Terms of Service

This agreement is between Dinnative Technologies (Pty) Ltd (registration number 2017/280514/07, VAT number 4640303303, registered address 74 Montrose Avenue, Northgate, Randburg, 2162, South Africa) trading as CareSavi (“we”, “us”), and the practice that creates a CareSavi account (“you”, “the Practice”).

By creating an account, or by using the service, you accept these terms and confirm you are authorised to bind the Practice.

• Service means the CareSavi platform: the practice application, the patient portal, the WhatsApp and messaging layer, the API and the supporting infrastructure.
• Practice Data means everything you or your patients put into the Service, including patient records, clinical notes, messages, forms and uploaded documents.
• Personal Information, Responsible Party and Operator carry the meanings given in POPIA.
• Order means the package agreed in writing, including its fees.
• Sub-processor means a third party we use to provide the Service, listed in the Privacy Notice.

CareSavi is a communication, automation and revenue layer that runs beside the systems a practice already runs. It does not connect to a practice management system, and it does not replace one.

What it is not, stated plainly:

• Not a medical device, and not registered as one with SAHPRA.
• Not a source of clinical advice or diagnosis. The AI features assist with wording and scheduling. Clinical judgement is yours, and every clinical record entry is authored and approved by a registered practitioner in your practice.
• Not a medical scheme claims switch. The Service assembles the information a claim needs and tells you what is missing; it does not submit claims to a scheme.
• Not your record of last resort. You remain responsible for keeping the clinical records the HPCSA and the National Health Act require you to keep.

• You are responsible for the accuracy of your registration details and for everything done under your users' accounts.
• Each staff member must have their own account. Shared logins defeat the audit trail your POPIA obligations depend on.
• You must assign roles so that staff can reach only the patient information their work requires, and remove access promptly when someone leaves.
• You must keep credentials confidential, enable two-factor authentication where offered, and tell us immediately if you suspect unauthorised access.
• Where you supply your own provider keys (for messaging, payments or AI), you are responsible for those accounts and their costs.

You must not, and must not permit anyone to:

• use the Service to send unsolicited direct marketing, or to message a patient who has objected or withdrawn consent;
• upload patient information you have no lawful basis to process, or import a patient list you did not lawfully obtain;
• put clinical detail into a WhatsApp or SMS message or message template, which the Service is deliberately designed to avoid;
• attempt to access another practice's data, probe or circumvent the tenancy, authentication or audit controls, or interfere with the Service's operation;
• reverse engineer, resell or white-label the Service without our written agreement;
• use the Service in breach of POPIA, the Consumer Protection Act, the Electronic Communications and Transactions Act, HPCSA ethical rules, WhatsApp's Business Messaging Policy, or any other law or policy that applies to you.

• You are the responsible party for patient information. We are your operator under POPIA s20–21 and process only on your documented instructions, expressed through the modules, automations and consent wording you configure.
• You own Practice Data. We claim no ownership and will not use it for our own purposes. We may use aggregated, de-identified statistics that cannot identify a practice or a patient to operate and improve the Service.
• Obtaining patient consent is yours. You must give patients a privacy notice, capture the consents each purpose requires (including the separate marketing opt-in and the separate consents for transfers outside South Africa) and honour objections. The Service provides the mechanisms; it cannot supply the lawful basis.
• Retention is yours to decide. As an operator we do not choose when a record is destroyed. Where you set no retention date, nothing is destroyed. Where you set one earlier than the statutory minimum for that record class, the Service refuses it.
• An operator agreement applies. A signed operator (data processing) agreement forms part of this agreement and governs our processing of patient information. Where it conflicts with these terms on data protection, it wins.
• Security incidents. If information under our control is compromised we will notify you without undue delay and give you what you need to meet your own POPIA s22 obligations. Notifying patients and the Information Regulator is your responsibility as responsible party.

The Service depends on third parties listed in the Privacy Notice. Their behaviour is outside our control and their own terms apply to you where relevant. In particular:

• WhatsApp. Delivery, message template approval and the rules about when a business may message a patient are set by Meta. A template can be rejected, a number can be rate-limited or restricted, and a conversation outside Meta's customer-service window can only be opened with an approved template. We cannot guarantee delivery of any message.
• Payments. Patient and subscription payments are processed on the provider's hosted checkout. Card details never reach the Service. Provider fees, chargebacks and settlement timing are governed by your relationship with the provider.
• Your own keys. Where you connect your own messaging or AI provider account, that relationship is directly between you and that provider.

• The AI receptionist is on unless your practice asks us to switch it off; the clinical note assistant is off unless switched on. A patient's messages reach the model only after that patient agrees to the cross-border transfer.
• The model proposes only. Bookings, payments, sends and record writes are performed by application code with its own checks and are audited.
• The clinical note assistant produces a draft. A clinician must review, edit and explicitly approve it before it becomes a clinical note. You remain responsible for the accuracy and clinical appropriateness of every note.
• AI output can be wrong. Do not rely on it for clinical decisions, and check anything a patient will act on.
• Using AI features transfers minimised content outside South Africa. You must have captured the relevant transfer consent before enabling them.
• AI usage is metered and may be billed by consumption where the Order says so, or run on your own provider key.

• Fees are those in your Order. Current plans are published at caresavi.com/pricing; a written quotation prevails over the published page.
• All amounts are in South African Rand. Amounts are exclusive of VAT unless stated, and VAT is added where applicable.
• Subscription fees are billed in advance for each billing period and are non-refundable except where the law requires otherwise. Usage-based charges are billed in arrears.
• Third-party pass-through costs (WhatsApp conversation charges, SMS, payment-provider fees, AI usage where not on your own key) are your responsibility.
• If an amount is overdue we may suspend the Service after giving you notice and a reasonable opportunity to pay.
• We may change fees on 30 days' written notice, effective from your next billing period. If you do not accept a change you may terminate before it takes effect.

We aim to keep the Service available and to give reasonable notice of planned maintenance. No service level is committed by this document; any uptime or response commitment applies only if it is agreed separately in writing.

We may change, add to or withdraw features. Where a change materially reduces a core function you rely on, we will give reasonable notice, and you may terminate if the change is materially adverse to you.

Each party will keep the other's confidential information confidential, use it only to perform this agreement, and protect it at least as carefully as its own. This does not apply to information that is public through no breach, already lawfully held, independently developed, or required by law to be disclosed, in which case the disclosing party is told first where lawful. Patient information is confidential in every case and is additionally governed by §6.

We own the Service, its software, design, documentation and brand, and all intellectual property in them. You get a non-exclusive, non-transferable right to use the Service for your practice for as long as this agreement lasts. You own Practice Data and grant us only the licence needed to host, process and display it in order to provide the Service. Feedback you give us may be used without obligation.

We warrant that we will provide the Service with reasonable skill and care, and in accordance with the security measures described in the Privacy Notice.

Beyond that, and to the fullest extent the law allows, the Service is provided as is. We do not warrant that it will be uninterrupted or error-free, that any message will be delivered, that AI output will be accurate, or that it will meet a requirement we have not agreed in writing. Nothing in this section limits rights you have under the Consumer Protection Act 68 of 2008 where it applies to you.

Neither party excludes liability for death or personal injury caused by its negligence, for fraud, or for anything else that cannot be excluded by law.

Subject to that, and to the fullest extent permitted: neither party is liable for indirect or consequential loss, loss of profit, loss of goodwill, or loss of anticipated savings; and each party's total aggregate liability arising out of this agreement in any twelve-month period is limited to the fees you paid us in the twelve months before the event giving rise to the claim.

Clinical responsibility is not ours. We are not liable for clinical decisions, for the content or accuracy of a clinical record authored in your practice, or for a treatment outcome.

You will indemnify us against claims, losses and reasonable costs arising from your breach of §5 (acceptable use) or §6 (your data and our role), including a claim by a patient or the Information Regulator arising from your failure to obtain a lawful basis, to give a privacy notice, or to honour an objection.

• This agreement starts when you create an account and continues for as long as you subscribe.
• Either party may terminate for convenience on 30 days' written notice, effective at the end of the billing period in which the notice period ends.
• Either party may terminate immediately for a material breach the other has not remedied within 14 days of written notice, or on the other's insolvency or business rescue.
• We may suspend the Service immediately where continued use poses a security risk, breaches §5, or is required by a provider or by law. We will restore it as soon as the cause is resolved.
• On termination our team exports Practice Data for you on request for 30 days. After that we delete or return it in accordance with the operator agreement and the retention rules in the Privacy Notice, keeping only what law requires us to keep.
• Sections on confidentiality, intellectual property, liability, indemnity and governing law survive termination.

We may update these terms. Material changes take effect on 30 days' written notice to the email on your account. Continuing to use the Service after that date accepts the change; if you do not accept it, you may terminate before it takes effect without penalty.

This agreement is governed by the law of the Republic of South Africa. The parties will first try in good faith to resolve any dispute by discussion between senior representatives. Failing that, the parties submit to the jurisdiction of the High Court of South Africa, Gauteng Local Division, Johannesburg. Nothing prevents either party seeking urgent interim relief from any competent court.

• Notices to you go to the email on your account; notices to us go to info@caresavi.com and to the registered address in §1.
• Assignment. Neither party may assign this agreement without the other's written consent, except to a successor of its business on notice.
• Subcontracting. We may use sub-processors as described in the Privacy Notice, and we remain responsible for their performance.
• Severability. If a provision is unenforceable, the rest stands.
• No waiver. Not enforcing a right is not a waiver of it.
• Entire agreement. These terms, the Order, the operator agreement and the Privacy Notice are the whole agreement between us on this subject.
• Relationship. Nothing here creates a partnership, employment or agency between the parties.