Terms of Service

• Service — the Inaimed application at medflow.forgeitsystems.com, its installable app, and the backend services supporting them.
• Customer — the clinic, hospital or practice that operates a workspace on the Service.
• Workspace — a Customer's isolated area within the Service, containing its patients, channels, tasks and members.
• User — an individual authorised by a Customer to access a Workspace, including you.
• Customer Data — everything Users enter into a Workspace: patient records, messages, tasks, notes and uploads.

The Service is intended for healthcare professionals and the administrative staff who support them, in the course of their work. To hold an account you must be at least 18 years old and have the authority of a Customer to access its Workspace.

• Register with accurate details and keep them current.
• Keep your password confidential. Do not share an account, and do not let anyone else use your credentials — audit records attribute every action to the account that performed it.
• Tell your Workspace administrator, and us, promptly if you suspect your account has been compromised.
• Accept that your administrator can change your role or remove your access at any time, and that your access ends when the Customer's agreement with us ends.

You are responsible for everything done through your account.

The Service provides clinical coordination tools: workspaces per clinic, patient-linked channels and messaging, patient records, task tracking and assignment, direct messages, file attachments, an activity feed and usage analytics.

It is a coordination layer and nothing more. In particular:

• It is not a medical device and has not been assessed, registered or certified as one under the Medical Devices Rules, 2017 or any comparable regime.
• It is not clinical decision support. It does not interpret clinical data, recommend treatment, or flag clinical risk. Any summarising, searching or querying feature returns only what Users have entered, and may be incomplete or out of date.
• It is not a medical record system. It does not replace your institution's medical records, hospital management system or statutory registers, and must not be treated as the authoritative source for any clinical fact.
• It is not an emergency or alerting channel. Messages and notifications are delivered on a best-effort basis, may be delayed, and may not be delivered at all. Do not use the Service to communicate anything time-critical.
• It does not transmit prescriptions or communicate with patients. Patients have no access to the Service.

Features evolve. Some are early, and we may add, change, limit or withdraw any part of the Service. Where a change materially reduces functionality a Customer relies on, we will give its administrators reasonable notice.

You agree that you will:

• Verify any clinical information in the Service against the authoritative record before acting on it.
• Not rely on the Service being available, or on a message or task notification arriving, when patient safety depends on it.
• Record in your institution's medical record anything required to be recorded there, regardless of what you enter here.
• Exercise your own professional judgement, and comply with the standards of your professional council and your institution's clinical governance policies.

We provide software. We do not provide medical services, and no clinician-patient relationship arises between us and any patient.

As set out in our Privacy Policy, the Customer is the Data Fiduciary for Customer Data and we are its Data Processor. The Customer therefore represents and warrants, on an ongoing basis, that it:

• Has a lawful basis for entering each item of patient data into the Service, and has given patients any notice and obtained any consent that applicable law requires.
• Is permitted, under its own policies and any regulatory obligations binding on it, to use a third-party coordination tool for this purpose.
• Grants Workspace access only to people who need it, and revokes it promptly when they no longer do — understanding that all members of a Workspace can see all patients and channels in it.
• Will enter only the patient data that coordinating care requires, and will not enter payment card data, government identity numbers or credentials.
• Will keep Customer Data accurate, and will respond to its own patients' requests about their data.

The Customer instructs us to process Customer Data as needed to provide the Service. We will not use it for any other purpose.

You must not:

• Access, or try to access, a Workspace, patient record or account you are not authorised to see.
• Use the Service to store or transmit anything unlawful, defamatory, harassing or infringing.
• Upload malware, or anything designed to disrupt or gain unauthorised access to the Service.
• Probe, scan or test the security of the Service, or circumvent its authentication, rate limits or access controls, except under a written authorisation from us.
• Scrape, bulk-export or systematically extract Customer Data except through features we provide for that purpose.
• Reverse engineer, decompile or attempt to derive the source code of the Service, or resell, sublicense or provide it as a service to anyone else.
• Remove patient data from the Service and disclose it to anyone who is not entitled to receive it.
• Use the Service to develop a competing product, or to benchmark it for publication without our written consent.

We may suspend access immediately where we reasonably believe this section has been breached, or where continued access risks harm to patients, other Users or the Service. Where circumstances allow, we will tell the Customer's administrators first.

Our handling of personal data is governed by our Privacy Policy, which forms part of these terms. Please read it — it sets out the roles of Customer and processor, what we collect, how we secure it, how long we keep it, and your rights under the Digital Personal Data Protection Act, 2023.

The Service is not certified under HIPAA, SOC 2 or ISO 27001, and we do not offer a Business Associate Agreement by default. Encryption at rest, retention schedules and any other control your institution requires must be agreed with us in writing before you rely on them.

We work to keep the Service available, but we do not guarantee uninterrupted access. The Service may be unavailable during maintenance, or because of faults, network problems or events outside our reasonable control.

Unless a Customer has a separate written agreement with us setting out service levels and support response times, the Service is provided without any committed uptime or support commitment. Where we have agreed service levels in writing, those prevail over this section.

Where a Customer has agreed fees with us, they are payable as set out in that agreement or order form, exclusive of applicable taxes which the Customer bears. Fees for a period already begun are non-refundable except where the law requires otherwise.

Where access is provided free of charge — during a pilot, trial or evaluation — we may change or withdraw it at any time, and sections 11 to 13 apply with full force.

The Service, including its software, interface, design system and documentation, belongs to Forge IT Systems and its licensors. We grant the Customer and its Users a limited, non-exclusive, non-transferable, revocable right to use the Service for the Customer's internal clinical operations for as long as the agreement lasts. No other rights are granted.

Customer Data belongs to the Customer. The Customer grants us only the licence needed to host, process, transmit, back up and display it in order to provide the Service, and to produce aggregated statistics that do not identify any Customer, User or patient.

If you send us feedback or suggestions, we may use them without obligation or compensation to you.

Each party may receive information the other treats as confidential. Each will protect the other's confidential information with at least reasonable care, use it only to perform this agreement, and disclose it only to people who need it and are bound by equivalent obligations.

This does not apply to information that is public through no breach of this section, was already known without obligation, or is independently developed. Where disclosure is legally compelled, the disclosing party will give the other reasonable notice where it is lawful to do so.

To the maximum extent permitted by law, the Service is provided "as is" and "as available", without warranty of any kind. We disclaim all implied warranties, including merchantability, fitness for a particular purpose, non-infringement, and any warranty arising from course of dealing.

We do not warrant that the Service will be uninterrupted, error-free or secure against every threat, that notifications will be delivered, that defects will be corrected, or that Customer Data will be free of inaccuracy — its accuracy depends entirely on what Users enter. We are not responsible for any clinical outcome, and nothing in the Service constitutes medical advice.

Nothing in these terms excludes any liability or warranty that cannot lawfully be excluded, including for death or personal injury caused by our negligence, or for fraud.

Subject to section 12's final paragraph, and to the maximum extent permitted by law:

• Neither party is liable for indirect, incidental, special, consequential, exemplary or punitive damages, or for lost profits, lost revenue, lost goodwill or lost or corrupted data, however caused and on any theory of liability, even if advised of the possibility.
• Our total aggregate liability arising out of or relating to the Service, in all claims combined, will not exceed the greater of (a) the fees the Customer paid us for the Service in the twelve months immediately preceding the event giving rise to the claim, or (b) ₹10,000.
• Where the Service is provided free of charge, our total aggregate liability will not exceed ₹10,000.

These limits apply in the aggregate across the Customer and all of its Users; they are not multiplied by the number of claimants. The parties agree that these limits are a reasonable allocation of risk given the nature of the Service and that the agreement would not be made on different terms.

The Customer will defend and indemnify us against any third-party claim, and any resulting loss, liability, damages, cost or reasonable legal fees, arising from:

• Customer Data, including a claim that entering, storing or disclosing it breached a patient's rights or any law.
• The Customer's or its Users' breach of section 5 (Customer obligations) or section 6 (Acceptable use).
• Any clinical decision taken by the Customer or its Users.

We will notify the Customer promptly of any such claim, let the Customer control the defence of it, and provide reasonable cooperation at the Customer's expense. The Customer may not settle a claim in a way that imposes an obligation on us without our consent.

These terms apply for as long as you use the Service. You may stop at any time, and a Customer administrator may close a Workspace or remove a User.

We may suspend or terminate access: immediately, for a breach of section 6 or a risk of harm; or otherwise on reasonable notice. Either party may terminate for material breach that is not cured within 30 days of written notice.

On termination the Customer's right to use the Service ends. For 30 days afterwards we will, on written request, make Customer Data available for export, and will then delete or return it as the Customer directs, except where law requires us to retain it. Sections 10 to 14 and 16 survive termination.

We may amend these terms as the Service and the law develop. The "last updated" date at the top of this page reflects the current version.

For material changes we will give Customer administrators reasonable notice — by email or in the application — before they take effect. Continuing to use the Service after that date means you accept the amended terms. If you do not accept them, stop using the Service and ask your administrator to close your account.

These terms are governed by the laws of India, without regard to conflict-of-laws rules. The parties submit to the exclusive jurisdiction of the courts at Chennai, Tamil Nadu, India.

Before starting proceedings, the parties will attempt in good faith to resolve any dispute by discussion between senior representatives for 30 days after written notice of the dispute. This does not prevent either party from seeking urgent injunctive relief.

• Entire agreement — these terms and the Privacy Policy, together with any written agreement or order form between us and a Customer, are the whole agreement on their subject matter. Where a signed agreement conflicts with these terms, the signed agreement prevails.
• Severability — if a provision is unenforceable, it is limited or severed to the minimum extent necessary and the rest remains in force.
• No waiver — failing to enforce a provision is not a waiver of it.
• Assignment — you may not assign these terms without our written consent. We may assign them to an affiliate or in connection with a merger, acquisition or sale of assets.
• Force majeure — neither party is liable for a failure to perform caused by an event beyond its reasonable control, excluding payment obligations.
• No third-party rights — these terms create no rights for anyone who is not a party to them, including patients.
• Notices — we may give notice by email to your registered address or in the application; you may give notice to us at the address in section 19.

Questions about these terms, or anything else: foundersoffice@forgeitsystems.com, or Forge IT Systems, Chennai, Tamil Nadu, India.