Terms of Service — HealthDesk

These Terms of Service ("Terms") govern your use of HealthDesk, a cloud-based clinical operating system developed and maintained by Innov8alpha ("Company", "we", "us"). By subscribing to any HealthDesk license (Pro, Premium, or Enterprise), you ("Client", "Healthcare Provider") agree to these Terms in addition to our General Terms of Service.

HealthDesk provides: electronic medical records (EMR), e-prescriptions, appointment scheduling, queue management, billing and invoicing, WhatsApp patient reminders, teleconsultation, AI medical scribe, patient self-check-in, and multi-department hospital management.

HealthDesk is designed to comply with the Ayushman Bharat Digital Mission (ABDM) framework and supports ABHA ID creation and health record synchronization.

While HealthDesk implements security controls equivalent to HIPAA (Health Insurance Portability and Accountability Act) standards for data protection, it is the Healthcare Provider's sole responsibility to:

• Ensure their use of HealthDesk complies with all applicable local, state, and national healthcare regulations
• Obtain necessary patient consent for electronic record keeping and data processing
• Maintain compliance with the Clinical Establishments Act and applicable state healthcare regulations
• Report data breaches to relevant authorities as required by applicable law
• Ensure staff members are trained on proper data handling procedures

Innov8alpha assists with compliance infrastructure but does not provide legal or regulatory compliance advice. Healthcare Providers should consult qualified legal counsel for compliance guidance.

Patient Health Information (PHI) processed through HealthDesk is treated with the highest level of security and confidentiality. Innov8alpha acts as a data processor; the Healthcare Provider is the data controller.

Data protection measures include:

• Encryption in transit (TLS 1.3) and at rest (AES-256) on enterprise-grade AWS infrastructure
• Role-based access controls (RBAC) with audit logging for all data access events
• Automated daily encrypted backups with 90-day retention and geo-redundant storage
• Physical and logical network segmentation of patient data
• Regular vulnerability assessments and penetration testing
• SOC 2 Type II aligned operational practices

Innov8alpha does not access, view, analyze, or use patient medical records for any purpose other than system maintenance, technical support (when explicitly authorized by the Healthcare Provider), and service improvement (using de-identified, aggregated data only).

By subscribing to HealthDesk, a Data Processing Agreement (DPA) is implicitly executed between Innov8alpha (Processor) and the Healthcare Provider (Controller). Key terms:

• Innov8alpha processes patient data exclusively on behalf of and under instruction from the Healthcare Provider
• Sub-processors (AWS, communication APIs) are disclosed and subject to equivalent security obligations
• Data is stored on servers located in India (AWS Mumbai region) unless otherwise agreed in writing
• Innov8alpha will notify the Healthcare Provider within 48 hours of discovering any confirmed data breach affecting patient data
• Upon termination, patient data is exported to the Healthcare Provider and permanently deleted within 60 days

Enterprise clients may request a custom DPA with additional terms. Contact hello@innov8alpha.com for enterprise data governance documentation.

The AI Medical Scribe feature converts voice notes into structured clinical documentation. The Healthcare Provider acknowledges:

• AI-generated clinical notes must be reviewed and approved by a qualified healthcare professional before becoming part of the official patient record
• The AI Medical Scribe is an assistive tool, not a diagnostic instrument
• Innov8alpha is not liable for clinical errors arising from unreviewed AI-generated documentation
• Voice recordings are processed and discarded after note generation; they are not stored permanently

HealthDesk targets 99.9% uptime for all cloud infrastructure. Given the critical nature of healthcare operations, scheduled maintenance is performed exclusively during 1:00 AM – 4:00 AM IST with 72 hours advance notice.

In the event of unscheduled downtime, Innov8alpha provides priority escalation for healthcare clients. Innov8alpha is not liable for clinical decisions made during system downtime; Healthcare Providers must maintain manual backup procedures for critical patient information.

HealthDesk subscriptions are billed monthly. Enterprise licenses may be invoiced quarterly or annually upon agreement.

Failed payment triggers a 14-day grace period (extended from standard 7 days due to healthcare data sensitivity). After the grace period, the account enters read-only mode for an additional 30 days. Data is exported and deleted 60 days after subscription lapse.

Innov8alpha's total aggregate liability shall not exceed the total subscription fees paid in the 12 months preceding the claim.

Innov8alpha is expressly not liable for:

• Clinical outcomes, misdiagnosis, or treatment errors
• Patient harm arising from incorrect data entry by healthcare staff
• Regulatory fines or penalties incurred by the Healthcare Provider
• Loss of patient data due to Healthcare Provider negligence in access management
• Any indirect, consequential, or punitive damages

Either party may terminate the subscription with 30 days written notice. Upon termination:

• All patient data is exported in standard interoperable formats (HL7 FHIR, CSV) within 14 days
• ABHA-linked records are delinked per ABDM guidelines
• All data is permanently deleted from Innov8alpha servers within 60 days of export confirmation
• The Healthcare Provider receives a certificate of data deletion upon request

These Terms are governed by Indian law, including the Information Technology Act 2000 and applicable healthcare data protection regulations. Disputes are subject to the exclusive jurisdiction of UP courts.