TERMS OF SUPPLY

Microsoft 365 Health Assessment (Vitals)

Version 2.6 · Effective 19 October 2026

1. Who these terms are between

1.1 Innova Group. Innova Technologies Group Ltd, registered in England and Wales under company number 17205930, registered office 7 Stromberg Street, Anlaby, Hull, HU10 7ER, trading as Innova Group, VAT number 519893442 (“Innova Group”, “we”, “us”).

1.2 Client. The organisation identified when the order is placed (“you”, “your”, the “Client”).

1.3 These Terms of Supply and the Data Processing Agreement (“DPA”) together form the agreement for the Assessment (the “Agreement”). They are accepted online before customer processing begins. We record the version accepted and provide a copy electronically.

1.4 If these Terms conflict with the DPA on a data-protection matter, the DPA prevails to the extent of that conflict.

2. Business customers only

2.1 The Assessment is supplied only for business purposes and is not offered to consumers.

2.2 By accepting the Agreement, you confirm that you are acting wholly or mainly for purposes relating to your trade, business, craft or profession and that you have authority to bind the organisation identified in the order.

2.3 If you are a sole trader, you may purchase only where the Assessment is acquired wholly or mainly for your business. Nothing in these Terms excludes any right that cannot lawfully be excluded.

3. What you are buying

3.1 Vitals is a read-only, point-in-time assessment of the Microsoft 365 tenant identified in the order. It analyses the areas described in clause 4 and produces a written Report.

3.2 Vitals Assessment — £99 plus VAT. The Vitals Assessment Report provides scores, findings, affected-item counts and prioritised recommendations. Identifying examples such as individual file paths, user names and guest email addresses are removed before the Vitals Assessment Report is rendered.

3.3 Vitals In-Depth — £295 plus VAT. Vitals In-Depth includes the Vitals Assessment output plus a detailed remediation document (the “Worklist”), which may include file and folder paths, sharing links and account identifiers, together with a remediation review call of up to one hour to be taken within 30 days after release.

3.4 A Vitals Assessment Report is released through a token-protected bearer link sent to the purchasing/delivery email address. The link remains usable by anyone who holds it until it expires or is deleted, and expires no later than 30 days after delivery.

3.5 A Worklist included with Vitals In-Depth is generated but not delivered by email when processing finishes. We withhold it until the scheduled Worklist review has taken place and an authorised Innova Group administrator expressly releases it to the authorised recipient. Before authorised release, the Worklist is inaccessible through its report token even if that token is known or possessed. On release, the report link is issued and the 30-day retention period begins.

3.6 Report-access links are bearer links and remain usable until they expire no later than 30 days after delivery (Vitals Assessment) or release (Vitals In-Depth Worklist). You should retain any copy you need before expiry. After the applicable retention period, we cannot promise to reproduce the original Report without running a new Assessment.

3.7 Verification Assessment. Where a Vitals In-Depth order expressly includes a Verification Assessment, Innova Group may re-run the same read-only Assessment approximately 90 days after release of the Worklist so that the Client can compare the later position with the earlier Assessment. Verification is available only where stated in the order or service description and is not included merely because tenant access remains technically available. Where an order includes a verification, it is run from a minimum baseline rather than from the Worklist or from your contact details, which Innova Group removes within 30 days after release under the Data Processing Agreement. Innova Group may retain the minimum assessment baseline needed to perform it, for no longer than 180 days after release. The baseline is removed when the verification completes or lapses. The baseline is the identifier of your Microsoft 365 tenant and the stored results of the earlier Assessment, not your contact details; the Worklist and other report documents follow their own shorter retention. Where the order was placed through an IT provider, the verification report is delivered to the IT provider’s current contact details or partner portal. Otherwise Innova Group holds no contact details for you and cannot tell you that the verification report is ready: you should contact Innova Group at hello@tenantvitals.com, quoting the order reference, no earlier than approximately 90 days after release and within the 30 days that follow, and Innova Group will send the verification report once to the email address you give at that time, which it uses for that delivery only and does not keep beyond the minimal delivery record that the send requires. A verification report is removed 30 days after it was delivered or, if it was not delivered, 30 days after the verification was completed.

3.8 The Client may revoke Microsoft Entra access at any time. If the access required for an included Verification Assessment is not available when verification falls due, Innova Group may invite the Client to restore it within a reasonable period. If it is not restored, the Verification Assessment may lapse without a refund attributable to that verification element. A verification that cannot be run because that access is not restored, or that has not been completed 30 days after it fell due, lapses. The Data Processing Agreement explains that a Verification Assessment does not extend the retention of your contact details or the Report.

4. Scope and limitations of the Assessment

4.1 Read-only. The Microsoft Graph permissions used by Vitals are read-only. Vitals cannot create, alter or delete tenant content or configuration. It does not open, read or copy the contents or bodies of documents, email messages or Teams chats.

4.2 Included areas. The Assessment may examine SharePoint and Teams content metadata; users, guests, groups, roles and administrators; Microsoft subscriptions and per-person licence/service-plan status; Intune-managed devices and compliance state; Conditional Access configuration, adoption and effectiveness using limited recent sign-in metadata; tenant identity settings and relevant directory audit events; Microsoft 365 activity over the relevant Microsoft reporting period, including per-person SharePoint/OneDrive activity counts; presence of selected account contact methods; tenant sharing defaults; Microsoft Secure Score and controls; third-party application consent; MFA registration/capability; sensitivity labels; site/page hygiene; and Copilot readiness derived from those areas.

4.2A Conditional Access effectiveness. For this check Vitals temporarily reads a limited subset of Microsoft Entra interactive sign-in records from the previous seven days. It does not request names, UPNs/email addresses, IP addresses, locations, device details or application names for this purpose. Account, group and role identifiers needed for counting distinct accounts and applying policy exclusions are used transiently in memory and are not persisted for this purpose; only aggregate counts and derived assessment results are stored.

4.3 Public DNS. Vitals also checks published SPF, DKIM and DMARC records for domains associated with the Assessment. These are public DNS records. Domain names may be sent to a public DNS resolver operated by Cloudflare or Google for the lookup. No Microsoft 365 tenant permission is used for this step.

4.4 Mailbox rules. Mailbox-rule analysis is included in the standard Assessment. Vitals uses the read-only MailboxSettings.Read permission to assess mailbox settings, including forwarding and inbox rules. It may read rule names, conditions and forwarding addresses, but it does not read the contents or bodies of email messages.

4.5 Automated recommendations. Vitals produces prioritised recommendations automatically, from its analysis of the available Microsoft 365 evidence. In the current service, assessment findings are not sent to an AI provider to generate them. The DPA contains the detailed processing description.

4.6 Sampling — important. The Assessment examines up to 15 site collections, up to 500 items within each sampled site, and detailed sharing permissions on up to 200 items per sampled site. On larger tenants, the Report is therefore a representative sample rather than an exhaustive examination of every item. The Assessment is not a certification, penetration test, statutory audit or guarantee that every issue has been identified.

4.7 Point in time. The Report describes the tenant as it appeared when the Assessment ran. Changes before or after that time are outside the Report.

4.8 Advisory. Findings and recommendations are advisory professional opinions based on the information sampled and the checks performed. They are not legal, regulatory, accounting or compliance advice and do not certify compliance with any law, standard or framework.

4.9 The Report itself will state that the Assessment is a point-in-time sample and not an exhaustive audit.

5. Size limit

5.1 Published Vitals Assessment and Vitals In-Depth prices apply to organisations with up to 100 staff and a single Microsoft 365 tenant.

5.2 If the organisation is larger or requires more than one tenant to be assessed, we may pause before processing and offer a separate quotation. If you do not accept it, we will refund the affected order in full.

6. What we need from you

6.1 Before the Assessment can run, the Agreement must be accepted and a Global Administrator of the tenant must approve the requested read-only application permissions through Microsoft Entra.

6.2 The payer and the administrator approving tenant access may be different people. You are responsible for providing accurate recipient and approver details and ensuring that the person granting consent is authorised to do so.

6.3 If access has not been approved 30 days after payment, we may close the order and refund the price paid in full. No tenant Assessment will have been run.

6.4 You must not provide us with instructions, access or data that you are not authorised to provide.

7. Turnaround, price, payment and refunds

7.1 We aim to make the Report available within three working days after the required tenant access has been approved. This is a service target, not a guaranteed deadline.

7.2 Prices are in pounds sterling and exclude VAT, which is added where applicable.

7.3 Payment is taken in advance through Stripe. We do not receive or store full payment-card details.

7.4 We will refund the affected Assessment in full if we cannot complete it because of a technical failure for which we are responsible. If a Report has not been made available within 14 days after the required access was approved, you may request a full refund.

7.5 Except where these Terms expressly provide otherwise or the law requires otherwise, no refund is due after a Vitals Assessment Report has been delivered or, for Vitals In-Depth, after the Worklist has been released.

8. Confidentiality and data protection

8.1 Each party shall keep confidential information received from the other in connection with the Assessment confidential and use it only for the Agreement, except where disclosure is required by law or made to professional advisers or service providers who are bound by appropriate confidentiality obligations.

8.2 We treat tenant information and the Report as confidential. The Worklist should be treated as particularly sensitive because it may identify exact files, links and accounts requiring remediation.

8.3 The DPA governs our processing of Personal Data on your behalf. Assessment Personal Data is subject to the retention and deletion controls in the DPA.

8.4 We may retain a pseudonymised assessment comparison profile of your latest delivered Assessment: the structured results that a later comparison needs, without any Report document, kept solely to compare with a future Assessment of the same tenant. It does not include your tenant name or domain, the raw tenant identifier, site names or addresses, or ordinary contact details, and it is linked to you only through a pseudonymous identifier that we can recompute when the tenant is next assessed, so it is not anonymous. We do not use it for any other purpose, and we remove it if you ask us to remove your tenant’s data under the Data Processing Agreement. We will not publish a benchmark that identifies you without your prior written consent.

9. Ownership and permitted use

9.1 You may retain, reproduce and share your Report within your organisation and with your professional advisers and IT provider.

9.2 Vitals software, assessment logic, scoring methodology, report layout, branding and other underlying intellectual property remain owned by Innova Group or its licensors. No ownership of those materials transfers to you.

9.3 Except to the extent expressly permitted under a current IT Provider / MSP Agreement between Innova Group and an IT provider involved in supplying the Assessment to you, you must not remove Innova Group attribution from a Report, represent the Report as having been produced by another provider, reverse engineer Vitals, or resell access to the Vitals software. Nothing in this clause permits resale or sublicensing of the Vitals software.

10. IT providers and purchases for another organisation

10.1 An IT provider or other intermediary may purchase an Assessment for a client only where it is authorised to do so by the organisation whose tenant will be assessed.

10.2 Where the purchaser is acting as a processor for its client and Innova Group would process the end client’s Personal Data as a sub-processor, the direct-customer DPA does not by itself govern that chain. The purchaser must enter into Innova Group’s applicable IT-provider/sub-processor terms before the Assessment is run.

10.3 The organisation whose tenant is assessed must be correctly identified in the order and the required Microsoft Entra administrator consent must be granted for that tenant.

10.4 Where an IT provider supplies or supports your Assessment under a current IT Provider / MSP Agreement with Innova Group, the provider’s rights and obligations concerning branding, attribution, commentary and use of the Report are governed by that agreement. These Terms do not grant the provider any additional right to resell or sublicense the Vitals software.

11. Removing access and end of service

11.1 Tenant access can be revoked by the tenant administrator through Microsoft Entra at any time. Revocation prevents further use of that authorisation.

11.2 We do not use the tenant authorisation after completion of the Assessment unless you give a further documented instruction, for example to run a new Assessment.

11.3 Retention and deletion of Assessment Personal Data after completion are governed by the DPA.

12. Liability

12.1 Nothing in the Agreement excludes or limits either party’s liability for death or personal injury caused by negligence, fraud or fraudulent misrepresentation, or any other liability that cannot lawfully be excluded or limited.

12.2 Subject to clause 12.1, neither party is liable to the other for any indirect or consequential loss, or for loss of profit, revenue, anticipated savings, business opportunity or goodwill, arising out of or in connection with the Assessment.

12.3 Subject to clauses 12.1 and 12.4, Innova Group’s total aggregate liability arising out of or in connection with a single Assessment and the Agreement governing it, whether in contract, tort (including negligence), breach of statutory duty or otherwise, shall not exceed £10,000.

12.4 The cap in clause 12.3 does not operate to exclude or limit any liability to the extent that applicable law prohibits that exclusion or limitation. Nothing in the Agreement changes any responsibility or liability imposed directly on either party by Data Protection Legislation.

12.5 The Assessment is a sampled, point-in-time advisory service. Subject to clause 12.1, Innova Group is not responsible for an issue that falls outside the stated scope or sampling limits, arises after the Assessment, results from inaccurate/incomplete information or access supplied by the Client, or results from a Client decision to implement, not implement or modify a recommendation except to the extent the loss was caused by Innova Group’s breach of the Agreement or negligence.

12.6 Nothing in this clause requires the Client to waive a right of a Data Subject or regulator that cannot lawfully be waived.

13. General

13.1 The version of the Agreement accepted for an order is the version that governs that order. We may update future versions, but an update does not retrospectively alter an existing order unless both parties agree or the change is required by law.

13.2 Neither party is liable for delay or failure caused by circumstances beyond its reasonable control, but this does not excuse obligations concerning confidentiality, security or Personal Data to the extent they remain capable of performance.

13.3 No person other than the parties has any right under the Contracts (Rights of Third Parties) Act 1999 to enforce the Agreement.

13.4 If any provision is invalid or unenforceable, the remaining provisions continue in effect and the invalid provision is treated as modified to the minimum extent necessary to make it valid where legally possible.

13.5 A failure or delay in exercising a right is not a waiver of that right.

13.6 The Agreement is governed by the law of England and Wales and the courts of England and Wales have exclusive jurisdiction, subject to any mandatory law that applies.

14. Acceptance record

14.1 Acceptance is recorded electronically against the order. We may record the accepting person’s name and job title, organisation, date and time, IP address and the version of the Agreement accepted, and provide a copy electronically.

14.2 We retain contractual, tax, payment and accounting records where necessary for our own legal and business obligations. These records are distinct from Assessment Personal Data processed on your behalf under the DPA.