Terms of Service

Status: Version 1.1 effective 2026-05-14. These revisions are an internal editorial pass intended to make the document complete and accurate. The text remains under outside-counsel review. Material legal positions (entity definition, liability cap carve-outs, AI Article 22 disclosures, Transfer Impact Assessment) are flagged for counsel and may change before final publication.

These Terms of Service ("Terms") are a binding agreement between you and QEHS. By creating an account or using the Service, you accept these Terms on behalf of yourself and the organisation you represent. If you do not agree, do not use the Service.

Enterprise customers contract under a separate Master Services Agreement (MSA), which supersedes these Terms for the relevant subscription. Where the MSA is silent, these Terms apply.

"Service" means the QEHS web application, APIs, and supporting infrastructure operated under the qehsethos.com domain. "Customer Data" means data that you upload, submit, or generate in your tenant. "Customer" means you (the individual accepting these Terms) and the organisation you bind.

You must be 18 or older. The Service is intended for workplace and occupational use.

You must not be located in, or a resident of, a country subject to comprehensive trade sanctions under the lists maintained by the United States Department of the Treasury Office of Foreign Assets Control (OFAC), the United Kingdom Office of Financial Sanctions Implementation (OFSI), the European Union Consolidated List, or the United Nations Security Council Sanctions List. You must not be a person or entity named on any of those lists.

You are responsible for the actions of users under your tenant, including their compliance with these Terms and the Acceptable Use Policy.

You will provide accurate registration information and keep it current. You will not share credentials, and you will maintain reasonable security over your account.

Customer retains all right, title, and interest in Customer Data. We do not claim ownership of Customer Data.

Customer grants QEHS a worldwide, non-exclusive, royalty-free licence to host, copy, transmit, display, and process Customer Data solely as needed to provide the Service, to comply with law, and to enforce these Terms. The licence terminates when Customer Data is deleted under the retention schedule in the Privacy Policy or the DPA.

QEHS may use de-identified, aggregated, or anonymised data derived from Customer Data for product analytics, benchmarking, and service improvement, provided the data cannot reasonably be linked back to Customer or any individual.

The Acceptable Use Policy (AUP) is incorporated by reference. Violations may result in warning, throttling, suspension, or termination as described in the AUP. The AUP provides a 15-day cure period for non-emergency violations; emergencies (active attack, ongoing harm, CSAM, etc.) are subject to immediate suspension.

Self-serve plans (Trial, Starter, Business) renew automatically at the then-current price unless cancelled before the renewal date. Cancellation is effective at the end of the current billing period.

Fees are billed in advance and are non-refundable except where required by law or expressly stated in a written agreement.

QEHS may change prices for new subscription terms on 60 days' notice. Price changes for existing terms take effect at the next renewal.

Taxes (VAT, GST, sales tax, withholding tax) are the responsibility of Customer unless QEHS is required by law to collect them.

These Terms remain in effect for the duration of your subscription and any continued use of the Service.

Termination for convenience by Customer: at any time by cancelling the subscription in-product or by written notice to hello@qehsethos.com. Cancellation takes effect at the end of the current billing period and prepaid fees are not refunded.

Termination for convenience by QEHS: on 30 days' written notice, except as provided in the AUP or where required by law.

Termination for cause: either party may terminate immediately by written notice if the other party materially breaches these Terms and fails to cure the breach within 15 days of written notice describing the breach.

Effect of termination: Customer's right to use the Service ends. QEHS will make Customer Data available for export for 30 days after termination. After 90 days, QEHS will delete Customer Data in accordance with the retention schedule in the Privacy Policy and DPA, except where a legal hold applies.

Accrued payment obligations and the sections listed under Survival continue in effect after termination.

QEHS may make features available marked as "beta", "preview", "experimental", or similar. These features are provided as-is, without warranty, are excluded from the SLA, and may be modified or withdrawn at any time without liability.

QEHS includes AI-assisted features (collectively, "AI Features") that produce suggestions, classifications, scores, and natural-language outputs. AI Features are provided for informational purposes only. They do not constitute professional safety, health, environmental, legal, engineering, regulatory, medical, or any other professional advice.

Customer is solely responsible for all decisions made on the basis of AI outputs. Customer must apply independent human judgment, consult appropriate professionals, and comply with applicable law before acting on any AI suggestion.

QEHS may use third-party AI providers to power AI Features. Customer Data sent to those providers is subject to the DPA and the providers are listed as sub-processors in the Trust Center. AI Features are subject to data residency and bring-your-own-key options where described in the DPA or the MSA.

QEHS warrants that the Service will perform materially in accordance with its then-current published documentation. Customer's sole and exclusive remedy for breach of this warranty is the service-credit mechanism in the SLA (for paid plans) and, at QEHS's option, re-performance of the affected feature or termination with a pro-rata refund of prepaid unused fees.

EXCEPT AS EXPRESSLY STATED IN THESE TERMS, THE SERVICE IS PROVIDED "AS IS" AND "AS AVAILABLE" WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, OR THAT THE SERVICE WILL BE UNINTERRUPTED OR ERROR-FREE.

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, NEITHER PARTY WILL BE LIABLE FOR INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, OR FOR LOST PROFITS, REVENUE, BUSINESS, OR DATA, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

EACH PARTY'S AGGREGATE LIABILITY ARISING OUT OF OR RELATING TO THESE TERMS WILL NOT EXCEED THE FEES PAID OR PAYABLE BY CUSTOMER TO QEHS IN THE 12 MONTHS PRECEDING THE EVENT GIVING RISE TO THE CLAIM.

The exclusions and cap above do NOT apply to: (a) either party's indemnification obligations under these Terms; (b) breach of confidentiality obligations; (c) breach of obligations under the Data Processing Addendum or applicable data-protection law; (d) infringement of the other party's intellectual property rights; (e) gross negligence or wilful misconduct; (f) death or personal injury caused by negligence; or (g) any liability that cannot lawfully be excluded under applicable law.

The cap and exclusions allocate the risks between the parties and form the basis of the bargain. Each party acknowledges that these allocations are reasonable in light of the fees paid.

QEHS indemnification: QEHS will defend Customer against any third-party claim alleging that the Service, as provided by QEHS and used in accordance with these Terms, infringes a third party's intellectual property rights, and will pay damages and reasonable costs awarded against Customer or agreed in settlement, provided Customer promptly notifies QEHS, gives QEHS sole control of the defence, and reasonably cooperates. If the Service becomes, or in QEHS's opinion is likely to become, the subject of an infringement claim, QEHS may at its option modify the Service to be non-infringing, procure a licence, or terminate the affected subscription and refund prepaid unused fees.

Customer indemnification: Customer will defend QEHS against any third-party claim arising from (a) Customer Data being placed in the Service in violation of applicable law or these Terms, (b) Customer's violation of the AUP, or (c) Customer's violation of applicable export-control or sanctions law. This indemnity does NOT apply to claims arising from QEHS's breach of its security obligations under the DPA or these Terms.

Neither party is liable for failure or delay in performance caused by events beyond its reasonable control, including: acts of God, war, terrorism, civil disturbance, pandemic, government action, labour disruption, internet failure, third-party hosting or infrastructure failure, cyber-attack, embargo, or natural disaster.

The affected party will notify the other promptly and use reasonable efforts to resume performance. Payment obligations are not excused by this section.

Customer may not assign these Terms or any rights or obligations under them without QEHS's prior written consent, except to a successor in a merger, acquisition, or sale of substantially all of Customer's assets, on notice to QEHS.

QEHS may assign these Terms in connection with a merger, acquisition, or sale of substantially all of its assets, on notice to Customer. QEHS may delegate performance of any obligation to a wholly-owned affiliate or to a sub-processor subject to the DPA.

QEHS may modify these Terms from time to time. For material changes affecting paid customers, QEHS will give at least 30 days' notice by email and by posting an updated version with a new effective date. For non-material changes, QEHS may post an updated version without prior notice.

Continued use of the Service after the effective date of a modification means you accept the modification. If you do not agree, your sole remedy is to cancel your subscription before the effective date.

Material changes affecting the processing of personal data may require renewed consent or other action under applicable data-protection law and will be communicated accordingly.

Customer represents that neither it nor any of its affiliates, owners, directors, officers, or employees is a person or entity on, or owned or controlled by a person or entity on: the OFAC Specially Designated Nationals and Blocked Persons List, the OFAC Sectoral Sanctions Identifications List, the OFSI Consolidated List of Financial Sanctions Targets, the EU Consolidated List of Persons, Groups, and Entities Subject to EU Financial Sanctions, the UN Security Council Consolidated Sanctions List, or any equivalent list maintained by an applicable government authority.

Customer will not use the Service in or for the benefit of any country subject to comprehensive trade sanctions or any party on the lists referenced above. If Customer becomes aware that this representation is or has become inaccurate, Customer will notify QEHS immediately. QEHS may suspend or terminate access without notice on becoming aware of a violation.

The following sections survive termination of these Terms: Customer Data — ownership and licence (with respect to data licences granted to QEHS for already-disclosed aggregate or anonymised data, but not for ongoing processing of Customer Data); Warranties and disclaimers; Limitation of liability; Indemnification; Sanctions and export controls; Survival; Severability; Governing law and dispute resolution; and any accrued payment obligation.

If any provision of these Terms is held invalid, illegal, or unenforceable by a court of competent jurisdiction, that provision will be modified to the minimum extent necessary to make it valid, and the remaining provisions will remain in full force and effect.

These Terms are governed by the laws of England and Wales, without regard to conflict-of-laws principles. The courts of England and Wales have exclusive jurisdiction over any dispute arising out of or relating to these Terms, except as expressly stated below.

Notwithstanding the foregoing, applicable data-protection legislation (including EU GDPR, UK GDPR, CCPA / CPRA, LGPD, India DPDP, and equivalent laws) governs the parties' data-protection rights and obligations regardless of this governing-law clause. Data subjects retain their statutory rights to seek redress before the supervisory authority in their place of habitual residence and before the courts of their place of habitual residence.

Either party may seek injunctive or other equitable relief in any court of competent jurisdiction to protect its intellectual property, confidential information, or data-protection rights pending resolution of any underlying dispute.

These Terms, the AUP, the Privacy Policy, the DPA, the Cookie Policy, and (for Enterprise customers) the MSA constitute the entire agreement between the parties on their subject matter and supersede all prior and contemporaneous agreements, proposals, or representations, written or oral.

For commercial inquiries: hello@qehsethos.com.

For legal notices: legal@qehsethos.com (notices are also accepted at hello@qehsethos.com pending the dedicated alias being active).