Assignment and subcontracting

11.1 Assignment. Neither of us may assign or transfer rights or obligations under your Service Agreement without the other's prior written consent, not to be unreasonably withheld, except that we may, on written notice to you and without your consent, assign it to a Related Company, or to a purchaser of all or substantially all of our business or assets. A direct or indirect change in the ownership or control of WeTalk.ai is not an assignment requiring your consent. Where we do assign:

11.1.1 the Services you receive, and the terms on which you receive them, do not change;

11.1.2 the assignee must assume all of our obligations in writing, and we remain liable for them until it does; and

11.1.3 if you would rather not continue with the assignee, you may terminate your Service Agreement and each Statement of Work by written notice given within 30 days of our notice, without penalty and with no early-termination compensation payable.

11.2 Subcontracting. In providing the Services we may engage the Sub-processors and third-party platform providers listed in the Data Processing Schedule, and use our own personnel and contractors. We will not otherwise subcontract a material part of the Services without your prior written consent, not to be unreasonably withheld. Your notice and objection rights for new or changed Sub-processors are set out in the Data Processing Schedule. We remain responsible to you for the Services however they are performed.

---

12. Notices

12.1 Every formal notice under your Service Agreement must be in writing and sent by email, in the body or as an attachment, to the email address recorded in that agreement or, where none is recorded for a party, to the address that party has most recently used to correspond about the agreement.

12.2 An emailed notice is treated as received 2 hours after it is sent, or, where that falls outside 8:30am to 5:30pm on a Business Day, at 9:00am on the next Business Day, unless the sender receives a failed-delivery message or otherwise actually knows it did not reach the address.

12.3 If we send you a notice by email and have not had an acknowledgement or reply within 3 Business Days, we will send a follow-up copy. That is a courtesy to reduce the risk of a notice being missed and does not change when the original is treated as received.

12.4 Periods that run from a notice. A Statement of Work's express introductory opt-out deadline and receipt rule govern that opt-out instead of this clause. Where a notice starts a period in which you may object, terminate or exercise a right, the period runs from deemed receipt under clause 12.2. If a follow-up copy is required under clause 12.3, the period instead runs from the later of that deemed receipt and the sending of the follow-up copy. This includes a date-objection provision of the relevant Statement of Work and DPS 5.4. An express actual-receipt deadline for a plan choice or introductory opt-out in the Statement of Work prevails.

---

13. General

13.1 Changes in writing. How your Service Agreement and Statement of Work may be amended, and how these Terms may change, are dealt with in your Service Agreement.

13.2 Counterparts and electronic signature. Your Service Agreement records the parties' consent to electronic signature. Electronic signatures and records are given legal effect by Part 4 of the Contract and Commercial Law Act 2017.

13.3 Entire agreement. The entire-agreement and non-reliance provisions are set out in clause 9.3 of your Service Agreement.

13.4 No partnership. Except as expressly provided in clause 7.5 and the Data Processing Schedule (under which we process Customer Data as your agent for the purposes of section 11 of the Privacy Act 2020), nothing creates a partnership, joint venture, agency, trust, or employment relationship between us. Neither of us may represent that any such relationship exists, or act for or bind the other.

13.5 Severance. If a provision becomes unenforceable, illegal or invalid, it is severed without affecting the rest.

13.6 Rights cumulative. All rights and remedies are cumulative and may be exercised together or separately. Using one does not exclude another.

13.7 Waiver. A failure or delay in exercising a right is not a waiver of it. A waiver of a breach is effective only if in writing and signed by the party against whom it is claimed, and does not waive any other or later breach.

13.8 No third party rights. Except as expressly stated, nothing in these Terms is intended to confer a benefit on, or be enforceable by, any person who is not a party to your Service Agreement.

13.9 Order of precedence. Clause 1.6 of the Service Agreement is the only priority rule for the Contract, including its protected privacy, intellectual-property and risk provisions.

13.10 Governing law. The law governing your Service Agreement and these Terms, and the courts to which the parties submit, are set out in clause 12.3 of your Service Agreement.

13.11 Survival. Any provision of these Terms which by its nature is intended to continue after your Service Agreement ends does so. Without limiting that, the following survive the expiry or termination of your Service Agreement for as long as is necessary to give them effect:

(a) clause 5 (Intellectual property), in accordance with clause 6.14 of the Service Agreement;

(b) clause 6 (Confidential information), in accordance with clause 6.5;

(c) clause 7 (Privacy, data protection and security) and the Data Processing Schedule, including our obligations to delete Customer Data within the applicable retention period and to notify you of a Security Incident affecting your Customer Data;

(d) clause 8 (Liability), including the limits set out in your Service Agreement;

(e) clause 10 (Resolving a dispute) and clause 13.10 (Governing law); and

(f) any clause in a Part of these Terms that says it survives, in respect of anything done while your Service Agreement was in force.

13.12 For the avoidance of doubt, our obligations in respect of Customer Data still held by us or a Sub-processor at the date your Service Agreement ends continue until that data has been deleted in accordance with the Data Processing Schedule, whether or not any other obligation has ended.

---

14. Definitions and interpretation

14.1 In these Terms:

"AI System" means any artificial intelligence or machine learning system, model, or service.

"Confidential Information" has the meaning given in clause 6.1.

"Background IP" has the meaning given in clause 6.1 of the Service Agreement.

"Business Day" means a Monday to Friday other than a national public holiday in New Zealand or the weekday on which that national public holiday is observed. Regional anniversary days are not excluded.

"Customer Configuration" has the meaning given in clause 6.8 of the Service Agreement.

"Customer Data" means personal information (including health information) about an individual who deals with you through the Services, that is collected, received or processed by us in connection with the Services.

"Data Processing Schedule" means the schedule of that name forming part of these Terms.

"Deliverable" means any deliverable, work product, configuration or material we supply under a Statement of Work, other than Customer Outputs.

"Customer Outputs", "Service Fees", "Term", "Commencement Date" and "End Date" have the meanings given in the Service Agreement. Product service and billing dates and units are defined in the relevant Statement of Work.

"Force Majeure Event" means an event beyond a party's reasonable control, including an act of God, natural disaster, epidemic or pandemic, war, terrorism, civil unrest, government action, failure of a utility or telecommunications service, and the platform outages described in clause 9.4.

"Good Industry Practice" means the degree of skill, care and diligence reasonably expected of a competent supplier of services of the same kind in New Zealand.

"Harmful Code" means any virus, worm, trojan, ransomware, logic bomb, or other code designed to disable, damage, or gain unauthorised access to a system or data.

"Insolvency Event" means objectively established inability to pay debts when due, an actual relevant insolvency appointment or formal insolvency process, a general arrangement with creditors because of financial difficulty, or permanent cessation of the contracting party's business. It excludes a mere threat, allegation or liquidation application, an ordinary late/disputed invoice, routine agreed payment plan, temporary interruption or lawful solvent restructuring that preserves performance. The event and any exercise of a right remain subject to applicable law; Clause 5.3 of the Service Agreement states the notice and mandatory-supply safeguards.

"Intellectual Property" means all intellectual property rights of any kind, whether registered or unregistered, including copyright, trade marks, designs, patents, trade secrets, know-how, and rights in databases and software.

"Platform IP" has the meaning given in clause 6.8 of the Service Agreement.

"Related Company" has the meaning given in section 2(3) of the Companies Act 1993.

"Security Incident" means any actual or reasonably suspected unauthorised access to, or unauthorised or accidental disclosure, loss, alteration or destruction of, Customer Data or your Confidential Information held or processed by us.

"Service Location" means a location identified in a signed Statement of Work or an additional-clinic order validly accepted under its express process.

"Services" means services described in a signed Statement of Work, including its valid additional-clinic orders, provided under the Contract.

"Statement of Work" means a statement of work agreed and signed by both parties under your Service Agreement.

"Sub-processor" means a third party engaged by us to process Customer Data on your behalf, as listed in the Data Processing Schedule. That Schedule also lists our business service providers; their stated roles are assessed separately under DPS 1.

14.2 Interpretation. Headings are for convenience only. The singular includes the plural and vice versa. A reference to a person includes a body corporate. "Including" and similar words are not words of limitation. A reference to a statute includes it as amended or replaced. Where a word or expression is defined, its other grammatical forms have a corresponding meaning, whether or not capitalised. A reference to a clause or section is to a clause or section of these Terms unless stated otherwise.

14.3 Terms defined in a Part. A term defined in the Part of these Terms for a product (for the AI Receptionist, clause 20) has that meaning in that Part, in the Data Processing Schedule, in your Service Agreement and in your Statement of Work.

---

Part B: The AI Receptionist

Part B applies if your Statement of Work is for the AI Receptionist. Part A and the Data Processing Schedule apply to the AI Receptionist as well.

---

15. What the AI Receptionist is, and what it is not

15.1 Administrative scope. Jenny takes bookings, answers questions about your practice, routes calls and takes messages. The AI Receptionist does not provide clinical advice, symptom assessment, triage, diagnosis, treatment or clinical decisions. This description does not exclude a statutory duty or patient's right that applies by law.

15.2 The AI is not guaranteed to be perfect. The parties acknowledge that the AI Receptionist is a machine-learning system whose individual call outcomes are probabilistic and are not guaranteed to be error-free. Our obligation in respect of live call handling is to exercise reasonable skill and care in accordance with clause 1.1 and Good Industry Practice.

15.3 It is not an emergency service. The AI Receptionist is not a medical helpline and is not monitored in real time. It may not recognise that a call is urgent, and it cannot summon help. A Caller who needs urgent medical assistance should call 111 or contact a health professional directly. You are responsible for making that clear to your patients through your own patient-facing communications, and for the arrangements you have in place for urgent contact outside the AI Receptionist.

15.4 This clause 15 describes the nature and the limits of the Services. It does not reduce the standard of skill and care we owe under clause 1.1 in performing them.

15.5 Demonstration and introductory rights. Any demonstration, introductory period and opt-out right are governed by the Statement of Work. A demonstration does not remove service standards or remedies.

15.6 What this clause 15 says the AI Receptionist is, and is not, survives the expiry or termination of your Service Agreement, in respect of anything done while your Service Agreement was in force (clause 13.11).

---

16. Callers and their information

This clause 16 is a protected privacy, data and security clause for clause 1.6 of the Service Agreement.

16.1 Telling callers they are speaking to an AI.

16.1.1 The AI Receptionist identifies itself as an artificial intelligence assistant at the beginning of every call, and says that the call may be recorded for quality assurance purposes. This applies to every call, without exception.

16.1.2 This disclosure is a fixed condition of the Services. It is not configurable by you, and you may not disable, shorten, delay or otherwise vary it. We do not supply the Services on any other basis.

16.1.3 The disclosure is made in this form, or in a form to substantially the same effect: "Hi, this is Jenny, your AI receptionist for [practice name]. This call may be recorded for quality assurance purposes."

16.1.4 This disclosure supports your obligations under Rule 3 of the Health Information Privacy Code 2020, under which a caller must be made aware that their information is being collected and why.

16.1.5 Patient notices. The greeting does not complete your Rule 3 obligations under the Health Information Privacy Code 2020. Take reasonable steps to make patients aware of collection, purposes and intended recipients; the names and addresses of the collecting and holding agencies; access and correction rights; whether any legally authorised or required supply is voluntary or mandatory and the authorising law; and the consequences, if any, of not providing all or part of the information. Where information is collected indirectly, assess the applicable Rule 3A requirements and exceptions. A Contract notice does not replace notice owed to an individual.

16.2 Existing patient records. Where the AI Receptionist looks up an existing patient in your practice management system, we access your records as your agent under section 11 of the Privacy Act 2020, and the information remains information held by you. We use it only as needed to identify the caller and complete the booking. You remain responsible for the notices you give your patients about how their information is used.

16.3 Voice identification. We do not create caller voiceprints or use a caller's voice characteristics to identify or verify them or deliberately profile them. Ordinary conversation processing and matching a supplied phone number or details against clinic records are different activities. This is not a warranty about every internal audio feature a provider processes or a blanket legal exemption. Before introducing voice identification or another relevant biometric feature, we must assess the applicable privacy code and safeguards, give at least 30 calendar days' prior written notice and obtain your written consent. No such feature is authorised by signing this Contract.

16.4 Recording instruction. You instruct us, as your agent under section 11 of the Privacy Act 2020, to make and retain the recordings and transcripts in DPS 2 for its stated purposes and periods, subject to DPS 1.2. Recording must be lawful; your instruction does not authorise unlawful interception.

16.5 What the Customer Configuration includes. For the AI Receptionist, the Customer Configuration (clause 6.8 of the Service Agreement) includes the call flow as we map it into the platform and the voice settings.

---

17. What we need from you for the AI Receptionist

The AI Receptionist works because a few things stay in place at your end.

17.1 Call forwarding. You are responsible for setting up and keeping in place the forwarding of calls from your own number to the dedicated number we provide. Calls to your own number cannot reach Jenny if forwarding is switched off, and we are not responsible for calls that never reach us.

17.2 Access to your practice management system. You will maintain the access we need to your practice management system so that bookings can be delivered to it, and will tell us promptly if credentials change, access is revoked, or your provider changes the integration.

17.3 Keeping your details current. You will tell us promptly when something changes that the AI Receptionist relies on: your practitioners, the services you offer, your opening hours, your booking rules, or your Service Locations. We can only book what we have been told about. Where a booking is made on information you have not updated, that is not a failure of the Services.

17.4 What the AI Receptionist is used for. You will not use, or allow the use of, the AI Receptionist for clinical triage, symptom assessment or emergency response, or for any purpose described in clause 15 as outside the Services. Each of those is a purpose that these Terms state is outside the Services for the purposes of clauses 2.2 and 2.5.

17.5 The AI disclosure. You will not ask us to suppress, shorten or omit the disclosure required by clause 16.1, and you will make sure your own patient-facing privacy information is consistent with it.

17.6 Your own systems and suppliers. Your practice management system (for example Gensolve, Cliniko, Nookal or Zanda (formerly Power Diary)) is supplied to you by a third party under your own arrangement with that supplier. We deliver bookings into it, but we do not control it, and it is not one of our Sub-processors. You are responsible for maintaining it, including your subscription, your credentials, and any integration settings it requires.

17.7 If a system or supplier under your control fails or withdraws access, we are not responsible to the extent the resulting failure is genuinely outside our control and not caused or contributed to by our faulty integration, setup or other breach. The exclusion does not excuse our own failure. We will tell you promptly and use reasonable endeavours to help restore the connection, without guaranteeing another supplier's repair time. Relief for an outage of our service is in clause 18.

17.8 A booking or call-handling error caused by a failure to do any of the things in this clause 17 is an error for the purposes of clause 2.4.

---

18. Outages and credits

18.1 Voice platforms. For the AI Receptionist, the third-party platforms referred to in clause 9.4 include voice processing and speech-to-text platforms.

18.2 If the AI Receptionist is unavailable. If the AI Receptionist is unavailable at our platforms for 3 consecutive Business Days, then from the fourth consecutive Business Day and for each further day of continuous unavailability:

18.2.1 credit one fourteenth of the affected clinic's applicable Fortnightly Subscription for each calendar day of continuing unavailability from that trigger. For a group, credit only affected clinics, or all clinics if all are affected. The credit cannot exceed the fees actually payable for the affected days;

18.2.2 despite clause 9.3, you may withhold the part of your next invoice referable to those days until the Services are restored; and

18.2.3 Relief reduces fees or creates a credit during the engagement. Clause 5.9.6 of the Service Agreement governs final-invoice and unused-credit treatment. Where no fee was payable, including the Free Period, no credit is due and that period is not extended. We must work to restore Jenny as quickly as reasonably possible.

18.2.4 This clause applies only where the AI Receptionist is unavailable at our platforms. Unavailability caused by any system or supplier under your control is dealt with in clause 17.7 and never qualifies for relief under this clause.

18.3 If an outage continues for more than 10 Business Days. If the AI Receptionist is unavailable at our platforms for more than 10 consecutive Business Days, you may terminate the affected Statement of Work (or, if it affects all Services, your Service Agreement) by written notice, without penalty and with no early-termination compensation payable. The days of unavailability are credited under clause 18.2, and what is refunded is set out in clause 5.9 of your Service Agreement.

---

19. Privacy, data protection and security for the AI Receptionist

19.1 This is a protected privacy, data and security clause for clause 1.6 of the Service Agreement.

19.2 Call information. We must restrict access to call information, retain and delete it under DPS 2 and the legal exception in DPS 1.2, and ensure it is not used for AI model training. DPS 3 identifies providers and processing roles.

19.3 Booking delivery. Booking information is sent to your practice management system to the extent its integration supports delivery. If delivery is unsupported or fails, relevant information must be flagged for staff follow-up as the Statement of Work provides. Neither party may assume that the clinic holds the information merely because a call ended.

19.4 Required records. You are responsible for your clinical records. Our QA recordings and transcripts are not an agreed substitute. Calling a copy administrative does not override the Health (Retention of Health Information) Regulations 1996 or another applicable duty. Each party must meet recordkeeping duties applying to its actual role. Required information must be transferred to and retained by the appropriate holder before a working copy is deleted. DPS 1.2 preserves legal duties without authorising indefinite retention of all calls.

---

20. Definitions for this Part

20.1 In this Part B and wherever else these Terms use them:

"AI Receptionist" means the artificial-intelligence voice receptionist service supplied by us, as described in a Statement of Work.

"Caller" means a person whose call is answered by the AI Receptionist under your Statement of Work.

"Caller Data" means Customer Data about a Caller.

---

Schedule: Data Processing Schedule

This Schedule forms part of these Terms. DPS 1, DPS 3.1, the first table in DPS 3, and DPS 5 apply to every product. DPS 2, DPS 3.2 and the second table in DPS 3 apply to the AI Receptionist and are read with Part B. DPS 4 applies where personal information is processed overseas, with its caller-specific rules applying to the AI Receptionist. Together they set out how information is handled, what is kept and for how long, who else processes it, on what legal basis it leaves New Zealand, and how we tell you of a change.

DPS 1. Who is responsible for what (every product)

DPS 1.1 Roles and purposes. You determine the clinic purposes for Customer Data. We process it solely on your behalf to provide the Services, subject to applicable law and section 11 of the Privacy Act 2020. We separately handle business contacts, contracts and billing records to administer our business and meet legal duties. Independent supplier purposes, including Twilio's carrier metadata, must be assessed separately.

DPS 1.2 Retention and mandatory preservation. Each category's stated retention period applies subject to legal duties. We must retain an item beyond a contractual maximum only where a law or binding order requires it, or while an access request requires preservation, including under section 212(2)(d) of the Privacy Act 2020. A legal duty is not postponed until we happen to learn of it. Restrict retained items, record the legal basis and delete them when the duty ends unless another duty applies. Each party must promptly tell the other of a request or binding requirement affecting information it may hold. A complaint or investigation alone does not authorise indefinite retention. This preserves applicable Health (Retention of Health Information) Regulations 1996 duties; it does not assume every audio recording must be held for ten years.

DPS 2. What is held, and for how long (AI Receptionist)

DPS 2.1 Maximums. The table periods are maximums subject to DPS 1.2. We must maintain effective automated expiry and selective preservation controls across relevant systems. We cannot restore an item permanently deleted from systems available to us. No claim is made about recovery by every person from every system.

DPS 2.2 These periods govern our copies only. Clause 19.4 of these Terms explains how they relate to your own record-keeping.

DPS 2.3 Service-email copies. We remove patient service emails from the systems available to us, including recoverable deleted-item folders, no later than 12 calendar months after each message, and earlier if no longer needed for its lawful purpose, subject to DPS 1.2. Ending the engagement does not start a new year: only these existing necessary email records may remain for the unused part of their original period, protected and used solely for the stated service-history/issue purpose. Recordings and full transcripts keep their separate 30-day maximum; do not attach or paste them to avoid it. The clinic's received copies and clinical records are under its control.

DPS 2.4 Provider deletion completion. We must issue effective deletion instructions and verify expiry controls. Restricted residual provider copies may complete deletion under the applicable binding processing terms and law; they cannot remain available for our ordinary use or be restored to extend retention. For Google, its published deletion commitment allows up to 180 days after an item becomes irrecoverable by us. We must establish the terms actually applicable to our account and the necessary lawful safeguards; this is not a promise every internal provider copy disappears on the customer-facing expiry date. The separate maximums for available recordings and transcripts remain.

DPS 3. Sub-processors (every product and the AI Receptionist)

The tables identify providers, their functions, the information they handle and processing locations. A provider may perform both business administration and patient-service processing; the relevant role and purpose are stated. DPS 4 governs overseas safeguards.

Every product: providers holding business information

AI Receptionist

DPS 3.1 You authorise us to engage the Sub-processors listed above. This list is current as at the version date of these Terms and is updated when arrangements change; you are notified of material changes under DPS 5 below.

DPS 3.2 The agent characterisation in DPS 1.1 applies to all Caller Data we process on your behalf, with one exception: Twilio, as the underlying telecommunications carrier, holds and uses a limited set of carrier and telephony metadata for its own purposes (the information any phone company necessarily holds to connect a call), so under section 11(3) of the Privacy Act 2020 it holds that information in its own right as well as on your behalf.

DPS 4. Information processed outside New Zealand

DPS 4.1 Providing the Services involves Caller Data processing in the United States and Germany, and global processing for the Google Workspace service-email function identified in DPS 3, and access from Australia by authorised WeTalk personnel working for us. That access remains subject to clause 7 and this Schedule. Your own business information may in addition be held in New Zealand, Australia, or globally, as shown in the tables in DPS 3.

DPS 4.2 Agency processing. Where an overseas provider processes Caller Data solely on our and your behalf, section 11 of the Privacy Act 2020 governs whether the transfer is a disclosure. We must establish its actual terms, purposes and enabled settings before relying on that basis. Independent purposes are not covered by an agency label. Twilio's independent carrier metadata is assessed as an overseas disclosure under DPS 4.3.

DPS 4.3 Overseas disclosure. A disclosure must have a lawful basis under Rule 11 of the Health Information Privacy Code 2020, where applicable, and satisfy Rule 12. For booking-related disclosure made for the purpose for which information was obtained, the relevant basis is Rule 11(1)(c). Before relying on Rule 12(1)(f), we must have and record reasonable grounds to believe the recipient is required to protect the information with safeguards comparable overall to the Privacy Act 2020 as modified by that Code.

Those grounds must be established from binding processing terms, actual purposes, security and retention settings and other relevant evidence. We must verify the applicable terms and settings for a provider within Vapi before enabling it. A list, certification or Customer signature alone is insufficient. No transfer may be enabled without meeting the applicable legal requirements. Non-health personal information is governed by the applicable Information Privacy Principles. No foreign law or framework substitutes for these New Zealand requirements.

DPS 5. Notice of changes to Sub-processors (every product)

DPS 5.1 We may engage a new Sub-processor, or change an existing Sub-processor arrangement, without your prior approval.

DPS 5.2 Where such a change materially affects (i) the location at which Customer Data is processed, or (ii) the privacy safeguards applicable to Customer Data, we must give you written notice at least 30 days before the change takes effect, describing the change and the safeguards applying to the new arrangement, and must update this Schedule accordingly.

DPS 5.3 Urgent changes. Where a change described in DPS 5.2 must be made without delay in order to (i) respond to a security vulnerability, security incident, or failure or discontinuation of service affecting a Sub-processor, or (ii) comply with the law or the direction of a regulator, we may make the change immediately and must give the notice required by DPS 5.2 as soon as reasonably practicable and in any event within 5 Business Days after the change takes effect. The notice must state which ground in this DPS 5 we relied on.

DPS 5.4 You may, within 15 Business Days of receiving a notice under DPS 5.2 or DPS 5.3, object to the change on reasonable grounds related to the protection of Customer Data. If you object and we cannot resolve the objection within a further 15 Business Days, you may terminate the affected Statement of Work (or, if the change affects all Services, your Service Agreement) on not more than 10 Business Days' written notice, without penalty and without liability for any agreed compensation on early termination.

Version 3 — 25 October 2026  ·  © 2026 WeTalk.ai Limited

Previous versions

Your Service Agreement names the version of these Terms that applies to you. Every published version stays at its own address so you can always read the version you signed under.

• Version 3 — 25 October 2026 — current (this page)
• Version 2 — 22 September 2026 — superseded
• Version 1 — 9 September 2026 — superseded