Glim Practitioner Agreement

1. Parties

This Agreement is between Glim Health Inc., operator of the Glim platform, referred to as Glim, and the licensed professional accepting these terms, referred to as the Practitioner.

It takes effect on the date the Practitioner accepts it electronically or signs it, and governs all use of the platform and all processing of client information carried out through it.

2. Definitions

Client means a person who engages the Practitioner through the platform.

Client Information means all personal information, sensitive personal information and privileged information relating to a Client that is processed through the platform.

Clinical Record means notes, assessments, treatment plans, correspondence and other documentation created by the Practitioner in the course of professional engagement with a Client.

Data Privacy Act means Republic Act No. 10173, its Implementing Rules and Regulations, and the issuances of the National Privacy Commission.

Mental Health Act means Republic Act No. 11036 and its Implementing Rules and Regulations.

Personal Data Breach has the meaning given in the Data Privacy Act.

3. How responsibility is divided

This allocation governs regulatory accountability and is not altered by the practical operation of the platform.

Each party is responsible for its own compliance with the Data Privacy Act in respect of the information it controls, and neither instruction nor platform functionality relieves the Practitioner of professional obligations under the Mental Health Act, Republic Act No. 10029 (the Philippine Psychology Act), Republic Act No. 2382 (the Medical Act) or the codes of ethics of the Practitioner's profession, as applicable.

4. Practitioner warranties

The Practitioner represents and warrants, on acceptance and continuously:

1. That the Practitioner holds a current and valid Professional Regulation Commission licence in the relevant profession, is in good standing, and is not subject to suspension, revocation or pending administrative or criminal proceedings affecting fitness to practise.
2. That the Practitioner will provide services only within the scope of that licence, training, competence and supervision arrangements.
3. That the Practitioner will notify Glim in writing within three working days of any lapse, suspension, revocation, investigation, complaint or restriction affecting the licence or fitness to practise.
4. That all credentials, qualifications, specialisations and experience presented to Glim and to Clients are accurate and current.
5. That the Practitioner carries professional indemnity cover appropriate to the scope of practice, where such cover is available and customary for the profession.
6. That the Practitioner has completed the privacy and platform onboarding required by Glim before receiving access to Client Information.

A breach of warranty entitles Glim to suspend access immediately, before notice, where continued access would place Clients at risk.

5. Confidentiality

The Practitioner will hold all Client Information in strict confidence and will not disclose it to any person except:

1. to the Client;
2. to another professional, with the Client's documented consent, for the purpose of continuity of care or referral;
3. as necessary to prevent imminent and serious harm to the Client or to another person, following the escalation protocol in Annex C, and disclosing only the minimum information necessary;
4. where required by a court order, subpoena or other legally enforceable demand, after review of its validity and scope and, where lawful, notice to the Client;
5. where required by laws for the protection of children and vulnerable persons from abuse, exploitation and neglect;
6. as necessary to establish or defend a legal claim involving the Practitioner and the Client.

This obligation survives termination of this Agreement indefinitely.

Every disclosure under items 3 to 6 is recorded in the platform disclosure log with the date, the recipient, the information disclosed and the basis for it.

6. Data protection obligations of the Practitioner

The Practitioner will:

• process Client Information only for the purpose of delivering professional services to that Client, and never for research, publication, marketing, teaching or commercial purposes without separate written consent obtained for that purpose;
• collect and record no more information than is necessary for the engagement;
• keep Clinical Records accurate, complete and contemporaneous;
• access only the records of Clients the Practitioner is engaged with, and never browse, search or export records outside the engagement;
• keep platform credentials confidential, use multi factor authentication, and never share an account or delegate access to an assistant, student or colleague;
• conduct consultations from a private location where the session cannot be overheard or observed, using a secured connection and a device with an active screen lock and full disk encryption;
• not download, copy, photograph, screenshot, print or export Client Information to a personal device, personal email account, personal cloud storage or messaging application, except where clinically necessary and in accordance with Glim's export procedure, which logs the export;
• not record any session without the documented consent of the Client, consistent with Republic Act No. 4200;
• not input Client Information into any external artificial intelligence tool, transcription service, note taking application or similar third party service that has not been approved in writing by Glim;
• not use Client Information to train, fine tune or evaluate any model;
• return or securely destroy Client Information held outside the platform on termination, and certify that this has been done.

7. Approved tools and sub processing

The Practitioner may not engage any sub processor or third party tool to process Client Information without Glim's prior written approval. Where approval is given, the Practitioner remains fully responsible for the acts and omissions of that party and will bind it in writing to obligations no less protective than those in this Agreement.

Glim maintains a list of approved tools and provides thirty days notice before adding or removing a tool, during which the Practitioner may object on reasonable grounds.

8. Security incidents

The Practitioner will notify Glim's Data Protection Officer at privacy@thrivewithglim.com within twenty four hours of becoming aware of any of the following:

• a Personal Data Breach or suspected breach affecting Client Information;
• loss or theft of a device used to access the platform;
• compromise, sharing or suspected compromise of platform credentials;
• an unauthorised disclosure, however inadvertent;
• receipt of a legal demand for Client Information;
• receipt of a data subject request, which the Practitioner forwards to Glim without responding to it independently.

The notification states what happened, when, what information was involved, and what has been done. The Practitioner will cooperate fully and promptly with Glim's investigation, containment, regulatory notification and remediation, at no charge, and will not communicate with the National Privacy Commission, a Client or the public about a breach involving the platform without prior coordination with Glim, except where the Practitioner is independently required by law to do so.

9. Records, retention and continuity

Clinical Records are created and maintained within the platform. Records are retained for ten years from the date of last consultation, and where the Client was a minor at the time of consultation, until that person turns eighteen and then for ten years.

On termination of this Agreement, the Practitioner may export a complete copy of the Clinical Records of Clients the Practitioner has served, in a machine readable format, at no charge, within thirty days of termination. Glim retains its own copy for the retention periods in the preceding paragraph and for its obligations to Clients.

The Practitioner will not terminate an active engagement without reasonable notice to the Client and, where clinically indicated, a referral or handover that protects continuity of care. Abandonment of a Client in active treatment is a material breach of this Agreement.

10. Safety and escalation

The Practitioner will follow the escalation protocol in Annex C where a Client presents a risk of serious harm to self or to another person, will document the assessment and the action taken, and will notify Glim's clinical safety contact where the platform's escalation pathway is used.

The Practitioner acknowledges that Glim does not provide emergency or crisis intervention services and does not monitor sessions or messages in real time.

11. Fees, payouts and taxes

The Practitioner sets professional fees, which are displayed to Clients before booking. Glim collects fees on the Practitioner's behalf and remits them net of the platform fee published in the Practitioner dashboard, on the payout cycle stated there.

The Practitioner is responsible for the registration, invoicing, withholding, value added tax and income tax obligations arising from the Practitioner's own practice, and will provide Glim with the tax documentation required for lawful remittance. Glim withholds and remits taxes where required by law and issues the corresponding certificates.

12. Independent practice

The Practitioner is an independent professional and not an employee, partner, agent or joint venturer of Glim. Nothing in this Agreement creates an employment relationship, and neither party may bind the other.

The Practitioner exercises independent clinical judgement. Glim does not direct, review or override clinical decisions, and does not practise medicine or psychology.

13. Audit and compliance

Glim may, on fourteen days written notice and no more than once a year unless a breach or regulatory requirement makes more frequent review necessary, request evidence of the Practitioner's compliance with Sections 4 to 8, including licence status, training completion, device security attestation and export logs. The Practitioner will respond within fourteen days.

14. Term, suspension and termination

This Agreement continues until terminated by either party on thirty days written notice, subject to Section 9 on continuity of care.

Glim may suspend or terminate access immediately where there is a lapse or restriction of licence, a credible allegation of client harm, a material breach of confidentiality or data protection obligations, or a legal or regulatory requirement to do so. Where immediate suspension is applied, Glim gives written reasons within three working days and provides an opportunity to respond.

Sections on confidentiality, data protection, records and retention, indemnity, and governing law survive termination.

15. Indemnity and liability

The Practitioner indemnifies Glim against claims, losses, penalties and reasonable costs arising from the Practitioner's clinical acts or omissions, breach of professional obligations, breach of this Agreement, or unauthorised disclosure of Client Information.

Glim indemnifies the Practitioner against claims arising from a failure of platform security attributable to Glim, or from Glim's own breach of the Data Privacy Act.

Neither party is liable to the other for indirect or consequential loss. Nothing limits liability for fraud, wilful misconduct, gross negligence, or any liability that cannot be limited under Philippine law.

16. General

Governing law and venue. The laws of the Republic of the Philippines govern this Agreement. Disputes are submitted to the exclusive jurisdiction of the courts of Quezon City.

Amendment. Glim may amend this Agreement on thirty days written notice. The Practitioner may terminate without penalty before the amendment takes effect.

Assignment. The Practitioner may not assign this Agreement. Glim may assign to a successor entity on notice.

Severability and waiver. An invalid provision is severed and the rest remains in force. Failure to enforce is not a waiver.

Entire agreement. This Agreement, its Annexes, the Privacy Notice and the fee schedule constitute the entire agreement between the parties on this subject.

17. Acceptance

Annex A: Description of processing

Subject matter. Delivery of mental health assessment, consultation and treatment services to Clients through the Glim platform.

Duration. The term of the Agreement, plus the retention periods stated in Section 9.

Nature and purpose. Collection, recording, storage, retrieval, consultation, use, disclosure to the Client and to authorised recipients, erasure and destruction, for the purpose of professional mental health services and the administration of those services.

Categories of data subject. Clients, and persons named by Clients in the course of consultation.

Categories of information. Identity and contact details; demographic information; screening and assessment responses and scores; presenting concerns, history and symptoms; diagnoses and formulations; treatment plans and progress notes; medication information; risk assessments; correspondence; appointment and attendance records; billing records.

Sensitivity. Sensitive personal information under Section 3 of the Data Privacy Act, and privileged information arising from the professional relationship.

Location of processing. Secured cloud infrastructure, with sub processing by approved providers as disclosed in the Privacy Notice.

Annex B: Minimum security measures

Glim provides:

• encryption of information in transit and at rest;
• role based access control, with Practitioner access scoped to the Practitioner's own Clients;
• multi factor authentication on all Practitioner accounts;
• logging of every access to Clinical Records, retained for two years and available on request;
• separation of clinical data from analytics and development environments;
• automated backup with tested restoration;
• vulnerability scanning, independent penetration testing and enforced patching;
• written contracts with all sub processors imposing equivalent standards;
• a registered Data Protection Officer and a tested incident response plan.

The Practitioner provides:

• a device with full disk encryption, an active screen lock, current operating system patches and reputable endpoint protection;
• a private consultation environment with no unauthorised person present or within hearing;
• a secured network connection, and no use of unsecured public wireless networks for consultations or record access;
• unique credentials, never shared, with multi factor authentication enabled;
• no local storage of Client Information outside the platform except through the logged export procedure;
• prompt reporting under Section 8 of the Agreement.

Annex C: Crisis escalation protocol

Step 1. Assess. Where a Client discloses or displays indications of suicidal intent, intent to harm another person, or an acute condition requiring immediate care, the Practitioner conducts a risk assessment appropriate to the presentation and documents it in the Clinical Record.

Step 2. Stay with the Client. Where risk is assessed as imminent, the Practitioner remains in contact with the Client while arranging support, and does not end the session until the Client is connected to help or the Practitioner has exhausted reasonable means of contact.

Step 3. Use the nominated contact and emergency services. With the Client's cooperation where possible, and without it where the risk is imminent and the law permits, the Practitioner contacts the Client's nominated emergency contact and, where necessary, emergency services on 911, or the National Center for Mental Health Crisis Hotline at 1553 (Luzon-wide landline, toll free), 0917 899 8727, 0966 351 4518, or 0908 639 2672, all operating 24 hours a day.

Step 4. Notify Glim. The Practitioner notifies Glim's clinical safety contact at support@thrivewithglim.com, monitored on the schedule published in the Practitioner dashboard within twenty four hours of any escalation involving emergency services or disclosure without Client consent.

Step 5. Document. The assessment, the decision, the information disclosed, the recipient and the outcome are recorded in the Clinical Record and in the disclosure log on the same day, and in every case before the end of the following working day.

Step 6. Follow up. The Practitioner arranges follow up contact and, where the Client's needs exceed the scope of platform based care, a referral to in person or inpatient services.

Disclosure under this protocol is limited to the minimum information necessary to secure the Client's safety.