The terms for using Cypher.

These terms are an agreement between Cypher (“Cypher”, “we”, “us”) and the organisation or person that signs up to use Cypher (“you”, the “Customer”). By creating an account or using Cypher, you agree to them. If you sign up for an organisation, you confirm you’re allowed to bind it.

Section 19 applies to patients and members of the public who use services that pharmacies, clinics or prescribers run on Cypher. Our privacy policy explains how we handle personal data. Contact us at hello@cypheros.uk.

• Customer: a pharmacy, clinic, group, independent prescriber or other healthcare organisation with a Cypher account.
• Users: the people a Customer allows to use its account, such as pharmacists, technicians, counter staff and managers.
• Patients: people who receive care or use the booking pages, forms, WhatsApp, phone line, kiosk or other patient-facing features a Customer runs on Cypher.
• Customer Data: information that a Customer, its Users or its Patients put into Cypher, including patient records.
• Modules: optional parts of Cypher (such as the WhatsApp Agent, Phone Agent, AI features, check-in kiosk or dispensing data) that are switched on separately.

• Cypher is for healthcare organisations and professionals in the UK. We may check your details, such as your pharmacy’s ODS code, before switching features on. A pharmacy’s public booking page goes live once we’ve approved it.
• Independent prescribers must hold current registration with the GMC, GPhC, NMC or another recognised regulator, and appropriate indemnity. We check registration before you can prescribe, and you must tell us straight away if your registration or indemnity changes.
• You decide who your Users are and what each can do. You’re responsible for what happens under your account, for removing access when someone leaves, and for making sure Users follow these terms.
• Keep sign-in details secret, don’t share accounts, and use two-factor authentication where you can. Tell us at once at hello@cypheros.uk if you think an account has been misused.

We provide Cypher as an online service. Some Modules need extra set-up or third-party accounts, such as a Stripe account for booking fees, a WhatsApp Business number, or a phone number for the Phone Agent, and some are switched on only by us.

We improve Cypher all the time. We may add, change or retire features, but we won’t remove a core part of the service you rely on without reasonable notice. Features we label as early access or preview are provided as they are, and may change or be withdrawn.

• You are responsible for the care you provide, every clinical decision, and the records you keep, including checking any information Cypher shows or suggests.
• You must hold valid, signed and in-date Patient Group Directions (PGDs) and other authorisations for the services you run, and only let authorised, trained people use them. Cypher’s PGD checks help; they don’t replace your PGDs.
• Where you provide NHS services such as Pharmacy First, you must follow the NHS service specification and clinical pathways. Pathway and travel health information in Cypher (including from TravelHealthPro) is there to help, and you must check it is current and right for each patient.
• You’re responsible for your own clinical risk management when you use Cypher (the NHS DCB0160 standard). We maintain our DCB0129 clinical safety case and will share information to help.
• You’re responsible for safeguarding, consent, capacity and confidentiality, and for telling a patient’s GP where that’s needed.

• AI features are optional and switched on by you. Their output can be wrong or incomplete. Treat it as a suggestion: a qualified person must review it before it’s used.
• The WhatsApp Agent and Phone Agent answer from the information you give Cypher, such as opening hours, prices and services. Keep it accurate and up to date.
• The Phone Agent tells every caller it’s an automated assistant. Its emergency message and handovers to your team don’t replace your own processes: check and act on callbacks and flagged conversations promptly.
• Don’t use AI features in a way that would mislead patients about who they are talking to.

• You decide who you contact and why. You must have a lawful basis for every message and call, and consent where the law needs it, including under the Privacy and Electronic Communications Regulations (PECR) for marketing.
• Only send marketing to patients who have agreed to it, and honour opt-outs. Cypher records STOP and START replies on WhatsApp.
• When you use WhatsApp, text messages or phone numbers through Cypher, you must also follow the rules of those services, such as WhatsApp’s Business and Commerce Policies.
• Don’t use Cypher to send spam, or messages that are misleading, offensive or unlawful.

Prescribers

• You are responsible for every prescription you issue, and for prescribing within your competence and the law, including the Human Medicines Regulations 2012 and the Misuse of Drugs Regulations 2001, and your regulator’s standards.
• Cypher’s allergy, interaction and dose warnings support you but aren’t a complete check. Only you can sign a prescription, and you must keep your signing access secure.

Dispensing pharmacies

• Before dispensing a Cypher prescription, you must make your usual professional checks, including that the prescription is valid and appropriate and that the patient is who they say they are.
• Don’t dispense a prescription Cypher marks as invalid, and record each supply accurately.

• Where you use Cypher alongside NHS systems (for example the optional prescription tracker, which works inside your own NHS smartcard session), you must follow the terms of those systems and your smartcard, and only look up patients you have a legitimate reason to.
• Dispensing data features use NHS open data and documents you upload, such as your FP34 statements. Check figures against your official statements before relying on them.

Paying for Cypher

• You pay the fees for your plan and the Modules you use, as agreed with us when you sign up or set out in your order. Fees are exclusive of VAT, which we add where it applies.
• We bill by card or Direct Debit through our payment providers. Pay invoices by the date shown. If a payment is overdue, we’ll remind you, and may suspend the service after giving you notice.
• We’ll give you at least 30 days’ notice of any change to your fees. If you don’t agree, you can end the agreement before the change takes effect.

Booking fees from patients

• If you take booking fees, patients pay them through Stripe on your own Stripe account. You are the seller, and Stripe’s terms apply between you and Stripe.
• You set your own fees and cancellation policy, and you’re responsible for refunds, receipts and any tax. Cypher refunds a booking fee automatically when a patient cancels before your cancellation cut-off.
• Any platform fee we charge on booking fees will be agreed with you in advance.

You and your Users must not:

• break the law, or use Cypher for anything harmful, fraudulent or misleading
• look at or use patient information without a legitimate reason
• try to get around security, test our systems for weaknesses without our written permission, or access other customers’ data
• copy, reverse-engineer, resell or build a competing product from Cypher
• upload malicious code, or overload or scrape the service
• share accounts or let anyone use Cypher who isn’t allowed to

• You own your Customer Data. You give us permission to use it only to provide, secure and support Cypher for you, and as the law requires.
• We may use information about how Cypher is used, in a form that doesn’t identify patients, to run and improve the service.
• We own Cypher, its software, designs and content. We give you the right to use it under these terms while your agreement lasts.
• If you send us ideas or feedback, we can use them freely.

For patient information and other Customer Data, you are the controller and we are your processor. The data processing terms in the schedule below form part of these terms. Where we are the controller, for example for your account and our billing, our privacy policy applies.

You’re responsible for having a lawful basis for the data you put into Cypher, and for giving patients the privacy information they need, including that you use Cypher.

Each of us will keep the other’s confidential information confidential, use it only for this agreement, and share it only with people who need it and are bound to keep it confidential. This doesn’t apply to information that is public, already known, independently developed, or that the law requires to be disclosed.

• We protect Cypher and Customer Data with appropriate technical and organisational measures, described in our privacy policy and on our compliance page.
• We aim to keep Cypher available at all times, but we can’t promise it will never be interrupted. We try to schedule maintenance for quieter times and fix problems quickly.
• Keep your own processes for when systems are unavailable, as you would for any clinical system.
• For help, email hello@cypheros.uk.

Cypher connects to services run by others, such as Stripe, WhatsApp, phone networks, email providers and NHS systems. Their own terms apply, and we’re not responsible for their availability or for changes they make. If a provider changes or withdraws a service, we’ll do our best to keep the affected feature working or tell you.

• You can end the agreement at any time by emailing us. It ends at the end of your current billing period, unless your order says otherwise.
• We can end the agreement by giving you 30 days’ notice, or straight away if you seriously break these terms, don’t pay after notice, or become insolvent.
• We may suspend access straight away if we need to protect patients, data or the service, for example if an account is misused, a prescriber’s registration lapses, or the law requires it. We’ll tell you why and restore access as soon as we can.
• When the agreement ends, you can ask us for a copy of your Customer Data in a common format for 30 days. We then delete it, except what the law requires us to keep. Deleted data leaves our backups as they expire.

• We’ll provide Cypher with reasonable skill and care. Apart from that, and as far as the law allows, Cypher is provided without other warranties, and we don’t promise it will meet every need or be free of errors.
• Nothing in these terms limits liability for death or personal injury caused by negligence, for fraud, or for anything else the law doesn’t allow to be limited.
• Neither of us is liable for indirect or consequential loss, or for loss of profit, revenue, goodwill or anticipated savings.
• We aren’t liable for clinical decisions, prescriptions, supplies or messages made or sent by you or your Users, or for information you put into Cypher.
• Otherwise, our total liability to you in any 12 months is limited to the fees you paid us in the 12 months before the event that caused the claim.
• You’ll compensate us for claims by others arising from your breach of the law or of these terms, including messages you send and clinical care you provide.

If you use a booking page, form, WhatsApp, phone line, kiosk or prescription that runs on Cypher:

• Your care is provided by the pharmacy, clinic or prescriber you deal with, not by Cypher. Questions about your care, a booking or a refund are for them.
• Cypher is not for emergencies. If you need urgent help, call 999 or NHS 111.
• Please give accurate information, and only book or fill in forms for yourself or for people who have agreed or whom you care for.
• Booking fees are paid to the pharmacy or clinic, and their cancellation policy applies.
• Some replies come from automated assistants. You can ask for a person at any time.
• Your rights as a consumer aren’t affected by these terms.

We may update these terms. We’ll give Customers at least 30 days’ notice of important changes by email, unless a change is needed sooner for legal, safety or security reasons. If you keep using Cypher after a change takes effect, the new terms apply; if you don’t agree, you can end the agreement before then.

• Neither of us is liable for delays caused by events outside our reasonable control.
• You may not transfer this agreement without our agreement. We may transfer it to a business that takes over Cypher, and will tell you.
• These terms, any order and the schedule are the whole agreement between us about Cypher. If a part is found unenforceable, the rest still applies. Not enforcing a right straight away doesn’t mean giving it up.
• Nobody else has rights under this agreement under the Contracts (Rights of Third Parties) Act 1999.
• We’ll send notices to the email address on your account. Send notices to us at hello@cypheros.uk.
• These terms are governed by the law of England and Wales, and the courts of England and Wales deal with disputes. If you are a consumer in Scotland or Northern Ireland, you can also use your local courts.

These terms apply where we process personal data for a Customer, and meet the requirements of Article 28 of the UK GDPR.

What we process

• Subject and purpose: providing Cypher to the Customer, as described in these terms.
• Duration: while the agreement lasts, and until the data is returned or deleted afterwards.
• People: patients and their family members or carers, the Customer’s staff, prescribers, and others the Customer records.
• Types of data: identity and contact details, NHS numbers, appointments, forms, consultation and prescription records, health information, vitals, messages, call transcripts, payment references, and staff records such as clock-in times and locations.

Our commitments

• We process the data only on the Customer’s documented instructions (these terms and how the Customer configures and uses Cypher), unless the law requires otherwise, in which case we’ll tell the Customer unless the law prevents it.
• Everyone who processes the data for us is bound to keep it confidential.
• We keep appropriate technical and organisational security measures in place.
• The Customer authorises the sub-processors listed in our privacy policy. We’ll give notice before adding or replacing one, and the Customer may object on reasonable grounds. We put equivalent data protection terms in place with each sub-processor and remain responsible for them.
• We only transfer data outside the UK with safeguards that UK law accepts.
• We help the Customer respond to people exercising their data protection rights, and with security, breach notifications, data protection impact assessments and consultations with the ICO.
• We tell the Customer without undue delay after becoming aware of a personal data breach affecting their data, with the information they need.
• When the agreement ends, we return or delete the data as section 17 sets out.
• We give the Customer the information it reasonably needs to show compliance with these terms, and allow reasonable audits with notice, at a time that doesn’t risk other customers’ data.