Our work may also be described in a quote, proposal, Statement of Work, Change Request, Service Plan, email or other written communication.

If there is any inconsistency, the following order applies:

1. a signed agreement or contract;

2. a signed Statement of Work or Variation Agreement;

3. an accepted quote, proposal or Change Request;

4. these Terms.

A signed agreement with your organisation always takes precedence over these Terms.

We will provide our services with reasonable skill, care and professionalism.

Successful delivery also depends on your involvement. You agree to provide the information, instructions, decisions, approvals, access and appropriately authorised people we reasonably need to carry out the work.

We will both communicate openly, raise concerns promptly and work in good faith to resolve issues practically.

The agreed scope is the work described in our quote, proposal, Statement of Work, Change Request, email or other written confirmation.

Anything not included in that description is outside scope.

Where you request additional or changed work, we will discuss the likely cost and delivery impact before proceeding. The work may be covered by an approved Change Request, your Service Plan, an agreed allowance, or charged at our current hourly rates.

Any estimate or delivery date is based on the information and assumptions available at the time.

We will make reasonable efforts to meet agreed timeframes, but dates may change where:

• information, access, feedback or approvals are delayed;

• requirements or priorities change;

• we identify previously unknown technical or operational complexity;

• third-party systems or services affect the work; or

• circumstances arise that are reasonably outside our control.

We will let you know when we become aware of a material effect on timing or cost.

Spiral provides software, database services, technical services and implementation support for clinical trials and medical research.

The sponsor, investigators and study team remain responsible for:

• the design, governance and conduct of the study;

• participant safety and clinical decisions;

• compliance with the protocol and applicable ethical, legal and regulatory requirements;

• obtaining and maintaining necessary approvals;

• confirming that the database reflects the approved protocol and study requirements;

• User Acceptance Testing and approval for production use;

• monitoring, source data verification and review of study data;

• statistical analysis and interpretation of results; and

• the accuracy, completeness and lawful collection of information entered into the database.

Unless we expressly agree otherwise in writing, Spiral does not provide medical, clinical, regulatory, legal or statistical advice.

Unless we agree otherwise in writing:

• time-based work is charged at our current hourly rates;

• recurring services are invoiced in advance;

• other work may be invoiced as it is completed or at agreed milestones;

• reasonable third-party costs and approved expenses may be charged to you; and

• invoices are payable within 14 days.

Fees exclude GST and any other applicable taxes unless stated otherwise.

If an invoice is overdue, we may pause non-critical work or services after giving you reasonable notice. This may affect previously discussed delivery dates.

You remain responsible for fees for work already completed and costs already committed.

We will work from the requirements, specifications, wireframes, data descriptions and other materials agreed for the work.

You are responsible for reviewing deliverables and carrying out appropriate User Acceptance Testing using realistic study and operational scenarios.

Unless we agree otherwise, work will be considered accepted when the first of the following occurs:

• you confirm acceptance;

• you approve it for production use;

• you begin using it in production; or

• ten business days pass after delivery without a material issue being reported.

Acceptance does not remove your right to report a genuine defect.

A defect is a failure of the delivered work to conform materially to the agreed and documented requirements.

We will correct genuine defects within the agreed scope without charging additional development fees.

A new requirement, changed interpretation, new workflow, protocol amendment, third-party change, unexpected data pattern or behaviour arising through real-world use is not necessarily a defect. We will assess the issue with you and let you know whether it is a defect, support activity or additional work.

We do not guarantee that software will always be uninterrupted or completely free from defects.

You retain ownership of the study, participant and operational data you provide or store using our services.

You are responsible for ensuring that:

• you have authority to collect, use and provide the data;

• appropriate participant information, consent and approvals are in place;

• users are authorised to access the data; and

• you tell us about any particular data handling, location, retention or security requirements before the work begins.

We will access and use your data only as reasonably required to provide, secure, maintain and support the services, or as required by law.

On reasonable request, and subject to payment of outstanding amounts, we will assist you to obtain an export of your data in an available and reasonably usable format.

Each party will protect the other party’s confidential information and use it only for the purpose for which it was provided.

We will take reasonable technical and organisational measures to protect information held within systems we manage. The specific controls, hosting arrangements, backups, retention periods and service levels are those included in the agreed scope or Service Plan.

You are responsible for managing your users, promptly advising us when access should change, protecting login credentials and notifying us promptly of any suspected privacy or security incident affecting the services.

Neither party is required to keep information confidential where it:

• is already lawfully public;

• was lawfully known without a duty of confidence;

• is independently developed; or

• must be disclosed by law.

Each party retains ownership of the intellectual property it owned or developed independently of the engagement.

Spiral retains ownership of its:

• software platforms and source code;

• reusable components, libraries and frameworks;

• development tools, templates and methodologies;

• database structures and technical approaches;

• general knowledge, skills and experience; and

• improvements that are not unique to your confidential information or study.

Once all related invoices have been paid, you may use the project-specific deliverables we provide for the purposes for which they were created.

Unless expressly agreed otherwise, this gives you a licence to use those deliverables and does not transfer ownership of Spiral’s underlying software or intellectual property.

You give us permission to use materials and information you provide solely as required to perform the services. You confirm that doing so will not infringe another person’s rights.

Our services may rely on third-party hosting, software, integrations, communication services or other suppliers.

Third-party products may be subject to their own terms, availability, pricing and technical limitations. We are not responsible for an interruption, change or failure caused by a third-party service that is outside our reasonable control, but we will provide reasonable assistance in investigating and managing its effect.

We warrant that we will perform our services with reasonable skill and care.

Except for this commitment and any express written warranty, we do not promise that:

• the services will meet requirements that were not communicated and agreed;

• software will be continuously available or entirely free from defects;

• third-party products or services will always remain available or unchanged; or

• use of the services will, by itself, satisfy your legal, ethical, regulatory or validation obligations.

Where a problem arises, both parties will cooperate in good faith to identify its cause and agree on an appropriate response.

Nothing in these Terms limits liability that cannot lawfully be limited or excluded.

Subject to that:

• neither party is liable to the other for indirect or consequential loss, or for loss of profit, revenue, opportunity or anticipated savings; and

• Spiral’s total liability arising from the relevant services is limited to the fees paid or payable to Spiral for those services during the 12 months before the event giving rise to the claim.

The liability limit does not apply to fraud or deliberate misconduct.

Each party will take reasonable steps to reduce or avoid loss when an issue occurs.

Neither party is responsible for delay or failure caused by circumstances reasonably outside its control, including natural disasters, widespread internet or cloud-service failures, cyberattacks not caused by that party’s failure to take reasonable care, industrial action, epidemics, government action or failures of essential utilities.

The affected party will notify the other as soon as reasonably practicable and take reasonable steps to reduce the effect.

Either party may end an engagement by giving reasonable written notice, unless a different notice period has been agreed.

Either party may end it immediately if the other party:

• materially breaches the agreement and does not remedy the breach within a reasonable period after receiving written notice;

• becomes insolvent or ceases trading; or

• engages in unlawful conduct connected with the services.

We may suspend affected services where reasonably necessary to protect security, data, people or systems, or where undisputed invoices remain materially overdue. Where practicable, we will give notice and work with you to minimise disruption.

When the engagement ends:

• you will pay for work completed and costs reasonably committed up to the end date;

• each party will return or securely dispose of the other party’s confidential information where reasonably requested, subject to legal, backup and record-retention requirements; and

• provisions intended to continue, including confidentiality, intellectual property, payment and liability provisions, will remain in effect.

If either party has a concern, it will raise it promptly with an appropriate representative of the other party.

We will first try to resolve the issue through good-faith discussion. If that is unsuccessful, either party may request a meeting between senior representatives before beginning formal proceedings.

This does not prevent either party from seeking urgent legal relief where necessary.

Neither party may transfer its rights or obligations under the engagement without the other party’s reasonable written consent, except as part of a genuine sale or restructuring of its business.

A delay in enforcing a right does not mean that right has been waived.

If part of these Terms is found to be invalid or unenforceable, the remaining terms will continue to apply.

Changes to the agreed scope, fees or these Terms will be recorded in writing. Email is sufficient unless the parties agree that a formal signed document is required.

These Terms are governed by the laws of New Zealand.