Terms of Service

1. The agreement

These terms form a contract between WeHearYou ("we", "us") and the organisation that accepts them ("you", "Customer"). The individual accepting confirms they are authorised to bind that organisation.

By creating an account you accept these terms and, where you handle protected health information, the Business Associate Agreement presented alongside them. If you do not accept both, do not create an account.

2. What the service does

WeHearYou requests reviews from your customers, routes their responses according to rules you configure, collects private feedback from dissatisfied customers, publishes review content on pages and embeddable widgets, and synchronises reviews from connected third-party profiles.

We may change how features work. Where a change materially reduces what the service does, we will give you at least thirty days' notice before it takes effect.

3. Your account

You are responsible for everything done under your account, including by your staff. You must keep credentials confidential, remove access promptly when someone leaves, and tell us without delay if you believe an account has been compromised.

Accounts are for named individuals. Sharing one login between multiple people defeats the audit trail this service keeps, and you accept the consequences of doing so.

4. Consent — your responsibility, not ours

This is the obligation most likely to cause you difficulty, so it is stated plainly. You are solely responsible for having a lawful basis to contact every person you upload or add.

We do not verify consent. We send what you tell us to send, to the people you tell us to send it to.

• Text messages: you must hold prior express consent from each recipient as required by the Telephone Consumer Protection Act. Statutory damages run to hundreds of dollars per message, and they are assessed against you.
• Email: you must comply with the CAN-SPAM Act, including honouring unsubscribe requests promptly.
• Health context: where the recipient is a patient, you must confirm that contacting them for this purpose is permitted under HIPAA and any state law that applies to you.
• Purchased, scraped, or rented contact lists are prohibited without exception.

5. Acceptable use

You may not use the service to:

• Offer payment, discounts, or any other inducement in exchange for a review, or condition an incentive on the review being positive — this breaches Google's and Meta's platform policies and, in the United States, FTC rules.
• Write, solicit, or publish reviews that misrepresent a genuine customer experience.
• Selectively suppress genuine negative reviews already published on a third-party platform. Routing unhappy customers to private feedback before they publish is a permitted feature; removing or hiding what they have published is not.
• Send to people who have asked you to stop, or continue a campaign after a complaint.
• Attempt to access another customer's data, probe the service for vulnerabilities without our written permission, or circumvent any limit applied to your account.
• Resell or provide access to the service to a third party except through a reseller arrangement we have agreed in writing.

6. Sending limits and suspension

All customers send through shared email and SMS infrastructure. One customer generating spam complaints degrades deliverability for every other customer, so we apply per-organisation sending limits and may adjust them.

We may suspend sending, or the account, immediately and without notice where we reasonably believe a customer is causing or about to cause harm to that shared infrastructure, to recipients, or to us. We will tell you why, and restore service once the cause is resolved.

7. Your data

Your data remains yours. You grant us only the licence needed to operate the service for you: to store, process, transmit and display it as the features you use require, and to disclose it to the subprocessors listed in this agreement.

We do not sell customer or patient data. We do not use the content of your reviews or private feedback to train machine learning models, and we do not share it with other customers.

You may export your data at any time while your account is active. On termination, see section 12.

8. Artificial intelligence features

Some features send text to Google's Gemini API to generate a review summary, suggest a reply, or rephrase feedback. Review content and private feedback text are transmitted when those features are used.

AI output is a draft. It can be wrong, and it can be inappropriate. You are responsible for reviewing anything generated before it is published under your name, and an approval step is available for automated replies. We are not liable for the content of AI output you choose to publish.

9. Subprocessors

We use the third parties listed in the accompanying schedule to deliver the service. Each receives only the data its function requires. We remain responsible to you for their handling of it.

We will give you at least thirty days' notice before adding a subprocessor that will handle patient data, during which you may terminate without penalty if you object.

10. Fees

Subscription fees are billed in advance for the period shown at purchase and are non-refundable except where the law requires otherwise. Where a plan includes usage allowances, exceeding them may result in reduced service rather than an automatic charge.

We may change pricing with at least thirty days' notice, effective at your next renewal.

11. Availability and support

We aim for continuous availability but do not commit to a specific uptime percentage under these terms. Planned maintenance will be notified in advance where practical.

The service depends on third parties — Google, Meta, Twilio, Resend — whose outages we cannot control and are not liable for.

12. Term, termination and what happens to your data

Either party may terminate at the end of a billing period on written notice. We may terminate immediately for material breach, including any breach of sections 4 or 5.

On termination your data remains available for export for thirty days. After that we delete or de-identify it within ninety days, except where we are required to retain it by law. Where a Business Associate Agreement applies, its return-and-destruction provisions govern protected health information and take precedence over this section.

13. Confidentiality

Each party will protect the other's confidential information with at least the care it applies to its own, and will not disclose it except to people who need it to perform this agreement and are bound by equivalent obligations.

14. Warranties and disclaimers

We warrant that we will provide the service with reasonable skill and care. Beyond that, and to the maximum extent permitted by law, the service is provided as is, without implied warranties of merchantability, fitness for a particular purpose, or non-infringement.

We do not warrant that using the service will improve your ratings, your review volume, or your search visibility.

15. Limitation of liability

Neither party is liable for indirect, incidental, special, or consequential damages, or for lost profits or goodwill.

Except for your indemnity obligations under section 16, your payment obligations, and either party's liability for gross negligence, wilful misconduct, or breach of confidentiality, each party's total liability is limited to the fees paid or payable in the twelve months preceding the claim.

Nothing in this agreement limits liability that cannot lawfully be limited.

16. Indemnity

You will indemnify us against claims arising from your use of the service in breach of sections 4 or 5 — including claims under the Telephone Consumer Protection Act, CAN-SPAM, or equivalent legislation, and claims that you contacted someone without a lawful basis.

This is the practical consequence of section 4: because consent is your responsibility, the cost of getting it wrong is yours.

17. Changes to these terms

We may update these terms. Material changes will be notified at least thirty days before they take effect, and continued use after that date constitutes acceptance. Where a change materially reduces your rights, you may terminate without penalty before it takes effect.

Each version is dated. The version you accepted is recorded against your organisation and is the one that governs until you accept a newer one.

18. General

These terms, together with any applicable Business Associate Agreement, are the entire agreement between us on this subject. If any provision is unenforceable, the rest continues in effect. Neither party may assign this agreement without the other's consent, except as part of a merger or sale of substantially all assets.

Questions about these terms: privacy@wehearyou.app.

Schedule — subprocessors

Third parties that receive customer or patient data in the normal operation of the service.