ConsultHub Subscriber Terms

These Subscriber Terms ("Terms") govern access to and use of ConsultHub, the pharmacy practice platform operated by PharmacyConsultation.ie ("ConsultHub", "we", "us"). They apply to pharmacies and pharmacists who register for a ConsultHub subscription ("Subscriber", "you"). Patient use of PharmacyConsultation.ie is governed by separate Patient Terms.

By creating a ConsultHub account, ticking the acceptance box at registration, or using the Service, you confirm that you are authorised to bind the pharmacy business you represent, and that business agrees to these Terms, including the Data Processing Terms in Section 9.

1. Definitions

• "Service" — the ConsultHub platform: the pharmacist dashboard, consultation management and record-keeping tools, clinical reference features, patient booking management, messaging, and related services.
• "Clinical Reference Features" — any feature that presents clinical information, protocol guidance, eligibility screening, or AI-assisted content intended to inform a pharmacist's decision-making.
• "Patient Data" — personal data relating to patients processed through the Service, including special category health data within the meaning of Article 9 GDPR.
• "CCS" — the HSE Common Conditions Service. "PSI" — the Pharmaceutical Society of Ireland. "DPC" — the Data Protection Commission.

2. The Service — what ConsultHub is and is not

2.1. ConsultHub is a practice-support and record-keeping tool for registered pharmacists. It helps you manage CCS consultations, bookings, documentation, and patient communication.

2.2. ConsultHub does not practise pharmacy or medicine, is not a prescriber, and is not a substitute for the professional judgement of a registered pharmacist. No output of the Service constitutes medical advice, diagnosis, or a direction to treat.

2.3. Regulatory status. The Service is not a medical device within the meaning of Regulation (EU) 2017/745. Its intended purpose is the storage, retrieval, communication, and documentation of consultation records, the management of bookings and practice workflow, and the display of the official HSE Common Conditions Service protocols and eligibility criteria for reference. The Service does not itself diagnose, treat, or generate patient-specific clinical determinations: every assessment, diagnosis, and treatment decision is made by the registered pharmacist (Section 4). This intended purpose is binding — the Service must not be used for any purpose that would constitute a medical-device intended purpose. We maintain a clinical-safety process for clinical reference content and will notify Subscribers of any safety-relevant correction.

2.4. We may add, modify, or withdraw features with reasonable notice where a change materially reduces the Service. Safety-related changes may take effect immediately.

3. Eligibility and accounts

3.1. The Subscriber must be a pharmacy lawfully operating in Ireland, registered with the PSI, and (where offering CCS consultations) participating in the HSE Common Conditions Service.

3.2. Each superintendent/supervising pharmacist is responsible for ensuring that only appropriately qualified and authorised staff access the Service. Staff PINs and login credentials are confidential; the Subscriber is responsible for all activity under its accounts and must deactivate departing staff promptly.

3.3. You must keep registration details (including PSI registration numbers) accurate and current. We may suspend accounts that fail verification.

4. Clinical reference features and professional responsibility

4.1. Assistive only. Clinical Reference Features exist to assist the decision-making of a registered pharmacist. They present information for the pharmacist to consider; they do not make clinical decisions and must never be relied upon as the sole basis for any assessment, supply, referral, or refusal decision.

4.2. The pharmacist is the responsible clinician. For every consultation conducted using the Service, the conducting pharmacist retains full and sole professional responsibility for the assessment, diagnosis, treatment decision, supply, referral, safety-netting, and record accuracy, in accordance with the Pharmacy Act 2007, the PSI Code of Conduct, and the applicable HSE CCS protocols and service specification.

4.3. Human oversight by design. The Service is designed so that a qualified pharmacist reviews and confirms every clinically significant output before it takes effect. You must not use the Service in any way that bypasses pharmacist review.

4.4. AI-assisted content. Some features use artificial intelligence (including third-party large language models) to generate suggestions or summaries. AI-assisted outputs are identified as such in the interface; they may be incomplete, outdated, or incorrect; the pharmacist must independently verify any AI-assisted content against their own clinical knowledge and the applicable protocols before acting on it. The Service logs AI-assisted interactions to support traceability.

4.5. Protocols and guidance. Clinical content in the Service is provided for convenience and is reviewed against published HSE/PSI sources. The authoritative sources remain the current HSE CCS protocols, PSI guidance, and product SmPCs. Where the Service and an authoritative source conflict, the authoritative source prevails, and you must notify us of the discrepancy.

4.6. Clinical-safety reporting. If you identify an error in clinical content, a malfunction with potential patient-safety impact, or a near-miss you believe is attributable to the Service, report it to support@pharmacyconsultation.ie as soon as practicable. We operate a clinical-safety log, investigate reported issues, and notify affected Subscribers of confirmed safety-relevant defects and their remediation. This does not replace your own obligations to report incidents to the PSI, HSE, or HPRA where applicable.

4.7. No pharmacist–patient relationship with us. ConsultHub does not interact clinically with patients. Patient-facing booking and pre-screening flows collect information for your review; they do not provide patients with medical advice on our behalf.

4.8. Indemnity insurance. The Subscriber warrants that it holds and will maintain professional indemnity insurance appropriate to its CCS activities, covering consultations managed through the Service.

5. Subscription, trial, and billing

5.1. Plans. Standard and Premium plans as described at /pricing. VAT is applied as displayed at checkout.

5.2. Trial. New Subscribers receive a 30-day free trial. A payment card is required up-front; the first charge occurs automatically at the end of the trial unless you cancel beforehand.

5.3. Billing. Subscriptions are billed monthly in advance via Stripe and renew automatically. You can upgrade, downgrade, or cancel at any time from the dashboard; cancellation takes effect at the end of the current billing period. Plan changes are prorated as displayed.

5.4. Patient consultation fees. CCS consultation fees are set by you, paid by the patient directly to your pharmacy, and never pass through ConsultHub. We take no commission on consultations.

5.5. Non-payment. We may suspend the Service for unpaid fees after notice. Suspension does not delete your data (see Section 9.8); during suspension you retain export access for the period in Section 9.8.

6. Acceptable use

You must not: (a) use the Service for any purpose other than legitimate pharmacy practice; (b) upload data you have no right to process; (c) attempt to access another subscriber's data; (d) reverse engineer, scrape, or resell the Service; (e) use the Service to send unsolicited communications; (f) circumvent security controls or rate limits; (g) enter records you know to be false; (h) use Clinical Reference Features outside their stated intended purpose (Section 2.3).

7. Data protection — roles (GDPR)

7.1. You are the controller of Patient Data. The pharmacy determines the purposes and means of processing its patient records (clinical records, consultation notes, prescriptions, pre-screening responses, booking details). ConsultHub processes that Patient Data as your processor under Article 28 GDPR, on the terms in Section 9.

7.2. We are the controller of Subscriber account data (pharmacist names, contact details, billing records, usage analytics) and of the public pharmacy directory, processed per our Privacy Policy.

7.3. Patient portal. Where a patient creates an account or booking via PharmacyConsultation.ie, we act as controller for the operation of the patient's own portal account, and as your processor for the consultation/booking record once it is directed to your pharmacy.

7.4. Our governance. We maintain records of processing activities (Article 30 GDPR) and conduct data protection impact assessments for processing of health data at scale (Article 35 GDPR). Data protection contact: support@pharmacyconsultation.ie.

8. Lawful basis and your obligations as controller

8.1. You are responsible for ensuring a lawful basis under Articles 6 and 9 GDPR for the Patient Data you process through the Service (typically Article 9(2)(h) — provision of health care by or under the responsibility of a professional subject to the obligation of professional secrecy — supplemented by Section 52 of the Data Protection Act 2018).

8.2. You are responsible for transparency to your patients (Articles 13–14 GDPR), including that your pharmacy uses ConsultHub as a service provider.

8.3. Statutory record retention is your obligation. Irish pharmacy law and the CCS service specification impose minimum retention periods on pharmacy records. You must export or arrange retention of your records before they are deleted under Section 9.8.

9. Data Processing Terms (Article 28 GDPR)

These terms apply to all Patient Data we process on your behalf.

9.1. Subject matter and duration. Processing of Patient Data for the provision of the Service, for the duration of the subscription plus the retention period in 9.8.

9.2. Nature and purpose. Hosting, storage, transmission, display, backup, and (where you use the relevant features) automated analysis of Patient Data to provide consultation management, booking, record-keeping, messaging, and clinical reference functionality.

9.3. Categories of data and data subjects. Patients of the Subscriber: identification and contact data, date of birth, PPSN/GMS/DPS numbers, appointment data, and special category health data (symptoms, pre-screening answers, assessments, treatments, prescriptions, clinical notes).

9.4. Our obligations as processor. We shall:

• process Patient Data only on your documented instructions (using the Service constitutes such instructions), unless required by EU/Irish law;
• ensure persons authorised to process Patient Data are bound by confidentiality;
• implement appropriate technical and organisational measures (Annex A);
• engage sub-processors only per 9.5;
• assist you, insofar as possible, in responding to data subject rights requests, taking into account the nature of the processing;
• assist you with your Articles 32–36 obligations (security, breach notification, DPIAs), including providing the information a controller reasonably needs for its own DPIA of the Service;
• notify you without undue delay, and in any event within 48 hours, of becoming aware of a personal data breach affecting Patient Data, with sufficient detail for your own Article 33 notification to the DPC;
• at the end of the subscription, return or delete Patient Data per 9.8;
• make available information necessary to demonstrate compliance and allow audits (on reasonable notice, at most once per year unless following a breach).

9.5. Sub-processors. You authorise the sub-processors listed at /legal/subprocessors. We will give at least 30 days' notice before adding or replacing a sub-processor that processes Patient Data; you may object on reasonable data-protection grounds, in which case you may terminate the affected feature or subscription without penalty.

9.6. AI processing and international transfers. Patient Data at rest is hosted in the EU. Where you use AI-assisted features, the relevant data excerpts are processed under a data processing agreement with the AI provider incorporating Standard Contractual Clauses for any transfer outside the EEA, with data minimisation applied to what is sent. AI inputs and outputs are not used to train third-party models.

9.7. Data location. All Patient Data at rest is stored within the EU/EEA.

9.8. Retention, export, and deletion. During the subscription you can export your records at any time. After termination or expiry, we retain Patient Data for 90 days for export, then delete it from production systems within 30 days (backups age out within a further 35 days), unless EU/Irish law requires us to retain specific records. Statutory retention of pharmacy clinical records remains your obligation as controller (Section 8.3) — export before deletion. On written request we will instead delete immediately after termination.

Annex A — Technical and organisational measures (summary)

• Encryption in transit (TLS 1.2+) and at rest (EU-region managed database)
• Role-based access control; organisation-level data isolation enforced server-side; staff PIN identity within pharmacies; least-privilege internal access
• Signed, verified session tokens; authenticated API access controls
• Audit logging of clinical record access and changes; AI-assisted interactions logged
• Managed backups with point-in-time recovery
• Secure development: code review, dependency updates, vulnerability management; secrets managed outside source code; risk-based release process for changes affecting clinical content
• Documented breach-response procedure with 48-hour controller notification and a clinical-safety log
• Personnel confidentiality undertakings; access revoked on role change

10. Confidentiality

Each party will keep the other's confidential information confidential and use it only to perform under these Terms. This survives termination.

11. Intellectual property

We own the Service and all related IP. You own your data. You grant us a licence to host and process your data solely to provide the Service. We may use aggregated, anonymised usage statistics (never identifiable patient or pharmacy data) to improve the Service.

12. Availability, support, and business continuity

12.1. The Service is provided on an "as available" basis. We target high availability but do not guarantee uninterrupted service. Planned maintenance will be notified where practicable.

12.2. Clinical continuity. The Service is not a system of last resort: you must maintain procedures enabling you to conduct and record consultations if the Service is unavailable, consistent with PSI operational requirements.

12.3. Support: support@pharmacyconsultation.ie — we aim to respond within one business day.

13. Warranties and disclaimers

13.1. We warrant we will provide the Service with reasonable skill and care and substantially in accordance with its documentation.

13.2. Except as set out in these Terms, all other warranties are excluded to the maximum extent permitted by law. We do not warrant that Clinical Reference Features are accurate, complete, or suitable for any particular clinical situation — see Section 4.

14. Liability

14.1. Nothing in these Terms excludes liability for death or personal injury caused by negligence, fraud or fraudulent misrepresentation, or any liability that cannot be excluded under Irish law.

14.2. Subject to 14.1, we are not liable for: (a) clinical decisions made by pharmacists; (b) loss of profits, revenue, or goodwill; (c) indirect or consequential loss.

14.3. Subject to 14.1, our total aggregate liability in any 12-month period is capped at the greater of (i) the subscription fees paid by you in that period and (ii) €500.

14.4. You will indemnify us against third-party claims arising from your breach of Section 4 (clinical responsibility), Section 6 (acceptable use), or Section 8 (controller obligations).

15. Term, suspension, and termination

15.1. These Terms apply from registration until your subscription ends.

15.2. You may cancel at any time (effective end of billing period). We may suspend or terminate for material breach (with 14 days' cure period where curable), non-payment, loss of PSI registration, or unlawful use. We may suspend immediately where necessary to protect patient safety or data security.

15.3. Sections 9.8, 10, 11, 14, and 17 survive termination.

16. Changes to these Terms

We may update these Terms. Material changes will be notified by email or in-dashboard at least 30 days in advance; continued use after the effective date constitutes acceptance. If you object, you may cancel before the change takes effect. Each version is archived and your accepted version is recorded.

17. General

Governing law: Ireland; exclusive jurisdiction of the Irish courts. No assignment without consent (we may assign to a successor in business). Entire agreement (excluding fraud); severability; no waiver by delay.

18. Contact

PharmacyConsultation.ie, Dublin, Ireland — support@pharmacyconsultation.ie