Practitioner Terms
Last updated: 17 October 2026
About these terms
These terms apply when you buy a report pack from, or ask for a sample report from, Vigil Health Ltd, a company registered in England and Wales (company number 17385739), registered office 71-75 Shelton Street, London, WC2H 9JQ, UK ("Vigil", "we", "us"). "You" means the practitioner or practice using the service. You use the service in the course of your business, so consumer law rights for individuals do not apply.
Part A sets out how the service works. Part B is the data processing agreement for the client data you send us, and forms part of these terms. Sending us a panel, including for a free sample report, or buying a pack means you agree to them.
A1. The service
1.1 You send us a client's blood test results. We return a report in your practice's name that explains each marker, compares results with the lab's reference range and a research-based optimal range, and highlights markers worth discussing.
1.2 During early access, reports are prepared by us and sent back by email, normally within one working day of receiving a readable panel. Turnaround is a target, not a guarantee.
1.3 We may change how the service is delivered (for example, moving to self-serve upload). We will give you reasonable notice of any change that affects how you use it.
A2. What reports are, and are not
2.1 Reports are health information and education for discussion between you and your client. They do not diagnose, treat or prevent any condition, are not a clinical opinion and are not a substitute for medical advice.
2.2 Vigil is not a healthcare provider and does not have a relationship with your client. You remain responsible for any professional judgement, advice or recommendation you give.
2.3 Optimal ranges reflect associations reported in published research. They are not clinical thresholds set by Vigil.
A3. Credits and payment
3.1 Report packs are prepaid. One credit buys one report on one blood panel. Prices are shown on our website at the time you buy.
3.2 Credits do not expire while you use the service. They cannot be transferred to another practice or exchanged for cash, except as set out in A3.3.
3.3 You can ask for a refund of unused credits within 14 days of buying a pack. After that, payments are non-refundable unless we end the service under A12.3.
3.4 A credit is used when we deliver a report. If we cannot read a panel, or refuse it under A5, no credit is used.
3.5 Your first sample report is free and is covered by these terms.
A4. Your responsibilities
You agree that you will:
- only send results for clients aged 18 or over;
- have your client's explicit consent to share their results with us for this purpose, and keep a record of it;
- remove or black out your client's name, date of birth, address and other direct identifiers before sending, and send only what we need to prepare the report;
- read each report before sharing it with your client;
- not present a report as a diagnosis, or as produced or endorsed by a doctor or by Vigil as a clinical service;
- hold any professional registration, membership and insurance your work requires;
- not use the service for emergencies or time-critical decisions.
A5. Results that need prompt medical attention
5.1 If a result suggests your client may need medical attention urgently, we will not prepare a report. We will tell you which result triggered this as soon as we reasonably can, so you can direct your client to their GP, NHS 111 or emergency services as appropriate.
5.2 Reports always list any result outside the lab's reference range first, with a prompt to raise it with a GP.
5.3 Our checks are not a clinical safety net. You remain responsible for acting on results in line with your professional obligations.
A6. Accuracy
6.1 We take care to read results correctly, but lab reports vary in format. Check that the values in each report match the original results before sharing it.
6.2 If a report contains a reading error, tell us within 30 days and we will correct it at no charge.
A7. Fair use
You must not send results that you are not entitled to share, try to reverse-engineer the service, resell reports as a standalone product without our written agreement, or use the service in a way that breaks the law or professional rules.
A8. Your branding and our content
8.1 You give us permission to use your practice name, logo and the notes you send us, only to put them on your reports. You confirm you have the right to let us do this.
8.2 We own the Vigil service, its marker library and the report design. Each report you receive is licensed to you to share with the client it was prepared for, and to keep in your client records. Reports carry a "Powered by Vigil" line, which you must not remove.
A9. Data protection
9.1 For the client data you send us, you are the controller and we are your processor. Part B applies.
9.2 For your own details (name, practice, email address and payment records), we are the controller and our Privacy Policy applies.
A10. Confidentiality
Each of us will keep the other's confidential information confidential and use it only for the purpose of these terms. This does not cover information that is public, already known, or that must be disclosed by law.
A11. Liability
11.1 Nothing in these terms limits liability for death or personal injury caused by negligence, for fraud, or for anything else that cannot be limited by law.
11.2 Subject to A11.1, neither of us is liable for loss of profit, business, revenue, goodwill or data, or for any indirect or consequential loss.
11.3 Subject to A11.1, our total liability to you in any 12-month period is limited to the amounts you paid us in that period.
11.4 We are not responsible for clinical or professional decisions made by you or your client, or for any reliance on a report that is not consistent with A2.
A12. Ending the service
12.1 You can stop using the service at any time. A3.3 sets out when unused credits can be refunded.
12.2 We can suspend or end your access straight away if you seriously or repeatedly break these terms, in particular A4 or A7.
12.3 We can end the service for everyone on 30 days' notice. If we do, we will refund any unused credits.
12.4 When the service ends, B10 (return and deletion of client data) applies. A8.2, A10, A11 and A14 continue to apply.
A13. Changes to these terms
We may update these terms. We will email you at least 30 days before a change that materially affects you. If you continue to use the service after it takes effect, the new terms apply; if you do not agree, you can stop and ask for a refund of unused credits.
A14. General
14.1 These terms, including Part B, are the whole agreement between us about the service.
14.2 Neither of us is liable for delays caused by events outside our reasonable control.
14.3 You may not transfer your rights under these terms without our agreement. We may transfer ours to a business that takes over the service, and will tell you if we do.
14.4 No one other than you and us has any right to enforce these terms.
14.5 These terms are governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.
14.6 Contact: adnaan@vigilhealth.co.uk. Privacy questions: privacy@vigilhealth.co.uk.
Part B: Data processing agreement
This agreement is between you (the controller) and Vigil Health Ltd (the processor). It forms part of the Practitioner Terms and meets the requirements of Article 28 of the UK GDPR. "Data protection law" means the UK GDPR and the Data Protection Act 2018. "Client data" means the personal data you send us about your clients, described in Annex 1.
If you need a signed copy for your records, email adnaan@vigilhealth.co.uk.
B1. Roles
1.1 You decide why client data is processed and are the controller. We process it on your behalf to prepare reports, and are your processor.
1.2 Client data includes data concerning health, which is special category data. You are responsible for having a lawful basis and an Article 9 condition for sharing it with us. In most cases that will be your client's explicit consent.
1.3 You are responsible for the accuracy of the client data you send, for telling your clients how their data is used (including that it is shared with Vigil), and for removing direct identifiers as A4 requires.
B2. Instructions
2.1 We will process client data only on your documented instructions. These terms and your requests for reports are your instructions. We will not process client data for our own purposes, and we will not use it to train AI models.
2.2 If the law requires us to process client data in another way, we will tell you first unless the law prevents it.
2.3 We will tell you promptly if we think an instruction breaks data protection law.
B3. Confidentiality
Everyone we authorise to process client data is bound by a duty of confidentiality. During early access, the only person with access to client data is the company's director.
B4. Security
We will keep the technical and organisational measures in Annex 3 in place to protect client data, as Article 32 of the UK GDPR requires, and review them as the service changes.
B5. Sub-processors
5.1 You give general authorisation for us to use the sub-processors listed in Annex 2.
5.2 We will tell you by email at least 14 days before adding or replacing a sub-processor. If you object on reasonable data protection grounds, we will work with you to resolve it; if we cannot, you may stop using the service and we will refund unused credits.
5.3 Each sub-processor is bound by a written contract with data protection terms that offer at least the same protection as this agreement. We remain responsible to you for their performance.
B6. International transfers
6.1 Client data is processed in the UK and the European Economic Area (EEA). The UK recognises the EEA as providing adequate protection.
6.2 Where a sub-processor may access client data from outside the UK or EEA (for example, for support), we rely on the UK–US data bridge or the UK International Data Transfer Addendum, as applicable.
B7. Your clients' rights
7.1 If one of your clients contacts us directly about their data, we will pass the request to you without undue delay and will not respond except on your instructions.
7.2 We will help you respond to requests from your clients to exercise their rights (access, correction, deletion, restriction, objection and portability), taking into account the nature of the processing. For example, we can delete a client's panel and report on request within 5 working days.
B8. Personal data breaches
8.1 We will tell you without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting client data.
8.2 We will give you the information you need to meet your own obligations, including what happened, the data and number of clients likely to be affected, likely consequences, and what we have done or will do about it. Where we cannot give all of this at once, we will give it in stages.
8.3 We will not notify the Information Commissioner's Office (ICO) or your clients about a breach of client data on your behalf unless you ask us to or the law requires it.
B9. Other assistance
We will give you reasonable help with data protection impact assessments and with any prior consultation with the ICO, so far as they relate to our processing of client data.
B10. Return and deletion
10.1 We keep client data only for as long as we need it to prepare and correct a report: 30 days after we deliver the report, then we delete it, including the panel and report held in our systems.
10.2 You can ask us to delete client data earlier at any time. When the service ends, we will delete any client data we still hold within 30 days, unless the law requires us to keep it.
10.3 Deleted data may remain in encrypted backups held by our sub-processors until those backups expire under their normal schedules. It is not restored or used in that time.
B11. Audits and information
11.1 We will make available the information you reasonably need to show that we meet this agreement, such as answers to a security questionnaire and copies of sub-processor certifications.
11.2 If that is not enough, or a regulator requires it, we will allow an audit by you or an auditor you appoint, on at least 30 days' notice, during business hours, no more than once a year, and under a duty of confidentiality. You will bear your own costs.
B12. Liability and order of precedence
12.1 A11 (liability) applies to this agreement.
12.2 If this agreement conflicts with Part A about client data, this agreement prevails.
Annex 1: Details of the processing
| Item | Detail |
|---|---|
| Subject matter | Preparing practitioner-branded reports that explain a client's blood test results |
| Nature of processing | Receiving results through the request form on our website or by email; storing them in a private storage area; reading values from PDFs or images (including automated text recognition); removing remaining identifiers; comparing values with reference and optimal ranges; generating explanatory text with an AI model; producing a PDF report; returning it to you; storage and deletion |
| Purpose | To give you an educational report to discuss with your client |
| Data subjects | Your clients, aged 18 or over |
| Personal data | Blood test values and units; lab name and printed reference ranges; test date; sex where it is needed to apply a range; whether the client is on medication or treatment for a diagnosed condition, if you tell us; a client label you choose (for example, "Client A"); any notes you ask us to include |
| Special category data | Data concerning health |
| Not wanted | Names, dates of birth, addresses, NHS numbers, contact details. If any reach us, we remove them before interpretation and delete them with the panel |
| Duration | For each panel, until 30 days after the report is delivered (B10). Overall, for as long as you use the service |
Annex 2: Sub-processors
| Sub-processor | What it does with client data | Location |
|---|---|---|
| Amazon Web Services (Bedrock, Textract) | Reads text from images; runs the AI model that reads values and writes explanatory text. Data is not used to train models and is not shared with the model provider | UK and EU |
| Supabase | Stores the panel files you upload, and panels and reports | EU (Ireland) |
| Vercel | Hosts the website and runs the servers that process uploads | EU, with possible US access for support |
| Our business email provider | Sends reports back to you, and receives any panels you email instead of uploading | Details on request |
Stripe, PostHog and Loops are also used by Vigil but do not receive client data in this service.
Annex 3: Security measures
- Data minimisation: you remove direct identifiers before sending. We also remove the patient-details section and common identifiers (labelled names, dates of birth, postcodes, NHS numbers, email addresses) automatically before results reach the AI model.
- Location: client data is stored and processed in the UK and EEA (Annex 2).
- Encryption: data is encrypted in transit (TLS) and at rest by our hosting and database providers.
- Access: only the company's director can access client data during early access. Accounts used to reach client data are protected by strong, unique passwords and two-factor authentication.
- Separation: development and testing run against a separate database that holds no client data.
- AI processing: client data is processed through Amazon Bedrock, which does not use it to train models or share it with the model provider.
- Retention: panels and reports are deleted 30 days after the report is delivered, or sooner on request (B10). Reports are kept on local devices only as long as needed to send them.
- Breach response: suspected breaches are investigated straight away and reported to you within 48 hours (B8).
- Review: these measures are reviewed when the service changes, and at least once a year.