Terms of Service — Pocket and Scale

1. About these Terms

These Terms of Service (these "Terms") form a binding contract between AAR GEE PTY LTD (ABN 56 682 972 685) trading as Compliance Care ("Compliance Care", "we", "us", "our") and the entity or person who creates an account or uses the Service (the "Customer", "you", "your").

By creating an account, ticking the acceptance box, or otherwise accessing the Service, you confirm that you have read these Terms, the Privacy Policy (CC-LEGAL-PRIV-001), the Impartiality Statement (CC-LEGAL-IMP-001), and (where applicable to your tier) the Data Processing Addendum (CC-LEGAL-DPA-PC-001), and that you have authority to bind the Customer entity to them.

If you do not agree to these Terms, do not create an account or use the Service.

2. Incorporation of related artefacts

The following are incorporated into these Terms by reference and form part of the agreement between us:

• the Privacy Policy at compliancecare.com.au/privacy (CC-LEGAL-PRIV-001);
• the Impartiality Statement at compliancecare.com.au/trust (CC-LEGAL-IMP-001);
• the Data Processing Addendum (CC-LEGAL-DPA-PC-001), which applies to Customer Personal Information processed under these Terms;
• the AI Handling Memo summary at compliancecare.com.au/trust-center/ai, derived from CC-LEGAL-AI-001; and
• the sub-processor register at compliancecare.com.au/trust-center/sub-processors (CC-LEGAL-SUBP-001).

In the event of inconsistency between these Terms and a document incorporated by reference, these Terms prevail on commercial matters; the Privacy Policy and Data Processing Addendum prevail on privacy and data-handling matters; the Impartiality Statement prevails on impartiality and conflict-of-interest matters.

3. Definitions

• "Authorised User" means a named individual whom the Customer has authorised to use the Service under the Customer's account.
• "Customer Content" means information, documents, and materials that the Customer or its Authorised Users upload to or enter into the Service, including organisation information, worker records, participant records (to the extent permitted under these Terms), policies, procedures, registers, and incident records.
• "Customer Personal Information" has the meaning given in CC-LEGAL-DPA-PC-001.
• "Pocket" means the Pocket Progressive Web App, including its Pocket, Pocket+, and Pocket Pro tiers as described in Schedule 1.
• "Scale" means the Scale SaaS as described in Schedule 1.
• "Service" means Pocket and Scale, together with the related infrastructure and any feature, integration, or update from time to time.
• "Subscription" means the Customer's paid subscription to a Pocket or Scale tier.
• "Tier" means the Subscription tier the Customer has selected.

4. Eligibility

The Service is offered to NDIS providers (or organisations preparing to become NDIS providers) operating in Australia, and to their personnel acting in that capacity. By using the Service the Customer represents that:

• the Customer is an Australian entity carrying on business in connection with the National Disability Insurance Scheme, or is preparing to do so;
• each Authorised User is at least eighteen (18) years old;
• the Customer holds all licences and registrations required to carry on its business; and
• the Customer's use of the Service complies with these Terms and with applicable Australian law.

5. Account creation, access, and security

5.1 Self-serve account. Pocket and Pocket+ are fully self-serve. The Customer creates an account by providing an organisation name, ABN, and Authorised User email address, and verifying the email by magic link.

5.2 Authorised Users. The Customer is responsible for the actions of every Authorised User on its account. The Customer must:

(a) ensure each Authorised User keeps their login secure; (b) remove an Authorised User's access promptly on role change or departure; and (c) not permit the use of one Authorised User account by more than one person.

5.3 Multi-factor authentication. Multi-factor authentication is required for Pocket Pro and Scale, and recommended for all tiers.

5.4 Compliance with usage scope. Some tiers limit the number of Authorised Users, the number of records, or the number of participants supported. The Customer must not exceed the limits of its Tier.

6. Subscription, Trial, Fees, and Billing

6.1 Trial. A fourteen (14) day trial of Pocket+ is available without payment details on first sign-up. The trial converts to a paid Pocket+ Subscription if the Customer enters payment details before expiry; otherwise the account becomes read-only with a fourteen (14) day grace period before deletion.

6.2 Subscription tiers and fees. The Tier fees are set out in Schedule 1. All fees are in Australian dollars and exclusive of GST.

6.3 Billing cycle. Subscriptions are billed monthly in advance. Annual billing may be offered for Scale.

6.4 Renewal. Subscriptions renew automatically at the end of each billing period at the then-current fee for the Tier unless cancelled before the start of the next billing period.

6.5 Cancellation. The Customer may cancel a Subscription at any time, taking effect at the end of the current billing period. Cancelled Subscriptions are not refunded for unused time, except where required by the Australian Consumer Law (see clause 14.5).

6.6 Downgrade and upgrade. The Customer may change Tier at any time. Upgrades take effect immediately with a pro-rata fee for the remainder of the billing period. Downgrades take effect at the start of the next billing period.

6.7 Failed payments. If a payment fails, Compliance Care will attempt redelivery on a published retry cadence and may suspend access if payment is more than fourteen (14) days overdue. Suspension does not relieve the Customer of the obligation to pay accrued fees.

6.8 Taxes. Compliance Care is GST-registered. Fees are exclusive of GST; GST is added to invoices at the published rate.

7. Acceptable use

The Customer and its Authorised Users must not:

(a) use the Service to store, transmit, or process information that the Customer is not lawfully authorised to handle; (b) attempt to access, probe, or test the vulnerability of the Service except under a written security-research agreement with Compliance Care; (c) reverse engineer, decompile, or attempt to derive the source code of the Service except to the extent that right is non-excludable by law; (d) use the Service to infringe the rights of a third party (including intellectual property, privacy, or confidentiality rights); (e) use the Service in a manner that misrepresents the Customer's compliance status to a Quality Auditor, the NDIS Quality and Safeguards Commission, or any other regulator; (f) resell, rent, or sublicence access to the Service except as expressly permitted in writing; (g) use the Service to send unsolicited commercial communications; or (h) use the Service to upload malware, viruses, or other harmful code.

Compliance Care may suspend an Authorised User or the entire account on reasonable grounds where a breach of this clause is suspected, with notice given as soon as reasonably practicable.

8. Customer Content and intellectual property

8.1 Customer owns Customer Content. As between the Customer and Compliance Care, the Customer retains all intellectual property rights in Customer Content.

8.2 Licence to operate the Service. The Customer grants Compliance Care a non-exclusive, royalty-free, worldwide licence to host, process, transmit, display, and use Customer Content as necessary to provide the Service to the Customer.

8.3 Compliance Care IP. Compliance Care retains all intellectual property rights in the Service, the Compliance Care template library, the Document Discovery rules engine, the Methodology, and any improvement, derivative, or general learning developed in the course of providing the Service that does not contain the Customer's Confidential Information.

8.4 Licence to use Compliance Care Methodology in output. The Customer is granted a perpetual, non-exclusive, royalty-free, non-transferable licence to use the Compliance Care Methodology, in its instantiated form within the Customer's populated policies, procedures, registers, and other outputs produced from the Service, for the Customer's internal operations as an NDIS provider.

8.5 Aggregated and de-identified insights. Compliance Care may aggregate and de-identify data observed during the operation of the Service for the purposes of improving the Service and producing benchmark insights, provided that no Customer, participant, worker, or third party is identifiable from the resulting outputs and the aggregation is consistent with the Privacy Act 1988 (Cth).

9. Artificial intelligence

9.1 The Service uses generative AI tools (in particular models supplied by Anthropic) to assist in producing drafts, analyses, and suggestions. The full position is set out in the AI Handling Memo (CC-LEGAL-AI-001), summarised at compliancecare.com.au/trust-center/ai.

9.2 Customer acknowledgments: the Customer acknowledges that:

(a) AI-generated content is offered as a draft requiring expert human review; (b) responsibility for adopting any AI-generated material into the Customer's policies, procedures, registers, or representations to a Quality Auditor or the NDIS Commission rests with the Customer; (c) Compliance Care does not use Customer Personal Information to train or fine-tune AI models; and (d) cross-border processing of minimised, non-identifying content by the AI vendor is disclosed in the Privacy Policy (§7).

10. Privacy and data handling

10.1 Compliance Care's handling of Personal Information is governed by the Privacy Policy (CC-LEGAL-PRIV-001).

10.2 Where the Service processes Customer Personal Information on the Customer's behalf, the Data Processing Addendum (CC-LEGAL-DPA-PC-001) applies and forms part of these Terms.

10.3 All Customer Personal Information is stored at rest in Australian-resident infrastructure. Cross-border processing is described in the Privacy Policy §7 and CC-LEGAL-AI-001 §8.

10.4 Compliance Care will notify the Customer of an Eligible Data Breach affecting Customer Personal Information without undue delay and in any case within twenty-four (24) hours of becoming aware of it.

11. Impartiality

11.1 The Impartiality Statement (CC-LEGAL-IMP-001) applies to the Customer's use of the Service. On Subscription creation, the Customer is recorded on the permanent client-quarantine register (IMP-C1, Impartiality Statement §7).

11.2 Auditor Invite. Where the Customer uses the Auditor Invite feature (Pocket Pro and Scale tiers), the Customer selects its own Quality Auditor from the JAS-ANZ-accredited list. Compliance Care does not refer, rank, or recommend Quality Auditors (Impartiality Statement §3 clause 4 and §6).

12. Beta features

Compliance Care may make features available on a "beta" or "preview" basis. Beta features are provided as is, may change at any time, and may be withdrawn without notice. Beta features are not subject to any service-level commitment and are not subject to the security or data-handling commitments in these Terms to the extent expressly stated at the point of enrolment.

13. Availability and support

13.1 Target availability. Compliance Care will use commercially reasonable efforts to make the Service available 99.5% of the time on a monthly basis, excluding scheduled maintenance announced at least twenty-four (24) hours in advance and downtime caused by events outside Compliance Care's reasonable control.

13.2 Support. Support channels by Tier are set out in Schedule 1.

13.3 No service credits unless expressly stated. This clause 13 does not create a contractual service-level credit unless the Customer is on a Scale tier with a separately signed service-level agreement.

14. Warranties, disclaimers, and Australian Consumer Law

14.1 Compliance Care warrants that it will perform the Service with the degree of skill and care reasonably expected of a competent provider of services of the same kind.

14.2 To the maximum extent permitted by law, all other warranties, conditions, and representations (express, implied, statutory, or otherwise) are excluded.

14.3 The Customer acknowledges that:

(a) AI-generated content is a draft, not a finished compliance document; (b) Compliance Care does not warrant that the Service will produce a successful audit outcome or any specific regulatory result; (c) the Customer is responsible for the truthfulness, completeness, and currency of representations it makes to a Quality Auditor or to the NDIS Commission based in whole or in part on Service output; (d) the Service is not legal advice; and (e) the Service is not participant care and does not replace clinical or professional judgment.

14.4 Compliance Care does not warrant that the Service is error-free, that it will be available without interruption, or that it will meet a specific compliance requirement of any specific regulator.

14.5 Australian Consumer Law. Nothing in these Terms excludes, restricts, or modifies any guarantee, right, or remedy under the Australian Consumer Law that cannot be lawfully excluded, restricted, or modified. To the maximum extent permitted by law, where a guarantee under the Australian Consumer Law applies and the goods or services are not of a kind ordinarily acquired for personal, domestic, or household use, Compliance Care's liability for breach of that guarantee is limited, at Compliance Care's option, to:

(a) re-supplying the Service or the relevant part of it; or

(b) paying the cost of re-supplying the Service or the relevant part of it.

15. Liability

15.1 To the maximum extent permitted by law, Compliance Care's aggregate liability to the Customer in connection with these Terms (whether in contract, tort, statute, or otherwise) is limited to the greater of:

(a) the Fees paid by the Customer to Compliance Care under the affected Subscription in the twelve (12) months preceding the event giving rise to the claim; and

(b) AUD $10,000.

15.2 To the maximum extent permitted by law, neither Party is liable to the other for indirect, consequential, or special loss, or for loss of profits, revenue, goodwill, or business opportunity.

15.3 Clause 15.1 does not limit any liability that cannot lawfully be limited, including liability for personal injury or death caused by negligence, fraud, fraudulent misrepresentation, or any non-excludable Australian Consumer Law guarantee.

16. Indemnity

The Customer will indemnify Compliance Care against loss, cost, damage, or liability arising from a third-party claim caused by:

(a) the Customer's breach of clause 7 (Acceptable use); (b) the Customer's upload of Customer Content that infringes the rights of a third party; or (c) the Customer's use of Service output in a representation to a Quality Auditor, the NDIS Commission, or any other regulator that is untruthful, incomplete, or out of date through no fault of Compliance Care.

The indemnity does not apply to the extent the loss is caused by Compliance Care's breach of these Terms or its negligence.

17. Suspension and termination

17.1 Compliance Care may suspend or terminate the Customer's access for material breach of these Terms not cured within fourteen (14) days of notice, or immediately for a breach of clause 7 that creates a security, legal, or reputational risk that cannot reasonably be deferred.

17.2 The Customer may cancel under clause 6.5.

17.3 On termination:

(a) the Customer's right to access the Service ends;

(b) the Customer has thirty (30) days from termination to export Customer Content in a commonly-used format (CSV or PDF for registers; PDF for policies);

(c) after the thirty (30) day window, Customer Personal Information is deleted in accordance with CC-LEGAL-RET-001 and the Data Processing Addendum §10; and

(d) all accrued fees become due and payable.

17.4 Clauses 8, 10, 11.1, 14, 15, 16, 17.3, 19, and 20 survive termination.

18. Changes to these Terms

18.1 Compliance Care may update these Terms from time to time. Material changes are notified by:

(a) prominent notice in the Service for a period of not less than thirty (30) days; and

(b) email to each Authorised User who is the billing contact for an active Subscription.

18.2 Changes take effect at the end of the notice period. Continued use of the Service after that date is acceptance of the change. If the Customer does not accept a material change, the Customer may terminate the Subscription with effect from the change date and is entitled to a pro-rata refund of any prepaid fees for the post-change period.

18.3 Changes required by law take effect on the date the law requires.

19. Disputes

19.1 The Parties will attempt to resolve a dispute in good faith by direct discussion between authorised representatives within fifteen (15) business days of written notice of the dispute.

19.2 If the dispute is not resolved under clause 19.1, either Party may refer the dispute to mediation administered by the Resolution Institute. The Parties will bear the mediator's costs equally.

19.3 Nothing in this clause prevents a Party from seeking urgent interlocutory relief.

20. Governing law and jurisdiction

20.1 These Terms are governed by the laws of New South Wales, Australia, and the laws of the Commonwealth of Australia applicable in New South Wales.

20.2 Each Party submits to the non-exclusive jurisdiction of the courts of New South Wales.

21. General

21.1 Entire agreement. These Terms, together with the artefacts incorporated under clause 2 and any agreed order form, are the entire agreement between the Parties on their subject matter and supersede all prior arrangements.

21.2 Assignment. The Customer may not assign these Terms without Compliance Care's prior written consent. Compliance Care may assign these Terms to a successor of substantially the whole of its business on notice to the Customer.

21.3 Severability. If a clause is held invalid or unenforceable, it is severed and the rest of the Terms remain in force.

21.4 Notices. Notices to Compliance Care are given to contact@compliancecare.com.au. Notices to the Customer are given to the Authorised User who is the billing contact for the Subscription.

21.5 No partnership. Nothing in these Terms creates a partnership, joint venture, or agency relationship.

21.6 Force majeure. Neither Party is liable for delay or failure to perform caused by events outside its reasonable control, provided it takes reasonable steps to mitigate.

22. Contact

AAR GEE PTY LTD (ABN 56 682 972 685) trading as Compliance Care General contact: contact@compliancecare.com.au Privacy contact: privacy@compliancecare.com.au Trust Center: https://compliancecare.com.au/trust-center Impartiality Statement: https://compliancecare.com.au/trust

Schedule 1 — Tiers, fees, and features

Pricing is the public list price; promotional or partner pricing may apply on an order form. Tier pricing may change in accordance with clause 18.