CUSTOMER PORTAL TERMS OF USE

Issue 1, August 2026

 

1.   Definitions and scope

1.1 “Authorised User” means an individual who is authorised by the Customer and approved or enabled by Express Medicals to access and use the Portal on the Customer’s behalf.

1.2 “Customer” means the organisation to which we provide Portal access.

1.3 “Data Subject” means an identified or identifiable living individual to whom personal data processed through the Portal relates, including an employee, worker, applicant, contractor or other individual receiving occupational health services.

1.4 “Customer Data” means all information supplied, entered, uploaded, generated, stored or processed through the Portal by or for Express Medicals Plc, the Customer, an Authorised User or a relevant Data Subject, including personal data, Occupational Health Information and audit records.

1.5 “Express Medicals” means Express Medicals Plc, “EM”, “we”, “us” or “our”.

1.6 “Health Data” means personal data concerning a person’s physical or mental health, including clinical or medical information and information revealing health status.

1.7 “Occupational Health Information” means occupational health outcomes, fitness for work results, drug & alcohol or blood test results, recommendations, restrictions, appointment and related service information.

1.8 “Portal” means the Customer-facing portal and associated functionality, service bookings, documents, notifications, data and reports made available by Express Medicals Plc.

1.9 “Security Incident” means an actual or suspected unauthorised access, disclosure, loss, misuse, compromise, corruption, alteration, destruction or unavailability affecting the Portal, users or information processed through it.

1.10 “Service Agreement” means any separate written agreement under which we provide services to the Customer.

1.11 These Terms govern the Customer’s and each Authorised User’s access to and use of the Portal. They supplement our Standard Terms of Business, any Service Agreement and applicable privacy or data processing documents. Portal access is a limited, non-exclusive, non-transferable and revocable permission; not a transfer of ownership.

2.   Acceptance and permitted use

2.1 By accessing, registering for or using the Portal, the Customer and each Authorised User agree to these Terms. 

2.2 The Portal may be used only for lawful business purposes connected with services supplied by EM, including bookings and access to Occupational Health Information. Access must be limited to Authorised Users with a genuine need to know. The Customer must not use the Portal or information obtained through it for any unlawful, unfair, discriminatory, excessive, unauthorised or unrelated purpose.

2.3 The Portal is intended for use in the United Kingdom. The Customer is responsible for ensuring that any overseas access on their behalf is lawful and does not create an unauthorised transfer, disclosure or security risk.

3.   Customer accounts and security

3.1 The Customer is responsible for:

  • Authorising users and maintaining accurate information and contact details;

  • Promptly removing or disabling former, redundant or inappropriate users;

  • Protecting its devices, networks and credentials and applying multi-factor authentication;

  • Ensuring Authorised Users keep login credentials secure and use appropriately protected devices; and

  • Complying with applicable law and our reasonable security instructions.

3.2 The Customer is responsible for activity within its Portal account/s, systems or devices except to the extent caused by our breach, negligence, fraud or wilful misconduct.

3.3 The Customer shall notify us without undue delay of suspected unauthorised access, compromised credentials, data loss, misuse or a Security Incident and provide reasonable cooperation.

3.4 We may review permissions or suspend, restrict or disable access where reasonably necessary to address a breach, suspected misuse, security risk or legal requirement.

4.   Availability and changes

4.1 Access may be affected by maintenance, upgrades, security work, system or telecommunications failures, third-party service disruption or events beyond our reasonable control.

4.2 We will use reasonable efforts to give advance notice of planned maintenance or material changes. Urgent security, legal or emergency work may be carried out without prior notice.

5.   Occupational health information

5.1 The Portal is a booking and delivery mechanism for Occupational Health Information. The Customer is responsible for promptly reviewing information, limiting access, communicating it appropriately and making its own lawful employment, deployment, safety, HR and management decisions.

5.2 The Portal is not an emergency, urgent-care, or clinical decision-support mechanism.

6.   Acceptable use

6.1 The Customer and its Authorised Users shall not:

  • Access or disclose information without a genuine business need;

  • Impersonate another person, or circumvent security controls;

  • Introduce harmful code, disrupt, overload, scrape, probe or test the Portal without written consent;

  • Upload unlawful, inaccurate, excessive, misleading or unauthorised information;

  • Copy, modify, reverse engineer, decompile, disassemble, replicate or use the Portal to develop a competing solution, except where law prevents that restriction; or

  • Use the Portal in any way that is unlawful or creates a security risk.

6.2 We may monitor and retain logs of Portal use for security, audit, compliance, support, service improvement and misuse prevention, subject to applicable law and privacy documentation.

7.   Ownership and data

7.1 The Customer or relevant Data Subject retains any rights it has in the Customer Data, subject to EM’s legal and professional record-keeping obligations.

7.2 The Customer is responsible for the accuracy, completeness and lawfulness of Customer Data supplied by it.

7.3 We may process Customer Data only as reasonably required to provide, secure and support the Portal and our services, maintain lawful clinical, professional and business records, investigate misuse, comply with law and exercise our contractual rights. 

7.4 Feedback about the Portal may be used by EM without restriction, provided we do not disclose the Customer’s confidential information except as permitted by law or agreement.

8.   Data protection

8.1 Each party must comply with applicable UK data protection law. The Portal may process identity, booking, user, audit and Occupational Health Information, including Health Data.

8.2 The parties’ roles depend on the processing activity. EM normally acts as an independent controller for clinical and occupational health records and for data processed to deliver, secure and evidence its services.

8.3 The Customer normally acts as controller for information it provides, referral and booking decisions, management of Authorised Users and its use of results. 

8.4 The Portal is hosted on a third-party platform which processes the Customer Data on our behalf.

8.5 Our standard privacy notice, any data processing agreement and the Service Agreement provide further detail and take precedence for data protection matters.

8.6 The Customer must limit access to people with a lawful need and cooperate reasonably with data protection enquiries, complaints, requests, investigations and Security Incidents relating to its users, systems, instructions or use of the Portal.

9.   Warranty and liability

9.1 The Portal is provided on an “as available” basis. We do not guarantee uninterrupted or errorfree operation, compatibility with every Customer system or suitability for a purpose not expressly agreed. This does not limit any obligations applying to occupational health services under a separate agreement.

9.2 Unless otherwise expressly provided in a separate written agreement between EM and the Customer, and subject to any liability that cannot lawfully be excluded, we are not liable for indirect or consequential loss, loss of profit, revenue, contracts, goodwill or management time.

9.3 We are not liable for loss caused by the Customer’s misuse, inaccurate information, failure to manage accounts, failure to review or act appropriately on information, or systems under the Customer’s control, except to the extent caused by our breach, negligence, fraud or wilful misconduct.

9.4 Our total liability connected with the Portal is subject to the liability cap and risk allocation in our Standard Terms of Business or, where applicable, the separate written agreement between EM and the Customer. These Terms do not create a separate or additional cap.

9.5 Nothing excludes liability for death or personal injury caused by negligence, fraud, fraudulent misrepresentation or any liability that cannot lawfully be excluded.

10.   Customer indemnity

10.1 The Customer shall indemnify EM against reasonable third-party claims, losses and reasonable legal and professional costs, but only to the extent caused by its breach, unlawful instructions or data, misuse, negligent account administration or breach of confidentiality or data protection obligations.

11.   Suspension, termination and data export

11.1 We may suspend, restrict or terminate access to the Portal where these Terms are breached, security concerns arise, continued access poses a risk, suspension is required by law, or the relevant Service Agreement ends.

11.2 Before access ends, or within any period stated in our Standard Terms or Service Agreement, the Customer may request a reasonable export of Customer Data in a structured, commonly used and machine-readable format where technically available and legally permitted.

11.3 We may retain clinical, professional, audit, security and other records where required or permitted by law.

11.4 Accrued rights and provisions intended by their nature to survive termination remain effective.

12.   Changes to these Terms

12.1 We may update these Terms for legal, regulatory, security, operational, technical or service reasons.

12.2 Updated Terms may be published through the Portal, our website or otherwise communicated. We will use reasonable efforts to notify Customers of material changes.

12.3 Continued use after the effective date constitutes acceptance. Anyone who does not agree must stop using the Portal.

13.   Contract terms and precedence

13.1 These Terms supplement rather than replace other binding agreements.

13.2 For data protection matters, applicable mandatory data protection terms and data processing terms take precedence. Subject to that, and unless expressly agreed otherwise, any other conflict is resolved in the following order:

a.      a separate written agreement between EM and the Customer that expressly varies the relevant provision;

b.      our Standard Terms of Business;

c.      these Terms.

13.3 Customer purchase orders, policies, emails or other Customer terms do not apply unless expressly accepted by us in writing.

13.4 If any provision of these Terms is or becomes invalid, illegal or unenforceable, it shall be deemed modified to the minimum extent necessary to make it valid, legal and enforceable. If such modification is not possible, the relevant provision shall be deemed deleted. Any modification or deletion shall not affect the validity and enforceability of the remaining provisions.

13.5 A failure or delay by a party to exercise any right or remedy under these Terms or by law shall not constitute a waiver of that or any other right or remedy. A single or partial exercise of any right or remedy shall not prevent or restrict its further exercise or the exercise of any other right or remedy. The rights and remedies provided under these Terms are cumulative and are not exclusive of any rights or remedies provided by law.

14.   Governing law, contacts and acceptance

14.1 These Terms and any related dispute are governed by the laws of England and Wales.

14.2 The courts of England and Wales have exclusive jurisdiction, although we may seek urgent protective relief in another court of competent jurisdiction where necessary to protect the Portal, systems, confidential information, personal data or intellectual property.

14.3 Contact details

Portal support: workhealth@expressmedicals.co.uk

Security incidents: compliance@expressmedicals.co.uk

Data protection/privacy: dpo@expressmedicals.co.uk

Address: Express Medicals Plc, 8 City Business Centre, Lower Road, London, SE16 2XB