INTERSESH | PRACTICE SERVICE AGREEMENT
Service Provider: Jamieson D. Cobbs, carrying on business as InterSesh, a British Columbia sole proprietor ("InterSesh").
Customer: [legal name of clinic or practitioner] ("Practice").
Effective date: [date of last signature] | Practice jurisdiction(s): [state/province and country] | Billing owner: [authorized person].
The Practice and InterSesh agree as follows.
1. Service and scope
1.1 InterSesh provides software for clinicians and their invited adult clients to organize client-reported information between sessions, including Agreements, follow-through, barriers, check-ins, journal entries, and clinician preparation views. Features and permitted service regions depend on the Practice's subscription, its verified scope, and the Service's currently authorized release configuration.
1.2 The Service is not psychotherapy, medical care, a diagnostic system, clinical decision-making software or a crisis line. InterSesh does not independently monitor incoming client entries for emergencies, promise that a clinician will see an entry before a session, or guarantee uninterrupted service. The Practice must give its clients separate emergency instructions and maintain its own clinically appropriate monitoring and follow-up arrangements.
1.3 The planned initial paid MVP market is Canada, in BC, AB, SK, MB, ON, NB, NS, PE, NL, YT, NT and NU, excluding Québec. It is not a representation that real clinical-data processing is already authorized in any region. Only eligible adult-client use in jurisdictions and customer-specific scopes separately approved for the relevant activity is permitted. US clinical-data use is outside the initial Canada-only launch and requires separate review. Neither this Agreement nor a subscription purchase grants authority to enroll a client, provide care, share records across jurisdictions, or override local professional, privacy and healthcare requirements. The Practice must not upload identifiable client information before InterSesh gives written production activation authorization for the applicable scope.
2. Professional responsibilities
2.1 The Practice controls clinical judgments, treatment, assessment, referral decisions, professional documentation, recordkeeping duties and whether use of InterSesh is suitable for each client. Clinical notes, care instructions and emergency arrangements must continue to be maintained wherever applicable law and professional rules require.
2.2 The Practice is responsible for obtaining any required professional and client-facing notices, treatment consents and lawful authority before entering or directing processing of client information. The Practice will verify its clinicians' identity, registration, professional scope, organization membership and permissions and will notify InterSesh when these change.
2.3 InterSesh may generate structured summaries or indicators from client-reported information. Such outputs are aids, may be incomplete or inaccurate, and must be reviewed by a qualified professional in context rather than relied on automatically.
3. Accounts, access and Passport
3.1 Practice users must use their own accounts, protect credentials, maintain accurate authorization records and promptly report known or suspected unauthorized access. InterSesh may enforce role-, organization-, client- and assignment-based restrictions and limit access while an identity or contract is unresolved.
3.2 Initial client activation requires an authorized clinician invitation. If enabled under separately approved release controls, a client may authorize an identified receiving practice to obtain continuing access to eligible client-level Passport history, including information entered before the connection and under previous practice relationships. The current source design does not select discrete dates, entries, categories or a single source practice. Sharing requires an accurate disclosure, effective separately versioned and share-specific client choice, and verified receiving-practice authority. It does not create universal access and does not automatically expose other-practice clinician-private notes or treatment plans.
3.3 A receiving practice is independently responsible for verifying its right to receive and use information, professional scope, applicable client notices, and lawful record retention. The source-reviewed Passport connection is not necessarily read-only. An appropriately authorized connected clinician may modify eligible portable goals, homework, shared Agreements and follow-through events, potentially affecting other authorized connections. A seven-day share-link expiry limits first redemption but does not end an established connection. Revocation stops subsequent connection access as implemented but may not remove information already lawfully obtained or retained. Cross-jurisdiction sharing requires applicable review, disclosures and authorization; different jurisdictions alone do not establish a blanket prohibition.
4. Fees and subscription
4.1 The subscription tier, capacity and price are the prices accepted by the Practice's authorized billing owner at checkout or in a written order. Taxes apply as required. No unstated tier price, storage allowance, clinical usage limit or additional service is promised by this Agreement.
4.2 Subscription charges recur on the selected billing interval until cancelled. Cancellation ordinarily takes effect at the end of the current paid period, with no mid-period refund except where required by law or expressly agreed in a signed order. A billing issue does not waive a separate duty to preserve protected records or support legally required access.
4.3 Changes to material prices or commercial terms affecting a renewed term will be disclosed before they apply, with any required affirmative consent. The Practice may decline changes and cancel subject to applicable law and the current subscription period.
5. Privacy, data and confidentiality
5.1 The attached Data Processing Addendum ("DPA"), including completed Schedules A to C, governs the Practice's covered personal/health information and forms part of this Agreement. Where a specific customer-lawful written instruction conflicts with this Agreement about processing, the DPA controls to the extent of that conflict. The DPA does not replace any clinician's statutory obligations.
5.2 Each party will use non-public information received under this relationship only for the purposes of providing, receiving, securing or lawfully administering the Service, protect it with reasonable safeguards, and disclose it only to authorized people and processors or when legally required. These duties survive termination for so long as the information remains protected. A lawful request for records, regulatory reporting or breach response is not prohibited by confidentiality terms.
5.3 Actual provider locations and services are identified in the DPA. In particular, the primary production database is located in Toronto, while automated Cloud SQL backups currently reside in a US multi-region. The Practice accepts only the destinations permitted by its applicable law, professional rules and completed DPA. A Practice that requires Canada-only storage must not begin processing until a separate suitable agreement and verified configuration are in place.
6. Availability, safety and changes
6.1 InterSesh will take reasonable steps to operate, maintain and protect the Service, but does not promise 24/7 availability or zero defects. Planned maintenance, security incidents, upstream dependencies and emergencies may interrupt access. Any service levels must be separately accepted in writing.
6.2 InterSesh may update features and security controls, including to address risk or legal requirements. It will provide appropriate notice when changes materially affect the Practice's contracted use or data-processing terms. Updates must not silently expand authorized clinical data use, marketing use or disclosure without the required basis and notice.
6.3 No customer clinical content may be used for advertising, cross-practice model training or third-party generative-model training under this Agreement without a new, explicit and lawful agreement.
7. Term, suspension and exit
7.1 This Agreement begins when signed and continues while there is an authorized subscription or until ended by written agreement or a valid termination under its terms. Either party may end it for a material breach that the other fails to correct within a reasonable written cure period, except that urgent security or unlawful processing can require immediate restriction.
7.2 InterSesh may temporarily restrict access where reasonably needed to prevent unauthorized access, mitigate an incident, respond to a legal prohibition or investigate credible misuse. Restrictions will be no broader than reasonably necessary, with notification when lawful and practicable.
7.3 At exit the parties will follow Schedule C for lawful export, return, deletion and retention, including protected backups, litigation/regulatory holds, audit/incident evidence and records that remain legally controlled by a Practice or other record holder. Account closure alone does not erase a Practice's statutory record obligations. InterSesh will not promise instant deletion from all backups.
8. Responsibility and liability
8.1 Each party is responsible for its own acts and omissions and those of people or processors for whom it is legally responsible. InterSesh is not responsible for professional decisions made by the Practice or for a clinician's failure to respond to an urgent communication outside InterSesh's agreed role. The Practice is not responsible for security or processing failures caused by InterSesh.
8.2 To the extent permitted by applicable law, neither party is responsible for speculative or remote indirect losses, including lost profits or lost opportunities, where such losses were not reasonably foreseeable. This clause does not exclude reasonably foreseeable direct loss for breach of this Agreement or the DPA, nor fraud, wilful misconduct, gross negligence or liability that cannot legally be excluded or restricted.
8.3 This KISS Agreement does not include an express monetary cap. No dollar amount, fee multiplier, unlimited indemnification or waiver of clients' statutory rights is implied. Any negotiated cap, insurance-dependent allocation or special indemnity must be separately drafted, reviewed and signed rather than imported by checkout or a hidden schedule.
9. General
9.1 The parties will cooperate in good faith on data rights, reasonable audits, regulator requests and incident response where legally required and consistent with the DPA. Each remains responsible for its own laws and registrations.
9.2 Notices about contracts may be sent to the verified business and privacy contacts in Schedule A or to a separately confirmed secure channel. Urgent clinical information must not be sent to an ordinary support or marketing mailbox. Legal incident deadlines in applicable law and any specifically agreed executable schedule govern over internal operational targets.
9.3 This Agreement and its signed Schedules constitute the agreement for the described Service, together with any accepted order identifying price and tier. An amendment requires evidence of acceptance by authorized representatives. If any clause is unenforceable, the remaining clauses continue as far as law permits. Neither party may transfer the Agreement in a way that materially weakens data protection without required notice and safeguards.
9.4 British Columbia law governs the ordinary contractual interpretation of this Agreement, subject to non-waivable privacy, healthcare, consumer and professional obligations or mandatory jurisdictional rules applying to either party. The parties will first attempt reasonable informal resolution before litigation, without delaying statutory complaints, emergency remedies or required incident reporting.
9.5 Electronic signatures and counterparts may be used when applicable law permits; this Agreement is not effective merely because a blank form is published online.
Signatures
For InterSesh
Legal person: Jamieson D. Cobbs, carrying on business as InterSesh
Signature: ______________________________ Date: ______________
For the Practice
Practice legal name: __________________________________________
Authorized signer and title: ___________________________________
Signature: ______________________________ Date: ______________
Attached and completed: Data Processing Addendum, Schedules A to C; conditional US HIPAA Addendum only where applicable and independently executed.