Service Level Agreement

Effective 24 May 2026. Forms part of the Cogent Clinic Terms of Service.

This Service Level Agreement ("SLA") sets out the Provider's commitments on availability, planned maintenance, support response, breach notification timing, and the remedies available if those commitments are missed. It applies to the Cogent Clinic Class I medical device and is incorporated into the Terms of Service.

The targets in this SLA apply only to the registered Class I medical device. The out-of-scope features identified in clause 2.6 of the Terms of Service (neurodevelopmental assessment report drafting and the Cogent Witness expert-report product) are governed by their own arrangements and are not covered by this SLA.

1. Availability target

1.1 The Provider targets 99.5% monthly availability of the Service, measured as the percentage of minutes in the calendar month during which the Service responds to authenticated requests at the primary web endpoint (app.cogent.clinic) with a successful HTTP response.

1.2 The 99.5% target permits up to approximately 3 hours 40 minutes of unplanned downtime in a 30-day month. The Provider may operate the Service to a tighter internal target; this SLA states the minimum it commits to.

1.3 Availability is calculated by the Provider from its server-side monitoring records. Disputed measurements may be cross-checked against the public status page (where available) and against the Customer's own logs.

2. Planned maintenance

2.1 The Provider maintains the Service under a continuous-deployment model. Most releases are deployed without taking the Service offline.

2.2 Where a release does require downtime, the Provider's standard maintenance window is Sunday 02:00 to 06:00 UK time. Time spent in this window for planned maintenance is excluded from the availability calculation in clause 1.

2.3 The Provider will give at least 48 hours' notice of any planned maintenance expected to cause downtime, by email to the primary administrative contact on the Customer's account and by a banner in the Service.

2.4 The Provider may carry out unplanned emergency maintenance outside the standard window where a security, clinical-safety, or data-protection risk requires it. Emergency maintenance is treated as unplanned downtime for the purposes of clause 1 unless it is the only available remedy for an event listed in the exclusions at clause 5.

3. Support response targets

3.1 Support is provided by email to [email protected] during the Provider's standard support hours of Monday to Friday, 09:00 to 17:00 UK time, excluding UK public holidays.

3.2 The Provider operates the following response targets, measured from the time the Customer's report is received during support hours. Reports received outside support hours are treated as received at the start of the next support window.

Severity	Definition	First response target
S1, Critical	Service is unavailable to all users of the Customer, or a confirmed personal-data breach is in progress	Within 2 support hours
S2, High	A core feature (drafting, transcription, client folder access, sign-in) is unavailable to multiple users, with no reasonable workaround	Within 4 support hours
S3, Standard	A non-core feature is degraded, or a single user is affected, or a workaround is available	Within 1 support business day
S4, Low	Question, documentation issue, cosmetic defect, feature request	Within 3 support business days

3.3 "First response" means an acknowledgement from a person at the Provider that the report has been received, an initial classification of severity, and an indication of next steps. It is not a commitment to fix within the same window.

3.4 The Provider classifies severity in good faith based on the symptoms described. Customers who believe a report has been classified too low may escalate to [email protected] with reasons.

4. Vigilance and clinical-safety reporting

4.1 Events that affect, or could have affected, the safety of patient care or the confidentiality of patient data are handled under clause 18 of the Terms of Service, not under the support targets in clause 3.

4.2 Such events should be reported as set out in clause 18 of the Terms. The Provider's commitment is to acknowledge within 2 hours of receipt during support hours, triage, investigate, and, where the event meets MHRA thresholds, report it to the MHRA in accordance with the manufacturer's vigilance obligations under UK MDR 2002.

4.3 Personal-data breach notification to the Customer follows the Data Processing Agreement at clause 11. The Provider's commitment, stated here for clarity, is to notify the Customer of a confirmed Personal Data Breach affecting Customer personal data without undue delay, and in any event no later than 72 hours after becoming aware of it, with the information set out in clause 11.2 of the DPA. The Provider will issue an initial notification with the information available and follow up as further details become known.

5. Exclusions

The following are excluded from the availability calculation in clause 1:

• planned maintenance carried out within the window in clause 2.2 or after the notice in clause 2.3;
• downtime caused by the Customer's own infrastructure, devices, browser, network, or configuration;
• downtime caused by the Customer's failure to use the Service in accordance with the Terms or the published Instructions for Use;
• downtime caused by a Force Majeure event as described in clause 13A of the Terms of Service;
• downtime caused by an attack on the Service, where the Provider has taken reasonable measures consistent with its security commitments;
• downtime in an upstream sub-processor (AWS, AssemblyAI, Stripe, Anthropic via Bedrock, transactional email) where the Provider has taken reasonable mitigation, although the Provider will publish updates on the status page;
• downtime caused by the Customer's instructions to suspend access;
• short outages of less than 5 consecutive minutes;
• the Service degradations described as known limitations in the in-product Instructions for Use.

6. Remedies

6.1 If, in any calendar month, monthly availability falls below 99.5% for reasons not within the exclusions in clause 5, the Customer is entitled, on request, to a service credit equal to 10% of the monthly subscription fee for that calendar month for each 1 percentage point shortfall, capped at 50% of the monthly subscription fee for that month.

6.2 Service credits are the Customer's sole and exclusive remedy for missed availability targets under this SLA. Service credits do not limit the Customer's other remedies under the Terms of Service or the DPA, including the liability provisions at clause 13 of the Terms.

6.3 To claim a service credit, the Customer must request it by email to [email protected] within 30 days of the end of the calendar month in question, stating the period of downtime and the basis of the claim. Credits are applied to the next renewal invoice. Where the Customer has terminated the Service, the Provider will pay the credit by bank transfer within 30 days of acknowledging the claim.

6.4 The Provider may choose to pay a credit by refund rather than by application to the next invoice, where this is operationally simpler for both parties.

7. Status, history, and reporting

7.1 The Provider intends to publish a public status page reporting current Service availability, current incidents, and the rolling 90-day availability record. Until that page is live, current availability and incident reports are available on request from [email protected].

7.2 On request, the Provider will provide the Customer with a written record of monthly availability for the preceding 12 months. There is no charge for this report.

8. Continuous improvement

8.1 The Provider reviews this SLA at least annually as part of its quality-management cycle. Material changes are notified in accordance with clause 15 of the Terms of Service.

8.2 The Provider may tighten the targets in this SLA at any time without further notice. Loosening the targets, or introducing new exclusions, will be communicated in advance.