Terms of Service

Version: v1.0-temp · Last updated: 13 July 2026 · Effective: from the date this version is published at cbtflow.com/legal/platform-terms

Provider: Digita1 OÜ, trading as CBT Flow · Contacts: legal@cbtflow.com · privacy@cbtflow.com · security@cbtflow.com · support@cbtflow.com

1. The agreement

These Platform Terms are an agreement between:

• Digita1 OÜ, an Estonian private limited company with registry code 17003669, VAT number EE102745881, and registered office at Sepapaja tn 6, 15551 Tallinn, Harju maakond, Estonia, trading as CBT Flow (we, us or CBT Flow); and
• the UK-established therapist or practice identified during registration or in an order (you or the Practice).

If you practise in your own name, you contract personally. If the Practice is a company, partnership or other legal entity, that entity contracts and the person accepting these Platform Terms confirms that they have authority to bind it.

These Platform Terms are for business customers only. Flow Team is planned but is not available yet and cannot currently be purchased.

2. When the agreement starts and what it includes

The agreement starts when an authorised person accepts these Platform Terms for the Practice or, if later, when CBT Flow activates the account.

The agreement includes:

1. any signed order form or displayed plan order;
2. these Platform Terms;
3. the CBT Flow Data Processing Agreement (DPA);
4. the Therapist Payment Terms, if the Practice enables client payments;
5. the acceptable-use rules in Schedule 1; and
6. the Offer Terms published at cbtflow.com/legal/offers/flow-pro-free-2026, where the Practice validly registers for that offer.

If documents conflict, a signed order form takes priority only where it expressly changes another document. The DPA takes priority for the processing of Practice-controlled personal data. The Therapist Payment Terms take priority for client-payment matters. These Platform Terms take priority for the remainder. A policy or product description does not change a signed order or these Platform Terms unless it expressly says so and is accepted in the required way.

3. Definitions

In these Platform Terms:

• Authorised User means the person the Practice allows to access its account under an available plan.
• Client means a person who receives or may receive services from the Practice and whose information or invited access is managed through the Platform.
• Client Data means personal data and other content relating to a Client that the Practice or Client enters, sends, stores or generates through the Platform.
• Client app means the client-facing part of CBT Flow made available by invitation to eligible Clients.
• Documentation means current user guidance CBT Flow makes available for the Platform.
• Free Period means the 60-day Flow Pro entitlement described in section 8 and in the Offer Terms, publicly promoted as "60 days free on Flow Pro".
• Platform means the CBT Flow therapist service, Client app and related features supplied under the agreement.
• Subscription means the paid Flow Solo or Flow Pro plan selected by the Practice.
• Subscription Period means the monthly or annual billing period selected in the order.

4. Eligibility and account authority

At launch, a Practice may contract only if it is established in the United Kingdom. The Practice must provide accurate legal, business, billing and professional information and keep it current.

The account owner is responsible for:

• deciding who may act for the Practice;
• keeping credentials and devices secure;
• promptly removing access that is no longer authorised;
• reviewing account and security notices; and
• all activity carried out through its Authorised Users, except to the extent caused by CBT Flow's breach or security failure.

The Practice must notify security@cbtflow.com promptly if it suspects unauthorised access or compromised credentials.

5. What CBT Flow provides

CBT Flow provides software designed to support structured, therapist-led CBT practice. Depending on the selected plan and current product release, the Platform may support Treatment Plans, sessions, homework, outcome measures, protocols, the Client app, secure communications, appointments, invoices and client payments.

Features, limits and availability are described in the current plan page, order and Documentation. A roadmap, preview or "coming soon" description is not a contractual commitment unless an order expressly says otherwise.

CBT Flow will provide the Platform with reasonable care and skill. We may use subcontractors and third-party services as described in the DPA and privacy notices.

6. CBT Flow is software, not a healthcare provider

The Practice, not CBT Flow:

• provides therapy and maintains the therapeutic relationship;
• decides whether a Client is suitable for therapy and for Platform use;
• makes all diagnoses, assessments, clinical decisions and safeguarding decisions;
• selects, reviews and interprets materials, measures, scores and records;
• obtains and records any required treatment, confidentiality, privacy and communication arrangements; and
• complies with its professional, clinical, legal and insurance obligations.

CBT Flow does not provide therapy, medical advice, clinical supervision, diagnosis or an emergency response service. The Platform is intended as practice-management and therapy-support software for qualified professionals. Platform content, protocols, scores, trends and reminders support professional workflows but do not replace the Practice's independent judgement, and no Platform feature is intended to make a diagnosis or an autonomous clinical decision.

7. Plans and client limits

The launch plans are:

Prices are stated exclusive of VAT and similar taxes. Where the applicable cross-border VAT rules make the Practice responsible for accounting for VAT (for example under the reverse-charge mechanism for business customers), the invoice will state the applicable treatment.

An "active Client" is determined by the Platform's current documented status rules. The Practice may archive Clients in accordance with those rules. Flow Solo cannot be selected or retained where the Practice's verified active-client count exceeds 10. A Practice that wishes to move to Flow Solo must first reduce its active-client count to 10 or fewer.

The Practice must not evade plan limits by duplicating, deleting and recreating, or improperly archiving Client records.

Client-payment Application Fees are separate from Subscription prices and are governed by the Therapist Payment Terms. At launch they are 2.9% + £0.20 per successful client payment on Flow Solo and 2.5% + £0.20 per successful client payment on Flow Pro.

8. The Free Period

An eligible new Practice that completes a valid registration by the deadline in the Offer Terms receives Flow Pro free for exactly 60 consecutive days from the qualifying registration or start event recorded by our servers. The account shows the exact expiry date and time.

No card is required for the Free Period. The Practice is not automatically converted to a paid Subscription. CBT Flow will send expiry notices 14 days, 7 days and 1 day before the Free Period ends.

When the Free Period ends, normal workspace access is locked until the Practice chooses an eligible paid plan and supplies payment details. Billing/setup, eligible plan selection, support and export remain available during the post-expiry export window.

The full offer conditions, including eligibility, the registration deadline and what happens at expiry, are in the Offer Terms at cbtflow.com/legal/offers/flow-pro-free-2026.

9. Ordering and paying for a Subscription

The Practice may choose an available monthly or annual Subscription. Subscription charges are billed in advance at the price displayed and accepted in the order. Digita1 OÜ issues the Subscription invoice.

The Subscription renews for successive periods of the same length unless the Practice cancels before the next renewal date. The Practice authorises the agreed payment method to be charged for renewal amounts and applicable taxes.

CBT Flow will give at least 60 days' notice before a Subscription price increase takes effect. If the Practice does not accept the new price, it may cancel before the increase takes effect; the new price applies only from the Practice's next renewal after the notice period.

10. Failed payments

If a Subscription payment fails, CBT Flow may notify the Practice and retry the payment. The Practice has a seven-day grace period from the failed due date to restore payment.

If payment remains outstanding after the grace period, CBT Flow may lock normal workspace access. Billing, support and export access remain available. Access is restored after payment succeeds, subject to any separate suspension ground.

The Practice remains liable for properly incurred charges. CBT Flow will not delete Client Data merely because a payment fails; the export and deletion process in section 13 applies.

11. Cancellation

The Practice may cancel a Subscription at any time through the supported account process or by contacting support. Cancellation takes effect at the end of the current paid Subscription Period. There is no minimum commitment.

Subscription charges are not normally refunded for an unused part of a paid period. This does not affect a refund required by law or a refund CBT Flow agrees because of a serious service failure.

At the end of the paid period, normal workspace access is locked and the 30-day export window begins.

12. Suspension and termination

CBT Flow may suspend all or part of the Platform where reasonably necessary because:

• the Practice materially breaches the agreement;
• use creates a material security, fraud, legal, safeguarding or operational risk;
• required account or professional information is materially inaccurate or missing;
• a Subscription remains unpaid after the grace period;
• Stripe or another necessary provider restricts a relevant integration; or
• suspension is required by law or a competent authority.

Where lawful and safe, CBT Flow will explain the reason and give a reasonable opportunity to remedy it. Immediate suspension may be necessary for an urgent risk.

Either party may terminate the agreement for a material breach that the other party does not remedy within 30 days after written notice, where remedy is possible. CBT Flow may terminate immediately for an irremediable material breach, unlawful use or a serious security, fraud or safeguarding risk.

Ending the agreement does not affect rights and liabilities that arose before it ended, including payment, confidentiality, data return/deletion, dispute and liability provisions.

13. Lock, export and systematic deletion

When a Subscription ends, a Free Period ends without conversion, or the agreement otherwise enters the standard offboarding state:

1. normal clinical workspace access is locked;
2. the Practice has 30 days to obtain a supported self-service or assisted export;
3. CBT Flow sends a notice at the start of the window and reminders 14, 7 and 1 day before deletion;
4. the Practice may request one documented extension of up to 30 days, free of charge, before the deadline;
5. at the end of the window, CBT Flow deletes workspace and Client Data from active systems under the Practice's standing instruction in the DPA, unless an agreed extension or legal hold applies; and
6. CBT Flow records the deletion event and sends confirmation.

The Practice may instead give a different documented return or deletion instruction before the deadline, as described in the DPA.

The supported export covers the Practice's workspace records in usable formats; the export may combine self-service and assisted steps, and CBT Flow does not promise a one-click export or a particular file format. Contact support@cbtflow.com for assistance with an export.

Residual backup copies are removed through the documented backup lifecycle and are isolated from ordinary use while retained. CBT Flow may separately retain account, billing, tax, contract-acceptance, payment-ledger, fraud, security and legal-claims records where it acts as controller and has a lawful retention reason.

14. Practice data responsibilities

The Practice normally acts as controller for Client Data and CBT Flow normally acts as its processor under the DPA. The Practice must:

• have a lawful basis and any required special-category condition for its processing;
• give Clients accurate privacy information and handle their rights;
• give CBT Flow only lawful, documented instructions;
• collect no more information than is reasonably needed;
• maintain accurate records and appropriate retention instructions;
• configure access and notifications appropriately; and
• avoid entering data where Platform use would breach law, professional duties or a Client's confidentiality.

CBT Flow acts separately as controller for defined account, subscription, security, support, legal, fraud and payment-administration purposes described in its privacy notice.

The Practice owns its Client Data and other original content. It gives CBT Flow a limited, non-exclusive licence to host, copy, transmit and otherwise use that content only as needed to provide, secure and support the Platform, comply with law and exercise rights under the agreement.

15. Client age

The Client app is currently available only to invited Clients aged 18 or over. The Practice must not invite anyone under 18 or allow an under-18 to activate or use a Client account.

CBT Flow plans to extend the Client app to clients aged 16 and 17 once dedicated safeguards — age and eligibility assurance, a recorded therapist attestation and age-appropriate terms and privacy information — are in place. These Platform Terms and the related notices will be updated before that happens, and inviting a 16–17-year-old will require the Practice to complete the attestation the Platform presents at that time.

Whatever the Client's age, there is no automatic parent, guardian or family-member account, access or disclosure. CBT Flow does not automatically send anyone other than the Client and the Practice a Client's appointments, messages, measures or invoices. The Practice decides whether any disclosure to a third party is lawful, clinically appropriate and in the Client's interests, and records its basis.

16. Notifications, clinical risk and emergencies

CBT Flow does not continuously monitor Client entries, messages or measures, and does not provide an emergency, crisis-response or continuous-monitoring service.

Automated risk-classification and risk-alert features are not enabled in the current release. If CBT Flow introduces such a feature in the future, it will be a best-effort decision-support tool addressed to the treating therapist only — it may be incomplete, delayed, unavailable or wrong, must be reviewed in context by the treating therapist, and will not be sent automatically to a parent, guardian or any third party. CBT Flow will update these Platform Terms and the relevant notices before enabling such a feature.

The Practice must:

• maintain its own safeguarding, risk, emergency and out-of-hours arrangements;
• explain those arrangements to Clients;
• keep notification and availability details current;
• respond to Client information according to its professional judgement and obligations; and
• never direct a Client to rely on CBT Flow for urgent help.

The Practice must ensure its Clients know how to obtain urgent help. CBT Flow publishes general urgent-help signposting for Clients at cbtflow.com/legal/clinical-safety.

17. Clinical and other content

CBT Flow may provide templates, protocols, measures, examples or educational material. Unless expressly stated otherwise, this content is general workflow support, not a recommendation for a particular Client. The Practice must review suitability, licensing, version and interpretation before using it.

The Practice remains responsible for content it uploads, creates, assigns or communicates. It must have the rights and lawful basis needed to use that content and must not infringe intellectual property, confidentiality or privacy rights.

18. Acceptable use

The Practice and its Authorised Users must comply with Schedule 1. In particular, they must not:

• invite or allow an under-18 Client to use the Client app;
• use the Platform for unlawful, fraudulent, discriminatory, abusive or harmful activity;
• attempt to bypass plan, account, security or access controls;
• introduce malware or interfere with the Platform;
• access another practice's or person's information without authority;
• use the Platform as an emergency monitoring service;
• reverse engineer or commercially resell the Platform except where law permits or CBT Flow agrees; or
• use Client or therapist data to train a general AI model through an unauthorised export or integration.

19. AI and automated features

CBT Flow will not use therapist or Client data to train general-purpose AI models. CBT Flow will not send clinical data to a third-party AI provider unless the feature has been separately approved, risk-assessed, contractually governed and transparently disclosed.

Any future clinical AI feature must require meaningful therapist review and must not make autonomous treatment decisions. A preview, experiment or future feature is not authorised merely by these Platform Terms.

20. Third-party services

The Platform may depend on third-party infrastructure and integrations. A third party may have separate terms and privacy responsibilities. CBT Flow is not responsible for a third party's independent service, but remains responsible for its own contractual duties and for processors as required by the DPA and law.

Client payments use Stripe only if separately enabled and accepted under the Therapist Payment Terms. Calendar, authentication, messaging or other integrations must be used only as documented and must not be treated as clinical or emergency systems.

21. Security and incidents

CBT Flow will maintain technical and organisational measures appropriate to the risk, as described in the DPA's current security annex. Security depends on both parties. The Practice must use available security controls, protect devices and credentials, manage Authorised Users and report suspected incidents promptly.

CBT Flow does not promise that data is unreadable to authorised CBT Flow personnel, that unauthorised access is impossible or that the Platform will never be interrupted. Privileged access is instead limited, controlled and auditable, as described in the DPA.

Personal-data breach duties and cooperation are governed by the DPA and applicable privacy law.

22. Availability, support and changes to the Platform

CBT Flow will use reasonable care to keep the Platform available, but maintenance, security work, third-party failures and events outside reasonable control may interrupt it. No service-level guarantee applies unless a signed order expressly includes one.

CBT Flow may improve, replace or discontinue features. We will give reasonable advance notice where a change materially reduces a core paid feature, except where immediate action is needed for law, security, safety or a third-party dependency. Where a material reduction substantially deprives the Practice of the paid service, the Practice may cancel and request a fair pro-rata refund for the unavailable remaining paid period.

23. Intellectual property and feedback

CBT Flow and its licensors own the Platform, Documentation, branding, software and CBT Flow-supplied content, subject to any expressly identified third-party rights. During the agreement, CBT Flow gives the Practice a limited, non-exclusive, non-transferable right to use the Platform for its internal professional practice in accordance with the selected plan.

The Practice may not copy, sell, sublicense, scrape or create a competing service from the Platform except where applicable law cannot exclude the activity.

If the Practice voluntarily gives feedback, CBT Flow may use it without charge to improve the Platform, provided CBT Flow does not publish confidential information or identify the Practice without permission.

24. Confidentiality

Each party must protect the other's confidential information with reasonable care and use it only to perform the agreement, exercise rights or comply with law. Access may be given to personnel and advisers who need it and are bound by suitable confidentiality duties.

These duties do not cover information that is public without breach, was lawfully known already, is independently developed, or is lawfully received without confidentiality restriction. A legally required disclosure may be made after giving notice where lawful and reasonably practicable.

25. Warranties and disclaimers

Each party confirms that it has authority to enter into the agreement. CBT Flow warrants that it will provide the Platform with reasonable care and skill.

Except for express commitments in the agreement, the Platform is provided on an "as available" basis. CBT Flow does not warrant uninterrupted or error-free operation, that every feature is suitable for every Client, or that a score, template or communication is clinically complete or accurate. Nothing in this section excludes a warranty that cannot lawfully be excluded.

26. Liability

Neither party is liable to the other for indirect or consequential loss, or for loss of profit, revenue, business or anticipated savings, except to the extent such an exclusion is not permitted by law.

Subject to the paragraphs below, CBT Flow's total aggregate liability arising from or in connection with the agreement is limited to the greater of £5,000 and the fees paid or payable by the Practice to CBT Flow in the 12 months before the event giving rise to the claim.

For claims arising from CBT Flow's breach of its confidentiality obligations (section 24) or its data-protection or security obligations under the agreement and the DPA, CBT Flow's total aggregate liability is instead limited to £25,000.

Neither party limits liability for fraud, fraudulent misrepresentation, death or personal injury caused by negligence, or any liability that cannot lawfully be limited or excluded. Nothing in the agreement limits the statutory rights of a data subject or the powers of a supervisory authority. CBT Flow does not assume responsibility for therapeutic decisions, services or outcomes supplied by the Practice.

27. Practice responsibility for claims

The Practice is responsible for claims arising from its therapy, clinical decisions, unlawful instructions, content, infringement, misuse or breach of professional duties, to the extent caused by the Practice.

28. Changes to the agreement

CBT Flow may update these Platform Terms for legal, security, operational or product reasons. We will provide advance notice of a material change and state its effective date. A change to client-payment fees is subject to at least 60 days' notice under the Therapist Payment Terms.

CBT Flow will require versioned re-acceptance where a change materially alters the Practice's obligations, data use, clinical-risk allocation or other core contract terms, unless a shorter implementation is strictly necessary for law or an urgent security or safety risk.

29. Acceptance and records

Acceptance must be an unticked, affirmative action. CBT Flow keeps a record of each acceptance, including:

• document ID, version and the archived exact text or its cryptographic hash;
• timestamp and accepting user;
• Practice legal identity and account;
• the displayed authority confirmation and acceptance wording; and
• re-acceptance evidence for material changes.

30. Notices

CBT Flow may send contractual notices to the account owner's verified email address and through a prominent in-product notice. The Practice must keep its contact details current.

Notices to CBT Flow should be sent to:

• legal: legal@cbtflow.com
• privacy: privacy@cbtflow.com
• security: security@cbtflow.com

31. General terms

Neither party waives a right by delaying its enforcement. If a provision is unenforceable, the remainder continues. Neither party is liable for delay caused by events outside its reasonable control, but this does not excuse payment already due or data-protection and security duties that remain capable of performance.

The Practice may not transfer the agreement without CBT Flow's prior written consent, not to be unreasonably withheld for a genuine transfer of the Practice. CBT Flow may transfer it as part of a reorganisation, financing or sale of the relevant business if the transfer does not materially reduce the Practice's rights.

No person other than the parties has a right to enforce the agreement, except where applicable law says otherwise. The agreement is the entire agreement about the Platform and replaces earlier statements on that subject, but it does not exclude liability for fraud or fraudulent misrepresentation.

32. Governing law and disputes

The agreement is governed by English law, subject to any mandatory rules that apply regardless of the chosen law. The courts of England and Wales have exclusive jurisdiction, except where a mandatory rule provides otherwise.

Before starting proceedings, each party should send a written description of the dispute to the other's legal contact and allow 30 days for good-faith resolution, unless urgent relief is needed.

Schedule 1 — acceptable-use rules

The Practice must ensure that use of the Platform:

1. is lawful, professional and within the Practice's authority;
2. respects Client confidentiality, privacy, safeguarding and intellectual-property rights;
3. does not include malware, attacks, unauthorised access, credential sharing, bulk scraping or security testing without written permission;
4. does not bypass client, seat, plan, payment, consent or account controls;
5. does not send unlawful, abusive, discriminatory, deceptive or unsolicited communications;
6. does not use CBT Flow as an emergency, crisis-monitoring or autonomous clinical-decision service;
7. does not invite a Client under 18 while the Client app is limited to adults (see section 15); and
8. does not connect an unapproved tool that exposes Client Data or uses it for advertising or general AI training.

Schedule 2 — "60 days free on Flow Pro" registration offer

The Free Period is governed by the Offer Terms published at cbtflow.com/legal/offers/flow-pro-free-2026, which are incorporated into the agreement for each Practice that validly registers for the offer. In summary: eligible new UK Practices that complete registration by 23:59:59 (Europe/London) on 31 July 2026 receive Flow Pro free for exactly 60 consecutive days, with no card required and no automatic conversion to a paid Subscription. If the Offer Terms conflict with these Platform Terms, the Offer Terms take priority for the Free Period only.