Terms of Service

1. Acceptance of Terms

By accessing, registering for, or using any service provided by BMRAO ("Company", "we", "us", or "our"), including OpenEMR cloud hosting, on-premise deployment, customization, HL7/FHIR integrations, data migration, training, and technical support, you ("Client", "you", or "your") agree to be legally bound by these Terms of Service ("Terms").

If you are entering into these Terms on behalf of a clinic, hospital, or other organisation, you represent that you have the authority to bind that organisation. If you do not agree to these Terms, you must not use BMRAO's services.

2. Description of Services

BMRAO provides the following OpenEMR and healthcare IT services to clinics, hospitals, telemedicine platforms, and healthcare providers in India, USA, UK, UAE, Canada, and worldwide:

• Cloud Hosting & Deployment: Managed OpenEMR cloud hosting on multi-region infrastructure (India, US, EU, UAE) with 99.9% uptime SLA, SSL, automated daily backups, and 24/7 monitoring.
• On-Premise & Hybrid Deployment: Installation and configuration of OpenEMR on client-owned servers or in hybrid cloud-and-on-premise architectures.
• Customization & Integrations: Tailoring OpenEMR modules, clinical forms, workflows, and integrating with laboratory information systems (LIS), pharmacy management, billing, HL7/FHIR-compliant third-party systems, and ABDM (Ayushman Bharat Digital Mission) infrastructure for Indian clients.
• Data Migration: Zero-downtime migration of patient records and clinical data from legacy EMR systems to OpenEMR, including data validation and integrity checks.
• Training & Support: Comprehensive staff training on OpenEMR, video documentation, and 24/7 technical support via phone, email, and chat.
• Consulting: Strategic healthcare IT advisory, compliance guidance, and technology roadmap planning.

The specific scope of services, deliverables, timelines, and pricing for each engagement are defined in a separate Service Agreement or Statement of Work issued by BMRAO.

3. Client Responsibilities

As a client of BMRAO, you agree to:

• Provide accurate, complete, and current information about your organisation and requirements.
• Maintain the confidentiality of your account credentials and immediately notify BMRAO of any suspected unauthorised access.
• Comply with all applicable laws, regulations, and healthcare compliance requirements in your jurisdiction, including but not limited to the Information Technology Act 2000 (India), HIPAA (USA), GDPR (EU/UK), and local medical data protection laws.
• Ensure that all patient data uploaded to BMRAO-hosted systems has been collected with appropriate patient consent as required by law.
• Use BMRAO's services only for lawful purposes and in accordance with these Terms.
• Not attempt to reverse-engineer, hack, disable, or circumvent any security measures, access controls, or technical restrictions in BMRAO's systems.
• Promptly report any security vulnerabilities, data incidents, or service anomalies to BMRAO.

4. Data Ownership & Processing

You retain full and exclusive ownership of all patient data, medical records, clinical notes, and other health information ("Client Data") stored in your OpenEMR instance hosted or managed by BMRAO.

BMRAO acts solely as a data processor on your behalf. We will:

• Process Client Data only as necessary to deliver the contracted services.
• Never sell, rent, or share Client Data with third parties for any commercial purpose.
• Implement and maintain technical and organisational security measures appropriate to the sensitivity of healthcare data, including end-to-end encryption in transit and at rest, role-based access controls, audit logging, and automated backups.
• Notify you within 72 hours of becoming aware of any confirmed data breach affecting Client Data, as required by applicable data protection law.

For Indian clients, BMRAO's data handling practices are designed to align with the Digital Personal Data Protection Act 2023 (DPDPA) and the ABDM Health Data Management Policy.

5. Intellectual Property

OpenEMR is free and open-source software licensed under the GNU General Public License (GPL). BMRAO does not claim ownership of the OpenEMR platform itself.

BMRAO retains ownership of all proprietary tools, scripts, integration frameworks, configuration templates, documentation, and custom modules developed by BMRAO ("BMRAO IP"). Upon full payment for custom development work, BMRAO grants you a perpetual, non-exclusive licence to use BMRAO IP in connection with your OpenEMR instance.

You retain full ownership of any custom clinical forms, templates, and configurations developed specifically for and owned by your organisation ("Client IP"). BMRAO will not use Client IP for any other client or purpose.

6. Payment Terms

BMRAO uses transparent, flat-rate pricing that is agreed upon in writing before service commencement. Payment terms:

• Invoices are payable within 7 days of issuance unless otherwise agreed in writing.
• Recurring hosting and support fees are billed monthly or annually in advance.
• All prices are exclusive of applicable taxes (including GST for Indian clients). Taxes will be itemised separately on invoices.
• Late payments beyond 14 days may incur interest at 1.5% per month on the outstanding balance.
• Services may be suspended (with 7 days notice) if an account is overdue by more than 30 days.
• Refunds for hosting fees are not available for completed billing periods. Refunds for one-time project work are handled on a case-by-case basis and subject to work completed at the time of the refund request.

7. Service Level Agreement (SLA)

For cloud-hosted OpenEMR instances, BMRAO commits to the following service levels:

• Uptime: 99.9% monthly uptime, measured as ((total minutes − downtime minutes) / total minutes) × 100. Excludes scheduled maintenance windows.
• Scheduled Maintenance: BMRAO will provide at least 48 hours advance notice for planned maintenance. Maintenance is scheduled during off-peak hours wherever possible.
• Emergency Maintenance: BMRAO may perform emergency maintenance without advance notice when necessary to protect the security or integrity of hosted systems.
• Support Response Times: Critical issues (service down) — response within 1 hour; High issues (major feature unavailable) — response within 4 hours; Normal issues — response within 1 business day.
• Backup & Recovery: Daily automated backups with 30-day retention. Recovery Point Objective (RPO): 24 hours. Recovery Time Objective (RTO): 4 hours for cloud-hosted instances.

8. Acceptable Use Policy

You agree not to use BMRAO's services to:

• Store, process, or transmit any data that violates applicable law or third-party rights.
• Conduct unauthorised penetration testing, vulnerability scanning, or security assessments of BMRAO's infrastructure without prior written consent.
• Introduce malware, viruses, ransomware, or any malicious code into BMRAO's systems.
• Attempt to gain unauthorised access to other clients' data or systems.
• Use BMRAO's infrastructure for cryptocurrency mining, spam distribution, or any purpose unrelated to healthcare operations.
• Sublicense, resell, or transfer BMRAO's services to any third party without express written consent.

BMRAO reserves the right to suspend services immediately, without notice, if activity is detected that poses a security risk to BMRAO's infrastructure or other clients.

9. Confidentiality

Both parties agree to maintain the confidentiality of each other's proprietary information disclosed in the course of the service relationship ("Confidential Information"). This includes pricing, technical specifications, business processes, and patient data.

Confidential Information does not include information that: (a) is or becomes publicly known through no breach of these Terms; (b) was already known to the receiving party before disclosure; (c) is independently developed without use of the Confidential Information; or (d) is required to be disclosed by law or court order, provided the disclosing party is notified promptly.

BMRAO staff with access to client systems are bound by confidentiality agreements. BMRAO does not subcontract access to Client Data without your prior written consent.

10. Warranty Disclaimer

BMRAO provides services on an "as is" and "as available" basis, except as expressly stated in the Service Level Agreement above. To the fullest extent permitted by applicable law, BMRAO disclaims all implied warranties, including implied warranties of merchantability, fitness for a particular purpose, and non-infringement.

BMRAO does not warrant that: (a) the services will be error-free or uninterrupted at all times; (b) OpenEMR (as open-source software) will be free of bugs or vulnerabilities; or (c) the services will meet every specific clinical or regulatory requirement of your jurisdiction without customization.

11. Limitation of Liability

To the maximum extent permitted by applicable law, BMRAO's total cumulative liability to you for any claims arising from or related to these Terms or the services shall not exceed the total amount paid by you to BMRAO in the three (3) months immediately preceding the event giving rise to the claim.

In no event shall BMRAO be liable for: (a) indirect, incidental, special, consequential, or punitive damages; (b) loss of profits, revenue, data, goodwill, or business opportunity; (c) damages arising from force majeure events; or (d) damages arising from your failure to maintain adequate account security or to comply with applicable healthcare regulations.

12. Force Majeure

Neither party shall be liable for delays or failures in performance resulting from circumstances beyond their reasonable control, including but not limited to natural disasters, government actions, power outages, internet infrastructure failures, cyberattacks by third parties, pandemics, or other force majeure events. The affected party must notify the other within 48 hours of the event and use reasonable efforts to mitigate its impact.

13. Termination

Either party may terminate services by providing 30 days written notice to the other party. BMRAO may terminate immediately upon written notice if:

• You materially breach these Terms and fail to remedy the breach within 14 days of written notice.
• You fail to pay outstanding invoices after a 30-day overdue period.
• Your use of the services creates a security risk or violates applicable law.

Upon termination for any reason:

• BMRAO will provide a complete export of your Client Data in a standard format (SQL dump and/or CSV) within 14 days.
• Client Data will be securely deleted from BMRAO's servers within 30 days of the export delivery, with written confirmation provided.
• All outstanding invoices become immediately due and payable.

14. Dispute Resolution

Both parties agree to attempt in good faith to resolve any dispute through informal negotiation for a period of 30 days before initiating formal proceedings.

If informal resolution fails, disputes shall be resolved through binding arbitration under the Arbitration and Conciliation Act, 1996 of India, conducted in English. The seat of arbitration shall be India. The arbitrator's decision shall be final and binding.

Notwithstanding the above, either party may seek emergency injunctive or equitable relief from a court of competent jurisdiction to prevent irreparable harm.

15. Governing Law & Jurisdiction

These Terms are governed by and construed in accordance with the laws of India, without regard to conflict of law principles. For matters not subject to arbitration, you agree to submit to the exclusive jurisdiction of the courts of India.

For clients in the United States, United Kingdom, UAE, or Canada, BMRAO services are provided from India and these Terms remain governed by Indian law, subject to any mandatory consumer protection provisions of your local jurisdiction that cannot be contractually waived.

16. Changes to These Terms

BMRAO may update these Terms from time to time to reflect changes in our services, legal requirements, or business practices. When we make material changes, we will:

• Update the "Last updated" date at the top of this page.
• Notify existing clients by email at least 30 days before the changes take effect.

Continued use of BMRAO services after the effective date of updated Terms constitutes your acceptance of the revised Terms. If you do not agree to the updated Terms, you may terminate services with 30 days notice before the changes take effect.

17. Contact Information

For questions, concerns, or notices relating to these Terms of Service, please contact BMRAO at:

BMRAO
bmrao.office@gmail.com
+91 90160 02021
India

We aim to respond to all legal enquiries within 5 business days.