1. Definitions

• Clinic:The healthcare provider (and its authorised staff) that uses the PMS.
• PMS:PrimumAI’s Practice Management Solution (web apps, APIs, integrations, AI tools).
• Controller / Processor:As defined by GDPR. For patient data in the PMS, Clinic = Controller; PrimumAI = Processor.
• Data Subject:A natural person whose personal data are processed.
• AI Features:Drafting tools (e.g., note suggestions, coding prompts, triage summaries) that a clinician reviews and approves.
• Sub-processor:Third party engaged by PrimumAI to process personal data for the Clinic.

2. Accounts & Access

• You must be 18+ and authorised to bind the Clinic.
• Keep credentials secret; enable MFA.
• You are responsible for actions under your accounts and must maintain accurate account info.

3. Services & Support

• We provide the PMS and reasonable support. We may update features for security, performance, and usability.
• Availability:We aim for high uptime with planned maintenance windows notified in advance where practicable.
• Support hours:09:00–17:30 (Europe/Dublin) on business days, unless your Order Form states otherwise.

4. Acceptable Use

• Do not use the PMS unlawfully, to infringe IP, to attempt unauthorised access, or to introduce malware.
• No reverse-engineering, scraping, automated scanning, or security testing without written approval.
• You must comply with professional and healthcare obligations applicable to your practice.

5. Clinical Responsibility & AI Features

• The PMS supports—but does not replace—clinical judgment.
• Human-in-the-loop. AI outputs are drafts for clinicians to review, edit, and approve.
• No automated decisions with legal or similarly significant effects are made by PrimumAI.
• Clinics remain responsible for consent, notices to patients, and record-keeping in the PMS.
• Safety & Usage Constraints:No Emergency Use. The PMS (including AI features) is not for emergency communications or time-critical clinical decisions. Use standard emergency channels.
• Beta/Preview Features:Features marked Beta/Preview may change, have limits, or be withdrawn. They are optional, excluded from uptime commitments, and should not be used for critical workflows or patient-identifiable data unless agreed in writing with controls.

6. Fees & Taxes

• Fees (if any) are set out in the Order Form/Plan. Taxes and regulatory fees are extra unless stated.
• Late payments may lead to suspension after notice.

7. Your Content & IP

• Ownership:The Clinic owns its content and patient records.
• Licence to PrimumAI:You grant us a limited licence to process your data to provide, secure, and support the PMS, to comply with law, and as set out in the DPA.
• We do not sell patient data or use it for advertising.

8. Privacy & Data Protection

• When acting as Processor for patient data, the DPA in Annex A applies and controls in case of conflict.
• When acting as Controller for PrimumAI’s own business data, our Privacy & Cookies Policy applies (linked in the app/website).

9. Security Safeguards

• We maintain industry-standard safeguards described in Annex B (TOMs): encryption in transit/at rest, RBAC + MFA, logging/monitoring, vulnerability management, backups/DR, secure SDLC, vendor due diligence.
• We configure EU regions by default and, for AI services, settings that do not train on Clinic data.

10. Sub-processors

• We use vetted sub-processors under written data protection terms.
• We maintain an up-to-date list (Annex C) and will give prior notice of material changes.
• You may object on reasonable grounds; if not resolved, you may terminate the affected service.

11. Compliance Assistance & Audit

• We keep records of processing and will provide information reasonably necessary to demonstrate compliance (e.g., security summaries, certificates) under NDA.
• On reasonable written notice, you may perform audits as permitted by Annex A, subject to confidentiality, safety, and proportionality.

12. Confidentiality

• Each party must protect the other’s confidential information and use it only for the agreed purpose.
• Patient data is always confidential.

13. Warranties

• We warrant that we will provide the PMS with reasonable skill and care.
• Except as expressly stated, the PMS is provided 'as is'.

14. Liability & Indemnity

• Cap:Each party’s aggregate liability under these Terms is capped at fees paid/payable in the prior 12 months, excluding: death/personal injury; fraud; wilful misconduct; IP infringement; and any specific caps set in Annex A for data protection.
• Exclusions:Neither party is liable for indirect, incidental, or consequential damages where permitted by law.
• Indemnities:(a) PrimumAI will defend you against third-party IP infringement claims about the PMS (excluding your content/use). (b) You will defend us against claims from your unlawful use or instructions that breach law.

15. Term, Suspension & Termination

• Term per Order Form/Plan. Either party may terminate for uncured material breach after 30 days’ notice.
• We may suspend for non-payment, security risks, or legal requirements, after notice where practicable.

16. Exit, Return & Deletion

• On termination/expiry, we will return or delete patient data per Annex A and your written instructions.
• Requests for deletion can be sent to harsh@primumai.eu. Export access is provided for a limited period. Backups are purged on a rolling basis.
• Deletion & Exit SOP: Request → Verify → Export (optional) → Primary deletion → Backups purge → Certificate → Cascade to sub-processors.
• Request:Email harsh@primumai.eu from a Clinic admin address with subject “Deletion/Exit – [Clinic]”.
• Verify:We verify authority and scope (tenancy, features, backups, sub-processors)
• Export (optional):We provide a structured export (JSON/CSV/PDF per module) for 14–30 days
• Primary deletion:We delete active copies within 5–10 business days of confirmation
• Backups:Encrypted backups purge within 30–45 days on a rolling basis
• Certificate:We issue a Deletion Certificate on request to harsh@primumai.eu.
• Cascade:We cascade deletion to relevant sub-processors and keep proof of completion

17. Changes to Terms

• We may update these Terms for legal or operational reasons.
• We will provide at least 30 days’ notice for material changes. Continued use means acceptance.

18. Governing Law & Disputes

• Irish law governs.
• Disputes are subject to the exclusive jurisdiction of the Irish courts, after good-faith escalation and optional mediation.

19. Notices

• Notices are valid when emailed to harsh@primumai.eu and to the admin email associated with your account.

20. Order of Precedence

• If documents conflict: Annex A (DPA) → Order Form → these Terms → policies/FAQs

Annex A — Data Processing Addendum (GDPR Art. 28)

• A1. Parties & Roles:
• Controller:the Clinic named in the Order Form.
• Processor:PrimumAi Limited.
• A2. Processing Scope:
• Purpose:deliver and secure the PMS; provide support; implement AI drafting tools; comply with law.
• Nature:hosting, storing, structuring, transmitting, pseudonymising, and transforming data.
• Duration:term of the subscription plus backup purge window.
• A3. Data & Subjects:
• Subjects:patients; Clinic staff and contractors.
• Data types:patient demographics, contact details, clinical notes, codes, treatment and history, scheduling, communications, billing metadata; user access logs.
• Special categories:health data for patients (no genetic/biometric unless input by Clinic).
• A4. Instructions & Lawful Basis:
• We act only on the Clinic’s documented instructions.
• The Clinic determines lawful bases (e.g., Art 6(1)(e)/(f) and Art 9(2)(h)).
• A5. Processor Obligations:
• Confidentiality:bind personnel; train; least-privilege access.
• Security:implement TOMs in Annex B and improve them over time.
• Sub-processors:written contracts, equivalent protections, change notices, objection right.
• Assistance:support with DSARs, DPIAs, security obligations, and prior consultations (Art 36).
• Breach:notify the Clinic without undue delay; share Art 33(3) details; assist with notifications.
• Audits:provide information; allow audits or third-party reports under NDA and reasonable limits.
• Return/Delete:on end of services, return or delete per Clinic choice; purge backups within 30–45 days; issue deletion certificate on request.
• Records:maintain Art 30(2) processor records.
• A6. International Transfers:
• Default processing:in the EEA.
• Transfers outside EEA:apply valid mechanism (e.g., EU SCCs 2021/914) with TIAs and supplementary measures.
• A7. Liability & Precedence:
• Precedence:The DPA prevails over conflicting Terms when it comes to personal data processing.
• Liability cap:Unless otherwise agreed, the liability cap in §14 applies; the parties may agree a specific data-protection cap in the Order Form.

Annex B — Technical & Organisational Measures (TOMs)

• Governance:Named DPO; security officer; policies; training; confidentiality agreements; background checks.
• Access control:RBAC; MFA; SSO support; quarterly access reviews; immediate de-provisioning.
• Encryption:TLS 1.2+ for data in transit; AES-256 for data at rest; keys via cloud KMS; secrets in secrets manager.
• Data management:Tenant isolation; environment segregation; data minimisation; pseudonymisation/anonymisation for analytics.
• Secure SDLC:Peer review; dependency scanning; SAST/DAST; IaC; change control; vulnerability SLAs.
• Monitoring & logging:Centralised logs; admin/audit trails; SIEM alerts; time sync; integrity controls.
• Backups & resilience:Encrypted backups; tested restores; RTO/RPO targets; multi-AZ; DDoS protection; capacity planning.
• Incident response:24/7 on-call; runbooks; evidence preservation; post-incident reviews; comms templates.
• Third-party risk:Due diligence; DPAs/SCCs; annual re-assessment; sub-processor change logs.
• AI safeguards:Human-in-the-loop; clinician review; UI labels; prompt/output logging; ability to disable AI per Clinic; no training on Clinic data without written approval.

Annex C — Current Sub-processors (regions & purposes)

• Infrastructure & Platform:Amazon Web Services (AWS) — EU regions: hosting, storage, backups; also notifications & emails (SES/SNS). Microsoft Azure- EU regions: compute, databases; optional platform services.
• AI Inference (optional):Azure OpenAI Service — EU deployment: model inference for AI drafting. Configured not to use data for training.
• Communications:Twilio — EU/appropriate regions: phone numbers, SMS/voice delivery, appointment reminders; recordings disabled by default unless Clinic enables and lawfully notices/consents.
• Payments:[Payment Provider] — EU/EEA: payment processing for patient payments (PrimumAI does not store card numbers).

Annex D — Audio, Voice & Telephony (Twilio)

• Scope:Optional call/SMS/voice features via Twilio; appointment reminders; call recording OFF by default.
• Consent & notices:Clinics must provide clear notice before audio capture and collect consent where required.
• Default retention:Real-time transcription ephemeral unless Clinic enables retention; PrimumAI deletes per Clinic instructions.
• Storage location:Twilio EU endpoints used where available; if non-EEA routing, apply SCCs and supplementary measures.
• Risk & accuracy:Audio capture may fail; AI drafts may be incomplete; clinicians must verify before use.
• Prohibited content:No card numbers, credentials, or unlawful content via telephony.