One way NDA, patient app design briefing

One way NDA

A health company has to show a design studio an unreleased app, its employer pricing and its patient research. The studio is showing nothing back, which is exactly when an agreement should run in one direction.

Create a document with OneCraft7 A4 pages, editable, then download as a PDF

The document, page by page

Every page as it renders and as it prints, with nothing summarised. Read the wording before you reuse it.

Non-disclosure agreement

Patient App Design Briefing

Palewell Health discloses to Ori Studio

Palewell Health Pty Ltd
Dated 9 October 2026
Background

This agreement is made on 9 October 2026 between Palewell Health Pty Ltd, ABN 96 447 220 118, of 3 Hazel Street, South Yarra VIC 3141, called the Discloser, and Ori Studio Pty Ltd, ABN 24 610 903 771, of Level 2, 118 Gertrude Street, Fitzroy VIC 3065, called the Recipient.

Palewell is briefing Ori Studio to design the patient app for its chronic care programme. To write a useful proposal the studio has to see the unreleased product, the pricing offered to employers, the clinical protocol and the patient research behind it. Nothing flows the other way, so the obligations in this agreement sit entirely on the Recipient.

1. What the words mean
1.1
Confidential information
Anything the Discloser gives the Recipient, or that the Recipient sees or hears at a Palewell site or meeting, in any form. It includes the categories in the schedule and anything derived from them, such as notes, sketches, wireframes and summaries the Recipient makes itself.
1.2
The purpose
Preparing a proposal for the design of the patient app and, if that proposal is accepted, carrying out the design work under a separate agreement. Nothing else is the purpose, including pitching to any other health business.
1.3
Personnel
The named individuals listed in clause 3, and no one else at the Recipient or at any company related to it.
2. What the Recipient must do
2.1
Use it only for the purpose
The Recipient uses the confidential information only for the purpose, and not to develop a product of its own, to advise another client in health, or to inform a pitch to any competitor of the Discloser.
2.2
Protect it
The Recipient applies at least the standard of care it applies to its own most sensitive material, and never less than reasonable care, in line with the controls in clause 5.
2.3
Make no unnecessary copies
Copies are made only where the purpose requires them, are held in the one workspace named in clause 5, and are logged so that every copy can be found when clause 9 is triggered.
2.4
Do not take it apart
The Recipient will not decompile, reverse engineer or attempt to derive the source code, data model or algorithms behind anything it is shown, including the clickable prototype.
2.5
Keep it separate
The confidential information is not combined with the data or design libraries of the Recipient in a way that makes it impossible to extract and delete later. Shared components used in the work are recorded so they can be identified.
3. Who at the Recipient may see it
Name
Role
What they may see
Ori Danby
Creative director
Everything in the schedule
Priya Menon
Senior designer
Everything in the schedule
Sam Achterberg
Motion designer
Screens and copy only, no research or clinical material
Lucia Ferrand
Account manager
Commercial documents only
3.1
Changing the list
Anyone added to the list needs the written consent of the Discloser and must sign an acknowledgement of this agreement before receiving anything. Anyone who leaves the project loses access within two business days.
4. Subcontractors
4.1
Only with consent
The Recipient may not pass anything to a freelancer, a studio partner or an offshore team without prior written consent. Where consent is given, the subcontractor signs the same terms directly with the Discloser, and the Recipient stays liable for what it does.
5. How it must be held
1
One workspace
Everything lives in the shared Palewell project workspace. Nothing is sent as an email attachment, posted in a chat channel or copied to a personal drive.
2
Managed devices only
Work happens on encrypted, passcode locked devices issued by the Recipient. No personal laptops, no personal phones and no shared studio machines.
3
Nothing printed offsite
Printing is done at the Palewell office and the printed material stays there. Wireframes pinned to a studio wall are a disclosure.
4
No third party tools
The confidential information is not put into any cloud transcription, translation or artificial intelligence service, whether free or paid, without written consent.
5
Access reviewed monthly
The Recipient reviews who holds access on the first business day of each month and confirms the list to the Discloser by email.
6. What is not covered
1
Already public
Information already public, or that becomes public without any act or omission of the Recipient or its personnel.
2
Already held
Information the Recipient can show from its own dated records it held before disclosure, free of any obligation of confidence.
3
Lawfully received elsewhere
Information received from a third party entitled to disclose it, which in a field this small is rarer than it sounds.
4
Independently developed
Work developed by people at the Recipient with no access to anything disclosed, and demonstrable from its own records.
7. Compelled disclosure
7.1
If the law requires it
The Recipient may disclose what a law, court or regulator compels, tells the Discloser first where it is lawful to do so, discloses only what is actually required, and asks that the material be treated confidentially by whoever receives it.
8. No rights and no promises
8.1
No licence
Nothing here gives the Recipient any right in the product, the brand, the research or the protocol. Seeing a prototype grants no right to reproduce any part of it, in any project.
8.2
No obligation to disclose or to engage
The Discloser decides what to share and may stop at any point. Signing this agreement does not commit the Discloser to appoint the Recipient, to run a pitch fairly, or to pay for time spent reading a briefing.
8.3
No warranty
The information is provided as it stands. The Discloser does not warrant that it is accurate, complete or current, and the Recipient may not rely on it as the basis for any decision of its own.
9. Return and certification
9.1
Give it back
Within 10 business days of a written request, or of the Discloser deciding not to proceed, the Recipient returns or destroys everything it holds, including its own notes, sketches and summaries derived from it.
9.2
Certify it
A director of the Recipient certifies in writing that clause 9.1 has been carried out, naming the systems checked. Automatic backups that cannot be selectively purged may remain, and stay subject to this agreement until they expire.
10. Term, remedies and general
10.1
How long it runs
The obligations run for three years from the date each item was disclosed. The clinical protocol and the patient research remain confidential for as long as they are not public, without a time limit.
10.2
Breach
The Recipient tells the Discloser within one business day of becoming aware of any unauthorised access, use or disclosure. The Discloser may seek an injunction without proving loss, and this does not limit any other remedy.
10.3
General
Notices go by email to the signatories. This agreement may be varied only in writing signed by both parties. The laws of Victoria apply. It may be signed in counterparts and by electronic signature.
10.4
No assignment
The Recipient may not assign or novate this agreement, or the material held under it, to anyone, including on a sale of its business or a change of control, without the prior written consent of the Discloser.
10.5
Costs
Each party bears its own costs of negotiating and signing this agreement, and of taking part in the briefing and any proposal that follows. Nothing here is a commitment to pay a pitch fee.
10.6
Entire agreement
This agreement is the whole agreement between the parties about confidentiality. It replaces the confidentiality wording in the briefing email of 2 October 2026 and anything said in the introductory call.
Why this one runs in a single direction
Ori Studio is disclosing nothing that needs protecting. Making the agreement mutual would have added obligations on Palewell for no reason, and would have slowed the briefing down while two legal teams argued about a risk only one of them carries.
Schedule, what is being disclosed
Category
What it includes
Protected until
Product
Clickable prototype and the feature roadmap to June 2028
Public release of each feature
Commercial
Employer pricing and the terms of three signed pilots
Three years from disclosure
Clinical
The chronic care protocol and its evidence summary
Indefinitely
Research
De-identified patient journey interviews with 22 participants
Indefinitely

The research is de-identified before it leaves Palewell, so no participant can be recognised from it. That is a protection for the participants, not a reason to treat the material as less confidential, and it is why the research row has no end date.

Signed by a person authorised to bind each party. The Recipient confirms that each individual named in clause 3 has read this agreement before receiving anything under it.

For Palewell Health Pty Ltd
Name
:
Position
:
Date
:
For Ori Studio Pty Ltd
Name
:
Position
:
Date
:

Section by section

What each section is for, so you can keep the ones you need and drop the rest.

Cover
Names the briefing, who discloses and who receives, so the direction of the agreement is clear before it is opened.
Background
The parties, why the studio needs to see unreleased material, and a plain statement that nothing flows the other way.
Definitions
Confidential information including derived material, the purpose the disclosure is limited to, and who counts as personnel.
Obligations of the recipient
Five duties covering use, care, copies, reverse engineering and keeping the material separable from the studio's own libraries.
Who may see it
Four named individuals with what each may access, plus the rule for adding someone and the two day removal on leaving.
Subcontractors
No freelancer, partner studio or offshore team without written consent, and any approved one signs directly with the discloser.
How it must be held
Five controls: one workspace, managed devices, no offsite printing, no third party AI or transcription tools, and a monthly access review.
What is not covered
The four exclusions, each written with the evidence the recipient would have to produce to rely on it.
No rights and no promises
No licence in the product or brand, no obligation to disclose anything or to appoint the studio, and no warranty that the material is accurate.
Return and certification
Ten business days to return or destroy, a director's certificate naming the systems checked, and the narrow carve out for backups.
Schedule of disclosures
Four categories with what each includes and how long it stays protected, including two that never expire.

Clauses in this document

What makes this document work

It names the people, not just the company

Four individuals with three different levels of access, and a rule that anyone added has to sign an acknowledgement first. Confidentiality that binds an entity but not a person is difficult to enforce and easy to leak through.

The security controls are concrete

One workspace, managed devices only, nothing printed off site, no cloud transcription or artificial intelligence tools, and an access list confirmed on the first business day of each month.

Destruction has to be certified by a director

Not just returned. A director confirms in writing that everything is gone, including the studio's own notes and sketches derived from the briefing, and names the systems that were checked.

Questions people ask

When should an NDA be one way?

When only one side is actually disclosing. Making it mutual out of habit adds obligations to the party with nothing to protect, and it usually adds a fortnight of legal review to a briefing that could have started on Monday.

Does an NDA cover notes the recipient writes themselves?

Only if it says so. This one defines confidential information to include anything derived from the disclosure, naming notes, sketches, wireframes and summaries, which is what makes the destruction clause meaningful.

Can an NDA stop material being put into AI tools?

Yes, and it should be explicit. A general duty of care will not obviously cover pasting a clinical protocol into a transcription service, so this agreement names cloud transcription, translation and artificial intelligence tools and rules them out without written consent.

What is a certificate of destruction?

A written confirmation, signed by someone senior, that the material has actually been destroyed and where it was looked for. It converts a promise into a dated record that can be produced later if something surfaces.

How should an NDA handle subcontractors?

Name them as a category and bind them on the same terms. This NDA gives subcontractors their own section, requiring written obligations at least as strict before anything is passed on. A design studio almost always uses a contractor somewhere, and an NDA that ignores it is either breached or quietly worked around.

Who may see the confidential material?

Only the people who need it for the stated purpose. This NDA sets that out in its own section, limiting access to named personnel working on the briefing. Defining the circle at the start is what makes return and certification meaningful later, because there is a list to check the material against.

Build your own in about a minute

The button below opens the generator with this use case already described. Change the wording to match your own, generate, then edit anything you like.

Make one like this

Other document examples

Venue hire agreement template with bump in, noise and a bond

Hall hire disputes are almost always about time and noise: the hirer thought the hire started when guests arrived, and the committee thought music stopped at eleven. This agreement prices bump in, the event and bump out as three separate periods, and ties the curfew to the planning permit rather than to a preference.

Coaching agreement template that sets the sessions, the scope and the boundaries

The clause that makes a coaching agreement worth signing is the one that says what coaching is not. This three page example for a business coach and a founder sells twelve sessions for $3,600, maps them to four blocks of work, and states in clause 2.2 that the coach is not a psychologist, counsellor, accountant, lawyer or financial adviser.

IT support services agreement with response times by priority

Managed support is sold on a monthly fee and judged on how fast the phone gets answered when nobody can work. This agreement grades every ticket into four priorities with a published response and resolution target, credits the fee when the target is missed, and writes down exactly what the provider hands back on the way out.

Want the steps in the builder? Read Create a document with AI, then Send a PDF for e-signature. For everything this generator can do, see the document maker.

Sources

Written and checked by the OneCraft team. Last checked .