Terms and Conditions of Service
Effective date: August 1st 2026
Version: 2608011
These Terms and Conditions of Service govern access to and use of the MyAssays services.
Please read these Terms carefully before registering for, purchasing or using the Services. By creating an Account, accepting an Order, paying a Subscription Fee or using the Services, you agree to be bound by these Terms.
If you accept these Terms on behalf of a company, university, research institution, healthcare organisation, laboratory, public body or other organisation, you confirm that you have authority to bind that organisation.
The Services are provided solely for Research Use by business, scientific, research, educational and professional users. They are not intended for consumer, diagnostic, therapeutic or clinical use.
RESEARCH USE ONLY
The Services, including all calculations, analyses, reports, results and AI-Assisted Features, are intended solely for research use. They are not intended, designed or validated by MyAssays for diagnosis, screening, prognosis, treatment selection, patient management, monitoring of a medical condition or any other clinical or medical purpose.
The Services and their outputs must not be used to make or support decisions concerning an individual’s diagnosis, treatment, health or medical care.
THE CUSTOMER’S ATTENTION IS PARTICULARLY DRAWN TO CLAUSE 27, WHICH EXCLUDES AND LIMITS MYASSAYS’ LIABILITY.
1. About MyAssays
1.1 MyAssays Limited is a company registered in England and Wales under company number 07089538.
1.2 Our registered office is:
MyAssays Limited
21 Hampton Place
Brighton
East Sussex
BN1 3DA
United Kingdom
1.3 References in these Terms to “MyAssays”, “we”, “us” and “our” mean MyAssays Limited.
2. Definitions
In these Terms:
“Account” means an account created to access or use the Services.
“Administrator” means an Authorised User appointed by a Business or Organisational Customer to administer its Account, subscriptions, permissions or other Authorised Users.
“AI-Assisted Features” means any feature of the Services that uses artificial intelligence or machine-assisted technology to assist with assay protocol creation, configuration, review or analysis.
“Applicable Data Protection Laws” means the UK GDPR, the Data Protection Act 2018 and any other applicable law concerning privacy, electronic communications or the Processing of Personal Data, in each case as amended or replaced from time to time.
“Authorised User” means an individual whom the Customer permits to access or use the Services under its Account.
“Business Day” means a day other than a Saturday, Sunday or public holiday in England on which banks in London are generally open for business.
“Business or Organisational Customer” means a company, university, research institution, laboratory, healthcare organisation, public body, sole trader or other organisation that purchases, administers or uses the Services solely for Research Use.
“Confidential Information” means information disclosed by or on behalf of one party to the other that is identified as confidential or that should reasonably be understood to be confidential because of its nature or the circumstances of disclosure. Customer Content is the Customer’s Confidential Information.
“Customer” means the individual, Business or Organisational Customer or other legal person entering into the Agreement with MyAssays.
“Customer Content” means all information, data and material submitted to, uploaded to, stored in, configured through or generated through the Services by or for the Customer. Customer Content may include assay measurements, Sample IDs, protocols, standards, controls, plate layouts, analysis parameters, uploaded files, prompts, results, reports, notes and associated metadata.
“Customer Personal Data” means any Personal Data contained in Customer Content that MyAssays Processes on behalf of the Customer.
“Data Processing Schedule” means Schedule 1 to these Terms.
“Documentation” means any user instructions, technical documentation, knowledge-base materials or guidance made available by MyAssays concerning the Services.
“Free Services” means any Services provided without charge, including free Accounts, trials, demonstrations, evaluations, preview features and beta Services.
“Intellectual Property Rights” means patents, rights in inventions, copyright, database rights, design rights, trade marks, service marks, trade names, domain names, rights in software, trade secrets, rights in Confidential Information and all other intellectual property rights, whether registered or unregistered.
“Order” means an online order, quotation, order form, statement of work or other written document under which the Customer purchases Premium Services.
“Premium Services” means subscription-based Services for which the Customer pays a Subscription Fee.
“Research Use” means use for scientific research, assay development, method development, laboratory evaluation, teaching or training, where neither the Services nor their outputs are used to make or support a diagnostic, therapeutic, patient-management or other medical decision concerning an individual.
“Sample ID” means a laboratory, study, research or other code entered by a user to identify a sample within the Services.
“Services” means the Free Services, Premium Services, AI-Assisted Features and related support, tools, functionality and Documentation provided by MyAssays.
“Share Link” means a unique URL generated through the Services at the request of a Customer or Authorised User that enables a person possessing the URL to access specified Customer Content.
“Shared Content” means Customer Content made accessible through a Share Link.
“Sites” means myassays.com, myassays2.com, mycurvefit.com and any replacement or related website operated by MyAssays through which the Services are provided.
“Subscription Fee” means the fee payable for Premium Services, as specified in the applicable Order.
“Subscription Term” means the period during which the Customer is entitled to use Premium Services.
“UK GDPR” has the meaning given to it in section 3(10), as supplemented by section 205(4), of the Data Protection Act 2018.
The terms “Controller”, “Data Subject”, “Personal Data”, “Personal Data Breach”, “Processing”, “Processor” and “Special Category Personal Data” have the meanings given to them under Applicable Data Protection Laws.
3. The Agreement
3.1 The Agreement between the Customer and MyAssays consists of:
a. the applicable Order;
b. these Terms, including the Data Processing Schedule; and
c. any additional terms expressly incorporated into the Order.
3.2 If there is a conflict between those documents, the following order of precedence applies:
a. the Data Processing Schedule, in relation to the Processing of Customer Personal Data;
b. the Order;
c. these Terms; and
d. any other expressly incorporated terms.
3.3 The MyAssays Privacy Policy is provided separately and explains how MyAssays Processes Personal Data as a Controller. The Privacy Policy does not form part of the Agreement, and acceptance of these Terms does not constitute consent to all Processing described in the Privacy Policy.
3.4 The Website Terms of Use apply separately to access to and use of the publicly available areas, information and content of the Sites. They do not form part of the Agreement for the Services.
3.5 The Data Processing Schedule applies automatically where MyAssays Processes Customer Personal Data on behalf of the Customer.
3.6 No terms contained in a purchase order, procurement portal, email or other Customer document will amend the Agreement unless MyAssays expressly agrees to those terms in writing.
4. Eligibility and authority
4.1 An individual creating an Account must:
a. be at least 18 years old;
b. provide accurate and complete registration information;
c. use the Services only for Research Use; and
d. have authority to accept these Terms.
4.2 An individual accepting these Terms on behalf of a Business or Organisational Customer confirms that they have authority to bind that Customer.
4.3 If an individual does not have that authority, they must not accept an Order or submit Personal Data on behalf of the organisation.
4.4 MyAssays may request reasonable evidence of identity, employment, affiliation or authority before activating or continuing an organisational Account.
5. Registration and Accounts
5.1 To use certain Services, the Customer or an Authorised User must create an Account and complete any required account-activation process.
5.2 The Customer must ensure that:
a. registration and Account information remains accurate and current;
b. each Authorised User has an individual login where the applicable subscription requires individual accounts;
c. login credentials are not shared;
d. passwords are kept confidential and secure;
e. access is withdrawn promptly when an Authorised User no longer requires it; and
f. MyAssays is informed promptly of suspected unauthorised access.
5.3 The Customer is responsible for all activity carried out through its Account, except to the extent that the activity results directly from MyAssays’ breach of the Agreement.
5.4 MyAssays may rely on instructions given through an Account unless MyAssays knows, or reasonably suspects, that the Account has been compromised.
5.5 Accounts and subscriptions may not be transferred to another person or organisation without MyAssays’ prior written consent.
5.6 A Business or Organisational Customer may reassign an available user licence to another Authorised User where permitted by the applicable subscription plan.
5.7 An Administrator may be able to:
a. invite, remove or manage Authorised Users;
b. view Account and subscription information;
c. assign roles and permissions;
d. access Customer Content where permitted by the Services; and
e. make decisions concerning the organisation’s Account.
5.8 The Customer is responsible for appointing appropriate Administrators and for their actions.
6. Free Services and trials
6.1 MyAssays may make Free Services or trial Services available at its discretion.
6.2 Free Services may have limited functionality, usage restrictions, reduced storage, shorter retention periods or other limitations.
6.3 Unless otherwise stated in writing, MyAssays may modify, suspend or withdraw Free Services at any time without liability.
6.4 Data stored through Free Services may be deleted following a period of inactivity or termination of the Free Services, subject to Applicable Data Protection Laws.
6.5 Free Services and trial Services are provided without any commitment that they will become or remain part of the Premium Services.
6.6 Unless MyAssays expressly agrees otherwise in writing, a Customer must not use Free Services:
a. to process Personal Data or Special Category Personal Data relating to another person;
b. to store confidential patient or participant information;
c. for clinical, diagnostic, regulated or production purposes;
d. as the sole location for important Customer Content; or
e. to create a Share Link containing Personal Data, Special Category Personal Data or confidential information.
6.7 The Customer must maintain independent copies of all information submitted to Free Services.
7. Orders and contract formation
7.1 An Order may be placed through the Sites, accepted through an online checkout process or agreed in writing.
7.2 A quotation issued by MyAssays is an invitation to place an Order and is not, by itself, a binding obligation to provide Premium Services.
7.3 Unless otherwise stated, a quotation:
a. remains valid for 30 days from its issue date;
b. is exclusive of VAT and other applicable taxes; and
c. is subject to these Terms.
7.4 A contract for Premium Services is formed when:
a. MyAssays accepts the Customer’s Order; and
b. the applicable Subscription Fee is paid or MyAssays agrees to provide the Services on invoice terms.
7.5 MyAssays may reject an Order where:
a. payment authorisation fails;
b. information provided by the Customer is incomplete or inaccurate;
c. the proposed use would breach these Terms or applicable law; or
d. MyAssays is unable to provide the requested Services.
8. Subscription Terms
8.1 Premium Services are provided for the Subscription Term specified in the Order.
8.2 Unless the Order states otherwise, a Premium Service subscription will renew automatically for successive periods equal to the initial Subscription Term.
8.3 Either party may prevent renewal by giving written notice at least 30 days before the end of the current Subscription Term.
8.4 If notice is given after the applicable notice deadline, the subscription may renew for the next Subscription Term.
8.5 MyAssays may change Subscription Fees for a renewal term by giving the Customer at least 30 days’ notice before the renewal date.
8.6 A price change will not apply during a Subscription Term unless:
a. the Customer agrees to the change;
b. the Order provides for a usage-based or variable charge; or
c. the change results from a change in tax or law.
8.7 Subscription rights are limited to the Customer and the number or category of Authorised Users specified in the Order.
9. Fees and payment
9.1 The Customer must pay all Subscription Fees and other charges specified in the Order.
9.2 Unless otherwise agreed:
a. online fees are payable immediately; and
b. invoiced fees are payable within 30 days of the invoice date.
9.3 Fees are exclusive of VAT and any other applicable sales, withholding or similar tax.
9.4 The Customer must raise any good-faith invoice dispute within 14 days after receiving the invoice and must pay any undisputed amount by the due date.
9.5 If an undisputed amount is overdue, MyAssays may:
a. charge interest at 4% per annum above the Bank of England base rate, calculated daily from the due date until payment;
b. recover reasonable costs of collecting the overdue amount; and
c. suspend access to Premium Services after giving reasonable notice.
9.6 Suspension for non-payment does not relieve the Customer of its obligation to pay amounts that have fallen due.
9.7 Except where these Terms expressly provide otherwise, Subscription Fees are non-refundable.
10. Licence to use the Services
10.1 Subject to payment of applicable fees and compliance with the Agreement, MyAssays grants the Customer a limited, non-exclusive, non-transferable and non-sublicensable right during the applicable Subscription Term to:
a. access and use the Services solely for the Customer’s internal Research Use;
b. permit its Authorised Users to use the Services; and
c. download or use reports and results generated through the Services.
10.2 The licence does not transfer ownership of the Services or any MyAssays Intellectual Property Rights.
10.3 The Customer must not, except where applicable law prevents restriction:
a. copy, modify, translate or create derivative works of the Services;
b. reverse engineer, decompile or disassemble the Services;
c. discover or attempt to discover source code, algorithms or underlying structure;
d. resell, sublicense, rent, lease or provide the Services as a service bureau;
e. allow unauthorised persons to access the Services;
f. circumvent technical, usage or access restrictions;
g. scrape, crawl or extract data from the Services by automated means without written permission;
h. interfere with the integrity, availability or security of the Services; or
i. remove proprietary notices.
10.4 The Customer may make reasonable internal copies of downloaded reports or results, subject to confidentiality, data protection and third-party rights.
11. Acceptable use
11.1 The Customer and its Authorised Users must use the Services lawfully and in accordance with the Documentation.
11.2 The Customer must not use the Services:
a. for any unlawful, fraudulent or deceptive purpose;
b. to infringe Intellectual Property Rights, privacy rights or other rights;
c. to upload malicious code, viruses or harmful material;
d. to gain unauthorised access to systems, data or accounts;
e. to disrupt, overload or degrade the Services;
f. to test vulnerabilities without MyAssays’ written permission;
g. to send unsolicited electronic communications;
h. to create or distribute unlawful, discriminatory, defamatory or abusive material;
i. to develop or assist a competing service by systematically copying features, outputs or Documentation;
j. in a manner that exposes MyAssays or another person to legal, regulatory or security risk;
k. to diagnose, screen, monitor, predict, prevent or treat a disease, injury, disability, medical condition or physiological or pathological state in an individual;
l. to select, recommend, alter or monitor treatment or otherwise make or support a patient-management or clinical-care decision;
m. to communicate a result as a clinical or diagnostic result to a patient, participant, healthcare professional or other person;
n. as, or as part of, a medical device, in vitro diagnostic medical device, clinical decision-support system or regulated diagnostic workflow; or
o. for any purpose other than Research Use.
11.3 Unless expressly agreed in writing, the Customer must not enter any of the following into a Sample ID field:
a. a person’s name;
b. an email address;
c. an NHS number;
d. a medical-record number;
e. a date of birth; or
f. another direct identifier.
11.4 Sample IDs should consist of non-identifying laboratory, study or research codes.
11.5 The Customer must use coded or pseudonymised identifiers wherever reasonably possible.
11.6 The Customer must not submit Special Category Personal Data unless:
a. the Processing is necessary for the Customer’s lawful use of the Services;
b. the Customer has identified an appropriate lawful basis and applicable special-category condition;
c. required privacy information has been provided to affected individuals;
d. the Processing is covered by the Data Processing Schedule; and
e. appropriate safeguards are in place.
11.7 The Customer is responsible for the legality, accuracy and appropriateness of its use of the Services.
12. Customer Content
12.1 Ownership
As between the parties, the Customer retains all right, title and interest in Customer Content.
MyAssays does not acquire ownership of Customer Content merely because Customer Content is submitted to, stored in or processed through the Services.
12.2 Licence to MyAssays
The Customer grants MyAssays a non-exclusive licence during the Agreement to host, store, reproduce, configure, analyse, transmit, display, back up and otherwise process Customer Content only as necessary to:
a. provide the Services;
b. carry out the Customer’s documented instructions;
c. provide support requested by the Customer;
d. maintain the security and integrity of the Services;
e. comply with applicable law; and
f. exercise MyAssays’ rights and perform its obligations under the Agreement.
12.3 Customer responsibilities
The Customer is responsible for:
a. the accuracy, quality and legality of Customer Content;
b. obtaining necessary rights, permissions and lawful bases;
c. ensuring that Customer Content does not infringe third-party rights;
d. maintaining appropriate independent copies of important Customer Content;
e. configuring the Services appropriately; and
f. reviewing results before relying on them.
12.4 No sale
MyAssays will not sell Customer Content or Customer Personal Data in exchange for money.
12.5 No independent AI training
MyAssays will not use Customer Content to train a general-purpose artificial-intelligence model, or permit an AI provider to use Customer Content for its own general model training, unless the Customer has expressly agreed to that use in writing.
12.6 Anonymised information
MyAssays may create and use statistical information derived from use of the Services only where the information has been anonymised so that neither an individual nor the Customer can reasonably be identified.
MyAssays may use properly anonymised information for:
a. service monitoring;
b. capacity planning;
c. security analysis;
d. product development;
e. quality assurance;
f. scientific or technical research; and
g. general business analysis.
MyAssays will not treat pseudonymised information as anonymous merely because direct identifiers have been removed.
12.7 Removal of unlawful content
MyAssays may remove, quarantine or restrict access to Customer Content where it reasonably believes that the content:
a. breaches applicable law;
b. infringes another person’s rights;
c. creates a material security risk; or
d. breaches these Terms.
Where reasonably practicable, MyAssays will notify the Customer before or promptly after taking action.
13. Data export and retrieval
13.1 During the Subscription Term, the Customer may access and export Customer Content using functionality made available through the Services.
13.2 Where an export cannot be completed through self-service functionality, the Customer may request an export in an available commonly used format.
13.3 MyAssays will not impose unreasonable restrictions on the Customer’s retrieval of Customer Content.
13.4 Export functionality may be subject to:
a. the nature and volume of Customer Content;
b. the formats available within the Services;
c. security and identity-verification requirements;
d. third-party rights; and
e. reasonable technical limitations.
13.5 Following termination, the Customer may request one export of available Customer Content within 30 days after Account closure, unless:
a. the Customer has instructed MyAssays to delete it immediately;
b. continued access would create a security or legal risk; or
c. the content has already been deleted in accordance with the Agreement.
13.6 Unless otherwise agreed, the termination export will be provided without an additional charge. MyAssays may charge reasonable fees for repeated, unusually complex or bespoke export requests.
13A. Share Links
13A.1 The Services may allow a Customer or Authorised User to generate a Share Link through which specified Customer Content can be viewed by another person.
13A.2 Unless the relevant feature expressly states otherwise, any person who obtains a Share Link may be able to access the Shared Content without creating a MyAssays Account or verifying their identity. The Customer must therefore treat each Share Link as confidential and distribute it only to intended and authorised recipients.
13A.3 The Customer is responsible for:
a. deciding whether to create a Share Link;
b. selecting the Customer Content made available through it;
c. determining the purpose of the disclosure;
d. selecting and verifying the intended recipients;
e. ensuring that it has all necessary rights, permissions, lawful bases and, where applicable, special-category conditions for the disclosure;
f. providing any privacy information required to affected individuals; and
g. taking reasonable steps to prevent the Share Link from being disclosed to unauthorised persons.
13A.4 MyAssays generates and maintains a Share Link on the Customer’s documented instruction. MyAssays does not select the recipients of the Shared Content and does not independently determine the purpose for which the Customer shares it.
13A.5 MyAssays will apply appropriate technical and organisational measures designed to protect Share Links and Shared Content against unauthorised access, disclosure, alteration or loss.
13A.6 The Customer may request that MyAssays disable or delete a Share Link at any time. Following a verified request, MyAssays will disable access through the Share Link without undue delay.
13A.7 Disabling or deleting a Share Link:
a. prevents future access through that Share Link;
b. does not, by itself, delete the underlying Customer Content from the Customer’s Account; and
c. cannot recall or delete copies that a recipient downloaded, saved, copied, photographed, printed or disclosed before the Share Link was disabled.
13A.8 The Customer must notify MyAssays promptly if it believes that a Share Link has been disclosed to an unauthorised person or otherwise compromised.
13A.9 MyAssays may disable or restrict a Share Link where reasonably necessary to:
a. comply with law or a competent authority’s request;
b. address a security incident or suspected unauthorised access;
c. protect a Data Subject, Customer, recipient or third party; or
d. enforce these Terms.
13A.10 Subject to clause 27, MyAssays is not responsible for access, copying or onward disclosure resulting from the Customer’s or a recipient’s disclosure of a Share Link, except to the extent caused by MyAssays’ breach of the Agreement or failure to apply the security measures required under it.
14. Research Use Only and scientific responsibilities
14.1 The Services are supplied solely for Research Use.
14.2 The Services and their outputs are not intended, designed or validated by MyAssays for:
a. diagnosis or differential diagnosis;
b. screening for a disease, condition or health risk;
c. prognosis or prediction of clinical outcomes;
d. treatment selection, recommendation or monitoring;
e. patient stratification for the purpose of making a clinical-care decision;
f. patient management or clinical decision-making;
g. monitoring a physiological or pathological condition for a medical purpose;
h. emergency decision-making; or
i. any other diagnostic, therapeutic, clinical or medical purpose.
14.3 The Customer must not use, and must ensure that its Authorised Users do not use, the Services or any output:
a. to make or support a decision concerning an individual’s diagnosis, treatment, health or medical care;
b. as a substitute for a validated diagnostic method, manufacturer instruction, clinical test or qualified healthcare professional’s judgement;
c. as, or as part of, a medical device, in vitro diagnostic medical device, clinical decision-support system or regulated diagnostic workflow; or
d. in any other manner inconsistent with Research Use.
14.4 Results depend on the Customer Content, assumptions, parameters, methods and configurations supplied or selected by the Customer. An assay-analysis method, calculation or configuration made available through the Services has not been independently validated by MyAssays for the Customer’s particular assay, kit, protocol, specimen, equipment or research purpose unless MyAssays expressly confirms otherwise in writing.
14.5 The Customer is responsible for:
a. selecting appropriate research methods, settings and parameters;
b. checking the completeness and accuracy of input data;
c. independently reviewing and validating protocols, calculations, analyses and outputs;
d. interpreting outputs using appropriately qualified personnel;
e. determining whether an output is suitable for the Customer’s intended Research Use;
f. complying with applicable scientific, ethical, professional and regulatory requirements; and
g. ensuring that its personnel understand and comply with the restrictions in this clause.
14.6 MyAssays does not represent or warrant that the Services or their outputs satisfy the requirements applicable to a medical device, in vitro diagnostic medical device, clinical laboratory system, diagnostic procedure or regulated clinical workflow.
14.7 The Customer must not remove, obscure or alter a Research Use Only warning included in the Services, Documentation, reports or other outputs.
14.8 MyAssays may suspend or terminate access where it reasonably believes that the Services or an output are being used for a diagnostic, therapeutic, patient-management or other prohibited medical purpose.
14.9 Nothing in this clause prevents lawful scientific or clinical research, including research involving human specimens or study participants, provided that the Services and their outputs are not used to make or support decisions concerning an individual’s diagnosis, treatment, health or medical care.
15. AI-Assisted Features
15.1 AI-Assisted Features are intended to assist users with activities such as assay protocol creation, configuration, review or analysis.
15.2 AI-generated or AI-assisted output may be incomplete, inaccurate, outdated, unsuitable or misleading.
15.3 The Customer must ensure that a suitably qualified person reviews and validates AI-assisted output before relying on it.
15.4 AI-Assisted Features do not replace scientific expertise, professional judgement, manufacturer instructions, laboratory validation or regulatory review.
15.5 Unless expressly permitted in writing, users must not include in an AI prompt:
a. names or direct identifiers;
b. confidential patient information;
c. identifiable participant information; or
d. Personal Data that is not necessary for the permitted use of the feature.
15.6 MyAssays may impose additional limits or safeguards on AI-Assisted Features to address legal, technical, scientific or security risks.
15.7 MyAssays may identify AI-Assisted Features as preview, beta or experimental. Those features may be changed or withdrawn at any time.
16. MyAssays Intellectual Property Rights
16.1 MyAssays and its licensors retain all Intellectual Property Rights in:
a. the Services;
b. software and source code;
c. algorithms, calculation methods and workflows;
d. site designs and interfaces;
e. Documentation;
f. databases and data structures;
g. MyAssays names, marks and branding; and
h. improvements and modifications to those items.
16.2 No rights are granted except those expressly stated in the Agreement.
16.3 Customer Content, and the Customer’s own pre-existing materials incorporated into Customer Content, remain owned by the Customer or its licensors.
16.4 If the Customer provides suggestions, ideas or general feedback concerning the Services, MyAssays may use that feedback without restriction, provided that it does not disclose Customer Confidential Information or identify the Customer without permission.
16.5 Third-party software or materials may be subject to additional licence terms notified to the Customer.
17. Confidentiality
17.1 Each party must:
a. keep the other party’s Confidential Information confidential;
b. use it only for performing or receiving the Services and exercising rights under the Agreement;
c. disclose it only to persons who need to know it for those purposes; and
d. ensure that recipients are subject to appropriate confidentiality obligations.
17.2 MyAssays may disclose Customer Confidential Information to its personnel, professional advisers and approved service providers or subprocessors where access is necessary to provide, support or secure the Services.
17.3 Confidential Information does not include information that the receiving party can demonstrate:
a. is or becomes public other than through breach of the Agreement;
b. was lawfully known to it without restriction before disclosure;
c. was lawfully received from a third party without confidentiality restrictions; or
d. was independently developed without use of the disclosing party’s Confidential Information.
17.4 A party may disclose Confidential Information where required by law, court order or a competent authority, provided that, where legally permitted, it gives the other party reasonable notice and discloses only what is required.
17.5 Neither party may use the other party’s name, trade mark or logo in publicity without prior written consent.
17.6 These confidentiality obligations continue for five years after termination. Obligations concerning Customer Content, trade secrets and Personal Data continue for as long as the information remains confidential or protected by law.
18. Privacy and data protection
18.1 MyAssays acts as Controller for Personal Data that it Processes for its own purposes, including:
a. Account registration and administration;
b. subscriptions, billing and payments;
c. customer relationship management;
d. support;
e. fraud prevention and service security;
f. legal compliance; and
g. permitted marketing.
18.2 MyAssays’ Processing as Controller is described in its Privacy Policy.
18.3 Where MyAssays Processes Customer Personal Data solely on behalf of the Customer, the Customer acts as Controller and MyAssays acts as Processor.
18.4 The Data Processing Schedule applies to the Processing described in clause 18.3.
18.5 Each party must comply with its obligations under Applicable Data Protection Laws.
18.6 Nothing in the Agreement relieves the Customer of its responsibilities as Controller, including responsibility for:
a. lawfulness and transparency;
b. data minimisation;
c. accuracy;
d. responding to Data Subject requests;
e. identifying lawful bases and special-category conditions; and
f. determining whether a data protection impact assessment is required.
19. Service providers
19.1 MyAssays may use service providers to operate, secure and support the Services.
19.2 Principal providers may include:
a. Microsoft Azure for cloud infrastructure, application hosting, data storage and backup;
b. Stripe for subscription billing, payment processing and payment fraud prevention; and
c. Twilio SendGrid for transactional and service-related email delivery.
19.3 The role of a provider may differ according to the processing activity. A provider may act as MyAssays’ Processor, subprocessor, independent Controller or joint Controller.
19.4 Subprocessors used to Process Customer Personal Data are governed by the Data Processing Schedule.
19.5 MyAssays remains responsible for the performance of its subprocessors to the extent required by Applicable Data Protection Laws.
20. Security
20.1 MyAssays will maintain appropriate technical and organisational measures intended to protect Customer Content and Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or unauthorised access.
20.2 Those measures are described further in Annex 2 to the Data Processing Schedule.
20.3 The Customer acknowledges that no internet-based service can be guaranteed to be completely secure or continuously available.
20.4 The Customer must:
a. keep credentials confidential;
b. use appropriately strong passwords;
c. restrict Account access;
d. maintain secure devices and networks;
e. promptly remove access from former personnel; and
f. notify MyAssays promptly of suspected compromise.
20.5 MyAssays may temporarily suspend access where reasonably necessary to:
a. contain or investigate a security incident;
b. prevent unauthorised access;
c. protect the Services or other customers; or
d. comply with law.
21. Support, maintenance and availability
21.1 MyAssays will use reasonable skill and care in providing the Services.
21.2 Support may be requested through the support facility made available on the Sites.
21.3 Any response time displayed on a Site or in support materials is an indicative target unless expressly stated as a binding service level in an Order.
21.4 MyAssays may perform planned or emergency maintenance.
21.5 Where reasonably practicable, MyAssays will give advance notice of planned maintenance likely to cause material disruption.
21.6 MyAssays does not guarantee uninterrupted or error-free operation unless an Order contains an express service-level commitment.
21.7 MyAssays may update, modify or replace the Services to:
a. improve performance or security;
b. correct errors;
c. comply with law;
d. address technical changes; or
e. add, modify or remove functionality.
21.8 MyAssays will not materially reduce the core functionality of paid Services during a Subscription Term without reasonable notice, except where necessary for legal, security or technical reasons.
21.9 If MyAssays permanently removes material paid functionality and does not provide a reasonably equivalent replacement, the Customer may terminate the materially affected Premium Service and receive a pro-rata refund of prepaid fees covering the unused period.
The termination right and pro-rata refund described in this clause are the Customer’s sole and exclusive remedies for a permanent material reduction in functionality under clause 21.8, subject to rights that cannot lawfully be excluded.
22. Suspension
22.1 MyAssays may suspend some or all access to the Services where:
a. the Customer materially breaches the Agreement;
b. fees are overdue;
c. use of the Services creates a security, legal or operational risk;
d. suspension is necessary to protect another customer or third party;
e. MyAssays reasonably suspects fraud, unlawful activity or credential compromise; or
f. required by law or a competent authority.
22.2 Where reasonably practicable, MyAssays will:
a. notify the Customer before suspension;
b. explain the reason; and
c. give the Customer a reasonable opportunity to remedy the issue.
22.3 MyAssays may suspend immediately where delay would create a material security, legal or operational risk.
22.4 MyAssays will restore access as soon as reasonably practicable after the reason for suspension has been resolved.
23. Termination
23.1 Termination for breach
Either party may terminate the Agreement immediately by written notice if the other party:
a. commits a material breach that cannot be remedied;
b. fails to remedy a remediable material breach within 30 days after written notice;
c. becomes insolvent, enters administration or liquidation, or ceases business; or
d. is subject to an equivalent insolvency event.
23.2 Termination by the Customer
The Customer may:
a. prevent renewal by giving notice under clause 8.3;
b. terminate as expressly permitted elsewhere in the Agreement; or
c. close a Free Services Account at any time.
Unless MyAssays has materially breached the Agreement or these Terms expressly provide otherwise, early termination by the Customer does not entitle the Customer to a refund.
23.3 Termination by MyAssays
MyAssays may:
a. terminate Free Services at any time;
b. terminate for breach under clause 23.1;
c. terminate an Account used unlawfully or in a way that creates material risk; or
d. terminate Premium Services for convenience by giving at least 30 days’ notice.
If MyAssays terminates Premium Services for convenience, it will refund prepaid Subscription Fees on a pro-rata basis for the unused period.
23.4 Effects of termination
On termination or expiry:
a. the Customer’s right to use the affected Services ends;
b. outstanding fees become immediately payable;
c. each party must return or cease using the other party’s Confidential Information, subject to lawful retention;
d. Customer Content will be made available for export and deleted in accordance with clause 13 and the Data Processing Schedule; and
e. provisions intended to survive termination will continue.
23.5 Surviving provisions
Clauses concerning ownership, confidentiality, data protection, accrued payment obligations, limitations of liability, dispute resolution and any other provisions intended by their nature to survive will continue after termination.
24. Warranties
24.1 MyAssays warrants that during a paid Subscription Term:
a. it will provide the Services with reasonable skill and care; and
b. the Services will materially conform to their applicable description.
24.2 If MyAssays breaches clause 24.1, the Customer must notify MyAssays promptly and provide reasonable details.
24.3 MyAssays will use reasonable efforts to correct or re-perform the affected Services.
24.4 If MyAssays cannot remedy a material breach within a reasonable period, the Customer may terminate the affected Premium Services and receive a pro-rata refund of prepaid fees for the unused period.
24.5 The warranties do not apply where an issue results from:
a. Customer Content;
b. incorrect configuration or use;
c. use contrary to Documentation;
d. third-party systems outside MyAssays’ control;
e. unauthorised modifications; or
f. unsupported devices, browsers or software.
24.6 Except as expressly stated, all implied warranties, conditions and terms are excluded to the fullest extent permitted by law.
24.7 Subject to rights that cannot lawfully be excluded, the correction, re-performance, termination and refund remedies in this clause 24 are the Customer’s sole and exclusive remedies for breach of the warranties in clause 24.1.
25. Intellectual property claims
25.1 If a third party claims that authorised use of the Services infringes its UK Intellectual Property Rights, MyAssays may, at its option:
a. obtain the right for the Customer to continue using the Services;
b. modify or replace the affected Services so that they are no longer infringing; or
c. terminate the affected Services and refund prepaid fees for the unused period.
25.2 Clause 25.1 does not apply to a claim resulting from:
a. Customer Content;
b. use outside the scope of the Agreement;
c. combination with items not provided or approved by MyAssays;
d. modifications made by or for the Customer; or
e. continued use after MyAssays has provided a non-infringing replacement.
25.3 Subject to rights that cannot lawfully be excluded, clause 25.1 states MyAssays’ entire obligation and the Customer’s sole and exclusive remedy in relation to any actual or alleged infringement of third-party Intellectual Property Rights by the Services.
26. Customer indemnity
26.1 The Customer will indemnify and keep indemnified MyAssays, its officers, employees and contractors against all third-party claims, proceedings, liabilities, damages, losses, costs and reasonable legal expenses arising out of or in connection with:
a. Customer Content;
b. an allegation that Customer Content infringes another person’s Intellectual Property Rights, privacy rights, confidentiality rights or other rights;
c. the Customer’s collection, use, Processing or disclosure of Personal Data;
d. the Customer’s creation, distribution or use of a Share Link;
e. the Customer’s failure to obtain necessary rights, permissions, lawful bases or special-category conditions;
f. the Customer’s use of the Services contrary to the Agreement or applicable law; or
g. an instruction given by or on behalf of the Customer.
26.2 MyAssays will:
a. notify the Customer within a reasonable period after becoming aware of a relevant claim;
b. provide reasonable cooperation at the Customer’s expense; and
c. allow the Customer reasonable control of the defence and settlement of the claim.
26.3 The Customer must not make an admission on behalf of MyAssays or agree to a settlement that imposes liability, payment obligations or other material obligations on MyAssays without MyAssays’ prior written consent.
26.4 MyAssays may participate in the defence using advisers of its choice at its own cost.
26.5 The indemnity does not apply to the extent that the third-party claim was directly caused by MyAssays’ breach of the Agreement, negligence or unlawful Processing.
26.6 Any regulatory penalty or fine is included in this clause only to the extent that it is lawfully recoverable from the Customer.
27. Limitation of liability
27.1 Liabilities that are not limited
Nothing in the Agreement excludes or limits liability for:
a. death or personal injury caused by negligence;
b. fraud or fraudulent misrepresentation; or
c. any liability to the extent that it cannot lawfully be excluded or limited.
27.2 Excluded losses
Subject to clause 27.1, MyAssays will not be liable for:
a. loss of profit;
b. loss of revenue;
c. loss of anticipated savings;
d. loss of business, contracts or opportunity;
e. loss of goodwill or reputation;
f. indirect or consequential loss; or
g. punitive or exemplary damages.
27.3 Customer-controlled risks
Subject to clause 27.1, MyAssays will not be liable for any loss arising from or relating to:
a. inaccurate, incomplete, unlawful or unsuitable Customer Content;
b. settings, parameters or configurations selected by the Customer;
c. use or attempted use of the Services or any output contrary to clause 14, including use for diagnosis, screening, prognosis, treatment selection, treatment monitoring, patient management or any other clinical or medical purpose;
d. reliance on AI-assisted output without appropriate qualified human review;
e. systems, networks, software or services outside MyAssays’ reasonable control;
f. unauthorised access resulting from the Customer’s failure to protect credentials, devices, systems or Share Links;
g. access to, copying of or onward disclosure of Shared Content by a person who obtained a Share Link from the Customer or a recipient;
h. the Customer’s failure to maintain reasonable independent copies of important information; or
i. the Customer’s failure to check input data or validate outputs, calculations, protocols or results;
j. use of the Services contrary to the Agreement or Documentation.
27.4 Aggregate cap for Premium Services
Subject to clause 27.1, MyAssays’ total aggregate liability arising out of or in connection with the Agreement, an Order or any Premium Service, whether in contract, tort, including negligence, misrepresentation, restitution, breach of statutory duty or otherwise, will not exceed 100% of the Subscription Fees actually paid by the Customer to MyAssays, excluding VAT, for the affected Premium Service during the 12 months immediately preceding the first event giving rise to the claim.
Where the affected Premium Service has been provided for fewer than 12 months, the cap will be 100% of the Subscription Fees actually paid for that shorter period.
27.5 Related claims
All claims arising from the same event, substantially the same facts or a series of connected events will be treated as one claim arising on the date of the first relevant event.
The cap in clause 27.4 is an aggregate cap and does not apply separately to each claim, claimant, cause of action, incident or contractual obligation.
27.6 Refunds and other remedies
Any refund, credit or other amount paid or credited by MyAssays under the Agreement, including under clauses 21.9, 23.3, 24.4, 25.1 and 29.4 and clause 10.7 of the Data Processing Schedule:
a. counts towards and reduces the applicable liability cap;
b. is not payable in addition to that cap; and
c. may not result in the Customer recovering more than once for the same loss.
27.7 Free Services
Free Services include trial, demonstration, evaluation, preview and beta Services and any other Services provided without charge.
Free Services are provided on an “as available” basis, without charge and without any commitment that they will remain available, uninterrupted, secure, error-free or suitable for a particular purpose.
Subject to clause 27.1 and to the fullest extent permitted by law, MyAssays excludes all liability arising out of or in connection with Free Services, including liability arising from:
a. suspension, modification or withdrawal;
b. unavailability, interruption or failure;
c. errors, inaccuracies or omissions in outputs or results;
d. reliance on outputs;
e. loss, corruption or unavailability of Customer Content; and
f. the creation, use, compromise or disclosure of Share Links.
If any liability arising out of or in connection with Free Services cannot lawfully be excluded but can lawfully be limited, MyAssays’ total aggregate liability to the Customer, in respect of all Free Services used by the Customer or any of its Authorised Users, across all Accounts, claims and events, will not exceed £50 in total for the entire duration of the Agreement. This cap is not applied separately for each Authorised User, Account, Free Service, claim, event or year.
This Free Services limitation applies instead of the cap in clause 27.4.
27.8 Customer liability
Except to the extent expressly required by law, the exclusions and limitations in this clause 27 limit MyAssays’ liability only and do not limit:
a. the Customer’s obligation to pay fees and other amounts properly due;
b. the Customer’s liability under clause 26;
c. the Customer’s liability for infringement of MyAssays’ Intellectual Property Rights;
d. the Customer’s liability for breach of confidentiality;
e. the Customer’s liability arising from unlawful Customer Content, unlawful Processing or unlawful disclosure; or
f. the Customer’s fraud or fraudulent misrepresentation.
27.9 Mitigation
Each party must take reasonable steps to mitigate any loss for which it seeks recovery.
28. Force majeure
28.1 Neither party is liable for delay or failure caused by an event beyond its reasonable control.
28.2 Such events may include:
a. failure of telecommunications or internet services;
b. utility failure;
c. cloud or infrastructure outage;
d. cyberattack that could not reasonably have been prevented;
e. epidemic or pandemic;
f. natural disaster;
g. war, terrorism, civil disorder or government action;
h. labour dispute; or
i. failure of a critical supplier despite reasonable contingency arrangements.
28.3 The affected party must take reasonable steps to mitigate the effect of the event.
28.4 Payment obligations for Services already provided are not excused by force majeure.
28.5 If a force-majeure event prevents material performance for more than 60 consecutive days, either party may terminate the affected Services by written notice.
29. Changes to these Terms
29.1 MyAssays may amend these Terms to reflect:
a. changes in law or regulatory guidance;
b. security requirements;
c. changes to the Services;
d. changes to suppliers or infrastructure; or
e. reasonable commercial or operational requirements.
29.2 MyAssays will give at least 30 days’ notice of a material change that adversely affects an existing Customer.
29.3 A change may take effect sooner where required by law or urgently necessary to address a security risk.
29.4 If a proposed change materially and adversely affects Premium Services, the Customer may terminate the affected Services before the change takes effect and receive a pro-rata refund of prepaid fees for the unused period.
29.5 Changes to subprocessors are governed by the Data Processing Schedule.
29.6 Continued use after a change takes effect constitutes acceptance of the amended Terms.
30. Assignment
30.1 The Customer may not assign, transfer or novate the Agreement without MyAssays’ prior written consent, not to be unreasonably withheld.
30.2 MyAssays may assign or transfer the Agreement:
a. to an Affiliate;
b. as part of a merger, reorganisation or sale of its business or assets; or
c. to a successor to the relevant Services.
30.3 MyAssays will ensure that an assignee remains bound by obligations materially equivalent to those applicable under the Agreement.
30.4 Where reasonably practicable, MyAssays will notify the Customer of a material assignment.
31. Notices
31.1 Notices under the Agreement must be in writing.
31.2 MyAssays may send notices to the email address associated with the Customer’s Account.
31.3 The Customer may send notices:
a. through the support or contact facility on the Sites; or
b. by prepaid post to MyAssays’ registered office.
31.4 Data-protection notices may also be sent to:
privacy-2617@myassays.com
31.5 A notice is deemed received:
a. if sent by email, at 9:00 am on the next Business Day after transmission, unless the sender receives a delivery-failure notification;
b. if submitted through the support facility, when receipt is confirmed by MyAssays’ system; and
c. if sent by prepaid post within the United Kingdom, two Business Days after posting.
31.6 This clause does not apply to the formal service of legal proceedings.
32. General provisions
32.1 Entire agreement
The Agreement constitutes the entire agreement between the parties concerning its subject matter and supersedes previous discussions, statements and understandings.
32.2 No reliance
Each party acknowledges that it has not relied on any statement not expressly included in the Agreement, except that nothing excludes liability for fraud or fraudulent misrepresentation.
32.3 Waiver
A failure or delay in exercising a right does not waive that right.
32.4 Severability
If a provision is held invalid or unenforceable, it will be modified to the minimum extent necessary or, if modification is not possible, deleted. The remaining provisions will continue in effect.
32.5 No partnership or agency
The Agreement does not create a partnership, joint venture, fiduciary relationship, employment relationship or agency between the parties.
32.6 Third-party rights
A person who is not a party to the Agreement has no right to enforce it under the Contracts (Rights of Third Parties) Act 1999, except where the Data Processing Schedule expressly provides otherwise.
32.7 Further assurance
Each party will do all things reasonably necessary to give effect to the Agreement.
32.8 Counterparts and electronic acceptance
The Agreement may be accepted electronically and may be executed in counterparts. Electronic acceptance and signatures have the same effect as handwritten signatures.
33. Governing law and jurisdiction
33.1 The Agreement and any non-contractual obligations arising from it are governed by the law of England and Wales.
33.2 The courts of England and Wales have exclusive jurisdiction over any dispute arising out of or relating to the Agreement.
SCHEDULE 1
DATA PROCESSING SCHEDULE
1. Scope
1.1 This Data Processing Schedule applies where MyAssays Processes Customer Personal Data on behalf of the Customer.
1.2 For that Processing:
a. the Customer is the Controller;
b. MyAssays is the Processor; and
c. each party must comply with Applicable Data Protection Laws.
1.3 MyAssays remains a separate Controller for Personal Data that it Processes for its own purposes, including Account administration, billing, customer support, fraud prevention, service security, legal compliance and customer relationship management.
1.4 This Schedule forms part of the Agreement and is binding on MyAssays and the Customer.
1.5 If this Schedule conflicts with another provision of the Agreement concerning Customer Personal Data, this Schedule prevails.
2. Processing details
2.1 The subject matter, duration, nature and purpose of the Processing, the types of Personal Data and categories of Data Subjects are described in Annex 1.
2.2 The Customer retains control over the purposes of Processing Customer Personal Data.
2.3 The Customer’s rights and obligations include the right to:
a. determine the purposes of Processing;
b. configure its use of the Services;
c. provide lawful documented instructions;
d. access and export available Customer Content; and
e. request return or deletion in accordance with the Agreement.
3. Documented instructions
3.1 MyAssays will Process Customer Personal Data only:
a. on the Customer’s documented instructions;
b. as necessary to provide, support, secure and maintain the Services; or
c. where required by applicable law.
3.2 The Customer’s documented instructions consist of:
a. the Agreement;
b. the Customer’s configuration and authorised use of the Services;
c. written support requests;
d. additional written instructions agreed by the parties; and
e. an Authorised User’s instruction through the Services to create, maintain, disable or delete a Share Link and make specified Customer Personal Data available through that Share Link.
3.3 The Customer instructs MyAssays to make restricted international transfers necessary to provide the Services using the approved subprocessors and transfer safeguards described in this Schedule.
3.4 If applicable law requires MyAssays to Process Customer Personal Data otherwise than on the Customer’s instructions, MyAssays will inform the Customer before Processing unless the law prohibits such notification.
3.5 MyAssays will promptly inform the Customer if, in MyAssays’ reasonable opinion, an instruction infringes Applicable Data Protection Laws.
3.6 MyAssays may suspend the affected Processing while the parties address an unlawful or materially unsafe instruction.
4. Customer obligations
4.1 The Customer warrants that:
a. it has the right to submit Customer Personal Data to the Services;
b. it has provided required privacy information;
c. it has an appropriate lawful basis for Processing;
d. where applicable, it has identified an appropriate condition for Processing Special Category Personal Data;
e. its instructions comply with Applicable Data Protection Laws; and
f. Customer Personal Data is adequate, relevant and limited to what is necessary.
4.2 The Customer must use coded or pseudonymised identifiers wherever reasonably possible.
4.3 Unless expressly agreed in writing, the Customer must not enter direct identifiers in Sample ID fields.
4.4 The Customer remains responsible for:
a. responding to Data Subject requests;
b. assessing whether Processing is likely to result in a high risk;
c. carrying out any required data protection impact assessment; and
d. making notifications to affected individuals or regulators where required.
4.5 Where the Customer uses a Share Link, the Customer is responsible for determining the purpose and recipients of the disclosure and ensuring that the disclosure is lawful, fair, transparent and limited to information necessary for the intended purpose.
5. Confidentiality and personnel
5.1 MyAssays will ensure that personnel authorised to Process Customer Personal Data:
a. are subject to contractual or statutory confidentiality obligations;
b. receive access only where necessary for their duties;
c. receive appropriate data-protection and security guidance; and
d. Process Customer Personal Data only as authorised.
5.2 MyAssays will limit access according to role and business need.
5.3 Confidentiality obligations survive termination of the Agreement.
6. Security
6.1 MyAssays will implement and maintain appropriate technical and organisational measures to protect Customer Personal Data.
6.2 Measures will take account of:
a. the state of the art;
b. implementation costs;
c. the nature, scope, context and purposes of Processing; and
d. risks to the rights and freedoms of individuals.
6.3 The measures in place are described in Annex 2.
6.4 MyAssays may update security measures, provided that an update does not materially reduce the overall level of protection.
6.5 The Customer acknowledges that security is a shared responsibility and must maintain appropriate safeguards for its own users, devices, systems and credentials.
7. Personal Data Breaches
7.1 MyAssays will notify the Customer without undue delay and, where reasonably practicable, no later than 48 hours after becoming aware of a Personal Data Breach affecting Customer Personal Data.
7.2 The notification will include, to the extent known at the relevant time:
a. a description of the nature of the breach;
b. the categories and approximate number of affected Data Subjects;
c. the categories and approximate number of affected records;
d. the likely consequences;
e. containment and remediation measures taken or proposed; and
f. a contact point for further information.
7.3 Where complete information is not initially available, MyAssays may provide it in phases without undue further delay.
7.4 MyAssays will take reasonable steps to:
a. contain the breach;
b. investigate its causes and effects;
c. preserve relevant evidence;
d. remediate identified vulnerabilities; and
e. reduce the risk of recurrence.
7.5 MyAssays will provide reasonable assistance to the Customer in assessing and complying with its notification obligations.
7.6 When reasonably available, MyAssays will provide the Customer with an incident summary describing:
a. the material findings of the investigation;
b. the affected systems and information;
c. containment and recovery measures; and
d. corrective actions.
7.7 MyAssays is not required to disclose:
a. legally privileged material;
b. information that would materially compromise security;
c. another customer’s confidential information; or
d. information prohibited from disclosure by law.
7.8 MyAssays will not notify Data Subjects or a regulator on the Customer’s behalf unless instructed by the Customer or required by law.
7.9 Notification under this clause is not an admission of fault or liability.
8. Data Subject requests
8.1 Taking account of the nature of the Processing, MyAssays will provide reasonable assistance to enable the Customer to respond to Data Subject requests.
8.2 If MyAssays receives a request relating primarily to Customer Personal Data, MyAssays will:
a. promptly forward it to the Customer;
b. not respond substantively except on the Customer’s documented instructions or where required by law; and
c. preserve relevant information reasonably required to support the response.
8.3 The Customer is responsible for determining how to respond to a request.
8.4 MyAssays may charge a reasonable fee for assistance that is unusually complex, repetitive or outside the ordinary functionality of the Services, provided that the fee is agreed in advance.
9. Compliance assistance
9.1 Taking account of the nature of the Processing and information available to MyAssays, MyAssays will provide reasonable assistance concerning:
a. security of Processing;
b. Personal Data Breach assessment and notification;
c. data protection impact assessments;
d. prior consultation with the Information Commissioner’s Office or another competent regulator; and
e. demonstrating compliance with Applicable Data Protection Laws.
9.2 MyAssays may charge reasonable fees for assistance that requires material additional work beyond the ordinary provision of the Services, provided that:
a. the assistance is not required because of MyAssays’ breach; and
b. the fees are agreed in advance.
10. Subprocessors
10.1 The Customer gives MyAssays general written authorisation to use the subprocessors listed in Annex 3.
10.2 MyAssays will:
a. carry out reasonable due diligence before appointing a subprocessor;
b. enter into a written contract imposing data-protection obligations that provide materially equivalent protection;
c. remain responsible for the subprocessor’s performance to the extent required by law; and
d. maintain information concerning current subprocessors.
10.3 MyAssays will give at least 15 days’ prior written notice of an intended new or replacement subprocessor that will Process Customer Personal Data, unless urgent appointment is necessary to address a security or legal issue.
10.4 The Customer may object within the notice period on reasonable and documented data-protection grounds.
10.5 The parties will work in good faith to resolve a valid objection.
10.6 If no reasonable alternative is available, the Customer may terminate only the Services materially affected by the proposed subprocessor before the appointment takes effect.
10.7 A termination under clause 10.6 entitles the Customer to a pro-rata refund of prepaid fees for the unused period of the terminated Services.
10.8 Service providers that Process only MyAssays’ own Controller data are not subprocessors under this Schedule.
11. International transfers
11.1 MyAssays will not make a restricted transfer of Customer Personal Data unless:
a. it is consistent with the Customer’s documented instructions; and
b. a transfer mechanism permitted under Applicable Data Protection Laws is in place.
11.2 A transfer mechanism may include:
a. applicable UK adequacy regulations;
b. the UK International Data Transfer Agreement;
c. the UK Addendum to approved EU Standard Contractual Clauses;
d. binding corporate rules; or
e. another legally permitted safeguard or exception.
11.3 Where required, MyAssays will complete or assist with an applicable transfer-risk assessment.
11.4 MyAssays will provide reasonable information about relevant transfer safeguards on request.
11.5 Where an approved subprocessor relies on its own valid transfer safeguards, MyAssays may rely on those safeguards subject to Applicable Data Protection Laws.
12. Return, export and deletion
12.1 During the Agreement, the Customer may access and export available Customer Personal Data through the Services or by making a reasonable request.
12.2 On termination or expiry, MyAssays will, at the Customer’s choice:
a. return available Customer Personal Data; or
b. delete Customer Personal Data,
unless applicable law requires continued storage.
12.3 Unless otherwise agreed:
a. the Customer may request an export within 30 days after Account closure;
b. Customer Personal Data will normally be deleted from active systems within 30 days after Account closure or completion of a requested export; and
c. residual copies may remain in protected backups for up to 12 months.
12.4 Customer Personal Data retained in backups will:
a. remain protected;
b. be put beyond ordinary operational use;
c. not be restored except for disaster recovery, legal compliance or security purposes; and
d. be deleted through the normal backup-overwrite cycle.
12.5 If a backup containing Customer Personal Data is restored, MyAssays will take reasonable steps to reapply applicable deletion instructions.
12.6 MyAssays may retain limited information where required by law or reasonably necessary to establish, exercise or defend legal claims.
12.7 MyAssays’ own Controller records, including billing, transaction, security and compliance records, are retained in accordance with the Privacy Policy and are not governed by the Customer’s deletion instruction under this clause.
13. Audits and information
13.1 MyAssays will make available information reasonably necessary to demonstrate compliance with this Schedule.
13.2 MyAssays may initially satisfy an audit request by providing:
a. completed security questionnaires;
b. relevant policies or summaries;
c. subprocessor information;
d. independent reports or certifications, where available; or
e. other reasonable documentary evidence.
13.3 Subject to clause 13.4, the Customer may conduct an audit no more than once in any 12-month period.
13.4 The frequency limitation does not apply where:
a. a Personal Data Breach has materially affected Customer Personal Data;
b. a regulator requires an audit; or
c. the Customer has reasonable evidence of material non-compliance.
13.5 An audit must:
a. be subject to at least 20 Business Days’ notice, unless urgent circumstances justify shorter notice;
b. take place during normal business hours;
c. minimise disruption;
d. comply with reasonable security and confidentiality requirements;
e. not involve access to another customer’s information; and
f. be conducted by appropriately qualified persons.
13.6 The Customer bears its own audit costs.
13.7 MyAssays may charge reasonable costs incurred in supporting an audit, except where the audit identifies a material breach by MyAssays.
13.8 An audit must not require disclosure of:
a. another customer’s Confidential Information;
b. information that would compromise security;
c. legally privileged material; or
d. information whose disclosure is prohibited by law.
13.9 Nothing in this clause restricts the powers of the Information Commissioner’s Office or another competent regulator.
14. Records and regulatory cooperation
14.1 MyAssays will maintain records required of it as a Processor under Applicable Data Protection Laws.
14.2 MyAssays will cooperate with the Information Commissioner’s Office or another competent regulator where legally required.
14.3 MyAssays will notify the Customer of a regulator request specifically concerning Customer Personal Data unless prohibited by law.
15. Liability
15.1 The liability provisions in clause 27 of the main Terms apply to this Schedule.
15.2 Nothing in this Schedule limits liability to the extent that Applicable Data Protection Laws prohibit the limitation.
16. Duration and survival
16.1 This Schedule applies for as long as MyAssays Processes Customer Personal Data.
16.2 Provisions concerning confidentiality, security, return, deletion, audits, liability and regulatory cooperation survive termination to the extent necessary to give them effect.
ANNEX 1
DETAILS OF PROCESSING
1. Subject matter
Provision of the MyAssays SaaS assay-analysis, protocol-configuration, calculation, reporting and related support Services.
2. Duration
For the duration of the Customer’s Account or Subscription Term, followed by the export, deletion and backup periods specified in the Agreement.
3. Nature of Processing
Processing may include:
a. collection and receipt;
b. recording;
c. hosting and storage;
d. organisation and structuring;
e. configuration;
f. calculation and analysis;
g. retrieval and display;
h. transmission;
i. technical support;
j. backup and restoration;
k. export and return;
l. deletion;
m. making selected Customer Content available through Customer-directed Share Links; and
n. disabling or deleting Share Links on the Customer’s instruction.
4. Purposes
The purposes of Processing are:
a. providing the Services;
b. carrying out Customer configurations and instructions;
c. producing assay-related results and reports;
d. maintaining and securing the Services;
e. providing support;
f. backing up Customer Content;
g. complying with applicable law; and
h. enabling the Customer to disclose selected Customer Content to recipients selected by the Customer.
5. Categories of Data Subjects
Customer Personal Data may relate to:
a. Customer employees and contractors;
b. researchers and laboratory personnel;
c. study participants;
d. patients;
e. laboratory subjects;
f. the Customer’s clients; and
g. other individuals represented in Customer Content.
6. Types of Personal Data
Customer Personal Data may include:
a. coded or pseudonymised Sample IDs;
b. assay measurements and laboratory data;
c. sample and protocol information;
d. uploaded files;
e. analysis settings and parameters;
f. calculated results and reports;
g. notes and associated metadata; and
h. other Personal Data submitted by the Customer.
7. Special Category Personal Data
Customer Content may include health, genetic or other Special Category Personal Data where assay information relates to an identified or identifiable individual.
8. Frequency
Processing occurs continuously or as initiated by Authorised Users during their use of the Services.
ANNEX 2
TECHNICAL AND ORGANISATIONAL MEASURES
MyAssays maintains measures appropriate to the nature and risk of the Processing. Measures may include the following, as applicable to the relevant systems and Services.
1. Access control
a. unique user Accounts;
b. role and permission controls;
c. restricted administrative access;
d. access based on business need;
e. procedures for removing obsolete access; and
f. protection of privileged credentials.
2. Authentication and credential security
a. password-protection requirements;
b. cryptographic protection of stored passwords;
c. secure password-reset processes;
d. session-management controls; and
e. controls intended to prevent unauthorised Account access.
3. Encryption
a. encryption of information in transit using appropriate transport security; and
b. encryption at rest where appropriate to the system and risk.
4. Infrastructure security
a. hosting through Microsoft Azure;
b. network and application security controls;
c. restricted production access;
d. separation of development and production activities where appropriate; and
e. physical and environmental safeguards provided by the hosting provider.
5. Logging and monitoring
a. security and access logging;
b. monitoring of relevant system events;
c. investigation of suspected misuse; and
d. retention of logs according to MyAssays’ retention arrangements.
6. Vulnerability and change management
a. software patching and updates;
b. vulnerability assessment and remediation;
c. controlled software changes;
d. review and testing before material deployment; and
e. correction of identified security defects according to risk.
7. Data minimisation
a. guidance requiring coded Sample IDs;
b. restrictions on direct identifiers;
c. collection limited to information reasonably necessary for the Services; and
d. controls intended to reduce unnecessary access to Customer Content.
8. Backup and recovery
a. regular backup procedures;
b. protected backup storage;
c. recovery procedures;
d. backup-retention controls; and
e. deletion through the normal backup-overwrite cycle.
9. Incident response
a. procedures for identifying and reporting suspected incidents;
b. assessment and investigation;
c. containment and remediation;
d. escalation and customer notification; and
e. documentation of Personal Data Breaches.
10. Personnel safeguards
a. confidentiality obligations;
b. privacy and security guidance or training;
c. access limited according to role; and
d. disciplinary or corrective measures for unauthorised access or use.
11. Supplier management
a. assessment of relevant service providers;
b. contractual confidentiality and data-protection requirements;
c. subprocessor controls; and
d. periodic review where appropriate.
12. Secure deletion
a. deletion from active systems according to retention arrangements;
b. restricted use of retained backup information; and
c. procedures intended to prevent ordinary operational use after deletion instructions.
ANNEX 3
APPROVED SUBPROCESSORS
The following providers are approved to Process Customer Personal Data where relevant to the Services.
|
Subprocessor
|
Services
|
Customer Personal Data potentially processed
|
|
Microsoft Azure
|
Cloud infrastructure, application hosting, data storage and backup
|
Customer Content, Account information, technical records, security logs and related service data
|
|
Twilio SendGrid
|
Transactional and service-related email delivery
|
Email addresses, message content, message identifiers, delivery status and bounce information; Customer Personal Data only where included in an authorised service or support communication
|
Stripe provides billing, payment and payment-fraud-prevention services in relation to MyAssays’ Controller activities. Stripe is not treated as a subprocessor of Customer Content unless it Processes Customer Personal Data on behalf of the Customer.
MyAssays will not permit an external AI provider to Process Customer Personal Data unless the provider is identified in this Annex or appointed in accordance with clause 10 of the Data Processing Schedule.