Terms of Service for Advisers

These Terms of Service apply to advisers and staff who use the PalmFlow dashboard. If you are a client completing a PIP form, these terms do not apply to you.

1. Definitions

In these Terms:

• "Service" means the PalmFlow platform, including the adviser dashboard, client chat interface, AI processing, and related features.
• "Organisation" means the advisory organisation (Citizens Advice bureau, local council, NHS body, charity, or other entity) that has contracted with PalmFlow and employs or engages you.
• "Adviser" means you - an authorised user with a PalmFlow account created by your Organisation.
• "Client" means an individual completing a PIP application through PalmFlow at your Organisation's direction.
• "PIP" means Personal Independence Payment, a UK government benefit for people with long-term health conditions or disabilities.
• "We," "us," "our" means Digital Palm Ltd, operator of PalmFlow.

2. What PalmFlow Does

PalmFlow is an AI-assisted tool for advisory organisations to help clients complete PIP applications. Specifically:

For Clients:

• Provides an AI-guided chat that asks PIP-related questions across 12 sections
• Collects health information about conditions, daily living activities, and mobility
• Does NOT collect names, addresses, or other personal identifiers

For Advisers (You):

• Create client sessions (unique link + access code)
• Review AI-generated summaries of client responses
• Edit and refine summaries as needed
• Copy/paste summaries into the official gov.uk PIP application form
• Manage your Organisation's client sessions

What PalmFlow Does NOT Do:

• Submit applications directly to DWP (you do this via gov.uk)
• Provide legal or medical advice
• Make eligibility decisions
• Guarantee PIP application success
• Replace your professional judgment

3. Your Relationship With PalmFlow

Three-Party Structure:

Key Points:

• Your Organisation is our customer, not you individually
• Your Organisation controls your account (creation, access level, deactivation)
• You must follow both these Terms and your Organisation's policies
• Questions about service terms, billing, or contracts should go to your Organisation administrator

4. Data Protection Roles

For Client PIP Data:

• Your Organisation = Data Controller (determines purposes, means, retention of processing)
• PalmFlow = Data Processor (processes data on behalf of your Organisation under contract)
• You = Authorised Processor (act under your Organisation's instruction and control)

For Your Adviser Account Data:

• PalmFlow = Data Controller (determines how adviser account data is processed)
• Your Organisation = Joint Controller (decides who gets accounts, access levels, termination)

Your Obligations:

• Process client data only as instructed by your Organisation
• Follow UK GDPR and Data Protection Act 2018 requirements
• Maintain confidentiality of client health information
• Report data breaches to your Organisation immediately
• Never access client data outside your Organisation

5. Account Access and Security

Account Creation

Your account is created by your Organisation's administrator. You cannot:

• Create accounts without authorisation
• Use someone else's account
• Share your login credentials
• Create multiple accounts

Your Security Responsibilities

You are responsible for:

• Password security: Use a strong, unique password; enable MFA if available
• Session management: Log out when leaving your workstation; never leave sessions unattended
• Device security: Use secure, trusted devices; keep software updated
• Breach reporting: Immediately report suspected unauthorised access to your Organisation and us
• Activity responsibility: All actions taken under your account are attributed to you

Session Timeout

For security, sessions automatically expire after 8 hours of inactivity. You will need to log in again.

6. Acceptable Use

Permitted Uses

You may use the Service only for:

• Assisting clients with legitimate PIP applications
• Activities within your professional role at your Organisation
• Purposes consistent with your Organisation's mission and policies

Prohibited Activities

You must NOT:

• Misuse client data: Access, copy, or share client data outside authorised purposes
• Violate privacy: Access other Organisations' data; view clients not assigned to you (unless authorised by your admin)
• Compromise security: Attempt to bypass access controls, security measures, or authentication systems
• Disrupt service: Overload systems, use automated scripts without permission, introduce malware or viruses
• Competitive intelligence: Use the Service to build competing products or reverse-engineer functionality
• Fraudulent applications: Create fake clients, fabricate health information, or submit fraudulent PIP claims
• Unauthorised advice: Provide medical or legal advice beyond your professional qualifications
• Guarantee outcomes: Promise clients PIP approval or specific benefit amounts

Professional Standards

You must:

• Comply with your professional body's code of conduct (if applicable)
• Follow your Organisation's policies and procedures
• Act in clients' best interests
• Maintain appropriate professional boundaries

7. AI-Generated Content and Your Responsibilities

How AI Works in PalmFlow

The Service uses artificial intelligence (Azure OpenAI UK primary; OpenAI US fallback) to:

• Guide clients through PIP questions in a conversational format
• Generate summaries of client responses for each PIP section
• Ensure responses address DWP assessment criteria

Critical Limitations

AI is a tool, not a replacement for professional judgment. You acknowledge that:

• AI can make mistakes: Summaries may contain inaccuracies, omissions, or misinterpretations
• AI is not qualified: It provides no medical, legal, or professional advice
• AI makes no decisions: It does not determine PIP eligibility or predict outcomes
• Human review is mandatory: You MUST review and verify ALL AI-generated content before use

Your Professional Responsibilities

When using AI summaries, you must:

• Review thoroughly: Read every AI-generated summary carefully
• Verify accuracy: Check that summaries reflect client responses accurately
• Edit as needed: Correct errors, add missing information, remove irrelevant content
• Apply judgment: Use your professional expertise to refine and improve summaries
• Take ownership: You are responsible for the final content submitted to DWP, not the AI
• Never auto-submit: Never copy/paste AI output without review

No Liability for AI Errors

We are not liable for:

• Inaccurate AI summaries that you fail to correct
• PIP applications rejected due to AI-generated content
• Client harm resulting from uncorrected AI errors
• Professional consequences from inappropriate reliance on AI output

The AI assists you. You decide. You are accountable.

8. Intellectual Property

PalmFlow's IP

We own all rights to:

• The PalmFlow platform, software, and code
• Our trademarks, logos, and branding
• Documentation, training materials, and guides
• AI models and algorithms (licensed from third parties)

Your Licence

We grant you a limited, non-exclusive, non-transferable licence to:

• Access and use the Service for your Organisation's benefit
• View and edit client data within your Organisation
• Export summaries for use in PIP applications

This licence:

• Terminates when your account is deactivated
• Cannot be sublicensed or transferred
• Is subject to these Terms

Client Data and Content

Your Organisation retains all rights to client data. You grant us a licence to:

• Process and store client data as necessary to provide the Service
• Use aggregated, anonymised data for service improvement (no identifiable client information)

Feedback

If you provide suggestions, ideas, or feedback about the Service, we may use them freely without obligation to you.

9. Service Availability and Changes

Availability

We strive for high availability but do not guarantee that the Service will be:

• Available 100% of the time without interruption
• Free from errors, bugs, or technical issues
• Compatible with all devices, browsers, or operating systems
• Available during scheduled maintenance windows

Planned Maintenance

We may schedule maintenance that temporarily disrupts service. We will:

• Notify your Organisation at least 48 hours in advance (except emergencies)
• Minimise disruption by scheduling during low-usage periods
• Restore service as quickly as possible

Service Changes

We reserve the right to:

• Add, modify, or remove features
• Change the user interface or workflow
• Update AI models or processing logic
• Discontinue the Service (with 90 days notice to your Organisation)

Sub-Processors

We use the following sub-processors (see Privacy Policy for details):

• Supabase (UK): Database and authentication
• Vercel (UK): Application hosting
• Azure OpenAI (UK): Primary AI processing
• OpenAI (US): Fallback AI processing

We may change sub-processors with notice to your Organisation. If your Organisation objects, they may terminate the service agreement.

10. Termination

Termination by You

You may stop using the Service at any time by:

• Stopping logging in (account remains active)
• Requesting account deactivation from your Organisation administrator

Termination by Your Organisation

Your Organisation may deactivate your account at any time, typically when:

• You leave employment or engagement ends
• Your role changes and you no longer need access
• You violate these Terms or Organisation policies
• Your Organisation cancels PalmFlow service

Termination by Us

We may suspend or terminate your account immediately if you:

• Violate these Terms (especially data protection or security provisions)
• Engage in fraudulent or illegal activity
• Pose a security risk to the Service or other users
• Misuse client data or breach confidentiality

We will notify your Organisation of any termination and provide reasons unless doing so would compromise security or violate legal obligations.

Effect of Termination

When your account is terminated:

• Your access to the Service ceases immediately
• Your active sessions may be transferred to another adviser (Organisation decision)
• Your account data is retained for 2 years for audit purposes, then deleted
• Client data remains under your Organisation's control per their retention policy
• These Terms remain in effect for applicable provisions (liability, IP, confidentiality)

11. Disclaimers and Limitations of Liability

Service "As Is"

THE SERVICE IS PROVIDED "AS IS" WITHOUT WARRANTIES OF ANY KIND.

We disclaim all warranties, express or implied, including but not limited to:

• Merchantability and fitness for a particular purpose
• Non-infringement of third-party rights
• Accuracy, completeness, or reliability of AI-generated content
• Uninterrupted or error-free operation
• Security against all possible threats

No Professional Advice

PalmFlow does not provide and is not a substitute for:

• Legal advice or representation
• Medical diagnosis or treatment
• Financial or benefits advice beyond PIP applications
• Professional judgment or expertise

No Guarantee of Outcomes

We make no guarantees about:

• PIP application approval rates
• DWP assessment outcomes
• Benefit award amounts or durations
• Success at Mandatory Reconsideration or Tribunal

Limitation of Liability

TO THE MAXIMUM EXTENT PERMITTED BY UK LAW:

We shall NOT be liable for:

• Indirect, incidental, special, or consequential damages
• Loss of profits, revenue, data, or business opportunities
• Harm resulting from your reliance on AI-generated content
• Consequences of PIP application rejections or delays
• Professional liability arising from your use of the Service
• Data breaches resulting from your failure to secure your account
• Actions by third-party sub-processors (except as required by law)

Our total liability to you is limited to £100 (one hundred pounds sterling).

Exceptions

Nothing in these Terms excludes or limits our liability for:

• Death or personal injury caused by our negligence
• Fraud or fraudulent misrepresentation
• Breach of terms implied by Section 2 of the Supply of Goods and Services Act 1982
• Other liability that cannot be excluded or limited under UK law

12. Indemnification

You agree to indemnify, defend, and hold harmless PalmFlow, its directors, officers, employees, and agents from any claims, damages, losses, liabilities, and expenses (including legal fees) arising from:

• Your violation of these Terms
• Your misuse of the Service
• Your breach of data protection laws
• Your professional negligence or misconduct
• Claims by clients resulting from your actions or advice
• Your Organisation's breach of its service agreement with us

This indemnification survives termination of your account.

13. Confidentiality

Your Confidentiality Obligations

You agree to keep confidential:

• All client health information accessed through the Service
• Your Organisation's operational information visible in the dashboard
• PalmFlow's technical functionality, features, and trade secrets
• Security measures and vulnerabilities you discover

Permitted Disclosures

You may disclose confidential information only when:

• Required by law or court order
• Necessary for legitimate PIP application purposes
• Authorised by your Organisation for professional supervision
• Reporting suspected fraud or safeguarding concerns to authorities

Duration

Confidentiality obligations continue indefinitely, even after your account is terminated.

14. Dispute Resolution

Informal Resolution

If you have a dispute with PalmFlow, you should first:

• Raise the issue with your Organisation administrator
• Allow your Organisation to escalate to PalmFlow if unresolved

Governing Law

These Terms are governed by the laws of England and Wales.

Jurisdiction

Disputes will be resolved exclusively in the courts of England and Wales.

Organisation's Rights

Your Organisation may have separate dispute resolution provisions in their service agreement with us. Nothing in these Terms limits your Organisation's rights under that agreement.

15. General Provisions

Entire Agreement

These Terms, together with our Privacy Policy, constitute the entire agreement between you and PalmFlow regarding your use of the Service. They supersede any prior agreements or understandings.

Severability

If any provision of these Terms is found unenforceable by a court, that provision will be limited or eliminated to the minimum extent necessary, and the remaining provisions will remain in full effect.

No Waiver

Our failure to enforce any right or provision of these Terms does not waive our right to enforce it later.

Assignment

You may not transfer or assign your rights under these Terms. We may assign these Terms to a successor organisation (e.g., in a merger or acquisition) with notice to your Organisation.

Third Party Rights

These Terms do not create rights for any third parties except as expressly stated.

Force Majeure

We are not liable for delays or failures in performance resulting from causes beyond our reasonable control, including natural disasters, acts of government, cyberattacks, or third-party service failures.

16. Changes to These Terms

How We Update Terms

We may modify these Terms at any time. Changes will be communicated via:

• Email notification to all active adviser accounts
• Prominent banner in the PalmFlow dashboard
• Updated "Last Updated" date at the top of this page

Material Changes

For material changes (affecting your rights, responsibilities, or how we use data), we will provide:

• At least 30 days advance notice
• Clear explanation of what has changed
• Option to object via your Organisation

Acceptance of Changes

Your continued use of the Service after changes take effect constitutes acceptance of the updated Terms.

Objecting to Changes

If you disagree with material changes:

• Stop using the Service
• Request account deactivation from your Organisation
• Your Organisation may negotiate alternative terms or terminate their service agreement

By using PalmFlow, you acknowledge that you have read, understood, and agree to be bound by these Terms of Service.