SCHEDULE 1 - Peppy Employer Services Terms and Conditions

1. Interpretation
1.1. In these Conditions, the following words are defined:

1.2. Interpretation:

1.2.1. A reference to a statute or statutory provision is a reference to it as amended or re-enacted. A reference to a statute or statutory provision includes any subordinate legislation made under that statute or statutory provision, as amended or re-enacted.

1.2.2. Any phrase introduced by the terms including, include, in particular or any similar expression shall be construed as illustrative and shall not limit the sense of the words preceding those terms.

1.2.3. A reference to a clause or schedule is a reference to a clause or schedule of these Conditions.

1.2.4. A reference to writing or written includes email.

2.2. Basis of Customer Agreement

2.1. These Conditions, as amended from time to time, apply to the Customer Agreement between the Customer and Peppy to the exclusion of any other terms that the Customer seeks to impose or incorporate, or which are implied by trade, custom, practice or course of dealing.

2.2. The Customer waives any right it might otherwise have to rely on any term endorsed upon, delivered with or contained in any documents of the Customer that is inconsistent with the Customer Agreement.

2.3. Any demos, drawings, descriptive matter or advertising produced by Peppy are produced for the sole purpose of giving an approximate idea of the Peppy Platform. They shall not form part of the Customer Agreement nor have any contractual force.

3. Term

The Customer Agreement shall be deemed to begin on the Effective Date and will, unless terminated in accordance with Clause 10, continue for the Initial Term as set out in the Order Form , and thereafter the Customer Agreement shall automatically renew for further twelve (12) month periods (each, a “Renewal Term”).

4. Supply of Services

4.1. With effect from the Effective Date and for the duration of the Term, Peppy shall make the Peppy Platform available to the End Users to access the relevant Services. The Services are provided “as is” and Peppy makes no warranty or guarantee that the Services will be uninterrupted, error free or fit for purpose.

4.2. The Service Hours for each Service Type shall be as follows:

4.2.1. Fertility services: 9am-9pm on Business Days

4.2.2. Baby services: 9am-9pm on Business Days

4.2.3. Menopause services: 9am-9pm on Business Days

4.2.4. Men’s health services: 9am-6pm on Business Days

4.2.5. Women’s health services: 9am-6pm on Business Days
The Service Hours are subject to change at any time to enable Peppy to optimise End User access and use of the Services.

4.3. The Services will be delivered on all Business Days, with the exception of up to two (2) Training Days annually on which
Peppy will deliver training to Practitioners. Peppy will ensure that the Training Days fall on Fridays and during days in which Peppy expects lower End User demand for the Services than usual. Peppy will provide the Customer with sixty (60) days’ notice in advance of Training Days.

4.4. Each Employee may be entitled to grant login access to their End User account to their Partner to receive the benefit of the Services.

4.5. Peppy shall:

4.5.1. provide the Services in accordance with these Conditions in all material respects and with reasonable care and skill;

4.5.2. obtain and maintain insurance for the Term, at its own cost and expense, appropriate professional indemnity insurance with reputable insurers on customary terms and conditions prevailing in the insurance market;

4.5.3. ensure that Practitioners have been vetted to the minimum standards deemed appropriate by the relevant governing professional bodies. This will typically include:

a. Proof of identification;
b. Proof of current accreditation with the relevant professional body;
c. Proof of current professional indemnity insurance;

4.5.4. conduct any Scheduled Maintenance outside of Service Hours, typically between midnight and 6:00am, and use reasonable endeavours to provide prior notice of any Emergency Maintenance where expected downtime is in excess of one hour; and

4.5.5. comply with all Applicable Laws, provided that Peppy shall not be liable if, as a result of such compliance, it is in breach of any of its obligations under these Conditions. If there is any change to any Applicable Laws and such change affects Peppy’s ability to comply with these Conditions in a material respect, Peppy and the Customer shall negotiate in good faith appropriate changes to the affected provisions of these Conditions to the extent necessary to ensure that Peppy’s performance of its obligations under these Conditions is in accordance with such Applicable Laws.

4.6. Peppy may temporarily suspend, withdraw or restrict the availability of all or any part of the Peppy Platform, to the extent necessary for operational reasons and Peppy shall use reasonable endeavours to minimise the effects of any such suspension, withdrawal or restriction and to notify the Customer and the End Users of any such suspension, withdrawal or restriction.

4.7. Peppy shall have the right to make any changes to the Services from time to time: (i) to address its customers’ or the End Users’ needs; (ii) to comply with any Applicable Laws; and/or (iii) changes that do not materially affect the nature or quality of the Services.

BACK TO TOP

5. Customer's obligations

5.1. The Customer shall:

5.1.1. co-operate with Peppy in all matters relating to the Customer Agreement;

5.1.2. comply with all Applicable Laws in connection with the Customer Agreement;

5.1.3. provide, in a timely manner, such information as Peppy may reasonably require, and ensure that it is up-to-date, complete and accurate in all material respects; and

5.1.4. notify Peppy within 30 days of an increase during the Term of more than twenty (20) percent of the total number of Employees.

5.2. On receipt of information provided under clause 5.1.4, and in the event that any increase in the total number of Employees is more than twenty (20) percent, the Customer acknowledges and agrees that Peppy shall have the right to apply a proportionate increase in Charges in the subsequent Billing Period, in addition to Peppy’s rights under clause 7.9.

5.3. The Customer acknowledges and agrees that it shall not (i) licence, sublicense, sell, resell, rent, lease, transfer, distribute or otherwise commercially exploit or make the Peppy IPRs available to any third party other than as contemplated by these Conditions; (ii) make derivative works of, disassemble, reverse compile or reverse engineer any part of the Peppy IPR, or access the Peppy IPR in order to build a similar or competitive product or service (or contract with a third party to do so); without prior written consent from Peppy and provided that Peppy agrees to such action(s), the Customer shall comply with any reasonable instructions and restrictions imposed by Peppy.

5.4. The Customer acknowledges and agrees that:

5.4.1. the End User Peppy Terms and Conditions shall govern the relationship between Peppy and the End Users;

5.4.2. when first enabling an End User Licence, End Users will require a domain email address in the name of the Customer’s domain to verify that they are entitled to use the Services;

5.4.3. the Services are subject to Fair Use limitations, as set out in the End User Peppy Terms and Conditions made available to End Users on accessing the Services; and

5.4.4. in the event of a material breach and/or persistent breaches of the End User Peppy Terms and Conditions by the End Users, Peppy shall have the right, at its sole discretion, to suspend access to the Peppy Platform for any such End Users or suspend the provision of the Services under these Conditions.

6. Intellectual property

6.1. Peppy and its licensors shall retain ownership of all Peppy IPRs.

6.2. Peppy grants the Customer a fully paid-up, non-exclusive, royalty-free, non-transferable licence for Term to use the Peppy Logo on any promotional or marketing material.

6.3. Subject to the Customer providing advance written consent to Peppy, the Customer grants Peppy a fully paid-up, non-exclusive, royalty-free, non-transferable licence to use any Customer IPR in the provision and marketing of its Services for the Term.

6.4. Upon expiration or termination of the Customer Agreement, Customer will immediately cease use of any Peppy IPRs granted hereunder. The Customer will hold on trust for, and hereby assigns to Peppy, all goodwill and other right or interest it may acquire in:

6.4.1. any Peppy IPRs acquired during the Term; and / or

6.4.2. any inventions, discoveries, whether patentable, procedures or techniques made, developed, or created by the Customer, whether alone or with Peppy, arising out of or in connection with the Parties fulfilling their obligations under the Customer Agreement.

7. Charges and payment

7.1. In consideration for the provision of the Services, the Customer shall pay Peppy the Charges in accordance with this clause 7.

7.2. Peppy will issue an invoice for the Charges to the Customer initially upon signing the Order Form in respect of the first Billing Period and at the start of each subsequent Billing Period thereafter.

7.3. The Customer shall pay each invoice in full and in cleared funds, within 30 days of receipt to a bank account nominated in writing by Peppy.

7.4. Unless otherwise specified on the invoice, all amounts payable by the Customer exclude amounts in respect of value added tax (VAT), which the Customer shall additionally be liable to pay to Peppy at the prevailing rate (if applicable), subject to receipt of a valid VAT invoice.

7.5. Peppy shall submit invoices for the Charges (plus VAT if applicable) to the Customer by email, to an email address provided by the Customer from time to time. The Customer shall notify Peppy as soon as reasonably practicable to hello@peppy.health, or any alternative email address designated by Peppy for this purpose from time to time, of any changes to the email address where Peppy should submit its invoices.

7.6. Each invoice shall include all reasonable supporting information required by the Customer.

7.7. If the Customer fails to make any payment due to Peppy under the Customer Agreement by the due date for payment, then, without limiting Peppy's remedies under clause 10 (Termination):

7.7.1. the Customer shall pay interest on the overdue amount at the rate of 4% per annum above Barclays Bank's base rate from time to time. Such interest shall accrue on a daily basis from the due date specified in clause 7.3 until actual payment of the overdue amount, whether before or after judgement. The Customer shall pay the interest together with the overdue amount; and

7.7.2. Peppy may suspend the availability of the Peppy Platform or reduce the Services until payment has been made in full. In the event of suspension or reduction under this clause 7.7.2, Peppy reserves the right to notify the End Users of such suspension or reduction.

7.8. All amounts due under the Customer Agreement shall be paid by the Customer to Peppy in full without any set-off, counterclaim, deduction or withholding (other than any deduction or withholding of tax as required by law).

7.9. The Charges are subject to indexation to compensate for inflation with reference to the ONS Retail Price Index (RPI) and will increase by the applicable percentage yearly, starting after the first twelve-month period following the Effective Date.

8. Data protection and Security

The parties shall comply with the provisions of Schedules 2 and 3.

9. Limitation of liability

9.1. Nothing in these Conditions shall limit or exclude either party's liability: (i) for death or personal injury caused by its negligence, or the negligence of its personnel, agents or subcontractors; (ii) for fraud or fraudulent misrepresentation; and (iii) any other liability which cannot be limited or excluded by Applicable Laws.

9.2. Subject to clause 9.1, neither party shall have any liability to the other party, whether in contract, tort (including negligence), for breach of statutory duty, or otherwise, for any indirect or consequential losses arising under or in connection with this the Customer Agreement.

9.3. Subject to clauses 9.1 and 9.2, Peppy’s total liability for any breach of Schedule 2 (Data Protection) and Schedule 3 (Security) shall be limited to an amount equal to three (3) times the annual Charges paid by the Customer under the Customer Agreement at the point of any claim.

9.4. Subject to clauses 9.1, 9.2 and 9.3, each party’s total liability to the other party, whether in contract, tort (including negligence), breach of statutory duty, or otherwise, arising under or in connection with these Conditions shall be limited to two (2) times the annual Charges paid by the Customer under the Customer Agreement at the point of any claim. Nothing in this clause 9.4 shall affect the Customer’s liability to pay the Charges properly due under these Conditions and no amounts of Charges paid by, or due from, the Customer shall count towards the limit on the Customer’s liability under this clause 9.4.

10. Termination

10.1. Without affecting any other right or remedy available to it, either party may terminate the Customer Contract in its entirety with immediate effect by giving written notice to the other party if:

10.1.1. the other party commits a material breach of any these Conditions which breach is irremediable or (if such breach is remediable) fails to remedy that breach within a period of 30 days after being notified in writing to do so;

10.1.2. the other party repeatedly breaches any of these Conditions in such a manner to reasonably justify the opinion that its conduct is inconsistent with it having the intention or ability to give effect to the terms of these Conditions;

10.1.3. the other party takes any step or action in connection with its entering administration, provisional liquidation or any composition or arrangement with its creditors (other than in relation to a solvent restructuring), being wound up (whether voluntarily or by order of the court, unless for the purpose of a solvent restructuring), having a receiver appointed to any of its assets or ceasing to carry on business or, if the step or action is taken in another jurisdiction, in connection with any analogous procedure in the relevant jurisdiction;

10.1.4. the other party suspends, or threatens to suspend, or ceases or threatens to cease to carry on all or a substantial part of its business; or

10.1.5. the other party's financial position deteriorates to such an extent that in the terminating party's reasonable opinion the other party's capability to adequately fulfil its obligations under the Customer Contract has been placed in jeopardy.

10.2. Without limiting its other rights or remedies, Peppy may suspend provision of the Services under these Conditions or any other agreement between Peppy and the Customer if the Customer becomes subject to any of the events listed in clause 10.1.1 to clause 10.1.5, or if Peppy reasonably believes that the Customer is about to become subject to any of them. For the avoidance of doubt, suspension of the provision of the Services (for any reason) by Peppy shall not affect the Customer’s liability to pay the Charges in accordance with these Conditions.

10.3. Without affecting any other right or remedy available to it, Peppy may terminate the Customer Contract it its entirety with immediate effect by giving written notice to the Customer if the Customer fails to pay any amount due under these Conditions on the due date for payment and remains in default not less than 30 days after being notified in writing to make such payment.

10.4. The Customer may terminate the Customer Agreement at any time by giving Peppy not less than 30 days’ written notice of such termination, with such termination to take effect at the end of the then effective Initial Term or Renewal Term.

10.5. Any notice of termination of the Customer Agreement by the Customer must be delivered to Peppy by email on hello@peppy.health or any alternative email address designated by Peppy for this purpose from time to time.

10.6. Immediately on provision or receipt of notice to terminate under this Clause 10, the Customer shall issue written communications to the End Users regarding the conclusion of the Services. Peppy will provide reasonable assistance to the Customer in the preparation of such communications.

10.7. On termination of the Customer Agreement for whatever reason:

10.7.1. the Charges included in the Order Form shall become immediately due and payable up to the end of the current Billing Period unless the Customer terminates pursuant to Clause 10.1, in the event of which, the Charges shall be payable for Services provided up to and including the date of termination;

10.7.2. the Customer shall immediately pay to Peppy all of Peppy's outstanding unpaid invoices and interest and, in respect of Services supplied but for which no invoice has been submitted, Peppy may submit an invoice, which shall be payable immediately on receipt;

10.7.3. except where the Customer has terminated pursuant to Clause 10.1, no refunds shall be due to the Customer for any Charges paid to Peppy and/or any other sums paid by the Customer to Peppy;

10.7.4. termination of the Customer Agreement shall not affect any of the parties' rights and remedies that have accrued as at termination, including the right to claim damages in respect of any breach of these Conditions which existed at or before the date of termination; and

10.7.5. any provision of these Conditions that expressly or by implication is intended to come into or continue in force on or after termination shall remain in full force and effect.

BACK TO TOP

11. General

11.1. Force majeure. Other than in respect of Charges payable by the Customer under these Conditions, neither party shall be in breach of the Customer Agreement nor liable for delay in performing, or failure to perform, any of its obligations under these Conditions due to any circumstance not within a Party's reasonable control, including without limitation, if such delay or failure result from acts of God, flood, earthquake or other natural disaster.

11.2. Assignment and other dealings.

11.2.1. Except as permitted by clause 11.2.2, neither party may subcontract, assign, transfer, novate, grant any trust over, or otherwise deal with any of its rights or obligations under the Customer Agreement without the prior written consent of the other party, such request not to be unreasonably withheld or delayed, except that Peppy may assign the Customer Agreement to a purchaser of all or substantially all of its business or assets to which the Customer Agreement relates upon giving notice to the Customer in writing.

11.2.2. The Customer may assign all or any portion of its rights to the Services to one or more of the Group Companies listed in the Order Form, whose End Users shall receive the benefit of the Services provided that they are not a competitor of Peppy. No such assignment shall relieve the Customer of any of its obligations hereunder.

11.3. Confidentiality.

11.3.1. Each party undertakes that it shall not at any time disclose to any person any confidential information concerning the business, affairs, customers, clients or suppliers of the other party or the other party’s Group Companies, except as permitted by clause 11.3.2.

11.3.2. Each party may disclose the other party's confidential information:
(a) to its employees, officers, representatives, subcontractors or advisers who need to know such information for the purposes of carrying out the party's obligations under the Customer Agreement. Each party shall ensure that its employees, officers, representatives, subcontractors or advisers to whom it discloses the other party's confidential information comply with this clause 11.3; and (b) as may be required by law, a court of competent jurisdiction or any governmental or regulatory authority.

11.3.3. No party shall use any other party's confidential information for any purpose other than to perform its obligations under the Customer Agreement.

11.3.4. No party shall make, or permit any person to make, any public announcement concerning the Customer Agreement without the prior written consent of the other party (such consent not to be unreasonably withheld or delayed), except as required by law, any governmental or regulatory authority (including, without limitation, any relevant securities exchange), any court or other authority of competent jurisdiction.

1.1.1. This clause shall survive termination or expiry of the Customer Agreement.

11.4. Entire agreement.

11.4.1. These Conditions, the Order Form and the documents referred to in them (collectively the Customer Agreement) constitutes the entire agreement between the parties and supersedes and extinguishes all previous agreements, promises, assurances, warranties, representations and understandings between them, whether written or oral, relating to its subject matter.

11.4.2. Each party agrees that it shall have no remedies in respect of any statement, representation, assurance or warranty (whether made innocently or negligently) that is not set out in the Customer Agreement. Each party agrees that it shall have no claim for innocent or negligent misrepresentation or negligent misstatement based on any statement in these Conditions.

11.4.3. If any terms set out in any documents which make up the Customer Agreement conflict, the order of precedence shall be as follows:

11.4.3.1. the terms set out the Order Form shall prevail over these Conditions and any other documents referred to in them;

11.4.3.2. then the terms set out in these Conditions shall prevail over any other document referred to in them;
save where it is expressly stated in writing that a specific term shall prevail within any of those documents.

11.5. Variation. No variation of the Customer Agreement shall be effective unless it is in writing and signed by the parties (or their authorised representatives). These Conditions are subject to change at any time however any such change will only take effect for a Renewal Term.

11.6. Waiver.

11.6.1. A waiver of any right or remedy is only effective if given in writing and shall not be deemed a waiver of any subsequent breach or default. A delay or failure to exercise, or the single or partial exercise of, any right or remedy shall not:
(a) waive that or any other right or remedy; or
(b) prevent or restrict the further exercise of that or any other right or remedy.

11.7. No partnership or agency. Nothing in the Customer Agreement is intended to or shall operate to create a partnership between the parties, or authorise either party to act as agent for the other, and neither party shall have the authority to act in the name or on behalf of or otherwise to bind the other in any way (including, but not limited to, the making of any representation or warranty, the assumption of any obligation or liability and the exercise of any right or power).

11.8. Severance. If any provision or part-provision of these Conditions is or becomes invalid, illegal or unenforceable, it shall be deemed modified to the minimum extent necessary to make it valid, legal and enforceable. If such modification is not possible, the relevant provision or part-provision shall be deemed deleted. Any modification to or deletion of a provision or part-provision under this clause shall not affect the validity and enforceability of the rest of these Conditions.

11.9. Notices.

11.9.1. Without prejudice to clause 11.5, any notice or other communication given to a party under or in connection with the Customer Agreement shall be in writing, addressed to that party at its registered office or such other address as that party may have specified to the other party in writing in accordance with this clause, and shall be delivered personally, or sent by pre-paid first class post or other next working day delivery service, commercial courier, or email.

11.9.2. A notice or other communication shall be deemed to have been received: if delivered personally, when left at the address referred to in clause 11.9.1; if sent by pre-paid first class post or other next working day delivery service, at 9.00 am on the second Business Day after posting; if delivered by commercial courier, on the date and at the time that the courier's delivery receipt is signed; or, if sent by or email, one Business Day after transmission.

11.9.3. The provisions of this clause shall not apply to the service of any proceedings or other documents in any legal action.

11.10. Third party rights. No End User or other person, other than a party to the Customer Agreement shall have any right to enforce any of its terms.

11.11. Governing law. The Customer Agreement, and any dispute or claim (including non-contractual disputes or claims) arising out of or in connection with it or its subject matter or formation, shall be governed by, and construed in accordance with the law of England and Wales.

11.12. Jurisdiction. Each party irrevocably agrees that the courts of England and Wales shall have exclusive jurisdiction to settle any dispute or claim (including non-contractual disputes or claims) arising out of or in connection with the Customer Agreement or its subject matter or formation.


BACK TO TOP

SCHEDULE 2 – DATA PROTECTION

Definitions

Data Protection Laws means (i) the Data Protection Act 2018; (ii) the UK GDPR (iii) either the Privacy and Electronic Communications (EC Directive) Regulations 2003 or the EU ePrivacy Regulation whichever is in force in the UK at the relevant time; and (iv) all other applicable laws and regulations relating to the Processing of personal data and privacy, including statutory instruments and, where applicable, the guidance and codes of practice issued by the Information Commissioner or any other supervisory authority with jurisdiction, all as amended, extended, re-enacted or replaced from time to time;

End User means Employees and their Partners who have access to the Peppy Platform;

End User Licence means the individual End User account on the Peppy Platform, associated with an individual user email account, and which is subject to the End User Peppy Terms and Conditions;

Third-party Cloud Infrastructure Provider means an organisation with whom Peppy has contracted to provide software services that includes cloud infrastructure, such services to be provided in compliance with Peppy’s information security and other relevant policies;

Process/Processing, Data Controller, Data Processor, Data Subject, Personal Data, Personal Data Breach have the same meaning as in the Data Protection Laws.

UK GDPR has the meaning given to it in section 3(10) (as supplemented by section 205(4)) of the Data Protection Act 2018.


1. The Customer acknowledges that upon activation of an End User Licence by an End User, an independent contractual relationship will arise between Peppy and each End User, and that Peppy will be a separate Data Controller in relation to any Personal Data of each such End User, as Peppy will independently determine the purposes for which and the manner in which Peppy and relevant Third-party Cloud Infrastructure Providers where applicable, will Process such Personal Data, including, but not limited to, the Processing for the purpose of Peppy’s compliance with its contractual obligations to any such End User.

2. The terms, details and duration of Peppy’s processing of Personal Data as Data Controller shall be set out in its Privacy Policy, including details of Third-party Cloud Infrastructure Providers where these entities act as Processors of Personal Data on behalf of Peppy.

3. Peppy shall at all times comply with the Data Protection Laws in relation to its Processing of the Personal Data of End Users.

4. Peppy maintains appropriate technical and organisational measures to protect Personal Data against unauthorised or unlawful processing and against accidental loss, destruction, damage, theft, alteration or disclosure. These measures shall be appropriate to the harm which might result from any unauthorised or unlawful processing, accidental loss, destruction, damage or theft of the Personal Data and having regard to the nature of the Personal Data which is to be protected.

5. In the event of a suspected Personal Data Breach, Peppy will:

5.1. take action immediately to investigate the suspected Personal Data Breach;

5.2. take action immediately to identify, prevent and mitigate the effects of the Personal Data Breach and remedy the Personal Data Breach; and

5.3. comply with all notification obligations with respect to Data Subjects, Supervisory Authorities or any other entity requiring notification under the Data Protection Laws, and provide such information as may be reasonably required by the Customer to respond to complaints or enquiries from Data Subjects relating to the Personal Data Breach, provided that Peppy will not provide Personal Data to the Customer as part of such notification unless instructed to by the Data Subject.

6. If one party receives any complaint, notice or communication that relates directly or indirectly to the other party's Processing of End User Personal Data pursuant to the Customer Agreement it shall promptly notify the other party and provide full details and copies of any communication. Each party shall use reasonable endeavours to work with the other party to remedy the situation.

7. Any data provided by Peppy to the Customer relating to End Users’ use of the Services, including but not limited to use of the Peppy Platform, will not comprise Personal Data and shall be fully anonymised and aggregated in such a way that no Data Subject is identified or identifiable.

8. The parties do not anticipate that Peppy shall be a Data Processor on behalf of the Customer as a Data Controller under the CustomerAgreement. In the event that Peppy is a Data Processor on behalf of the Customer, Peppy and the Customer shall enter into a data processing agreement, in a form specified by the Customer.

BACK TO TOP

SCHEDULE 3 – SECURITY

Definitions

Customer Assets means Employees, Customer data or Relevant Infrastructure.

Customer Data means any Customer content or information

Customer Infrastructure means the infrastructure of Customer or any Customer Group Company to which Peppy or any of Peppy sub-contractors has access in the course of the Customer Agreement.

Customer Systems means the systems of Customer (or those of any Customer Company).

Good Industry Practice means the exercise of that degree of skill, care, prudence, efficiency, foresight and timeliness as would be expected from a leading company within the relevant industry or business sector.

Incident means any event where there is, or potentially could be, unauthorised access to, or use of, or interface with any Customer Assets or Customer System.

Public Cloud Services means any data hosting, processing or storage service which is provided to Peppy by a third party, where the service is provided on infrastructure owned and located at the third party’s premises, and the service is made available over the internet using infrastructure shared amongst customers.

Relevant Infrastructure means: (a) Customer Infrastructure; and (b) Peppy Infrastructure.

Peppy Infrastructure means the infrastructure used in the course of the Customer Agreement whether the infrastructure of Peppy or any of Peppy’s sub-contractors.

1. Information Security Requirements

Peppy shall maintain and implement appropriate security systems, controls, policies and procedures as least as effective at minimising the risk of an information security breach as required by Good Industry Practice (including an information security risk management framework to record and manage all information security risks which provides for, as a minimum: (i) a clear definition of the scope of information risk assessments; (ii) the performance of business impact assessments to determine impact to the Services; and (iii) all risks identified having a risk owner assigned to them).

2. Security Incident Management

Peppy will implement a process, including where appropriate forensic investigation, for the management and reporting of actual or suspected Incidents which includes: (i) communication to all relevant persons in order to promote prompt reporting and control of any suspected, attempted or actual security breaches; and (ii) notification to Customer with details of the Incident and its potential impact. Peppy will promptly make Customer aware of the remediation being instigated by Peppy in order to resolve any Incident impacting Customer or any Customer Group Company.

3. Access Management

Peppy shall: (a) maintain and implement appropriate security systems, controls, policies and procedures to ensure the secure use of (and protected access to) all applications, databases and devices used to service the Customer Group Companies' businesses; (b) ensure that access to any applications, databases or devices used pursuant to the Customer Agreement is: (i) only granted to those Peppy personnel who reasonably need it for the purposes of the Customer Agreement; and (ii) restricted in accordance with the role or function of the individual; and (c) ensure that adequate procedures are in place so that Peppy personnel access is: (i) added, modified and deleted in a timely manner; and (ii) routinely reviewed for recertification and revalidation purposes.

4. Remote Access Security

Peppy shall ensure that controls are in place to prevent unauthorised remote access, including (but not limited to): (i) using strong authentication (e.g. two-factor authentication) to authenticate Peppy's users; (ii) encryption from the end-point (e.g. laptop) to the network for all data travelling across a remote access mechanism; and (iii) logging of all remote access attempts and reviewing of any suspicious activity.

5. Portable Storage Device Security

Peppy shall not store Customer Data on unencrypted portable storage devices. Where portable devices do hold Customer Data, Peppy shall ensure that: (i) they are locked securely away when not in use; (ii) use in public areas is avoided; (iii) the data stored within the device is no more than the minimum required; and (iv) all devices are adequately encrypted and password protected.

6. Data Transfer Security

Peppy shall ensure that all Customer Data sent over the internet either by e-mail or via other internet protocols (e.g. FTP) is: (i) encrypted using at least a 256 bit encryption mechanism; and (ii) only transferred via pre-configured communications with electronic acknowledgement.

7. Password Management

Peppy will ensure that: (i) in respect of any passwords used for access to its systems, standard password configuration includes (without limitation): minimum length, complexity, expiry, history, and account lockout following consecutive failed logon attempts; (ii) the aforementioned configuration is implemented at system level and documented within a password management strategy or policy document; (iii) all non-personal IDs are documented (including the purpose of the access); and (iv) all staff are made aware of the importance of keeping their passwords confidential.

8. Network Security

Peppy shall perform (at least monthly): (i) anti-virus and perimeter scanning activities on its IT estate which include firewall and email scanning services; and (ii) patch management activity in accordance with Good Industry Practice.

9. Physical Security Management

Peppy shall ensure that appropriate controls are in place at its premises and any other premises used in the performance of the Customer Agreement to prevent unauthorised physical access to those premises.

10. Data Disposal

Peppy shall ensure that any hardcopy Customer Data is shredded (using a cross-cut shredder or incineration) and securely disposed of via an internal disposal mechanism or by using a third party. For IT assets, Peppy must ensure that any IT assets and electronic media being used to store Customer Data that are no longer required are destroyed by incineration, damaged beyond repair or that the Customer Data is erased using data erasure technology such that Customer Data is erased and not recoverable (and a certificate of destruction provided to Customer as evidence that the foregoing has been done). Upon the expiry or termination of the Customer Agreement, Peppy shall: (a) assist Customer in the return, transfer and/or destruction of all Customer Data from all sources, networks and devices used by Peppy or any of Peppy’s sub-contractors, if requested by the Customer; and (b) ensure that all physical or logical assets, intellectual property and licences are returned, and physical and logical system access to Customer Data or Customer Systems is revoked within timescales agreed with Customer. In the event that Customer Data has to be retained by Peppy due to legal and/or regulatory reasons, Peppy shall ensure that such Customer Data is only retained in accordance with Peppy’s data retention and privacy policy.

11. Public Cloud Services

Peppy will provide adequate assurance of any Public Cloud Services provider’s security controls by allowing Customer access to documentation relating to the Public Cloud Services provider’s security controls and certification status. Peppy reserves the right to change or modify its use of Public Cloud Services at any time.

BACK TO TOP

SCHEDULE 4 – Service Level Agreement

1. Service Level Requirements

1.11.1 Service Level Targets (as set out in the below table) shall be measured on a Monthly basis.

1.1 Where Peppy fails to adhere to an individual Service Level Target on four (4) or more occasions during a six (6) month rolling period, this shall constitute a material breach of these Conditions.

1.3 The following Service Level Targets set out in the below table shall apply as the initial service level targets for the provision of the Services, as may be amended by the Parties in writing from time to time:

BACK TO TOP

Service Description

Peppy will make the following Services available to End Users:

• Multi-week programmes
• Vetted resources aligned with NHS guidelines where applicable
• Private 1 to 1 chat with expert practitioners
• Private consultations with expert practitioners
• Private chat with a registered mental health practitioner
• Private & group video calls with an expert practitioner
• Webinars with expert practitioners

• Supports Customers with the successful implementation of Peppy services
• Is responsible for ensuring ongoing support throughout the duration of the contract

2. Queries will be addressed in a timely manner and can be directed to:

• As a Customer, any queries should be directed to customer.success@peppy.health
• Any questions from Users (your employees), should be directed to support@peppy.health

3. The implementation of Peppy consists of:

• Kick off meeting: In this meeting, a member of the Peppy Client Success Team will provide information on what is required for a successful implementation ahead of the employee launch event. This includes showcasing the Launch Communications Toolkit and sharing strategies for an effective launch campaign.
  
• Communications toolkit: This is a series of marketing and communications materials in digital and print format, to support Customers in promoting Peppy to drive awareness for the employee launch and beyond. This toolkit includes elements such as Information Sheets and videos that Customers can upload to their intranets and benefits portals, and tips on how to deliver an effective launch campaign to drive adoption.. The communications toolkit will be shared in the Kick off meeting (hosted on Notion) and it can be accessed by Customers in a self service manner.
• Employee launch event: This is a key element of driving awareness of Peppy amongst employees when first launching. Run by a member of the Client Success Team, the online launch event is open to a Customer’s entire workforce.It provides an overview of Peppy and its individual services, and gives guidance on how employees can sign up.

• Regular newsletters: These provide useful information to support Customers with their own ongoing marketing activities. Content from Peppy includes upcoming Peppy events that Customers and employees can attend, as well as broadcasts taking place within the app across the various services. All Peppy-created marketing assets to support these will be accessible through the
  Communications toolkit. Customers are enrolled onto the newsletter at the Kick off meeting and can unenroll at any time
• Management Information reporting: This reporting includes usage data for Customers to see how well Peppy is being adopted throughout their workforce.
• Dealing with any queries should they arise.

BACK TO TOP