Terms for a SaaS product sold to the NHS or public sector

Public bodies buy on their own terms where they can, and a supplier's SaaS terms have to be drafted knowing that: as the document that governs smaller purchases made without a tender, as the supplier's opening position where the body's standard terms are offered, and as the source of the schedules the body will accept from the supplier even when it insists on its own contract. NHS and public customers ask for data security assurances, accept transparency and freedom of information as facts of life, and expect payment on time and exit on their terms. I draft those terms for a fixed fee of £995, delivered in five working days.

Who this is for

SaaS businesses in England and Wales selling to NHS trusts, integrated care boards, GP practices, local authorities, central government bodies, police and other public sector customers, whether through frameworks, tenders or direct purchases below the thresholds.

What matters in SaaS terms for public sector customers

Procurement, frameworks and whose terms apply

Public bodies buy under the Procurement Act 2023 for contracts above the thresholds, through frameworks with their own call-off terms, or directly for smaller purchases under their own standing orders; the supplier's terms should be drafted to govern the direct purchases, to be the supplier's proposed terms where a body will consider them, and to contain the schedules (service description, service levels, data processing, security) that survive when the body's contract is used. The terms should say that they apply unless a signed contract provides otherwise, so that a purchase order does not silently import the body's terms.

Data security and the assurances public customers require

NHS organisations expect suppliers handling patient or staff data to meet the NHS data security and protection standards and to hold recognised security certifications, and other public bodies ask for equivalent assurance; the terms should state the standards and certifications the supplier holds, commit to maintaining them, contain the processor terms under Article 28 of the UK GDPR with security under Article 32 and breach notification that lets the body meet Article 33, and address where data is hosted and any transfers under Article 46. Patient information carries a common law duty of confidence as well, and the terms should acknowledge it.

Freedom of information and transparency

Public bodies are subject to the Freedom of Information Act 2000 and to transparency obligations under the Procurement Act 2023 that require contracts above certain values to be published, so the terms should acknowledge that the body may disclose the contract and information about it, identify the supplier's commercially sensitive information so that the body can consider the exemptions, and require the body to consult the supplier where reasonable before disclosure, without fettering the body's decision, which the Act does not permit.

Accessibility, equality and the body's public duties

The body must make its digital services accessible under the Public Sector Bodies (Websites and Mobile Applications) (No. 2) Accessibility Regulations 2018 and must have regard to equality under the Equality Act 2010, and it will ask the supplier to warrant the product's accessibility and to provide an accessibility statement; the terms should state the standard met and the remediation commitment. Public customers may also require compliance with their policies on modern slavery, with a statement under section 54 of the Modern Slavery Act 2015 where the supplier's turnover requires one, and on safeguarding where the product touches vulnerable people.

Payment terms and the thirty-day rule

Contracting authorities must pay undisputed invoices within thirty days under section 68 of the Procurement Act 2023 and must flow that obligation down their supply chains, and the terms should state payment within thirty days of a valid invoice, the invoicing requirements the body's finance function needs (purchase order numbers, itemisation), VAT, and interest under the Late Payment of Commercial Debts (Interest) Act 1998 where a body pays late, which suppliers rarely enforce but should preserve. Subscription pricing should be stated per year with any uplift mechanism, because public budgets are annual.

Liability, termination for convenience and exit

Public bodies' standard terms provide for uncapped or high liability and for termination for convenience on notice, and the supplier's terms should offer a defensible cap tested under section 11 of the Unfair Contract Terms Act 1977 with the data protection position addressed, accept termination for convenience on a stated notice period with fees to the termination date, and provide the exit the body will require: data export in an open format, cooperation with a replacement supplier, and deletion after a stated period. The Procurement Act 2023 implies termination rights into public contracts under section 78 in specified circumstances, and the terms should not conflict with them.

What it costs

SaaS terms of service, £995. Your standard customer-facing terms. Five working days.

Buying online forms the engagement on payment. The scope is what the saas and technology contracts page describes, you accept the Terms of Service at checkout, and I email you within four working hours to get started. If you would rather ask something first, email me.

What you get

• A bespoke contract drafted for how your product is sold, delivered and supported
• Service levels you can meet, with remedies that are proportionate rather than aspirational
• A liability position that is defensible and will survive enterprise procurement
• IP and data provisions that fit together rather than contradicting each other
• A commercial note on where you will get pushback and what is worth conceding
• One round of amendments

What is not included

• Negotiating individual enterprise deals, which I quote separately
• Advice on the law of jurisdictions outside England and Wales
• Technical security certification or audit
• Regulatory advice for regulated sectors such as financial services or health

Questions I am often asked

An NHS trust wants to use its own contract rather than our terms. What is our terms document for then?

It governs smaller purchases made on a purchase order, it is the supplier's opening position where the trust will consider it, and its schedules are what the trust accepts into its contract. Most of the value is in the schedules.

Can we refuse termination for convenience?

You can propose it, but public bodies rarely agree. The terms accept it on a stated notice period with fees to the termination date and recovery of committed costs, which is the position most bodies sign.

Will a public customer disclose our pricing under freedom of information?

It may, and larger contracts are published under the transparency rules. The terms identify what is commercially sensitive so the body can consider the exemptions, but the decision is the body's.

Related guidance and services

• SaaS and technology contracts, £995, the service this page describes
• Contract review, £495
• Data protection agreements and privacy terms, £795
• Reviewing a contract for selling into the NHS
• Reviewing a public sector contract before you bid

This page is general guidance for businesses in England and Wales, not advice on your own circumstances. Last reviewed: September 2026. Email geoffrey@caesar.co.uk.