Remedy for Firms terms

Part 1: Terms of service

These terms are between Kelmoss Ltd, a company registered in England and Wales (company number 15629688, registered office 124 City Road, London, EC1V 2NX, ICO registration ZB775702), trading as Remedy ("Remedy", "we", "us"), and the business that opens a practice workspace (the "Firm", "you"). They apply to firms acting in the course of business. They do not apply to members using Remedy for themselves, who are covered by the member terms at remedy.tax/terms.

1. Definitions

• Workspace: the Firm's practice account in Remedy, with its team, clients, settings and records.
• Member: an individual with a Remedy account, usually the Firm's client.
• Seat: one accepted team member of the Workspace. An invitation that is pending and unexpired also takes a Seat until it is accepted, declined or expires.
• Client: a Member with an active consent to the Workspace, or a pending, unexpired client invitation to someone who is not already connected.
• Tier: the subscription plan in clause 4.
• Contract Year: each period of 12 months from the day the Firm first accepts these terms.
• Member Data, Shared Data, Firm Records: as defined in the Data Sharing Agreement (Part 2) and the Data Processing Agreement (Part 3).
• Data Sharing Agreement and Data Processing Agreement: Parts 2 and 3 of these terms, which form part of the agreement.

2. The agreement

2.1 These terms, the Data Sharing Agreement, the Data Processing Agreement and any order form or pilot letter that Remedy and the Firm sign together form the agreement. If they conflict: the data protection agreements win on data protection; a signed order form or pilot letter wins on price and duration; otherwise these terms win.

2.2 The person accepting these terms confirms they have authority to bind the Firm. Remedy records which version of these terms was accepted, when, and by whom.

3. The service

3.1 Remedy gives the Firm a Workspace to work on its clients' public-service pension tax positions: consent links, a client list and readiness, evidence chasing, workflow and deadlines, the client's checked position and pack, working papers (including a Scheme Pays working paper and a Self Assessment figures CSV), draft AI answers over a checked pack, branded packs, audit export, an API and signed webhooks.

3.2 What the service does not include. Remedy does not file anything with HMRC, does not submit Scheme Pays elections or any scheme form, does not integrate with the Firm's tax or practice management software except through the CSV export, API and webhooks, and does not provide a custom domain or branded email sender in the current version.

3.3 Remedy may change the service. It will not remove a material feature the Firm is paying for without at least 30 days' notice; if the change is materially to the Firm's detriment the Firm may end the agreement and receive a pro rata refund of prepaid fees.

4. Tiers, fees and trial

4.1 Tiers. Prices include VAT at 20%.

Members register and connect free, and a Member does not use a Seat. While the Firm's subscription is in good standing (clause 4.6), the specialist checks of Members connected to the Workspace are covered by the Firm's subscription, and those Members are not charged for them.

4.2 Client cap. New client invitations pause when the Workspace reaches its Tier's client cap. From 1 January to 30 April (UK time), the Self Assessment season, the cap is soft: the Firm may go up to 20% over it, rounded down, with a warning and an offer to move up a Tier. Clients already connected are never disconnected because of the cap.

4.3 Trial. A Firm that has not subscribed before may start one free trial of 14 days, or longer if Remedy offers it in writing. A card is required at checkout; nothing is charged until the trial ends; cancelling from the billing portal before then costs nothing. After the trial the subscription renews at the chosen Tier's price.

4.4 Discounts. Remedy may give a Firm a promotion code, entered on the payment page. A discount applies only as its terms say (amount and duration), each invoice shows the list price and the discount, and a discount does not change the list price. When a discount ends, the subscription continues at the list price then in force.

4.5 Billing. Fees are billed in advance, monthly or yearly, through Stripe, and renew automatically until cancelled. VAT invoices are issued through Stripe. The Firm keeps its name, address and VAT number up to date in the billing portal so its invoices are correct.

4.6 Failed payments. If a payment fails, Stripe tells the Firm by email and retries the payment for at least 14 days. The Workspace keeps working meanwhile, and the Firm's clients keep their cover; the subscription is then in good standing. If the payment has still not been made when the retries end, the subscription ends and Remedy may suspend the Workspace under clause 13.

4.7 Changing Tier or billing period. The Firm changes Tier, or moves between monthly and yearly billing, in the billing portal. A move to a higher Tier takes effect at once, and the difference for the rest of the current billing period is charged then. A move to a lower Tier, or between monthly and yearly billing, takes effect at the end of the period already paid for. A change during the trial keeps the trial. Remedy does not disconnect clients or remove team members because of a Tier change; if the Workspace is over the new Tier's limits, new invitations pause until it is within them.

4.8 Cancellation. The Firm may cancel at any time from the billing portal. Cancellation takes effect at the end of the current billing period, monthly or yearly; fees already paid are not refunded except as these terms say.

4.9 Price changes. Remedy gives at least 60 days' notice of a price increase, which applies from the next renewal after the notice ends. A Firm that does not accept the new price may cancel before it applies.

4.10 Legacy plans. Workspaces on per-seat billing before the Tiers keep their existing price until they move to a Tier.

5. Reliance and the advice boundary

5.1 Remedy is not the Firm's adviser and not a regulated adviser. Remedy is not authorised by the Financial Conduct Authority, does not give personal recommendations on pension or investment merits, and does not give tax advice to the Firm or its clients. Remedy's outputs are information and working papers: figures, sources, dates and options presented neutrally.

5.2 The Firm exercises its own professional judgement. The Firm is solely responsible for the advice it gives, the returns it prepares and files, any Scheme Pays election it helps a client make, and any personal recommendation it makes. As the papers themselves say, the figures are for the Firm to sense-check; Remedy's accuracy check is separate; the Firm signs off in its own file, and Remedy does not record that it did. Marking a year reviewed or filed in the Workspace is the Firm's own note. The papers are not a filing, a Scheme Pays election or a personal recommendation. Remedy does not file at HMRC.

5.3 Checked and unchecked figures. A year a Remedy specialist has checked is marked as checked. A year not yet checked is a live working, labelled as such, for the Firm to verify against source documents. Suitability-evidence and cashflow outputs are inform-only and are not a recommendation; an FCA-authorised adviser prepares any recommendation in their own file.

5.4 AI drafts. AI answers are drafts over a client's checked pack, for the Firm's file. They are not advice, not a personal recommendation and not figures to file from.

5.5 The Firm's own obligations stay with the Firm, including engagement letters, anti-money-laundering customer due diligence and records under the Money Laundering Regulations 2017, professional body rules (for example ICAEW, ACCA, CIOT), FCA rules where it is authorised, and its own professional indemnity insurance, which the Firm must maintain as its regulator requires. Remedy's insurance does not cover the Firm's advice or filings.

6. The Firm's responsibilities

The Firm will:

• (a) give each person their own login, keep credentials, API keys and webhook secrets secure, and remove leavers promptly;
• (b) consider switching on "require two-factor authentication" for its Workspace, which Remedy strongly recommends;
• (c) invite only clients it has a genuine professional relationship with, and tell them it uses Remedy;
• (d) comply with the Data Sharing Agreement and its own data protection obligations;
• (e) check the figures it relies on against source documents, as clause 5 describes.

7. Acceptable use

The Firm must not: use the service unlawfully or to harm a Member; try to access a Member's data without that Member's consent; share logins; probe, scan or test the service's security without written permission; overload the service or scrape it other than through the API within its limits; reverse engineer it except as the law allows; resell it or build a competing product from it; upload malware; or use Remedy's outputs to mislead HMRC, a scheme or a client.

8. Intellectual property

8.1 Remedy owns the service, its software, methodology, calculations and templates. The Firm has a non-exclusive, non-transferable right to use the service for its own professional work during the agreement.

8.2 The Firm owns its Firm Records and its branding, and licenses Remedy to use them only to provide the service.

8.3 Papers generated for a client may be kept, copied and given to that client, HMRC or the Firm's regulator and insurers without restriction.

9. Confidentiality

Each party keeps the other's confidential information confidential, uses it only for the agreement, and discloses it only to its staff and advisers who need it and are bound by confidence, or as the law or a regulator requires. This lasts for five years after the agreement ends, and indefinitely for personal data and trade secrets.

10. Data protection

10.1 Remedy is an independent controller of each Member's account; the Firm is an independent controller of its client relationship; the Data Sharing Agreement governs what passes between them.

10.2 Remedy is the Firm's processor for Firm Records under the Data Processing Agreement.

10.3 When a Member deletes their Remedy account, Remedy erases the data it holds for the Member as controller, keeps the Firm Records for the Firm under the Firm's instructions and retention, and tells the Firm.

11. Liability

11.1 Nothing in the agreement limits or excludes liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, or for anything else that cannot lawfully be limited or excluded. Nothing in this clause limits the Firm's obligation to pay the fees.

11.2 Neither party is liable for loss of profits, revenue, business, goodwill or anticipated savings, or for indirect or consequential loss.

11.3 Remedy is not liable for any loss arising from the Firm's advice, returns, filings, elections or recommendations, or from the Firm relying on a figure it did not check against source documents, or on an output labelled unchecked, provisional, draft or inform-only.

11.4 General cap. Subject to clauses 11.1 and 11.5, each party's total liability arising out of or in connection with the agreement in each Contract Year is limited to the greater of: (a) the fees paid and payable by the Firm in the 12 months before the event giving rise to the claim; and (b) £100,000.

11.5 Data protection and confidentiality cap. Subject to clause 11.1, each party's total liability for breach of clause 9, the Data Sharing Agreement or the Data Processing Agreement in each Contract Year is limited to the greater of: (a) twice the fees paid and payable by the Firm in the 12 months before the event giving rise to the claim; and (b) £250,000. This cap is separate from, and in addition to, the cap in clause 11.4.

11.6 The parties agree these limits are reasonable, having regard to the fees, the nature of the service, the allocation of responsibility in clause 5 and the insurance available to each party.

12. Service levels

12.1 Remedy aims for the service to be available at all times but does not promise uninterrupted availability, and there is no uptime commitment or service credit in this version.

12.2 Remedy gives at least 48 hours' notice of planned maintenance that affects availability where it can, and schedules it outside 9am to 5pm UK time where it can.

12.3 Support is by email at support@remedy.tax, 9am to 5pm UK time, Monday to Friday, excluding English bank holidays. Remedy aims to reply within one working day.

12.4 Remedy backs up its database nightly and can restore it to a point in time; it tests restores every quarter.

13. Suspension

Remedy may suspend access, after notice where practical: if a payment is still unpaid when Stripe's retries end, at least 14 days after the Firm was first told it had failed (clause 4.6); if the Firm breaches clause 7; or where needed to protect Members, the service or other firms from a security threat. Remedy restores access once the cause is resolved.

14. Term and termination

14.1 The agreement starts when the Firm accepts these terms (or starts a trial) and continues until ended.

14.2 Either party may end it for convenience by cancelling or giving notice, effective at the end of the current billing period.

14.3 Either party may end it at once by notice if the other materially breaches it and does not remedy the breach within 30 days of notice, or becomes insolvent.

14.4 On termination: the Firm's access ends; every active client consent is revoked in the same transaction and each client is told by email; Members keep their own accounts; the Firm may export its records for 30 days; Firm Records are then deleted as the Data Processing Agreement says. Clauses 5, 8.3, 9, 10, 11 and 16 survive.

15. Changes to these terms

Remedy may update these terms with at least 30 days' notice by email. Each version is dated on this page, and the Firm accepts a new version in the Workspace. If a change is materially to the Firm's detriment, the Firm may end the agreement before it takes effect and receive a pro rata refund of prepaid fees.

16. General

• Notices by email: to Remedy at support@remedy.tax; to the Firm at the owner's email on the Workspace.
• Assignment: neither party may assign without the other's consent, except Remedy on a sale of its business, with notice.
• Force majeure: neither party is liable for delay caused by events beyond its reasonable control.
• Entire agreement: the agreement is the whole agreement on its subject; each party waives remedies for pre-contract statements not in it, except for fraud.
• Third parties: no one else may enforce it under the Contracts (Rights of Third Parties) Act 1999.
• Governing law and jurisdiction: the law of England and Wales; the courts of England and Wales have exclusive jurisdiction.

Part 2: Data sharing agreement

This agreement is between Kelmoss Ltd, a company registered in England and Wales (company number 15629688, registered office 124 City Road, London, EC1V 2NX), registered with the ICO under ZB775702, trading as Remedy at remedy.tax ("Remedy", "we"), and the Firm that accepts the Remedy for Firms terms. Each is a "party".

It forms part of, and is read with, the terms of service (Part 1) and the Data Processing Agreement (Part 3). The Firm accepts it electronically when it accepts the Remedy for Firms terms; Remedy's record of that acceptance takes the place of signatures. If the parts conflict on the sharing of Member Data, this agreement wins.

1. Definitions

• Member: an individual who holds a Remedy account (a member of a UK public-service pension scheme, or someone acting for them).
• Member Data: personal data in a Member's Remedy account, for which Remedy is controller: documents the Member uploads or collects from a pension or payroll portal, the figures Remedy reads from them, corrections to those figures (whoever makes them), the Member's annual allowance and McCloud remedy position, action plan and specialist-checked pack, and the papers Remedy generates from them (for example the client pack PDF, Scheme Pays working paper, Self Assessment figures CSV).
• Consent (in the product's sense): the permission a Member grants in their Remedy account for the Firm to see their account, covering their documents, their financial position, or both, revocable at any time. It is an instruction from the Member, not necessarily the lawful basis either party relies on (see clause 4).
• Shared Data: the Member Data that Remedy makes available to the Firm under a Member's Consent, within its scope.
• Firm Records: records the Firm creates inside Remedy: client notes and their revisions, workflow and stage status, assignments, tax-year review and filing records, chase history, the Firm's AI chat about a client, and papers or notes authored by the Firm's staff. Remedy processes Firm Records as the Firm's processor under the Data Processing Agreement, not under this agreement.
• Data Protection Legislation: the UK GDPR, the Data Protection Act 2018 (both as amended, including by the Data (Use and Access) Act 2025), the Privacy and Electronic Communications Regulations 2003, and any guidance or code the ICO issues under them.

2. Purpose of the sharing

2.1 The sharing lets a Member's accountant or financial adviser work on the Member's public-service pension tax position from the Member's own records, so that the Firm can:

• (a) review the Member's annual allowance and McCloud remedy position, carry-forward and Scheme Pays options;
• (b) prepare, review and file the Member's Self Assessment return from the Firm's own software;
• (c) where the Firm is FCA-authorised, prepare any personal recommendation in its own file; and
• (d) keep the evidence behind its work for its professional and legal obligations.

2.2 Permitted purposes. The Firm uses Shared Data only for the purposes in 2.1, for the Member it relates to, and for its own legal and regulatory obligations (including anti-money-laundering, HMRC enquiry and professional indemnity records). The Firm will not use Shared Data for direct marketing to the Member without a separate lawful basis and, where PECR requires, the Member's consent; to profile the Member for any unrelated purpose; or to sell or disclose it to anyone other than the Firm's own staff, professional advisers, insurers, regulators or HMRC as its professional duties require.

2.3 Remedy's use. Remedy continues to process Member Data under its own privacy policy (remedy.tax/privacy). Remedy does not use Firm Records for its own purposes (see the Data Processing Agreement). Corrections the Firm makes to a Member's figures are part of the Member's record and are Member Data; Remedy may use them as described in the privacy policy's "Improving how we read documents and calculate" section, where the Firm is recorded only as "accountant", never by name.

3. Roles

3.1 Remedy and the Firm are each an independent controller of the personal data they process. They are not joint controllers: each decides its own purposes and means. Remedy decides what it collects and reads for the Member; the Firm decides how it advises and what it files.

3.2 Remedy is the Firm's processor only for Firm Records, under the Data Processing Agreement.

3.3 Each party is responsible for its own compliance with Data Protection Legislation, including its own record of processing, its own privacy notice, its own ICO fee and its own security.

3.4 Contacts. Remedy: data protection lead, a director of the company, at support@remedy.tax. The Firm: the owner of its Workspace, at the owner's email on the Workspace, unless the Firm tells Remedy of another contact.

4. Lawful basis

4.1 Remedy discloses Shared Data to the Firm under UK GDPR Article 6(1)(b), performance of Remedy's contract with the Member, who asks Remedy to give their adviser access, and, for Members on the free tier, Article 6(1)(f), the legitimate interests of the Member and Remedy in the Member getting professional help with their position. The Member can end the sharing at any time by revoking Consent in their account.

4.2 The Firm relies on its own lawful basis for what it does with Shared Data, typically Article 6(1)(b) (its engagement with the client), Article 6(1)(c) (legal obligations, including the Money Laundering Regulations 2017 and record keeping for HMRC) and Article 6(1)(f). The Firm records its basis in its own records.

4.3 Special category data. Remedy does not seek special category data, but some documents carry it: a payslip can show trade union subscriptions, sick pay, occupational health or maternity pay lines; a pension statement or scheme letter can show ill-health retirement or an injury allowance; a remedy statement can show a period of sickness absence. Sickness and injury records, and ill-health retirement, are health data; trade union membership is special category data in its own right. Where Shared Data contains such lines, each party identifies and records its own Article 9 condition and, where Schedule 1 to the Data Protection Act 2018 requires one, keeps an appropriate policy document. Both parties minimise: neither extracts or records health or union information beyond what the pension tax calculation needs.

5. Data shared

The Firm sees only what the Member's current Consent allows. Remedy shows the Firm nothing for a Member who has not granted Consent or has revoked it, and every access by the Firm's staff is written to Remedy's audit log.

Data flowing the other way. The Firm may upload a document to a Member's account or correct a figure; that document or correction becomes Member Data held by Remedy as controller. The Firm must tell the Member it does this (its engagement letter or privacy notice is enough).

6. Transparency

6.1 Remedy's privacy policy tells Members that the Firm is a separate controller, what it can see, that Remedy is the Firm's processor for Firm Records, and what happens to Firm Records if the Member deletes their account (section "If you work with an accountant or financial adviser").

6.2 The Firm gives its clients its own privacy notice covering its use of Shared Data, including that it uses Remedy, and keeps it available on request. The Firm tells a Member before inviting them that Remedy will hold the Member's account as a separate controller.

7. Accuracy

7.1 Figures Remedy reads from documents carry a source and a confidence, and some years are marked provisional until a Remedy specialist checks the pack. The Firm treats unchecked or provisional figures as working figures to sense-check and exercises its own professional judgement before relying on them.

7.2 Where the Firm finds a figure wrong, it corrects it in Remedy (so the Member's record is right for everyone) or tells Remedy at support@remedy.tax.

8. Security

8.1 Remedy applies the measures in Annex 2 of the Data Processing Agreement to Member Data as well as Firm Records.

8.2 The Firm keeps its Remedy accounts secure: each person has their own login; Remedy strongly recommends that the Firm switches on "require two-factor authentication for every colleague" in its security settings; the Firm removes leavers promptly, restricts staff to assigned clients where appropriate, protects any API key or webhook secret, and secures Shared Data once downloaded to its own systems, where it is solely responsible for it.

9. Retention and deletion

9.1 Member Data in Remedy is kept and deleted under Remedy's privacy policy: while the Member's account is active; erased when the Member deletes their account, within 30 days, and from encrypted backups as they expire (90 days).

9.2 Shared Data the Firm has downloaded (papers, CSVs, API or webhook data) is the Firm's, kept under the Firm's own retention policy.

9.3 Firm Records are kept under the Data Processing Agreement. When a Member deletes their Remedy account, Remedy erases the Member Data it holds as controller, keeps the Firm Records for the Firm under the Firm's instructions and retention period, and notifies the Firm that the Member has deleted their account.

9.4 When a Member revokes Consent, the Firm stops seeing Member Data from that moment. Firm Records already made remain the Firm's.

10. Individuals' rights

10.1 Each party handles requests about the data it controls. Remedy handles requests about Member Data (Members can export it from Settings → Privacy at any time). The Firm handles requests about its own records, including Firm Records held in Remedy, which Remedy helps it answer under the Data Processing Agreement.

10.2 A party that receives a request about data the other controls passes it to the other within 5 working days and tells the individual it has done so. Neither party answers for the other.

10.3 An objection to Remedy's improvement use of corrections (Article 21) is made to Remedy; it covers corrections the Firm made to that Member's figures.

10.4 Complaints: each party handles complaints about its own processing under its own complaints procedure (Data Protection Act 2018, section 164A, in force from 19 June 2026) and tells the other of any complaint that concerns the sharing.

11. Personal data breaches

11.1 Each party is responsible for notifying the ICO and affected individuals of a breach of data it controls (Articles 33 and 34).

11.2 A party that becomes aware of a breach affecting the sharing, or data the other party controls, tells the other party's contact without undue delay and in any event within 48 hours, with what is known, and keeps it updated. The parties cooperate so the controller can notify the ICO within 72 hours of becoming aware.

12. International transfers

12.1 Remedy uses processors outside the United Kingdom, listed with their locations and transfer mechanisms in Annex 3 of the Data Processing Agreement and in the privacy policy. Transfers to the United States are made under the UK Extension to the EU-US Data Privacy Framework ("UK-US data bridge", Data Protection (Adequacy) (United States of America) Regulations 2023, in force 12 October 2023) or the UK International Data Transfer Addendum to the EU standard contractual clauses, as applicable to each provider.

12.2 The Firm does not transfer Shared Data outside the UK except in compliance with Chapter V of the UK GDPR.

13. Review

The parties review this agreement at least once a year, and after any significant complaint, breach or change to the data shared or to Remedy's processors.

14. Liability

Each party is liable for its own breach of Data Protection Legislation and of this agreement, subject to the limits in clause 11 of the terms of service (Part 1), including the separate data protection and confidentiality cap in clause 11.5.

15. Term and termination

15.1 This agreement starts when the Firm accepts the Remedy for Firms terms and lasts while the Firm has a Remedy Workspace.

15.2 When the Firm's Workspace is closed, every active Consent is revoked in the same transaction and each Member is told by email. The Firm Records are deleted after the return period under the Data Processing Agreement, clauses 8.2 and 8.3. Clauses 9, 10, 11 and 14 survive for as long as either party holds Shared Data.

16. Governing law

This agreement is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.

Part 3: Data processing agreement

Scope in one sentence. Remedy is an independent controller of each Member's account (see the Data Sharing Agreement, Part 2); this agreement covers only the records the Firm creates inside Remedy about its own work, for which Remedy is the Firm's processor under Article 28 of the UK GDPR.

This agreement is between the Firm that accepts the Remedy for Firms terms (the controller) and Kelmoss Ltd (company number 15629688, England and Wales; registered office 124 City Road, London, EC1V 2NX; ICO registration ZB775702), trading as Remedy (the processor). It forms part of the terms of service (Part 1). The Firm accepts it electronically when it accepts the Remedy for Firms terms; Remedy's record of that acceptance takes the place of signatures. If the parts conflict on the processing of Firm Records, this agreement wins.

1. Definitions

• Firm Records: personal data in records the Firm creates in Remedy about its clients and its own work, namely:
  • client notes and their revision history;
  • workflow status, stage, assignment and workflow notes;
  • tax-year review and filing records, including who reviewed or filed, when, and the review note;
  • chase settings and the record of chases, deadline alerts and practice digests sent;
  • the Firm's AI chat about a client and the draft answers;
  • papers and notes authored by the Firm's staff, and the Firm's own record printed on a pack ("Your practice's own record");
  • the Firm's team: names, emails, roles, memberships and invitations of the Firm's staff, and the Firm's client invitations;
  • webhook endpoints and delivery logs, API key details, and the Firm's branding and settings.
• Member Data, Shared Data, Member, Consent: as defined in the Data Sharing Agreement. Member Data is not Firm Records, even where a Firm Record quotes it.
• Sub-processor: a third party Remedy engages to process Firm Records.
• Data Protection Legislation: as defined in the Data Sharing Agreement.

2. Processing on documented instructions (Art. 28(3)(a))

2.1 Remedy processes Firm Records only on the Firm's documented instructions, including with regard to transfers outside the UK, unless UK law requires otherwise, in which case Remedy tells the Firm before processing unless that law forbids it.

2.2 The Firm's instructions are: this agreement; the terms of service; the Firm's use and configuration of the Remedy service (for example its access, security, notification, chase, webhook and API settings); and any further written instruction (email is enough) that Remedy accepts. Remedy tells the Firm promptly if, in its opinion, an instruction infringes Data Protection Legislation.

2.3 Remedy does not use Firm Records for its own purposes. In particular it does not use them to improve its reading or calculations, to train or evaluate models, or for marketing. Aggregate counts that identify no individual (for example the number of clients a Firm has, for the Tier's client cap and billing) are Remedy's own business data.

3. Confidentiality (Art. 28(3)(b))

Remedy ensures that everyone it authorises to process Firm Records is under a duty of confidence (by contract or statute) and has access only as far as their role needs. Remedy staff access a Firm's Workspace only to provide support the Firm asks for, to investigate a security incident, or as the law requires, and such access is recorded in the audit log.

4. Security (Art. 28(3)(c), Art. 32)

Remedy implements the technical and organisational measures in Annex 2, and will not reduce the overall level of protection during the term. Remedy may update the measures as the service changes and keeps Annex 2 current.

5. Sub-processors (Art. 28(2), 28(3)(d), 28(4))

5.1 The Firm gives Remedy general written authorisation to engage the sub-processors in Annex 3.

5.2 Remedy gives the Firm at least 30 days' notice by email of any intended addition or replacement, so the Firm can object on reasonable data protection grounds. If the parties cannot resolve an objection, the Firm may terminate the affected service without penalty and receive a pro rata refund of prepaid fees.

5.3 Remedy imposes on each sub-processor, by contract, data protection obligations that give an equivalent level of protection to this agreement, in particular sufficient guarantees of appropriate security. Remedy remains fully liable to the Firm for each sub-processor's performance.

5.4 AI providers. Only the AI providers listed in Annex 3 receive client content. Adding one is a sub-processor change under clause 5.2.

6. Data subjects' rights (Art. 28(3)(e))

Taking into account the nature of the processing, Remedy assists the Firm by appropriate technical and organisational measures in answering requests from individuals about Firm Records: the Firm can read, correct and export its records in the service (papers zip, audit CSV, Self Assessment figures CSV, the practice API). Where the Firm needs more, Remedy provides it within 10 working days of a written request. Remedy passes to the Firm, without undue delay, any request it receives about Firm Records and does not answer it itself except on the Firm's instruction.

7. Assistance with the Firm's obligations (Art. 28(3)(f))

Taking into account the nature of the processing and the information available to it, Remedy assists the Firm with its obligations under Articles 32 to 36: security, personal data breach notification, data protection impact assessments and prior consultation. Remedy shares its own data protection impact assessment with the Firm on request.

Breach notification. Remedy notifies the Firm of a personal data breach affecting Firm Records without undue delay after becoming aware of it and in any event within 48 hours, at the Firm's notified contact, with: the nature of the breach, the categories and approximate numbers of individuals and records, the likely consequences, the measures taken or proposed, and a contact. Where information is not available at once, Remedy provides it in phases. Remedy does not notify the ICO or individuals about Firm Records on the Firm's behalf unless the Firm asks it to.

8. End of processing (Art. 28(3)(g))

8.1 At the end of the provision of services, at the Firm's choice, Remedy deletes or returns all Firm Records, and deletes existing copies, unless UK law requires Remedy to keep them.

8.2 Return. For 30 days after the Firm's Workspace is closed or the agreement ends, the Firm may export its records as described in clause 6 or ask Remedy for a structured export.

8.3 Deletion. After that period Remedy deletes Firm Records from the live database within 60 days, and from encrypted backups as they expire (90 days). Remedy keeps the organisation's audit log entries for six years for the establishment, exercise or defence of legal claims, and the Firm instructs Remedy to do so.

8.4 When a Member deletes their Remedy account. Remedy erases the Member Data it holds as controller. Firm Records about that Member are not erased: Remedy keeps them for the Firm, under the Firm's instructions and retention period, and notifies the Firm, by email to its owners and admins (and the colleague the Member was assigned to) and in the Workspace, that the Member has deleted their account. The Firm's access to the Member's account (documents, position, pack) ends, because that is Member Data. The Firm may instruct Remedy to delete the Firm Records about that Member at any time ("Delete now" on the former client's page), and sets its retention period in its Workspace settings, between 1 and 10 years. Unless the Firm sets one, Remedy keeps them for six years from the end of the last tax year the Firm recorded a review or filing for that client (or from the day the account closed, if it recorded none), matching the audit log and HMRC's ordinary enquiry and discovery windows, and in any case for at least 30 days after the account closed so the Firm can export them; then Remedy deletes them.

9. Audits and information (Art. 28(3)(h))

Remedy makes available to the Firm all information necessary to demonstrate compliance with Article 28, and allows for and contributes to audits, including inspections, by the Firm or an auditor it mandates, on at least 30 days' notice, during working hours, no more than once a year unless a breach or a regulator requires it, at the Firm's cost, and subject to confidentiality. Remedy may first answer by written questionnaire and by sharing this agreement's annexes, its data protection impact assessment and relevant parts of its operations documentation.

10. International transfers

Remedy transfers Firm Records outside the UK only to the sub-processors in Annex 3 and only under a mechanism that Chapter V of the UK GDPR permits: UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework for US organisations that participate in it), or the ICO's International Data Transfer Agreement or International Data Transfer Addendum to the EU standard contractual clauses, with a transfer risk assessment where required.

11. Liability

Liability under this agreement is subject to the limits in clause 11 of the terms of service (Part 1), including the separate data protection and confidentiality cap in clause 11.5.

12. Term and governing law

This agreement lasts as long as Remedy processes Firm Records. It is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.

Annex 1: Details of the processing

Annex 2: Technical and organisational measures

Encryption

• TLS between browsers and the site and APIs; TLS required to the database in production.
• Encryption at rest provided by the hosting, object storage and database providers. Remedy does not run a separate end-to-end encryption layer for file contents.
• Nightly database backups, encrypted under a key held apart from the storage they are kept in, retained for 90 days; a backup is never uploaded unencrypted; restores are tested every quarter. Point-in-time restore from the managed database provider.
• Secrets at rest: two-factor secrets and HMRC tokens are encrypted, with key rotation; API keys and recovery codes are stored only as hashes; webhook deliveries are signed with HMAC-SHA256.

Authentication

• Passwords hashed with bcrypt; sessions are signed tokens in httpOnly cookies, with a version so a password reset or "sign out everywhere" ends every session.
• Two-factor authentication by authenticator app, with replay protection, lockout after five wrong codes (doubling to 15 minutes) and single-use recovery codes.
• A practice owner or admin can require two-factor authentication of every colleague before any practice page answers them.

Access control

• The Firm sees a Member only under an active Consent, limited to the documents, the financial position, or both, as the Member chose; revocation takes effect at once.
• Roles within the Firm (owner, admin, member). An owner or admin can restrict staff to assigned clients and set consent reviews every 6, 12 or 24 months.
• Row-level security policies in the database on member and practice tables; separate database roles for the web application, the background worker and erasure, so the request path cannot purge the audit trail.
• API keys are practice-scoped, stored as hashes, optionally expiring, and cannot invite clients or change settings.
• Rate limiting on authentication and other sensitive endpoints.

Audit and monitoring

• The audit log is append-only, enforced in the database, and kept six years. Firm staff access to a client, exports and consent events are logged, with time and IP address. The Firm can export its audit log as CSV.
• Case events are append-only in the same way.
• Error monitoring with Sentry (EU region), with personal data and local variables switched off; notifications about reading reviews carry no member data by design.
• Scheduled-job heartbeats alert when backups or retention tasks stop running.

AI processing

• Every model call goes through one router; only approved providers receive client content.
• Best-effort automated redaction of National Insurance and NHS numbers, labelled dates of birth, email addresses, UK mobile numbers and postcodes before text reaches an AI provider. It does not remove names, addresses or free-text health information, and salary figures are kept for document reading because the reader must extract them.
• Practice AI answers only over a client's specialist-checked pack, is labelled draft, and is audit-logged.

Resilience and deletion

• Emails and follow-on jobs go through a transactional outbox, so a failed provider retries rather than losing work.
• Member erasure deletes rows in one transaction on a dedicated database role, then deletes stored files and removes the Member from the payment and analytics providers. In the same transaction the Firm Records about the Member are kept for the Firm under a former-client record (clause 8.4).
• A daily task deletes Firm Records at the end of the Firm's retention period and after a closed Workspace's return period.

Organisational

• Staff with access to client data are Remedy's own team, bound by confidentiality; the data protection lead is a director.
• Staff do not paste client data into chats, tickets or AI assistants; excerpts used to review document reading are kept only in restricted working files for at most 30 days.
• Remedy does not currently hold a security certification or claim an independent penetration test. It will tell firms when that changes.

Annex 3: Sub-processors

Remedy's other processors that handle only Member Data, never Firm Records, are listed in the privacy policy.