Institutional User Agreement

1. Parties and status

This Institutional User Agreement (the Agreement) is between Whole Elephant Research Company Limited (trading as The WERC App) and the university, NHS, or other organisation that opens a tenant on the Platform (the Institution).

It sits alongside the Terms of Service (for all users) and a signed Privacy Policy. Processing of personal data is governed by the Data Processing Addendum (DPA) executed with the Institution. If there is a conflict on data protection, the DPA prevails.

Commercial fees, if any, are set in a separate order form or email confirmation. Use of a tenant after The WERC App has provided access constitutes acceptance of this Agreement unless a signed copy says otherwise.

2. What The WERC App provides

The WERC App provides a multi-tenant research operations platform: participant accounts, study listings, booking, messaging, points and rewards, and technician administration.

Optional modules (Data hosted payloads, Lab Manager, WERC network content, Data Bank) stay off unless The WERC App enables them for the Institution in writing or in the admin console after the Institution asks. Enabling hosted research modules is a change of processing scope — complete the DPA Schedule C and any DPIA the Institution requires first.

The WERC App does not provide ethics review, clinical care, or a medical device. We do not guarantee that a given study will recruit to target.

3. Institution responsibilities

• Ethics and research governance. The Institution (and its researchers) are solely responsible for ethics approval, participant information sheets, consent, and compliance with the Institution's policies. The WERC App does not review or endorse study ethics. Technicians control which studies go live on the tenant.
• Authorised users. Name technicians who approve researchers and studies. Require unique accounts. Do not share passwords. Require staff to enable two-factor authentication.
• Notices. Ensure campus-facing notices match modules you have actually enabled. Do not tell participants that The WERC App stores “no research data” if hosted Data modules are on.
• External tools. Gorilla, Qualtrics, Pavlovia, and similar tools remain the Institution's (or researcher's) responsibility, including their privacy notices and completion-callback configuration (including the participation nonce).
• Lawful basis. The Institution is responsible for the lawful basis and any Article 9 condition for processing it instructs on the tenant, including optional special-category demographics it chooses to collect.

4. Data ownership

• Platform Data (accounts, matching demographics, bookings, messages, points) is hosted by The WERC App. The parties are typically joint controllers as set out in the DPA.
• External study payloads are owned and controlled by the Institution / researcher. The WERC App does not store them.
• Hosted Data, if enabled, is stored by The WERC App under the study record. Controller/processor roles are in DPA Schedule C.

5. Acceptable use

The Institution shall ensure its users do not:

• Use the Platform for unlawful or unethical recruitment
• Attempt to access another institution's tenant or bypass security controls
• Upload special category or health-adjacent files except through enabled modules and approved studies
• Re-identify Data Bank packages or attempt to reverse pseudonymisation
• Publish copyrighted psychometric instruments without a licence

The WERC App may suspend a study, user, or tenant for security, integrity, or legal risk, and will notify the Institution's technician contact.

6. Data subject rights

Participants can export or delete much of their Platform Data in-product. The Institution shall forward to dpo@werc.uk any request it receives that The WERC App must action. Target response: 30 days. See the DPA and Complaints Procedure.

7. Confidentiality and security

Each party shall keep the other's non-public operational information confidential, except as required by law or to provide the service. Security measures are described in DPA Schedule B. The Institution remains responsible for how its staff use exported spreadsheets and devices.

8. Fees, points, and tax

Platform fees (if charged) are exclusive of VAT. Points are incentives, not wages. The Institution is responsible for any local tax, bursary, or expenses policy that applies to how it describes rewards to participants.

9. Liability

Nothing excludes liability that cannot legally be excluded (including death or personal injury caused by negligence, or fraud).

Subject to that, The WERC App's aggregate liability under this Agreement is limited to the greater of £10,000 or the fees paid by the Institution in the preceding 12 months. That cap does not apply to a personal data breach caused by The WERC App's negligence.

The WERC App is not liable for ethics non-compliance, external-platform outages, or study science outcomes.

10. Term

The Agreement starts when the tenant is activated and continues until either party gives 30 days' written notice, or immediately for material breach that is not remedied within 14 days of notice (or immediately for a serious security or legal breach). On exit, the Institution may request export assistance and deletion as in the DPA.

11. Law

England and Wales law; exclusive jurisdiction of the courts of England and Wales.

12. Contact

General: hello@werc.uk · Support: support@werc.uk · Data protection: dpo@werc.uk

Ask The WERC App for the current DPA template (also in the product repository as app/legal/dpa-template.md) before go-live.