A User-Centric Electronic Health Record + AI for Caribbean Clinics

These Terms of Service (“Terms”) are a binding agreement between MedRegis Inc. (“MedRegis”, “we”, “us”, or “our”) and the organisation that subscribes to or uses the Service (the “Subscriber”, “you”, or “your”). They govern access to and use of the MedRegis website at https://medregis.com, the MedRegisEHR web and mobile applications, and all related products, features, and documentation (together, the “Service”).

The Service is a clinical and administrative tool intended for use by licensed healthcare organisations and their personnel. By creating an account, accepting these Terms electronically, or accessing or using the Service, you confirm that you have authority to bind the Subscriber and that the Subscriber agrees to these Terms, the MedRegis Privacy Policy, and the MedRegis Data Processing Addendum, which are incorporated by reference. If you do not agree, you must not access or use the Service.

(a) “Authorized User” means an individual who is a member of the Subscriber’s own workforce (such as an employed or contracted clinician, nurse, pharmacist, or administrative staff member) whom the Subscriber permits to access the Service solely for the Subscriber’s internal healthcare and business operations.

(b) “Administrator” means an Authorized User whom the Subscriber designates to manage its account, including the creation, modification, and removal of other Authorized Users.

(c) “Subscriber Data” means all data the Subscriber or its Authorized Users submit to or generate within the Service, including Patient Data. Subscriber Data does not include Controller Data or De-identified Data.

(d) “Patient Data” means personal data and sensitive personal data relating to the Subscriber’s patients, including medical records, that is processed within the Service.

(e) “Controller Data” means account, user, billing, usage, telemetry, and security and audit log data generated in connection with the Service, in respect of which MedRegis acts as data controller as described in the Data Processing Addendum and the Privacy Policy.

(f) “De-identified Data” has the meaning given in the Data Processing Addendum.

(g) “Confidential Information” means non-public information disclosed by one party to the other, including the non-public features, functionality, user interfaces, workflows, screens, design, and know-how of the Service, which are the Confidential Information of MedRegis.

(h) “Documentation” means the user guides and materials MedRegis makes available for the Service.

3.1 Authorized Users only. The Subscriber may permit access to the Service only to its own Authorized Users. Each Authorized User must be assigned unique credentials tied to a named individual. The Subscriber’s Administrators are responsible for creating, modifying, and removing Authorized Users and for maintaining an accurate and current record of them.

3.2 No third-party or competitor access. The Subscriber must not create accounts or profiles for, share credentials with, or otherwise grant access to the Service to any person or entity that is not an Authorized User. Without limiting the foregoing, the Subscriber must not grant access to, or create any account or profile for, any competitor of MedRegis or any developer, operator, or agent of a product or service that competes with the Service. Any such grant is a material breach of these Terms.

3.3 Credential security. The Subscriber is responsible for maintaining the confidentiality of all account credentials, for restricting access to authorised devices, and for all activities that occur under its account, whether or not authorised by the Subscriber. The Subscriber must not permit credential sharing among individuals.

3.4 Notification. The Subscriber must notify MedRegis immediately at [email protected] upon becoming aware of any actual or suspected unauthorised access to, disclosure of, or use of the Service or of any Subscriber Data.

3.5 Accuracy and age. The Subscriber warrants that account information is accurate and current, and that all Authorized Users are at least eighteen (18) years of age and authorised by the Subscriber to use the Service. The Subscriber must designate and keep current a contact for security and privacy notices, including notices of a personal data breach. Notices sent by MedRegis to that contact, or to the account’s registered contact where none is designated, are deemed received by the Subscriber.

Subject to these Terms, MedRegis grants the Subscriber a limited, non-exclusive, non-transferable, non-sublicensable licence to access and use the Service and Documentation solely for the Subscriber’s internal healthcare and business operations during the subscription term. All rights not expressly granted are reserved by MedRegis.

The Subscriber must not, and must not permit any Authorized User or third party to:

(a) use the Service other than for the Subscriber’s internal healthcare and business operations, or for the benefit of any third party;

(b) reverse engineer, decompile, disassemble, or otherwise attempt to derive the source code, structure, or underlying ideas of the Service, except to the extent this restriction is prohibited by applicable law;

(c) access or use the Service to build, train, support, or improve a competing or similar product or service, or to benchmark or evaluate the Service for a competitor;

(d) copy, reproduce, screenshot, record, or recreate the features, functionality, user interfaces, workflows, or design of the Service, in whole or in part;

(e) use any robot, spider, scraper, or manual process to monitor, index, or copy any part of the Service without MedRegis’s prior written consent;

(f) circumvent, disable, or interfere with any access control, security, or authentication feature of the Service;

(g) attempt to gain unauthorised access to the Service or to any server, network, or database connected to it;

(h) introduce any virus, worm, or other harmful code, or take any action that impairs the integrity or performance of the Service;

(i) remove or obscure any proprietary notice; or

(j) use the Service in any way that violates any applicable law or regulation, or infringes the rights of any person.

6.1 Obligations. Each party must protect the other’s Confidential Information using at least reasonable care, must not disclose it except to personnel with a need to know who are bound by confidentiality obligations, and must use it only to perform under these Terms. The Subscriber acknowledges that the non-public elements of the Service are the Confidential Information of MedRegis and must not be disclosed to, or made accessible by, any third party or competitor.

6.2 Exclusions and survival. These obligations do not apply to information that is or becomes public through no fault of the receiving party, or that is independently developed without use of the Confidential Information. The obligations in this clause survive termination.

7.1 Ownership. The Service, and all intellectual property in it, including its original content, features, functionality, and design (but excluding Subscriber Data), are and remain the exclusive property of MedRegis and its licensors, and are protected by the laws of Barbados and other jurisdictions. Nothing in these Terms transfers any ownership of the Service to the Subscriber.

7.2 Feedback. If the Subscriber or its Authorized Users provide suggestions, ideas, or other feedback about the Service, MedRegis may use that feedback to operate, improve, and develop the Service without restriction or obligation. This does not transfer to MedRegis any pre-existing intellectual property of the Subscriber.

7.3 Publicity. MedRegis may identify the Subscriber as a customer, and use the Subscriber’s name and logo, in case studies, reference stories, and marketing or promotional materials only with the Subscriber’s prior written consent. The Subscriber may withdraw that consent on written notice, and MedRegis will cease the relevant use within a reasonable period, save for materials already published or distributed. Nothing in this clause permits the disclosure of Patient Data.

8.1 Ownership. As between the parties, the Subscriber owns all Subscriber Data, including Patient Data. As between the parties, MedRegis owns all De-identified Data created in accordance with the Data Processing Addendum.

8.2 Roles and Data Processing Addendum. For the purposes of the Data Protection Act, 2019-29 of Barbados (the “Act”) and any other applicable data protection law, the Subscriber is the data controller of Patient Data and MedRegis is the data processor. The MedRegis Data Processing Addendum governs that processing, forms part of these Terms, and satisfies the requirement under the Act for a written contract between controller and processor.

8.3 Subscriber responsibilities. The Subscriber warrants that it has a lawful basis to process Patient Data, that it has provided all required notices and obtained all required consents, and that its grant of access to Authorized Users complies with applicable law. The Subscriber is responsible for any exposure of Subscriber Data that results from its own acts or omissions, including the provisioning of access in breach of clause 3.

8.4 Security. MedRegis maintains administrative, technical, and physical safeguards designed to protect Subscriber Data, including role-based access controls, encryption of data in transit and at rest, and change logging of Patient Data recording who made a change, when, and what was changed, as further described in the Privacy Policy and the Data Processing Addendum.

8.5 Incident notification. Personal data breaches affecting Patient Data are governed by clause 8 of the Data Processing Addendum, which sets out MedRegis’s notification obligations, when MedRegis is treated as becoming aware of a breach, and the assistance MedRegis will provide to enable the Subscriber, as controller, to meet its own notification obligations to the supervisory authority with jurisdiction over it and to affected data subjects.

8.6 Licence to process Subscriber Data. The Subscriber grants MedRegis a limited, non-exclusive, worldwide licence to host, store, process, and transmit Subscriber Data solely to provide, maintain, secure, and support the Service, and to comply with the Subscriber’s documented instructions and applicable law. Except as expressly permitted by clauses 3.3 and 3.4 of the Data Processing Addendum, MedRegis acquires no other rights in Subscriber Data.

9.1 Billing. Parts of the Service are billed on a subscription basis in advance on a recurring monthly or annual cycle, as selected at purchase. A valid payment method is required, and the Subscriber authorises MedRegis to charge all applicable fees.

9.2 Automatic renewal. Each subscription renews automatically for a further term of the same length under the then-current Terms and fees, unless cancelled before the end of the current term through the account management page or by contacting MedRegis support.

9.3 Fee changes. MedRegis may modify fees effective at the start of the next renewal term, on reasonable prior notice. Continued use after a fee change takes effect constitutes acceptance of the change.

9.4 Refunds. Except where required by law or as expressly provided in the Data Processing Addendum, fees are non-refundable.

10.1 Suspension. MedRegis may suspend access to the Service immediately, in whole or in part, where it reasonably believes there is a security risk, unauthorised or third-party access, or a breach of clause 3 or clause 5, or as necessary to protect Subscriber Data or the Service. Where MedRegis suspends the Service, it will, where reasonably practicable and consistent with the reason for the suspension, preserve the Subscriber’s ability to access Patient Data on a read-only basis for the purpose of continuity of patient care.

10.2 Termination. Either party may terminate for material breach that remains uncured 30 days after written notice. MedRegis may terminate or suspend immediately for a breach of clause 3 (Access Control) or clause 5 (Restrictions), or where required by law.

10.3 Effect and data export. On termination, the Subscriber’s right to use the Service ends. Before the termination date, MedRegis will make the Subscriber Data available for export in a commonly used format, whether through self-service tools or by performing the export at the Subscriber’s request within a reasonable period. For sixty (60) days after termination (the “Retention Period”), MedRegis will retain the Subscriber Data and continue to apply the protections of these Terms and the Data Processing Addendum, during which the Subscriber may request a final export. On expiry of the Retention Period, MedRegis may delete the Subscriber Data, subject to any legal retention requirement and to the return-or-deletion terms of the Data Processing Addendum. The Subscriber remains solely responsible for retaining patient and medical records for the periods required by applicable law. Clauses that by their nature should survive termination will survive.

The Service is a tool to assist licensed healthcare providers and does not provide medical advice or clinical recommendations. All clinical decisions — including diagnosis, treatment, prescribing, and the interpretation of information within the Service — are the sole responsibility of the Subscriber and its qualified providers. MedRegis is not liable for any clinical decision, act, omission, or patient outcome arising from use of the Service.

Certain features of the Service use artificial intelligence, including AI-assisted transcription and documentation. AI-generated output may contain errors, omissions, or inaccuracies, is provided as a draft aid only, and must be reviewed and verified by a qualified provider before it is relied upon or entered into a patient record. The Subscriber and its providers remain solely responsible for the accuracy, completeness, and clinical appropriateness of any content derived from AI-assisted features. MedRegis does not warrant the accuracy of AI-generated output and is not liable for any decision made or action taken in reliance on it.

13.1 Changes to the Service. MedRegis may modify, update, add, or discontinue features of the Service from time to time. Where a change would materially reduce core functionality, MedRegis will provide reasonable prior notice.

13.2 Third-party dependencies. The Service relies on third-party services outside MedRegis’s control, including hosting, connectivity, clearinghouses, messaging channels, payment processors, and AI providers. MedRegis is not liable for failures, delays, or interruptions caused by such third-party services, though it will use reasonable efforts to address them.

Except as expressly stated in these Terms, the Service is provided “as is” and “as available”, and MedRegis disclaims all warranties, whether express, implied, or statutory, including warranties of merchantability, fitness for a particular purpose, and non-infringement, to the fullest extent permitted by law. MedRegis does not warrant that the Service will be uninterrupted or error-free. This clause does not exclude any warranty that cannot be excluded under applicable law.

15.1 General limitation. To the fullest extent permitted by law, neither party will be liable for any indirect, incidental, special, consequential, or punitive damages, or for any loss of profits, revenue, or data, arising out of or relating to these Terms, even if advised of the possibility. Except for the Subscriber’s payment obligations, a party’s indemnification obligations, and either party’s breach of confidentiality other than in respect of Patient Data, each party’s total aggregate liability arising out of or relating to these Terms will not exceed the fees paid by the Subscriber to MedRegis in the twelve (12) months preceding the event giving rise to the liability. For the avoidance of doubt, MedRegis’s liability arising out of or relating to Patient Data, including any breach of confidentiality or security affecting Patient Data, is subject to that limit. Nothing in these Terms limits liability that cannot be limited under applicable law, including liability to data subjects or the supervisory authority under the Act.

15.2 Customer-caused incidents. MedRegis is not liable for any security incident, unauthorised access, data exposure, or loss arising from the Subscriber’s own acts or omissions, including the sharing of credentials, failure to manage or revoke Authorized User access, or the granting of access to any person in breach of clause 3.

The Subscriber will defend, indemnify, and hold harmless MedRegis and its officers, directors, employees, and agents from and against any claims, damages, losses, and reasonable expenses arising out of or relating to: (a) the Subscriber’s breach of clause 3 or clause 5; (b) any access to the Service granted by the Subscriber to a third party or competitor; (c) the Subscriber’s Patient Data or its instructions for processing it; or (d) the Subscriber’s violation of any law or of the rights of any person.

Neither party is liable for any failure or delay in performance (other than payment obligations) caused by events beyond its reasonable control, including acts of God, natural disasters, power or internet failures, acts of government, or third-party service failures. The affected party will use reasonable efforts to mitigate and resume performance.

These Terms are governed by the laws of Barbados, without regard to conflict-of-law principles. The parties submit to the exclusive jurisdiction of the courts of Barbados. Before commencing proceedings, the parties will attempt in good faith to resolve any dispute through discussion between senior representatives.

MedRegis may amend these Terms by posting the revised Terms and updating the “Last updated” date, and, for material changes, by providing reasonable notice by email or in-Service notice. Continued use of the Service after the revised Terms take effect constitutes acceptance. If the Subscriber does not agree, it must stop using the Service and may cancel in accordance with clause 9.

20.1 Entire agreement and non-reliance. These Terms, together with the Privacy Policy and Data Processing Addendum, are the entire agreement between the parties regarding the Service and supersede prior agreements on that subject. The Subscriber acknowledges that, in entering into these Terms, it has not relied on any statement, representation, or assurance that is not expressly set out in these documents.

20.2 Assignment. The Subscriber may not assign these Terms without MedRegis’s prior written consent. MedRegis may assign to an affiliate or in connection with a merger or sale of assets.

20.3 Waiver and severability. A failure to enforce a provision is not a waiver. If any provision is held unenforceable, it will be limited to the minimum extent necessary and the remaining provisions will remain in effect.

20.4 Notices. Notices to MedRegis must be sent to [email protected]; notices to the Subscriber may be sent to the account’s registered contact.

Email: [email protected]

MedRegis Inc. (“MedRegis”, “we”, “us”, or “our”) operates https://medregis.com and the MedRegisEHR web and mobile applications (together, the “Service”). This Privacy Policy explains how we collect, use, disclose, and safeguard personal data, and the rights available to individuals under the Data Protection Act, 2019-29 of Barbados (the “Act”) and other applicable data protection law.

2.1 MedRegis as controller. For personal data about our website visitors, prospective customers, and the account and contact details of the staff of subscribing organisations, MedRegis is the data controller. We are also the controller of the account, user, billing, usage, telemetry, and security and audit log data generated in connection with the Service (together with the foregoing, “Controller Data”). Controller Data is not Patient Data. This Policy governs that processing.

2.2 MedRegis as processor. For patient data and clinical records that a subscribing organisation (a “Subscriber”) processes within the Service (“Patient Data”), the Subscriber is the data controller and MedRegis is the data processor. MedRegis processes Patient Data only on the Subscriber’s documented instructions and in accordance with our Terms of Service and the Data Processing Addendum. If you are a patient, please direct privacy requests to the clinic that holds your records; we will assist that clinic in responding.

Where we act as controller, we may collect: (a) identity and contact data, such as name, email address, telephone number, and mailing address; (b) account data, such as username, role, and affiliated organisation; (c) billing data, noting that payment card details are handled by our payment processors and are not stored by us; (d) usage and device data, such as IP address, browser and device type, pages visited, and diagnostic data collected through cookies and similar technologies; and (e) security and audit log data, such as authentication events, administrative actions, and records of changes made within the Service, which we retain to secure the Service, investigate incidents, and meet our own legal obligations.

Where we act as processor, the Service stores and processes Patient Data entered by the Subscriber’s Authorized Users, which may include patient identifiers, demographic information, medical history, clinical notes, prescriptions, laboratory and diagnostic information, and related administrative and scheduling data. This is sensitive personal data under the Act and is subject to enhanced safeguards. We do not sell personal data. We do not use Patient Data for our own purposes, except to provide, secure, maintain, support and bill for the Service, to comply with law, and to create aggregated and de-identified data as described below.

Aggregated and de-identified data. We may create aggregated or statistical data derived from Patient Data that does not identify, and cannot reasonably be used to identify, any patient, individual or Subscriber. We create this data only by irreversible transformation, we do not attempt to re-identify it, and we do not disclose it in a form that identifies a Subscriber without that Subscriber’s consent. We may use it to improve and develop the Service, for quality improvement, research and benchmarking, and to report on population health trends. This data is not personal data, and is described further in the Data Processing Addendum.

AI-assisted features. Certain features, such as AI-assisted transcription and documentation, process Patient Data to generate draft content for the Subscriber. This processing is carried out as processor on the Subscriber’s instructions; MedRegis does not use Patient Data processed through these features for its own purposes, and AI-generated output is subject to provider review as set out in the Terms of Service. Third-party AI providers are engaged as sub-processors under the Data Processing Addendum through their commercial API terms. Under those terms, Patient Data submitted through the API is not used to train or improve the providers’ general-purpose models.

As controller, we use personal data to: provide, maintain, and secure the Service; manage accounts and subscriptions; provide support; process billing; communicate service and, where permitted, marketing messages (from which you may opt out); improve the Service; and comply with legal obligations. We rely on the lawful bases available under the Act, including performance of a contract, our legitimate interests (balanced against your rights), compliance with a legal obligation, and consent where required.

We use session, preference, security, and analytics cookies to operate and improve the Service. You can control cookies through your browser settings, though disabling some cookies may affect functionality.

We may disclose personal data: to service providers and sub-processors who process data on our behalf under written obligations of confidentiality and security; where required by law or valid request of a public authority; to protect the rights, property, or safety of MedRegis, our customers, or others; and in connection with a merger, acquisition, or asset sale. We do not sell personal data, and we do not disclose Patient Data except on the Subscriber’s instructions or as required by law.

We engage vetted sub-processors to process Patient Data on the Subscriber’s behalf, including cloud hosting, file storage, content delivery, messaging and email delivery, and AI-assisted features. Each is bound by written obligations of confidentiality and security. The current list, with functions and locations, is maintained in Schedule 3 of the Data Processing Addendum, which MedRegis may update in accordance with clause 6 of that Addendum. We also engage service providers that do not process Patient Data, such as analytics, application monitoring, and payment processing providers. Those providers process Controller Data only, are not sub-processors of Patient Data, and are not listed in Schedule 3. Where a Subscriber uses the messaging features of the Service, patient contact details and message content are disclosed to our messaging providers. Our SMS, voice and email provider acts as a processor for message delivery, and also as an independent controller of message content and communications metadata (such as recipient phone numbers, delivery status and message logs) for its own limited purposes, including securing its services, preventing abuse, meeting its legal obligations, and improving and analysing its services. Our WhatsApp provider is engaged directly by MedRegis under the WhatsApp Business Terms; under those terms it acts as a processor in respect of message content and message details, and retains message data for up to 30 days. These roles are identified in Schedule 3 of the Data Processing Addendum. Each Subscriber, as controller of its Patient Data, is responsible for having a lawful basis for these disclosures and for giving patients any notice, or obtaining any consent, required before using the messaging features. Subscribers who do not wish patient data to be disclosed to messaging providers should not use the messaging features of the Service.

The Service is hosted on cloud infrastructure located in the United States, and Patient Data is processed and stored in the United States. Content delivery and security are provided through Cloudflare. Processing in the United States is inherent to the provision of the Service. MedRegis engages each sub-processor under written data protection terms and, where offered by the sub-processor, relies on standard contractual clauses or equivalent transfer safeguards, and applies the technical and organisational measures described in the Data Processing Addendum to Patient Data wherever it is processed. Each Subscriber, as controller of its Patient Data, remains responsible for determining that the transfer is permitted under the data protection law applicable to it. The specific providers are listed in Schedule 3 of the Data Processing Addendum.

We maintain administrative, technical, and physical safeguards appropriate to the sensitivity of the data, including: role-based access controls limiting users to what their role requires; unique credentials for each user; multi-factor authentication that is available and can be enforced across a clinic; encryption of Patient Data in transit and at rest; change logging of Patient Data recording who made a change, when, and what was changed; confidentiality obligations and least-privilege access for personnel and contractors; backup and recovery procedures; and routine security patching. Physical and infrastructure security is provided by our cloud hosting providers. No method of transmission or storage is entirely secure, but we work to protect personal data and to respond promptly to security events.

Where MedRegis acts as controller and becomes aware of a personal data breach that is likely to result in a risk to the rights and freedoms of individuals, we will notify the Data Protection Commissioner of Barbados without undue delay and, where feasible, within 72 hours of becoming aware of it, and will notify affected individuals where required by the Act. Where MedRegis acts as processor, we will notify the affected Subscriber without undue delay and assist that Subscriber, as controller, in meeting its own notification obligations to the supervisory authority with jurisdiction over it, in accordance with clause 8 of the Data Processing Addendum.

We retain personal data only for as long as necessary for the purposes described in this Policy or as required by law.

Account and billing records: retained for the period required by applicable company and tax law — generally between 5 and 7 years after account closure, depending on the applicable financial record-keeping obligation — after which they are deleted.

Usage and diagnostic data: retained for up to 14 months, then deleted or aggregated.

Aggregated and de-identified data: retained indefinitely, as it is not personal data and cannot reasonably be used to identify any individual.

Patient Data: retained in accordance with the Subscriber’s instructions and the post-termination Retention Period set out in the Terms of Service and the Data Processing Addendum. The Subscriber, as controller, remains responsible for retaining patient and medical records for the periods required by applicable law.

Subject to the Act, individuals have rights to access their personal data, to request rectification or erasure, to restrict or object to certain processing, to data portability, and to prevent processing for direct marketing. To exercise these rights in respect of data for which we are controller, contact us using the details below, and we will respond within the timeframe required by the Act. For Patient Data held within a clinic’s records, please contact the relevant clinic, which is the controller; we will support the clinic in responding. Individuals also have the right to lodge a complaint with the Data Protection Commissioner of Barbados or, where they are located outside Barbados, with the supervisory authority with jurisdiction over them.

The Service is intended for use by Authorized Users aged eighteen (18) or older. This Policy does not restrict a clinic, as controller, from maintaining records of patients of any age within the Service in the course of providing care; such records are Patient Data processed on the clinic’s instructions.

We may update this Policy from time to time. We will post the updated Policy, update the effective date, and, for material changes, provide notice by email or a prominent notice within the Service before the change takes effect.

For privacy questions or to exercise your rights, contact our Data Protection Officer at [email protected].

1.1 Processor role. This Data Processing Addendum (“Addendum”) applies where MedRegis processes Patient Data on behalf of the Subscriber under the Terms of Service. For that Patient Data, the Subscriber is the data controller and MedRegis is the data processor. In the event of a conflict between this Addendum and the Terms of Service in relation to the processing of Patient Data, this Addendum prevails.

1.2 Controller Data. MedRegis acts as data controller in respect of account, user, billing, usage, telemetry, and security and audit log data generated in connection with the Service (“Controller Data”). Controller Data is not Patient Data and is not subject to this Addendum. MedRegis processes Controller Data to provide, secure, support, improve and bill for the Service, to meet its own legal obligations, and to produce aggregated and de-identified statistics that do not identify the Subscriber, any patient or any individual. MedRegis’s processing of Controller Data is described in its Privacy Policy.

Terms such as “personal data”, “sensitive personal data”, “processing”, “data controller”, “data processor”, “data subject”, and “personal data breach” have the meanings given in the Data Protection Act, 2019-29 of Barbados (the “Act”). “Patient Data” and other capitalised terms have the meanings given in the Terms of Service. “Applicable Data Protection Law” means the Act and any other data protection law applicable to the Subscriber’s processing of Patient Data. “De-identified Data” has the meaning given in clause 3.4.

3.1 MedRegis processes Patient Data only on the Subscriber’s documented instructions, including as set out in the Terms of Service, this Addendum, and Schedule 1, unless required to act otherwise by law, in which case MedRegis will inform the Subscriber of that legal requirement before processing, unless the law prohibits it.

3.2 MedRegis will inform the Subscriber if, in its opinion, an instruction infringes Applicable Data Protection Law. MedRegis will not sell Patient Data and, except as permitted by clauses 3.3 and 3.4, will not use Patient Data for its own purposes.

3.3 Permitted purposes. Notwithstanding clause 3.2, MedRegis may process Patient Data to: (a) provide, secure, maintain, troubleshoot, support and bill for the Service; (b) comply with Applicable Data Protection Law or other applicable law; and (c) create De-identified Data in accordance with clause 3.4. Processing under this clause forms part of the Subscriber’s documented instructions under clause 3.1.

3.4 De-identified Data. “De-identified Data” means aggregated or statistical data derived from Patient Data that does not identify, and cannot reasonably be used to identify, any patient or other individual. MedRegis will create De-identified Data only by irreversible transformation, will not retain within De-identified Data any key or other information that would enable re-identification, and will hold De-identified Data separately from Patient Data. MedRegis may use and disclose De-identified Data for any lawful purpose, including improving and developing the Service, quality improvement, research, benchmarking, and reporting on population health trends, provided that MedRegis:

(a) will not attempt to re-identify De-identified Data, and will not permit any third party to do so;

(b) will not disclose De-identified Data in a form that identifies the Subscriber, or that could reasonably be used to identify the Subscriber, without the Subscriber’s prior written consent; and

(c) will apply appropriate technical and organisational measures to the de-identification process and to De-identified Data.

De-identified Data is not personal data or Patient Data, and clauses 9 and 11 do not apply to it. MedRegis’s rights under this clause survive termination of the Terms of Service and this Addendum.

MedRegis ensures that persons authorised to process Patient Data are bound by confidentiality obligations and are trained on their data protection responsibilities, and that access is limited to those who need it to deliver the Service.

MedRegis implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk, taking account of the sensitive nature of Patient Data. These measures are described in Schedule 2.

6.1 General authorisation. The Subscriber gives MedRegis general authorisation to engage the sub-processors listed in Schedule 3 and any additional or replacement sub-processors engaged in accordance with this clause 6, including the third-party providers of AI-assisted features, to process Patient Data. Service providers that do not process Patient Data are not sub-processors for the purposes of this Addendum and this clause 6 does not apply to them.

6.2 Flow-down and responsibility. MedRegis will enter into a written agreement with each sub-processor imposing data protection obligations that are materially equivalent to those in this Addendum, to the extent applicable to the services provided by that sub-processor, and remains responsible for the performance of each sub-processor’s obligations.

6.3 Notice of changes. Before authorising a new sub-processor to process Patient Data, MedRegis will give the Subscriber notice by any reasonable means, including by email to the Subscriber’s registered contact, by notice within the Service, or by publishing an updated list of sub-processors.

6.4 Objection. The Subscriber may object to a new sub-processor on reasonable data protection grounds by written notice given within thirty (30) days of notice under clause 6.3, specifying the specific and substantiated data protection risk arising from the proposed sub-processor. An objection that does not identify such a risk is not a valid objection under this clause. If no valid objection is received within that period, the new sub-processor is deemed accepted.

Where the Subscriber makes a valid objection, the parties will work together in good faith to address it. No termination right arises under this clause where MedRegis offers a reasonable alternative that avoids the objected-to sub-processor or that otherwise reasonably addresses the risk identified, including by additional technical, contractual or organisational measures.

If the parties are unable to resolve the objection within thirty (30) days, the Subscriber may, as its sole and exclusive remedy, terminate the affected part of the Service or, where the objected-to sub-processor is integral to the Service as a whole, the Service, on thirty (30) days’ written notice. MedRegis will refund any unused prepaid subscription fees covering the period after termination for the terminated portion. Onboarding, implementation, set-up and other one-off fees are not refundable.

6.5 Emergency replacement. Where a sub-processor ceases to provide its services, suffers a personal data breach, or otherwise presents an urgent security or service-continuity risk, MedRegis may engage a replacement sub-processor immediately and will notify the Subscriber as soon as reasonably practicable afterwards. The Subscriber’s objection right under clause 6.4 runs from that notice.

6.6 Changes that are not new sub-processors. The following do not constitute the addition of a new sub-processor and do not require notice under clause 6.3:

(a) the use of additional services, features, products or regions of an existing sub-processor;

(b) an affiliate of an existing sub-processor engaged under the same agreement and subject to the same data protection obligations;

(c) a successor to an existing sub-processor by merger, acquisition or corporate reorganisation; and

(d) a service provider that does not process Patient Data.

6.7 Sub-processors acting as independent controllers. Certain sub-processors process limited categories of Patient Data as independent controllers for their own restricted purposes, such as securing their services, preventing misuse and abuse, meeting their own legal obligations, and improving their services. Where this is the case, it is identified in Schedule 3. MedRegis’s obligations under clause 6.2 apply to those sub-processors in respect of the Patient Data they process on MedRegis’s behalf as processors, and not in respect of processing they carry out as independent controllers. MedRegis does not instruct, and is not responsible for, a sub-processor’s processing as an independent controller. The Subscriber, as controller, acknowledges that its use of the messaging features of the Service involves the disclosure of patient contact details and message content to those sub-processors on the terms identified in Schedule 3. The Subscriber is responsible for ensuring that it has a lawful basis for that disclosure, and for providing any notice and obtaining any consent required under Applicable Data Protection Law, before using the messaging features. MedRegis relies on the Subscriber’s instruction that it has done so.

7.1 Assistance. Taking account of the nature of the processing, MedRegis will provide reasonable assistance to the Subscriber, by appropriate technical and organisational measures, to enable the Subscriber to: (a) respond to requests from data subjects exercising their rights under Applicable Data Protection Law; (b) meet its security, breach-notification, and data protection impact assessment obligations; and (c) consult with the Data Protection Commissioner of Barbados or, in respect of a Subscriber established outside Barbados, the supervisory authority with jurisdiction over that Subscriber (the “Commissioner”), where required.

7.2 Service functionality. The Service provides functionality enabling the Subscriber to access and correct Patient Data. Export and deletion of Patient Data are performed either through self-service functionality, where MedRegis has made it available to the Subscriber, or by MedRegis at the Subscriber’s request. The Subscriber will use the functionality available to it, and will request export or deletion from MedRegis where that functionality is not available to it. MedRegis will action such requests within a reasonable period, taking account of the volume and complexity of the Patient Data concerned. MedRegis’s assistance under clause 7.1(a) is limited to circumstances where that functionality, and MedRegis’s actioning of such requests, are not reasonably sufficient to enable the Subscriber to respond.

7.3 Requests received directly by MedRegis. Where MedRegis receives a request from a data subject relating to Patient Data, MedRegis will not respond substantively to the request, will not confirm or deny whether it processes Patient Data relating to that individual, and will not action the request, except on the Subscriber’s documented instructions or where required by law. MedRegis will promptly, and in any event within five (5) business days, inform the Subscriber of the request and provide the details reasonably necessary for the Subscriber to respond, and will advise the data subject to direct the request to the healthcare provider that holds their records.

7.4 Costs of assistance. MedRegis may charge its reasonable costs, at its then-current professional services rates, for assistance under clauses 7.1 and 7.2 that goes beyond the standard functionality of the Service. No charge is made under this clause for notifying the Subscriber of a request under clause 7.3.

8.1 Notification to the Subscriber. MedRegis will notify the Subscriber without undue delay after becoming aware of a personal data breach affecting Patient Data, and will provide the information reasonably necessary for the Subscriber to meet its own obligation, as controller, to notify the Commissioner without undue delay and, where feasible, within 72 hours, and to notify affected data subjects where required. MedRegis will take reasonable steps to mitigate and remediate the breach.

8.2 Awareness. MedRegis becomes aware of a personal data breach when it has confirmed that a personal data breach affecting Patient Data has occurred. Investigating an alert, anomaly or suspected incident does not by itself constitute awareness.

8.3 Content and updates. MedRegis may make an initial notification with the information available at the time and will supplement it as further information becomes known. An initial notification made in accordance with this clause discharges MedRegis’s obligation to notify under clause 8.1, without prejudice to its continuing obligation to provide further information as it becomes known.

8.4 Records and cooperation. MedRegis will document the facts of the breach, its effects and the remedial action taken, and will cooperate reasonably with the Subscriber in relation to the Subscriber’s notifications to the Commissioner and to affected data subjects. A notification under this clause is not an acknowledgement of fault or liability by MedRegis.

9.1 Retrieval before termination. Before the termination date, MedRegis will make the Patient Data available for export in a commonly used format, whether by providing the Subscriber with self-service export tools or by performing the export at the Subscriber’s request within a reasonable period. The Subscriber is responsible for requesting or performing its export before the termination date.

9.2 Retention period. For a period of sixty (60) days following termination (the “Retention Period”), MedRegis will retain the Patient Data and continue to apply the security and confidentiality protections of this Addendum, during which the Subscriber may request a final export.

9.3 Return and deletion. On expiry of the Retention Period, MedRegis will restrict its processing of the Patient Data to secure storage pending its return or deletion. At the Subscriber’s request, MedRegis will return or delete the Patient Data and existing copies. Absent such a request, MedRegis may delete the Patient Data on reasonable prior notice to the Subscriber, except to the extent retention is required by law, in which case MedRegis will continue to store it securely and process it only as required by law.

9.4 Subscriber’s retention obligations. The Subscriber remains solely responsible for retaining patient and medical records for the periods required by applicable law, and for meeting its own records-retention, archiving, and legal-hold obligations. MedRegis’s retention or deletion of Patient Data under this clause does not discharge the Subscriber of those obligations.

9.5 Scope of deletion. MedRegis’s obligation under clause 9.3 applies to Patient Data held in MedRegis’s systems and, where MedRegis has the ability to do so, to Patient Data held by its sub-processors on MedRegis’s behalf. Patient contact details and message content disclosed to messaging sub-processors under clause 6.7 are retained and deleted in accordance with those sub-processors’ own retention periods and deletion practices. Patient Data submitted to AI sub-processors is retained and deleted in accordance with clause 12.3. Backup copies held by MedRegis or its sub-processors are deleted or overwritten in the ordinary course of business, and MedRegis is not required to restore, isolate or purge individual records from backups. Backup copies remain subject to the security and confidentiality protections of this Addendum until they are deleted or overwritten. Deletion under this clause does not extend to Controller Data, De-identified Data, or data that MedRegis or a sub-processor is required or permitted to retain under clause 9.3, clause 1.2 or applicable law.

10.1 Records and information. MedRegis maintains records of its processing of Patient Data. Upon the Subscriber’s reasonable written request, MedRegis will make available information reasonably necessary to demonstrate compliance with this Addendum. MedRegis may satisfy such requests by providing relevant policies, security documentation, compliance questionnaires, certifications, independent audit reports or other appropriate evidence, subject to applicable confidentiality and security restrictions.

10.2 Audit. Where the information provided under clause 10.1 is not reasonably sufficient to demonstrate compliance, the Subscriber may request an audit of MedRegis’s processing of the Subscriber’s Patient Data. Any audit will:

(a) be conducted no more than once in any 12-month period, unless required by Applicable Data Protection Law, the Commissioner or following a confirmed personal data breach affecting the Subscriber’s Patient Data;

(b) be subject to at least 30 days’ prior written notice, except where a shorter period is required by law;

(c) take place during normal business hours and in a manner that does not unreasonably interfere with MedRegis’s operations;

(d) be limited to systems, records and processing activities relevant to the Subscriber’s Patient Data and MedRegis’s obligations under this Addendum;

(e) be conducted by the Subscriber or a suitably qualified independent auditor that is not a competitor of MedRegis and is bound by appropriate confidentiality obligations;

(f) not require access to another customer’s data, MedRegis’s source code, trade secrets, vulnerability information or other information that could reasonably compromise the security of MedRegis or its customers; and

(g) not include penetration testing, vulnerability scanning or other testing of MedRegis’s systems without MedRegis’s prior written approval, which approval will not be unreasonably withheld.

10.3 Sub-processors. Audits under this clause do not extend to the systems, premises or facilities of MedRegis’s sub-processors. MedRegis will satisfy requests relating to its sub-processors by making available their certifications, independent audit reports or security documentation, to the extent MedRegis is permitted to share them.

10.4 Costs, findings and remediation. The Subscriber will bear its own audit costs and will reimburse MedRegis for reasonable costs incurred in supporting the audit, charged at MedRegis’s then-current professional services rates. Where an audit identifies a material breach of this Addendum by MedRegis, MedRegis will bear its own costs, will not charge the Subscriber for its support of that audit, and will remediate the non-compliance at its own expense within a reasonable period. The Subscriber will share audit findings and reports with MedRegis; such findings and reports are the Confidential Information of MedRegis and may be used only to verify compliance with this Addendum. MedRegis and the Subscriber will cooperate in good faith to agree the scope, timing and procedures of any audit.

11.1 Hosting and location. The Service is hosted on cloud infrastructure located in the United States, as described in Schedule 1. Processing of Patient Data in the United States, and in any other location where MedRegis’s sub-processors process Patient Data in accordance with clause 6, is inherent to the provision of the Service and forms part of the Subscriber’s documented instructions under clause 3.1.

11.2 Transfer safeguards. MedRegis engages each sub-processor under written terms in accordance with clause 6.2 and, where offered by the sub-processor, relies on standard contractual clauses or equivalent transfer safeguards. MedRegis applies the technical and organisational measures in Schedule 2, including encryption in transit and at rest and least-privilege access controls, to Patient Data, including where it is processed outside the Subscriber’s jurisdiction. AI-Assisted Features, and the additional safeguards that apply to them, are addressed in clause 12.

11.3 Subscriber responsibilities. The Subscriber, as controller, remains responsible for determining that the transfer and processing of Patient Data outside its own jurisdiction is permitted under Applicable Data Protection Law, and for any notice, consent, assessment or authorisation required of it. MedRegis will provide reasonable assistance to the Subscriber in meeting those obligations.

12.1 Scope. The Service includes features that use third-party artificial intelligence providers to generate draft clinical documentation from consultation audio or text (“AI-Assisted Features”). Providers of AI-Assisted Features are sub-processors, are subject to clause 6, and are listed in Schedule 3.

12.2 No training on Patient Data. MedRegis will engage providers of AI-Assisted Features only under written terms that prohibit the use of Patient Data to train or improve those providers’ models.

12.3 Retention by AI providers. MedRegis will engage providers of AI-Assisted Features only under written terms that require the deletion of Patient Data submitted through their interfaces following processing, or that limit its retention to the period reasonably necessary to deliver the feature, to detect and prevent misuse of the provider’s services, and to meet the provider’s own legal obligations.

12.4 Current position. As at the date of this Addendum, MedRegis’s AI sub-processors are engaged under commercial API terms under which Patient Data submitted through the API is not used to train or improve the providers’ general-purpose models.

12.5 Consent and patient notice. The Subscriber is solely responsible for obtaining any consent or authorisation required under Applicable Data Protection Law before using AI-Assisted Features that capture consultation audio, and for informing patients that audio may be recorded and processed for the purpose of generating draft documentation. MedRegis relies on the Subscriber’s instruction that it has obtained any such consent or authorisation.

12.6 Human review. Output generated by AI-Assisted Features is draft documentation only. It is not clinical advice, a clinical decision, or a diagnosis. The Subscriber and its clinicians remain responsible for reviewing, correcting and approving all output before it is entered into a patient’s record or relied on for any clinical purpose.

12.7 Disabling AI-Assisted Features. The Subscriber may disable AI-Assisted Features at any time through account settings, where that option is available for its plan. Where it is not, the Subscriber may request disablement in writing, and MedRegis will disable the features without undue delay and confirm to the Subscriber when disablement is complete. Until the Subscriber receives that confirmation, the Subscriber is responsible for instructing its Authorized Users to cease using AI-Assisted Features, and MedRegis is not responsible for Patient Data transmitted to AI sub-processors through those features before disablement is confirmed. Once disabled, Patient Data will not be transmitted to AI sub-processors for the purposes of those features.

Each party’s liability under this Addendum is subject to the limitations and exclusions in the Terms of Service. Nothing in this Addendum limits either party’s liability to data subjects or to the Commissioner to the extent such liability cannot be limited under Applicable Data Protection Law.

This Addendum is governed by the laws of Barbados. Where a Subscriber is established outside Barbados, the Subscriber is responsible for identifying any additional or overriding requirements of its local data protection law and for notifying MedRegis of them. Any such requirements apply only to the extent the parties agree them in writing.

Subject matter: Provision of the MedRegisEHR electronic health record service, including AI-assisted transcription and documentation features.

Duration: The term of the Subscriber’s subscription and any wind-down period.

Nature and purpose: Hosting, storage, retrieval, and processing of health records to enable the Subscriber to deliver and administer healthcare, including generation of draft documentation through AI-assisted features. Processing through AI-Assisted Features is subject to clause 12.

Types of personal data: Patient identifiers and demographics; contact details; medical history and clinical notes; prescriptions; laboratory and diagnostic data; appointment and administrative data.

Categories of data subjects: The Subscriber’s patients and, as applicable, their guardians or representatives.

Hosting and data location: The Service is hosted on cloud infrastructure in the United States (Heroku and Amazon Web Services), with content delivery and security through Cloudflare. Patient Data is processed and stored in the United States. Transfers of Patient Data outside the Subscriber’s jurisdiction, and the safeguards applied to them, are addressed in clause 11.

Access control. Role-based access controls restrict each user to the functions and data appropriate to their role. Each user is assigned unique credentials tied to a named individual, and clinic administrators can add, modify, and revoke user access. Multi-factor authentication is available and can be enforced across a clinic through account settings.

Data segregation. Patient Data is logically segregated by clinic, and access controls are designed to prevent a Subscriber’s users from accessing another Subscriber’s Patient Data.

Encryption. Patient Data is encrypted in transit using industry-standard transport encryption and at rest using industry-standard encryption provided by MedRegis’s hosting infrastructure.

Audit logging. The system maintains audit logs of changes to patient records, recording the action, the timestamp, and the identity of the user who made it.

Confidentiality and least privilege. Personnel and contractors who may access Patient Data are bound by confidentiality obligations, and access is limited to those who require it to deliver the Service. Access is reviewed and revoked when it is no longer required.

Resilience. Patient Data is backed up, with backup and recovery procedures in place. MedRegis periodically reviews the operation of its backup arrangements.

Secure development. Changes to the platform are subject to code review before deployment to production as a matter of standard practice. Development and staging environments are maintained separately from production, and production Patient Data is not used in development or testing environments.

Vulnerability and patch management. MedRegis monitors for security vulnerabilities affecting the platform and its dependencies and applies security updates and patches, prioritising those addressing higher-severity vulnerabilities.

Incident response. MedRegis maintains procedures for identifying, escalating, investigating and responding to suspected security incidents affecting Patient Data, including notification in accordance with clause 8.

Infrastructure and physical security. The Service is hosted on cloud infrastructure operated by MedRegis’s hosting providers, who are responsible for physical and environmental security and maintain their own security certifications.

Sub-processor security. MedRegis assesses the security practices of sub-processors that process Patient Data and engages them under written terms in accordance with clause 6.

De-identification. Where MedRegis creates De-identified Data under clause 3.4, it applies technical and organisational measures designed to prevent re-identification, including the removal or obscuring of direct and indirect identifiers and the application of access controls to the de-identification process.

MedRegis engages the following sub-processors to process Patient Data. The list may be updated from time to time in accordance with clause 6.