Partner API terms

These terms apply to every organisation using the Improval Partner API. The developer docs explain how the API works.

Partner: the organisation that accepts these terms for its integration.

Improval: 23 Lobsters Ltd (provider of Improval), Upper Barford Farmhouse, Bramshaw, Hampshire, SO43 7JN. Company number 14754401. Contact: Duncan Walling, Director, duncan@improval.com

together "the Parties".

How these terms are agreed: an authorised person accepts them for the Partner on its Integrations page in Improval before making its integration secret. A Partner that wants a signed copy can sign them as an agreement in Improval instead; the terms are the same. In these terms, "this agreement" means these terms as accepted or signed.

Part A: Partner API terms

1. Definitions

  • Partner API: Improval's application programming interface that lets the Partner's service add, read, update and delete learning entries in Users' Improval accounts, as described in the Documentation.
  • Documentation: the Partner API documentation at www.improval.com/developers/partner-api, as updated from time to time.
  • Integration: the Partner's integration with the Partner API, identified by its integration ID.
  • User: a person with an Improval account. A Linked User is a User who has linked their Improval account to the Integration and hasn't unlinked it.
  • Partner Entries: the entries, and their attachments, that the Integration has created in Linked Users' accounts.
  • Credentials: the Integration's integration secret, each Linked User's API key, and the webhook secret.

2. Access

2.1 Improval gives the Partner a non-exclusive, non-transferable, revocable right to use the Partner API, during this agreement, only to let Linked Users send their learning from the Partner's service to Improval and keep it in sync.

2.2 New integrations start in sandbox, where only Improval test accounts can link. Improval makes the Integration live once the Partner has accepted this agreement and finished testing.

2.3 Improval can change the Partner API. It will keep each version backwards compatible, and give at least 90 days' notice by email before withdrawing a version or making a change that isn't backwards compatible, except where a change is needed urgently for security or legal reasons.

3. The Partner's obligations

The Partner will:

  1. only create or change entries for a Linked User at that User's request, and only about learning the User took part in;
  2. not include patient-identifiable information in the content the Partner's service generates, and make reasonable efforts to discourage Users from including it;
  3. keep the Credentials secure, store them only on its servers, never share them, and tell Improval within 24 hours if it believes any have been exposed (the Partner can make a new integration secret itself on its Integrations page);
  4. use the Partner API only as described in the Documentation, keep within its rate limits, and not try to access any data other than the Partner Entries;
  5. stop using a User's API key as soon as the User unlinks (shown by a 401 response), and offer Users a way to disconnect in its own service;
  6. have a privacy notice that explains, in clear terms, how it shares data with Improval;
  7. not suggest that Improval endorses the Partner's service beyond the existence of the Integration, and use Improval's name and logo only to describe the Integration.

4. Improval's obligations

4.1 Improval will provide the Partner API as described in the Documentation, and support the Partner by email.

4.2 The Partner API is provided without a service level. Improval will make reasonable efforts to keep it available and to tell the Partner about planned maintenance.

5. Suspension

Improval can suspend the Integration, revoke its integration secret, or both, straight away if it reasonably believes the Integration puts Users, their data or the Service at risk, or that the Partner has materially breached this agreement. Improval will tell the Partner why as soon as it can, and restore access once the issue is resolved.

6. Fees

There are no fees for using the Partner API.

7. Intellectual property

Each Party keeps its intellectual property. Users own their learning entries. Nothing in this agreement transfers ownership of either Party's software, trade marks or content.

8. Confidentiality

Each Party will keep the other's confidential information confidential and use it only for this agreement. The Credentials are confidential information.

9. Liability

9.1 Nothing in this agreement limits liability for death or personal injury caused by negligence, for fraud, or for anything else that can't be limited by law.

9.2 Otherwise, neither Party is liable for indirect or consequential loss, or for loss of profits, revenue or goodwill. Each Party's total liability under this agreement in any 12 months is limited to £10,000.

10. Term and termination

10.1 This agreement starts when the Partner accepts it (or, if it's signed, when both Parties have signed it) and continues until either Party ends it by giving 30 days' written notice.

10.2 Either Party can end it straight away by written notice if the other materially breaches it and hasn't fixed the breach within 14 days of being asked to.

10.3 When it ends, Improval will stop the Integration, the Credentials will stop working, and Part B continues to apply to any shared data each Party still holds. Partner Entries stay in Users' Improval accounts, because they belong to the Users.

Part B: Data sharing

11. Roles

11.1 Each Party is a separate, independent controller of the personal data it holds:

  • the Partner is the controller of the personal data in its own service;
  • 23 Lobsters is the controller of the personal data in Users' Improval accounts, including Partner Entries once received, under Improval's privacy notice.

11.2 Neither Party processes personal data on the other's behalf, so this is a data sharing agreement between controllers, not a processing agreement under UK GDPR Article 28.

12. The data shared

12.1 From the Partner to Improval, for each Linked User: entry titles, dates, learning, reflection, duration or credits, source links, and attachments such as certificates.

12.2 From Improval to the Partner, for each Linked User:

  • a user ID that is different for each Partner and isn't the User's Improval ID;
  • the content and status of Partner Entries (for example whether they've been locked or deleted);
  • notifications when the User changes a Partner Entry.

12.3 Improval doesn't share any other data with the Partner. In particular, it doesn't share the User's name, email address, other entries, reflections, personal development plan or appraisal.

12.4 The purpose of the sharing is to let Users record learning from the Partner's service in their Improval portfolio, for continuing professional development and appraisal, and keep it in sync.

13. Lawful basis and transparency

13.1 The sharing happens at each User's request, when they link their accounts. Each Party is responsible for its own lawful basis for its processing.

13.2 Improval explains the sharing on the page where Users link their accounts, and in its privacy notice. The Partner will explain it in its privacy notice and wherever Users link their accounts in its service.

14. Individuals' rights

Each Party handles requests about the personal data it controls. If a Party receives a request that concerns the other Party's data, it will pass it on within 5 working days and give reasonable help.

15. Security

15.1 Each Party will keep appropriate technical and organisational measures in place to protect the shared data, including encryption in transit (all Partner API traffic uses HTTPS), access control and secure storage of the Credentials.

15.2 Improval is ISO 27001 and Cyber Essentials Plus certified, registered on the NHS Data Security and Protection Toolkit, and stores Improval data in the UK.

16. Personal data breaches

Each Party will tell the other without undue delay, and within 48 hours of becoming aware, of any personal data breach that affects the shared data, and cooperate in dealing with it. Each Party is responsible for any notification it must make to the ICO or to individuals.

17. Retention

17.1 The Partner will keep Improval user IDs, entry IDs and Credentials only for as long as needed to keep Linked Users' entries in sync, and delete a User's API key when the User unlinks or this agreement ends.

17.2 Improval keeps Partner Entries as part of the User's Improval account, under Improval's privacy notice, until the User deletes them or their account.

18. International transfers

Each Party is responsible for making sure any transfer of the shared data outside the UK, by it or its suppliers, meets UK data protection law.

19. Contacts

  • Improval: Duncan Walling, Director, 23 Lobsters Ltd, duncan@improval.com
  • Partner: the contact email on the Partner's Integrations page

General

  • Notices under this agreement are given by email to the contacts above.
  • This agreement is the whole agreement between the Parties about the Partner API, and replaces any earlier terms about it.
  • Improval can update these terms by giving 30 days' notice by email; the Partner can end this agreement under clause 10 if it doesn't accept the change. A signed agreement can only be changed in writing by both Parties, for example as a variation signed in Improval.
  • This agreement is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.

Acceptance and signatures

Improval records who accepted these terms for the Partner, and when. If this agreement is signed instead, it's signed electronically in Improval. The signature certificate at the end of the signed agreement records who signed for each Party, their role, and when.