Terms & Conditions

About these Terms

These Terms & Conditions (Terms) govern access to and use of SSapp by clinics, clinicians, and authorised staff. By using SSapp you agree to these Terms; if you do not agree, do not use the Service.

These Terms work alongside our Privacy Policy and any clinic-specific agreements. If there is a conflict, a signed written agreement prevails to the extent of inconsistency.

Compliance and jurisdiction

SSapp is designed to support compliance with New Zealand’s Privacy Act 2020 and Health Information Privacy Code 2020. For Australian users, SSapp also aligns with the Australian Privacy Act 1988, the Australian Privacy Principles (APPs), and the Notifiable Data Breaches scheme.

To the extent SSapp carries on business in Australia, the Privacy Act 1988 and APPs apply. Nothing in these Terms limits non‑excludable rights under the Australian Consumer Law (ACL) for Australian users.

Roles and allocation of responsibilities

The clinic remains the health agency/data controller and directs processing. SSapp and its subprocessors act as data processors providing note generation, referral drafting, and clinical Q&A functionality.

The clinic warrants it has lawful basis, provides required notices/consents, reviews outputs for accuracy, omits unnecessary identifiers in prompts, and files final records in the PMS/EHR.

How SSapp processes information

SSapp processes clinical inputs ephemerally to generate draft outputs. Inputs are handled in memory during processing; bodies of clinical payloads are not stored in databases or application logs.

Chat to Me maintains a short rolling context within a session for relevance and is wiped on exit. SSapp does not record audio and provides no audio capture features.

Processor commitments

SSapp processes information only on the clinic’s instructions for the purposes of documentation and referral. We apply encryption in transit and at rest, access controls, and environment isolation proportionate to health data sensitivity.

We assist clinics with access/correction requests routed via the clinic, and with privacy assessments or breach evaluations where reasonably required.

Cross‑border disclosures and subprocessors

SSapp uses reputable subprocessors; cross‑border transfers rely on recognised safeguards (for example, DPF/SCCs/CBPR or equivalent). Current subprocessors are:

• Cloudflare (edge, security, CDN)
• Railway (application hosting)
• Supabase (authentication, customer account and subscription data)
• OpenAI (inference with model training disabled on SSapp API keys)
• Chroma Cloud (vector store of audiology knowledge only; no patient embeddings)
• Stripe (payments; SSapp does not store card details)

The clinic acknowledges overseas processing may occur to deliver SSapp. We may update subprocessors; material changes will be communicated in‑app or on our website.

Security, storage, and deletion

We take reasonable steps to protect information from misuse, interference, loss, and unauthorised access or disclosure. Operational logs are minimised and avoid logging payload bodies that could contain health information.

SSapp is not a system of record. Drafts exist only during sessions unless exported by the clinician to the PMS/EHR. On termination, transient data is deleted in accordance with our ephemeral design.

Data breach assessment and notifications

If we become aware of a suspected incident involving personal information, we will promptly assess and aim to complete assessment within 30 days. We will notify the clinic without undue delay and cooperate on containment and remediation.

Where SSapp is the APP entity responsible under Australia’s Part IIIC, we will prepare the required statement and notify the OAIC and affected individuals; otherwise the clinic is the default notifier and SSapp will assist.

Direct marketing, anonymity, and identifiers

SSapp does not use personal information for direct marketing and does not use analytics or marketing cookies in the clinical app. Authenticated clinical accounts mean anonymity or pseudonymity is generally not practicable.

SSapp does not adopt government identifiers (for example, NHI or Medicare numbers). If included by a clinic in an input or template, they are used only for documentation or referral purposes and not repurposed.

User responsibilities and acceptable use

Users must protect credentials, comply with law and clinic policy, and not attempt to access, probe, or disrupt the Service. Users must avoid entering unnecessary direct identifiers and must review AI‑generated content before use.

Prohibited conduct includes reverse engineering, automated scraping, circumvention of rate limits, and introducing malicious code. We may suspend access for security or abuse concerns.

Subscription Terms

Your subscription is billed in advance and renews automatically at the end of each billing cycle. You can cancel your subscription at any time through Manage Subscription or by contacting support: support@shockinglysimple.app.

Billing

• Subscriptions renew automatically unless cancelled before the renewal date.
• All prices are GST‑inclusive.
• Payments are processed securely by Stripe. We do not store or handle your credit card details.
• If a payment fails, we may pause access until the issue is resolved.

Changes to pricing or terms

If pricing or subscription terms change, we will notify you in advance. Continued use after the effective date constitutes acceptance of the updated pricing or terms.

Termination

You may cancel at any time; access ends effective immediately. We may suspend or terminate for material breach, abuse, or security risk.

SSapp is not a system of record; on exit, transient data is deleted according to our ephemeral design. The clinic is responsible for retaining clinical records in the PMS/EHR.

Intellectual property and outputs

SSapp, its software, models, and interfaces are owned by SSapp or its licensors. No rights are granted except the limited right to use the Service under these Terms.

Subject to third‑party rights, the clinic owns its finalised outputs; you grant SSapp a limited licence to process inputs and generate outputs solely to provide the Service.

Disclaimers

SSapp is a clinical documentation and information tool; it does not provide medical advice or diagnosis. Clinicians must verify all outputs and exercise independent judgment.

To the maximum extent permitted by law, the Service is provided “as‑is” and “as‑available.” Nothing in these Terms limits non‑excludable consumer guarantees under the ACL.

Limitation of liability

To the maximum extent permitted by law, SSapp’s aggregate liability for all claims arising out of or relating to the Service is capped at the total fees paid by the clinic in the 12 months preceding the event giving rise to the claim. SSapp is not liable for indirect, consequential, special, punitive, or loss of profits, revenue, goodwill, or data.

The cap and exclusions do not apply to liability that cannot be excluded by law, or to liability arising from SSapp’s wilful misconduct or fraud. Claims under the ACL remain available to Australian users where applicable.

Governing law and venue

These Terms are governed by the laws of New Zealand and subject to the exclusive jurisdiction of New Zealand courts. For Australian users, nothing prevents you from bringing a claim in Australia where required by the ACL or other non‑excludable law.

This dual‑venue wording does not expand any rights beyond those required by applicable law and does not waive any applicable immunities or jurisdictional objections.

Changes to these Terms and effective date

We may update these Terms to reflect changes in law, processors, or technical safeguards. Material changes will be notified in‑app or by email with reasonable notice.

Effective date: 2 April 2026.

Contact

For questions about these Terms, privacy, or security, contact your clinic’s privacy officer first. To contact SSapp, email support@shockinglysimple.app.