Organization Legal Documents

1. This agreement

This agreement is between HealthCIP ("we", "us", "the Processor") and the clinic that creates an organization on HealthCIP ("you", "the Clinic", "the Data Fiduciary"). It governs the Clinic's subscription to the platform and the processing of patient data through it.

It operates alongside two other documents, and all three bind the Clinic:

• the Data Processing Agreement on this page, which sets out how patient data is processed on the Clinic's instructions;
• the Terms of Service, which govern the use of accounts by clinic staff and by patients.

Where this agreement and the Terms of Service disagree about the Clinic's subscription, this agreement prevails. By creating an organization, the person doing so confirms they are authorised to bind the Clinic to all three.

2. Who is who

The distinction matters more than any other in this agreement, and it decides who answers to whom.

Party	Role	What it means
The Clinic	Data Fiduciary	Decides why patient data is processed, and is answerable to patients and to the Data Protection Board for it. Owns notice, consent, breach notification, and grievance redressal towards its own patients.
HealthCIP	Data Processor	Processes patient data only on the Clinic's documented instructions, and only to provide the platform. Does not decide what is collected or how long it is kept.

The Clinic remains the Data Fiduciary for every patient record it holds on HealthCIP. Subscribing to a platform does not transfer that responsibility, and nothing in this agreement should be read as accepting it on the Clinic's behalf.

3. The subscription

• The subscription begins when the organization is created, and continues until it is terminated under section 11.
• The Clinic is responsible for the accounts it creates and for what those accounts do. Every user must have their own account, because the audit trail attributes every read and every change to the account that made it.
• The Clinic must keep at least one active administrator account. If the last administrator is removed or disabled, administration of the organization stops, and recovering it requires our involvement.
• We may suspend an organization where this agreement is breached, where a security risk requires it, or where fees are unpaid. Except where a security risk makes it impossible, we will tell the Clinic before doing so and say why.

4. The Clinic's obligations to its patients

These are the Clinic's duties, resting with it and not with us. We provide the machinery that records them.

• Notice. Give patients the notice the law requires before their personal data is entered into the platform, covering what is collected, why, who it is shared with, and how long it is kept.
• Consent. Obtain valid consent from patients — or rely on another lawful basis where one applies — before their data is entered. Registration screens that record a patient's own acceptance do not take this duty away from the Clinic; a record entered by the front desk for a walk-in patient has to have been agreed in person.
• Accuracy. Keep patient records accurate and complete, and act on correction requests. The platform stores what it is given.
• Children. Where a patient is a child, obtain verifiable parental consent as the law requires before their data is entered.
• Retention. Decide how long each category of record must be kept. The law on medical records can require retention for longer than a patient may wish, and that decision is the Clinic's to make and to explain.
• Requests from patients. Answer access, correction, erasure, and grievance requests. The platform carries the request and keeps the record of the decision; the answer is the Clinic's.
• Staff. Ensure that staff who use the platform are trained on it, are authorised to see the data they can reach, and have their access removed when they leave. Access in this system is granted by role, and roles are granted by the Clinic.

5. What we do with clinic data

• Patient data belongs to the Clinic and to its patients. We claim no ownership over it and use it for no purpose other than providing the platform and supporting the Clinic in using it.
• We do not sell patient data, do not use it to train machine-learning models, and do not disclose it to anyone except as the Clinic instructs, as the Data Processing Agreement permits, or as the law requires.
• Where the law compels a disclosure, we will tell the Clinic before complying unless we are prohibited from doing so.
• Aggregated, de-identified information about how the platform is used may be used to operate and improve it. Nothing that identifies a patient, a clinic, or a member of staff is included in that.

6. Fees, billing, and taxes

• Fees, what each plan includes, and the billing period are set out on the pricing page and in the order the Clinic accepts. Where the two disagree, the order prevails.
• Fees are payable in advance for each billing period, exclusive of applicable taxes, which are charged in addition.
• We may change our prices for a renewal period by giving the Clinic at least [30] days' notice before that period begins. A price change does not apply to a period already paid for.
• Fees paid for a period already begun are not refundable, except where we terminate the subscription without cause, in which case the unused portion is refunded pro rata.
• Consultations paid for by patients through the patient portal are collected by the Clinic's payment gateway into the Clinic's own account. We are not a party to that transaction and do not hold those funds.

7. Support, availability, and changes to the service

• Support is available at support@healthcip.in. We aim to acknowledge a request within one working day; this is a target, not a commitment, and the remedies in section 12 do not attach to it.
• There is no uptime guarantee under this agreement unless one is agreed separately in writing. We run the platform with the intention that it is always available, and we maintain it, patch it, and take backups, but a clinic that needs a contractual availability commitment must ask for one.
• We may change, add, or withdraw features. Where a change would materially reduce what the Clinic's subscription provides, we will give at least [30] days' notice, and the Clinic may terminate under section 11 before the change takes effect.
• We may take the platform down for planned maintenance. Where the interruption is expected to be significant, we will give notice in advance and prefer a window outside the Clinic's working hours.

8. Acceptable use

The Clinic must not, and must not permit anyone using its accounts to:

• use the platform for anything unlawful, or to store data it has no right to hold;
• attempt to reach data belonging to another organization, or to a patient of another clinic;
• probe, scan, or test the platform's security, or attempt to defeat its access controls, except under a written penetration-testing authorisation from us;
• copy, decompile, or reverse-engineer the platform, or resell it or provide it to another party as a service;
• upload anything designed to disrupt it — malware, or a payload aimed at the AI features' guardrails.

The Clinic is answerable for what its accounts do on the platform. Where an account is used this way, we may suspend it, and the Clinic remains liable for the fees for the period.

9. AI-assisted features

• Several features generate drafts — treatment plans, prescriptions, summaries, and matches — using a third-party language model. They are decision support. A clinician reviews, edits, and approves everything before it reaches a patient record, and that approval step is part of how the feature is designed, not a setting.
• The Clinic decides whether each AI feature is enabled for its organization, and which of its users may reach it.
• The Clinic must tell us promptly if a generated draft is wrong in a way that suggests a patient could be harmed by relying on it.
• The categories of data sent to the model provider, and the minimization applied before they are sent, are described in the Privacy Notice. The Clinic should read that section before enabling the features.

10. Security and incidents

• We operate the platform's security: access control, encryption in transit, storage of credentials in a form that cannot be read back, and an audit log of who read and changed what.
• We will tell the Clinic without undue delay after becoming aware of a personal data breach affecting its data, with what is known and what is not. The Clinic, as Data Fiduciary, notifies the Data Protection Board and its patients; we do not send those notices on the Clinic's behalf.
• The Clinic must tell us promptly about anything that may affect the platform's security: a compromised account, a lost device holding a session, or a suspicion that data has been reached by someone who should not have it.

11. Term, termination, and getting your data back

• The Clinic may terminate at the end of a billing period by giving notice in writing. Either party may terminate immediately where the other commits a material breach and does not remedy it within [30] days of being told.
• On termination the Clinic's access ends. Patient data is retained for [30] days so that it can be retrieved, and is then deleted from live systems and from backups on the platform's normal backup cycle.
• Data is exported on request, in a machine-readable form, before deletion. A Clinic that needs its records out should ask during the retention window — after it closes, the data is gone and we cannot recover it.
• Clinical records the Clinic is required by law to keep remain the Clinic's responsibility after termination, and are covered by the same export.

12. Liability

• Neither party excludes liability that cannot lawfully be excluded, including under the Digital Personal Data Protection Act, 2023.
• Subject to that, our total liability arising out of this agreement is limited to the fees the Clinic paid us in the [12] months before the event giving rise to the claim.
• We are not liable for indirect or consequential loss, or for lost profits, lost revenue, or lost goodwill.
• We are not liable for clinical decisions. The platform records and presents information; the judgement, and the responsibility for it, rests with the treating clinician.
• The Clinic indemnifies us against claims arising from patient data entered without a lawful basis, or from the Clinic's use of the platform contrary to this agreement.

13. Changes to this agreement

We may change this agreement. A material change needs at least [30] days' notice, given by email to the Clinic's administrators and shown in the platform. The Clinic may terminate before a material change takes effect if it does not accept it. Continuing to use the platform after the notice period ends the acceptance of the changed terms.

14. Governing law and jurisdiction

This agreement is governed by the laws of India. Subject to any applicable dispute resolution procedure, the courts at Ernakulam, Kerala shall have exclusive jurisdiction over any dispute arising out of or in connection with this agreement.

15. Contact

Sales and subscriptions	sales@healthcip.in
Support	support@healthcip.in
Data protection and grievances	grievance@healthcip.in

This Data Processing Agreement ("Agreement") is accepted by the clinic at the time it creates its organization on HealthCIP. The version accepted, the person who accepted it, and the date are recorded by the platform and are available to the clinic's administrators.

1. Parties

Data Fiduciary	The clinic, hospital, or diagnostic centre that creates the organization on HealthCIP and accepts this Agreement ("the Clinic").
Data Processor	HealthCIP ("the Processor").

2. Background

The Clinic uses HealthCIP to manage its patients. In doing so it enters personal data of its patients — including health data — into the platform. The Clinic determines what data is entered and for what purpose; the Processor hosts and operates the platform on the Clinic's instructions.

Section 8(2) of the Digital Personal Data Protection Act, 2023 requires a Data Fiduciary engaging a Data Processor to do so under a valid contract. This is that contract.

3. Definitions

Terms used but not defined here have the meanings given in the Digital Personal Data Protection Act, 2023 and the rules made under it. "Personal Data" means personal data of the Clinic's patients, staff, and other individuals whose data the Clinic enters into the platform. "Processing" means anything done with that data, including storing it.

4. The Processor's obligations

The Processor shall:

• Process only on instructions. Process Personal Data only to provide, secure, and support HealthCIP as described in the Clinic's order, and not for any purpose of its own.
• Not sell or share. Not sell Personal Data, not use it for advertising, and not disclose it except as this Agreement or the law requires.
• Keep it secure. Maintain the technical and organisational measures set out at section 8, appropriate to the risk.
• Notify breaches. Tell the Clinic without delay on becoming aware of a personal data breach affecting the Clinic's data, with the information the Clinic needs in order to meet its own notification obligations to the Data Protection Board of India and to affected individuals.
• Assist with data principal requests. Provide the Clinic with the means to answer access, correction, erasure, and consent-withdrawal requests — the platform records such requests and makes them available to the Clinic for decision — and assist the Clinic in answering them.
• Restrict access. Limit access to Personal Data to personnel who need it to provide the service, who are bound by confidentiality obligations.
• Delete or return on termination. As provided at section 10.
• Assist with compliance. Provide the information the Clinic reasonably needs to demonstrate compliance with its own obligations.

5. The Clinic's obligations

The Clinic shall:

• Obtain valid consent. Obtain each patient's consent before their personal data is entered, or record that consent through the platform at the point of registration. The platform enforces this: a patient record cannot be created without a recorded consent.
• Give notice. Make a privacy notice available to its patients, as required by section 5 of the Act. The notice published by the Processor is provided for this purpose and the Clinic may supplement it.
• Answer data principal requests as Data Fiduciary, including requests that the platform records on its behalf, and comply with the retention obligations that apply to medical records.
• Enter data lawfully and accurately, and not instruct the Processor to process data in a way that breaches the Act.
• Manage its users, including revoking access promptly when a user leaves the Clinic's employment.
• Appoint a grievance officer where the Act requires one, and make that contact available to its patients.

6. Sub-processors

The Clinic authorises the Processor to engage the following sub-processors. Each is bound by obligations no less protective than those in this Agreement.

Sub-processor	Purpose	Data involved
Amazon Web Services	Hosting of the application, database, and uploaded files; email delivery	All Personal Data
Razorpay	Online payment processing	Name, contact details, amount payable
Large language model providers	Generating AI-assisted drafts at the request of a treating doctor	Clinical content of the record on which the feature is invoked, minimised where the feature does not require identifiers

The Processor shall give the Clinic notice before adding a sub-processor that processes patient data, and the Clinic may object. The Processor remains liable to the Clinic for its sub-processors' performance of these obligations.

7. Cross-border transfer

Personal Data is stored on the Processor's cloud infrastructure. Some processing — in particular the AI features at section 6 — involves transfer outside India to the model providers listed above. Any such transfer is subject to the restrictions the Central Government may impose under the Act, and the Clinic will be told about the processing involved so that it can describe it to its patients.

8. Security measures

• Role-based access control, so staff see only what their role requires.
• An audit log recording who created, changed, or deleted a record, and when.
• Passwords stored only as one-way hashes.
• Encryption of data in transit, and at rest by the storage provider.
• Limits on how often the public registration forms may be submitted, and from where.
• Regular backups, with restoration tested.
• Segregation of each organization's data from every other organization's.

9. Audit

On reasonable written request, no more than once a year (except following a personal data breach affecting the Clinic), the Processor shall provide the Clinic with information sufficient to demonstrate compliance with this Agreement. Where an on-site audit is genuinely necessary, the parties shall agree its scope, timing, and cost in advance, and it shall not compromise the confidentiality or security of other customers' data.

10. Term, deletion, and return

• This Agreement takes effect when the Clinic accepts it, and continues while the Clinic uses HealthCIP.
• On termination, the Clinic may export its data. The Processor makes an export available for the period stated in the order, after which the data is deleted.
• Deletion is subject to any retention the Clinic must observe under medical records law. The Clinic must tell the Processor if it requires data retained for that reason, and must ensure it has exported anything it needs before the export period ends.
• The Processor may retain data where the law requires it, and shall process it for no purpose other than that requirement.

11. Liability

Each party is liable for its own failure to meet its obligations under the Act and under this Agreement. The Processor is liable to the Clinic for the acts and omissions of its sub-processors as if they were its own. Nothing here limits any liability that cannot lawfully be limited.

12. Limitation of liability

To the extent permitted by law, neither party is liable for indirect or consequential loss, loss of profit, or loss of goodwill. The Processor's total liability arising out of or in connection with this Agreement is limited to the subscription fees paid by the Clinic to the Processor during the twelve (12) months immediately preceding the event giving rise to the claim.

Nothing in this Agreement limits liability that cannot lawfully be limited, including liability under the Digital Personal Data Protection Act, 2023.

13. Governing law and jurisdiction

This Agreement is governed by the laws of India. Subject to any applicable dispute resolution procedure, the courts at Ernakulam, Kerala shall have exclusive jurisdiction over any dispute arising out of or in connection with this Agreement.

14. Changes

This Agreement is versioned. Where it changes materially, the Clinic will be asked to accept the new version before continuing to use the service. The version the Clinic accepted, and who accepted it, are recorded by the platform.

15. Contact

Data protection and privacy: grievance@healthcip.in
Commercial and support: support@healthcip.in