Terms of Service and Data Processing Agreement

1. What GRAI ClinicOS is

GRAI ClinicOS is a clinic management platform built by GlobalReach AI (operating as GRAI ClinicOS) for Indian doctors and small clinics. It provides appointment and queue management, patient records, WhatsApp-based patient communication, visit notes, prescription generation, and related tools. GRAI ClinicOS is a software service, not a medical service. It does not provide medical advice, diagnoses, or treatment recommendations.

2. Who can use GRAI ClinicOS

GRAI ClinicOS is intended for licensed medical practitioners and authorized clinic staff operating in India. You confirm that you hold a valid medical registration or are authorized staff of a registered clinic. You agree to use GRAI ClinicOS only for lawful clinic operations and patient care.

3. Your responsibilities as a doctor or clinic owner

• — Obtain appropriate patient consent before collecting and using their personal and medical information.
• — Keep your login credentials secure. You are responsible for all activity under your account.
• — Ensure that your use of GRAI ClinicOS complies with applicable Indian medical, privacy, and data protection laws, including the DPDP Act 2023.
• — Use GRAI ClinicOS only for your own clinic's legitimate patient care and administration. Do not share access with unauthorised persons.
• — Ensure that any staff you add to GRAI ClinicOS are authorised employees of your clinic.
• — Keep patient data accurate and up to date where practical.

4. Trial, billing, and plan

New clinics receive a full-plan free trial for 30 days from signup. No credit card is required during the trial. After the trial period, continued use requires a paid subscription. GRAI ClinicOS will communicate pricing and any plan changes by email before they take effect. If you do not renew after the trial, your clinic account will be deactivated. Your patient data will be retained for up to 90 days after deactivation so you can request an export, after which it will be permanently deleted.

5. WhatsApp and communication

During your free trial, GRAI ClinicOS provides patient WhatsApp communication through our shared managed number at no additional cost. Message costs are covered by GRAI ClinicOS during the trial. Paid plans include a communication allowance. GRAI ClinicOS uses Meta's WhatsApp Business API. You agree that patient messages sent through GRAI ClinicOS are subject to Meta's WhatsApp Business policies. GRAI ClinicOS is not responsible for Meta service interruptions or policy changes.

6. Intellectual property

GRAI ClinicOS, its software, design, and content belong to GlobalReach AI. Your patient data belongs to you and your patients. GRAI ClinicOS does not claim ownership of patient records, clinical notes, prescriptions, or any data you enter into the platform.

7. Limitation of liability

GRAI ClinicOS is provided as-is. While we take care to build a reliable, secure platform, we cannot guarantee uninterrupted service. GRAI ClinicOS is not liable for clinical decisions made using the platform, data loss caused by events outside our control, or indirect or consequential damages. Our maximum liability is limited to the subscription fees paid in the 3 months preceding any claim.

8. Termination

Either party may terminate at any time. If you stop using GRAI ClinicOS, your data is retained for 90 days so you can export it, then permanently deleted. GRAI ClinicOS may suspend accounts that violate these terms or applicable law.

9. Governing law

These terms are governed by the laws of India. Any disputes will be subject to the jurisdiction of courts in India.

DPA 1. What data GRAI ClinicOS processes on your behalf

Patient names, phone numbers, WhatsApp numbers, age, gender, family member details, appointment records, queue status, visit notes, diagnoses, prescriptions, follow-up dates, billing status, and WhatsApp message content related to clinic service.

DPA 2. How GRAI ClinicOS uses this data

• — To provide the GRAI ClinicOS queue, booking, visit notes, and communication features to your clinic.
• — To send WhatsApp messages to patients on behalf of your clinic (appointment confirmations, reminders, visit summaries).
• — For technical support, debugging, and security monitoring of the platform.
• — We do not sell, share, or use patient data for advertising, marketing, or any purpose outside operating your clinic.
• — We do not use patient data to train AI models or for product analytics beyond aggregate, anonymised usage metrics.

DPA 3. Data retention

Patient records are retained for 7 years from the last activity, in line with standard Indian medical records practice. After 7 years, records are permanently deleted unless you request earlier deletion. If you close your GRAI ClinicOS account, your clinic data is retained for 90 days so you can export it, then permanently deleted.

DPA 4. Data deletion and export requests

You can request a full export of your clinic's data by emailing contact@globalreach-ai.com (self-serve export coming soon). If a patient requests deletion of their records, contact us at the same address with the patient's phone number and we will action it within 30 days, subject to legal retention requirements. Note that medical records required by law cannot be immediately hard-deleted but can be restricted to prevent active use.

DPA 5. Security

GRAI ClinicOS uses Supabase Postgres with row-level security, role-based access control, private encrypted storage for medical files, and server-side functions for sensitive operations. All data is transmitted over HTTPS. Prescription PDFs are stored in private buckets accessible only through signed, time-limited links.

DPA 6. Sub-processors

GRAI ClinicOS uses the following third-party services to operate:

• — Supabase — database, authentication, and storage (data hosted in Singapore; India region migration in progress).
• — Vercel — web application hosting.
• — Meta (WhatsApp Business API) — patient WhatsApp messaging.

DPA 7. Your rights as a doctor

As the Data Fiduciary, you remain responsible for obtaining patient consent and complying with DPDP Act obligations toward your patients. GRAI ClinicOS will assist you by providing data export, deletion tools, and timely responses to data requests. You have the right to audit how GRAI ClinicOS processes your clinic's data by contacting contact@globalreach-ai.com.