1. PARTIES AND ACCEPTANCE

These Terms of Service, Privacy Policy, and Data Processing Agreement (“Agreement”) constitute a legally binding contract between the individual or entity that owns and operates the Scalpel platform (“Scalpel”, “we”, “us”, or “our”) and the registered medical practitioner, healthcare provider, billing coordinator, or authorised team member accessing the platform (“you”, “User”, or “Responsible Party”).

By clicking “I Accept”, you confirm that: (a) you are at least 18 years of age; (b) you have authority to enter into this Agreement on behalf of any organisation you represent; (c) you have read, understood, and agree to be bound by every provision of this Agreement; and (d) you consent to the collection, processing, and storage of personal information as described herein.

If you do not agree, you must click “Decline” and refrain from using the platform. Your use of the platform is conditional upon acceptance of this Agreement.

2. DEFINITIONS

• “POPIA” means the Protection of Personal Information Act 4 of 2013, as amended.
• “Personal Information” has the meaning ascribed in POPIA, including names, identity numbers, medical aid details, contact information, and health-related information.
• “Special Personal Information” means health or medical information, biometric information, and information processed for health service purposes as contemplated in Chapter 3, Part B of POPIA.
• “Patient Data” means any Personal Information or Special Personal Information relating to a patient entered into the platform by you or your authorised team members.
• “Processing” has the meaning ascribed in POPIA and includes collection, recording, organisation, storage, updating, retrieval, use, dissemination, merging, linking, restriction, degradation, erasure, or destruction of Personal Information.
• “Responsible Party” means the User who determines the purpose of and means for processing Patient Data. For the purposes of POPIA, each User is the Responsible Party in respect of Patient Data they enter into the platform.
• “Operator” means Scalpel, which processes Personal Information on behalf of the Responsible Party as contemplated in section 21 of POPIA.
• “Information Regulator” means the body established under section 39 of POPIA (the Information Regulator, South Africa).
• “AI-Generated Content” means clinical notes, summaries, coding suggestions, or other content generated by the platform’s integrated artificial intelligence systems (currently Google Gemini).
• “Sub-processor” means any third-party entity engaged by Scalpel to process Personal Information on behalf of the Responsible Party.

3. NATURE OF THE PLATFORM

Scalpel is a cloud-based software-as-a-service (SaaS) platform designed to assist registered South African medical practitioners with clinical documentation, ICD-10 coding, billing management, and related administrative tasks. The platform is not a medical device, does not provide medical advice, and is not intended to substitute for the independent clinical judgment of a qualified healthcare professional.

The platform incorporates artificial intelligence tools (“AI Features”) that may generate clinical notes, suggest diagnostic codes, or assist with billing entries. AI-Generated Content is provided for administrative assistance only and must be reviewed, verified, and approved by the responsible clinician before any clinical, billing, or legal use. Scalpel makes no representation as to the clinical accuracy, completeness, or appropriateness of AI-Generated Content.

4. LAWFUL BASIS FOR PROCESSING — POPIA COMPLIANCE

4.1 Responsible Party Obligations.

You, as the Responsible Party, warrant that:

1. (a) You have obtained the necessary consent from each patient, or that another lawful ground for processing under POPIA applies, before entering Patient Data into the platform;
2. (b) You will comply with all applicable provisions of POPIA, the National Health Act 61 of 2003, the Health Professions Act 56 of 1974, and all applicable HPCSA guidelines regarding patient confidentiality and record-keeping;
3. (c) You will only enter Patient Data that is adequate, relevant, and not excessive in relation to the purpose for which it is processed;
4. (d) You will ensure that Patient Data is accurate and kept up to date;
5. (e) You are solely responsible for obtaining and maintaining all professional registrations, licences, and authorisations required to practise medicine and to process patient health information under South African law.

4.2 Operator Processing.

Scalpel, as Operator, processes Personal Information only on your documented instructions and for the following purposes:

• Providing and operating the platform features you use;
• Generating AI-assisted clinical notes and billing entries at your direction;
• Storing and retrieving Patient Data on your behalf;
• Sending communications (including clinical notes and billing summaries) at your explicit instruction;
• Processing subscription payments via our payment processor;
• Improving platform performance (using anonymised or aggregated data only, never identifiable Patient Data).

4.3 Special Personal Information.

The parties acknowledge that Patient Data constitutes Special Personal Information under section 26 of POPIA. Scalpel processes such information exclusively on the basis of your instruction and in your capacity as a healthcare practitioner, as contemplated in section 32(1)(b) of POPIA. You warrant that you have a lawful basis to process such information under sections 26 and 32 of POPIA.

5. DATA PROCESSING AGREEMENT (DPA)

5.1 Scope.

This section constitutes the Data Processing Agreement contemplated in section 21 of POPIA. Scalpel agrees to:

1. (a) Process Personal Information only in accordance with your documented instructions;
2. (b) Ensure that persons authorised to process Personal Information are subject to confidentiality obligations;
3. (c) Implement appropriate technical and organisational security measures as described in section 6 below;
4. (d) Not engage additional Sub-processors without notifying you, subject to clause 5.3;
5. (e) Assist you in ensuring compliance with your obligations under POPIA, including responding to data subject access requests;
6. (f) Delete or return all Personal Information on termination of the Agreement, at your election, subject to any legal retention obligations;
7. (g) Make available all information necessary to demonstrate compliance with this Agreement.

5.2 Data Location.

Patient Data is stored by Supabase, Inc. on Amazon Web Services infrastructure located in the eu-central-1 (Frankfurt, Germany) region. Patient Data is therefore stored outside the Republic of South Africa, in a jurisdiction subject to the European Union’s General Data Protection Regulation (GDPR). Clause 5.3 lists every Sub-processor and where it processes Personal Information.

5.3 Sub-processors.

You authorise Scalpel to engage the following Sub-processors:

Where Sub-processors process Personal Information outside South Africa, Scalpel has implemented appropriate safeguards, including contractual protections, to ensure a level of protection consistent with POPIA.

5.4 AI Processor Instruction.

When you use AI Features, you instruct Scalpel to transmit the clinical content needed to generate the requested document to the Google Gemini API. For text-based AI Features, Scalpel replaces the patient’s name, and any 13-digit identity number appearing in the text, with placeholder tokens before transmission and restores them in the result; a date of birth is sent as an age. Other details you type into free-text fields (for example addresses, telephone numbers, or the names of other people) are transmitted as written.

Images, documents and audio you submit for AI processing — including photographed patient stickers, scanned or handwritten notes, laboratory report PDFs, and dictation or ambient recordings — are transmitted as captured and may contain patient identifiers, including names, identity numbers and medical aid details. Audio is transmitted to AssemblyAI; images and documents to the Google Gemini API. Scalpel is not responsible for any personal information you choose to include in AI prompts.

6. SECURITY

6.1 Technical Measures.

Scalpel implements and maintains the following security measures:

1. (a) Encryption in transit: TLS (version 1.2 or higher) for all data transmitted between the platform and users, and between platform components;
2. (b) Encryption at rest: AES-256 encryption for all data stored in the Supabase infrastructure (hosted on Amazon Web Services);
3. (c) Access control: Row-Level Security (RLS) policies enforced at the database level, ensuring each user can only access the database records of their own practice and records explicitly shared with their authorised team members. Uploaded files (note scans, note and patient attachments, laboratory report PDFs and letterhead images) are stored under long, randomly generated links; they are not publicly listed, but a file can be opened by anyone in possession of its link. Identity and professional verification documents are stored privately and can only be opened through short-lived links;
4. (d) Authentication: Supabase Auth with JWT-based session management; support for OAuth 2.0 (Google) and email/password with minimum 8-character passwords;
5. (e) Audit logging: Supabase platform audit logs for database access events;
6. (f) Offline data: Patient data cached locally for offline use is stored in an IndexedDB database scoped to the application origin. You are responsible for the physical and logical security of devices used to access the platform.

6.2 User Responsibilities.

You are responsible for:

1. (a) Maintaining the confidentiality of your login credentials and not sharing them with unauthorised persons;
2. (b) Promptly notifying Scalpel if you suspect any unauthorised access to your account;
3. (c) Ensuring that team members you invite are authorised to access the Patient Data they will encounter;
4. (d) Securing any devices used to access the platform, including enabling device-level encryption and using screen lock;
5. (e) Logging out of the platform on shared or public devices.

6.3 Security Breach Notification.

In the event Scalpel becomes aware of a security compromise that may affect your Patient Data, Scalpel will notify you without unreasonable delay and in any event within 72 hours of becoming aware, consistent with section 22 of POPIA. Scalpel will also notify the Information Regulator as required by law. You acknowledge that, as Responsible Party, you are independently obliged to assess whether notification to affected data subjects is required under POPIA.

6.4 No Absolute Security Guarantee.

Notwithstanding the measures described above, no data transmission over the Internet or method of electronic storage is 100% secure. Scalpel cannot guarantee absolute security of Patient Data. You acknowledge and accept this risk as an inherent feature of cloud-based software services.

7. LIMITATION OF LIABILITY AND INDEMNIFICATION

7.1 AI-Generated Content.

Scalpel expressly disclaims all liability for:

1. (a) Any clinical, diagnostic, or treatment decisions made in reliance on AI-Generated Content;
2. (b) Errors, omissions, or inaccuracies in AI-Generated Content;
3. (c) Any billing claims submitted based on AI-Generated coding suggestions without independent clinical verification;
4. (d) Adverse patient outcomes, regulatory sanctions, or financial loss arising from unverified use of AI-Generated Content.

You bear sole professional and legal responsibility for reviewing, verifying, and approving all AI-Generated Content before clinical, billing, or legal use.

7.2 General Limitation.

To the maximum extent permitted by applicable law, Scalpel’s aggregate liability to you for any claim arising out of or relating to this Agreement or the platform shall not exceed the total subscription fees paid by you in the twelve (12) months immediately preceding the event giving rise to the claim.

7.3 Exclusions.

Scalpel shall not be liable for any indirect, incidental, special, consequential, or punitive damages, including lost profits, loss of data, business interruption, or reputational damage, even if advised of the possibility of such damages.

7.4 Data Breach Liability.

Where a data breach or security incident results from:

1. (a) Your failure to maintain the security of your credentials or authorised devices;
2. (b) Your act or omission, or that of your team members;
3. (c) A breach by a Sub-processor acting outside Scalpel’s instructions;
4. (d) Force majeure events beyond Scalpel’s reasonable control;

Scalpel shall not be liable for any resulting loss, damage, or regulatory penalty. You agree to indemnify and hold harmless Scalpel, its directors, employees, and agents from and against any claim, loss, penalty, or liability (including legal costs on an attorney-and-own-client scale) arising from any breach by you of this Agreement or of any applicable law.

7.5 POPIA Regulatory Risk.

You acknowledge that as Responsible Party, you bear primary regulatory exposure under POPIA in respect of Patient Data you cause to be processed. Scalpel’s role as Operator does not diminish or transfer this regulatory exposure to Scalpel.

8. DATA RETENTION AND DELETION

8.1 Retention During Subscription.

Patient Data will be retained for as long as your account is active and in accordance with your instructions.

8.2 Post-Termination.

On termination of your account or subscription:

1. (a) You may export all Patient Data in supported formats (CSV, PDF) before account closure;
2. (b) Unless you request earlier deletion, Patient Data will be retained for a period of 90 days after account closure, after which it will be deleted from production systems;
3. (c) Backup copies may persist for a further 30 days before permanent deletion.

8.3 Legal Retention Requirements.

You acknowledge that South African law, including the National Health Act, may impose minimum retention periods for medical records (generally 6 years for adults, or until the patient reaches 21 years of age for minors). You are responsible for exporting and independently retaining Patient Data for any period required by law. Scalpel’s deletion schedule does not constitute legal advice or a warranty that deletion complies with your specific retention obligations.

8.4 Deletion Requests.

Data subjects (patients) exercising their right of deletion under POPIA must address such requests to you as Responsible Party. You may then instruct Scalpel to delete specific records, subject to any applicable legal retention obligations.

9. ACCEPTABLE USE

You agree that you will not use the platform to:

1. (a) Process Patient Data for any purpose other than legitimate clinical documentation, billing, and administrative functions;
2. (b) Store or process data of individuals who are not your patients or under your clinical responsibility;
3. (c) Circumvent any security, access control, or Row-Level Security mechanism of the platform;
4. (d) Attempt to access another user’s data or accounts;
5. (e) Upload, generate, or transmit any content that is unlawful, defamatory, or violates any third party’s rights;
6. (f) Use the platform to generate fraudulent billing claims or to engage in medical aid fraud — which constitutes a criminal offence under South African law;
7. (g) Resell, sublicense, or commercialise access to the platform without Scalpel’s prior written consent;
8. (h) Reverse engineer, decompile, or attempt to extract the source code of the platform.

10. SUBSCRIPTION AND PAYMENT TERMS

10.1 Fees.

Access to premium features is subject to a subscription fee as displayed on the platform at the time of subscription. Fees are denominated in South African Rand (ZAR) and are inclusive of VAT where applicable.

10.2 Payment Processing.

Payments are processed by Polar Software Inc., acting as merchant of record. You authorise recurring charges to your designated payment method. Your payment information is handled exclusively by Polar and is not stored by Scalpel.

10.3 Cancellation.

You may cancel your subscription at any time through the platform’s billing settings. Cancellation takes effect at the end of the current billing period. No refunds are provided for unused portions of a billing period.

10.4 Changes to Fees.

Scalpel reserves the right to change subscription fees upon 30 days’ written notice. Continued use of the platform after the notice period constitutes acceptance of the new fees.

11. INTELLECTUAL PROPERTY

The platform, including its software, design, AI models, billing code libraries, and all associated intellectual property, is owned by or licensed to Scalpel. This Agreement grants you a limited, non-exclusive, non-transferable right to use the platform for your internal professional purposes. No ownership or intellectual property rights in the platform are transferred to you.

Patient Data you enter remains your property (or that of your patients). You grant Scalpel a limited licence to process Patient Data as an Operator solely to provide the platform services.

12. AMENDMENTS TO THIS AGREEMENT

Scalpel may update this Agreement from time to time to reflect changes in law, platform features, or Sub-processors. Material changes will be notified to you by email and/or by an in-platform notification at least 14 days before taking effect. Continued use of the platform after the effective date of an amendment constitutes your acceptance of the amended terms. Where changes are material, a new acceptance event may be required.

13. GOVERNING LAW AND DISPUTE RESOLUTION

13.1 Governing Law.

This Agreement is governed exclusively by the laws of the Republic of South Africa, including but not limited to POPIA, the Electronic Communications and Transactions Act 25 of 2002, and the Consumer Protection Act 68 of 2008.

13.2 Jurisdiction.

You consent to the exclusive jurisdiction of the courts of the Republic of South Africa for any dispute arising out of or relating to this Agreement.

13.3 Information Regulator.

If you believe your rights under POPIA have been infringed, you may lodge a complaint with the Information Regulator:

• Website: www.inforegulator.org.za
• Email: inforeg@justice.gov.za
• Tel: 012 406 4818

14. GENERAL PROVISIONS

1. 14.1 Entire Agreement. This Agreement constitutes the entire agreement between the parties with respect to its subject matter and supersedes all prior agreements and understandings.
2. 14.2 Severability. If any provision of this Agreement is found to be unenforceable, the remaining provisions shall remain in full force and effect.
3. 14.3 Waiver. No waiver of any provision of this Agreement shall be effective unless in writing.
4. 14.4 Assignment. You may not assign your rights or obligations under this Agreement without Scalpel’s prior written consent.
5. 14.5 Contact. For privacy, data, or legal queries, contact: admin@scalpal.co.za