Nabhaya terms of service

Version 2026-12-26

These Terms of Service ("Terms") form a binding agreement between improveFX Technologies Private Limited (CIN U63999DL2024PTC438932), having its registered office at E-49/5, First Floor, Okhla Industrial Area Phase II, New Delhi, Delhi 110020, India ("Nabhaya", "we", "us"), and the clinic, practice or healthcare provider on whose behalf they are accepted ("Customer", "you"). By ticking "I agree", the person accepting confirms that they are authorised to bind the Customer.

1. The service

1.1 Nabhaya is a cloud-based clinic management software ("Service") for registering patients, managing appointments and outpatient visits, recording consultations and prescriptions, billing, pharmacy and inventory, staff access and patient communication.

1.2 The Service is a record-keeping and workflow tool. It does not provide medical advice, diagnosis or treatment recommendations. All clinical decisions, and the accuracy of clinical records, remain the sole responsibility of the Customer and its medical practitioners.

1.3 We may improve, change or add features from time to time. We will not materially reduce the core functionality of a paid plan during its current subscription period.

2. Accounts and access

2.1 The Customer creates user accounts for its own staff and is responsible for all activity under them. Each user must have their own account; accounts must not be shared.

2.2 The Customer must keep passwords and second-factor devices confidential, use two-step verification where the Service requires it, remove access promptly when a staff member leaves, and tell us without delay about any suspected unauthorised access.

2.3 Users may only access data their role permits. The Customer is responsible for assigning roles appropriately.

3. Subscriptions, fees and payment

3.1 Plans, prices, user limits, included storage and included WhatsApp message credits are shown in the application and on our pricing page at the time of purchase. Subscriptions are prepaid for a 12-month period unless stated otherwise.

3.2 A free trial, where offered, includes limited usage (currently 100 WhatsApp message credits and 1 GB of document storage) and ends on the date shown in the application. The full plan allowance starts when the plan is purchased.

3.3 Additional WhatsApp message credits and storage packs can be purchased. Free and purchased credits and additional storage are valid only until the end of the subscription period in which they are granted or bought, and do not carry over.

3.4 Fees are payable in advance through our payment partner and are exclusive of GST unless stated otherwise. A GST tax invoice is issued for every payment. Renewals are paid by the Customer, and charged automatically only if a Customer administrator or another user with billing access turns on automatic payment, which is optional, can be turned off at any time, and works as set out in section 2A of the Refund and Cancellation Policy. A mandate approved through one payment partner is never used through another.

3.5 Fees paid are non-refundable, including for unused subscription time, credits, storage and add-ons, and including when the Customer stops renewing or closes its account. The only exceptions are: money taken in error (a payment charged twice, more than the invoice amount, debited without the purchase being applied, or a renewal charged automatically after it was already paid another way), which is refunded after review under the Refund and Cancellation Policy; a plan renewal charged automatically and cancelled before its term starts, which is refunded in full under section 2A of that policy; and refunds required by law.

3.6 If a subscription is not renewed, the account stays fully usable for a grace period of 7 days after the end of the subscription period and then becomes read-only, followed by deletion, as set out in clause 10.5.

4. Customer data

4.1 "Customer Data" means all data entered into or uploaded to the Service by or for the Customer, including patient, clinical, billing and staff data. As between the parties, the Customer owns all Customer Data.

4.2 For personal data of patients and staff in Customer Data, the Customer is the Data Fiduciary and Nabhaya is its Data Processor under the Digital Personal Data Protection Act, 2023. The Data Processing consent accepted with these Terms forms part of this agreement.

4.3 The Customer is responsible for: having a lawful basis for collecting patient data; giving patients its privacy notice and recording their consent (or that of a parent or lawful guardian for patients under 18); the accuracy of the data; and responding to patients' requests, using the tools the Service provides.

4.4 We process Customer Data only to provide, secure and support the Service and as required by law. We do not sell Customer Data, use patient data for advertising or analytics, or use it to train artificial-intelligence models.

4.5 The Customer may export its data at any time in CSV or Excel format, or as a full export that also includes its uploaded files, including while the account is read-only under clause 10.5.

4.6 If the Customer was introduced by a Nabhaya Authorised Partner (the onboarding form names the partner), then while the Customer is active on the Service the partner sees the Customer's name and city, plan, status, trial and renewal dates, whether automatic payment is on, and the subscription amount before GST on which the partner's commission is worked out (added up with the partner's other clinics until the partner's monthly statements start, then shown for each commission), as described in section 4C of our privacy policy. The partner never sees patient data, staff, invoices, GST or payment details, and receives no other Customer Data.

5. Security and hosting

5.1 We maintain reasonable security practices appropriate to health data, including encryption in transit and at rest, role-based access control, two-step verification, logical separation of each clinic's data, a tamper-evident audit trail, monitoring and encrypted backups.

5.2 The production database and its backups are hosted in India (Amazon Web Services, Mumbai region). Uploaded files (such as patient documents, signatures and logos) and per-clinic backup copies are currently stored with Cloudflare R2, which may be outside India; private files and backups are encrypted by us before upload and the keys are kept only on our servers in India. We will move these files to storage in India and inform the Customer when we do. Some service providers that deliver messages or payments (for example WhatsApp, email and payment providers) may process limited data outside India under their own terms.

5.3 We will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Data and will provide reasonable assistance, including with notices to the Data Protection Board of India and to affected persons. We report cyber incidents to CERT-In as required by law.

6. Acceptable use

The Customer must not, and must ensure its users do not: (a) use the Service unlawfully or for any purpose other than its healthcare practice; (b) upload malware or material that infringes others' rights; (c) send unsolicited or promotional messages without the recipient's consent, or breach WhatsApp, telecom or email rules; (d) attempt to access other customers' data or probe, scan or test the Service's security without our written permission; (e) resell or sublicense the Service; or (f) copy, reverse engineer or build a competing product from the Service.

7. Messaging

7.1 Messages to patients (appointment, visit, billing, prescription and report notifications) are sent on the Customer's instructions and settings. The Customer is responsible for their content and for having the patient's consent where required.

7.2 Messages are delivered through third-party providers (such as WhatsApp Business by Meta and email providers). Delivery depends on those providers and the recipient, and is not guaranteed. Each WhatsApp message uses one message credit.

8. Availability and support

8.1 We use commercially reasonable efforts to keep the Service available at all times, except for planned maintenance (announced in advance where possible) and events outside our reasonable control.

8.2 Support is provided through in-app support tickets. Response times depend on the plan and the urgency of the issue.

8.3 We back up Customer Data daily. The Customer remains responsible for keeping its own exports where required by law or its policies.

9. Intellectual property and confidentiality

9.1 Nabhaya and its licensors own the Service, software, designs and documentation. We grant the Customer a non-exclusive, non-transferable right to use the Service for its internal healthcare operations during the subscription.

9.2 Feedback the Customer provides may be used by us freely to improve the Service.

9.3 Each party will keep the other's confidential information confidential and use it only for this agreement, except where disclosure is required by law.

10. Term, suspension and termination

10.1 These Terms apply from acceptance until the Customer's account is closed.

10.2 The Customer may stop renewing at any time (which also turns off automatic payment), or request deletion of its account from Account Settings (which turns off automatic payment at once). Deletion is held for 7 days (during which it can be cancelled) and then all Customer Data, including files, is permanently erased from the live Service. Encrypted backup copies expire on their normal schedule (daily and weekly copies within 35 days, the first copy of each month within about 13 months); until then they are used only to recover from a disaster and are never restored for use by or for the deleted account. We email the Customer's administrators a deletion certificate when the deletion is complete.

10.3 We may suspend or terminate access for non-payment, a material breach not remedied within 15 days of notice, unlawful use, or to protect the security of the Service or other customers. Fees already paid are not refunded on suspension or termination, except where a refund is required by law.

10.4 After we terminate the Service, the Customer's data is handled as in clause 10.5, counted from the date of termination, unless the account was deleted at the Customer's request.

10.5 Subscription ended and not renewed. When a subscription ends and is not renewed, the following applies, counted in India time from the day the grace period in clause 3.6 ends ("day 0"):

(a) Days 0 to 90: the account is read-only. All users can sign in, view and export all Customer Data (CSV, Excel, or a full export including uploaded files), but cannot create or change records.

(b) Days 90 to 180: only the Customer's administrators can sign in, to renew the subscription or export the data.

(c) Reminders: we send service messages (not marketing) to the Customer's administrators by email and WhatsApp when the subscription ends, and 60, 30 and 7 days before deletion, each with a link to the data export page.

(d) Day 180: all Customer Data, including patient records, uploaded files, staff accounts and settings, is permanently deleted from the live Service, unless we have agreed in writing to keep it longer, in which case it is deleted at the end of the agreed period.

(e) Renewing at any time before deletion restores full access immediately and cancels the deletion.

(f) When the deletion is complete we email the Customer's administrators a deletion certificate stating what was deleted (by category) and when, and what was retained.

(g) Encrypted backup copies expire on their normal schedule (daily and weekly copies within 35 days, the first copy of each month within about 13 months); they are used only to recover the Service from a disaster and are never restored for use.

(h) Our tax invoices, payment records and GST documents issued to the Customer, with the Customer's billing name, address, GSTIN and PAN, are kept for 8 years as tax law requires, and security and audit logs are kept for their own retention period with personal details removed.

(i) For subscriptions that ended before 11 December 2026, these periods are counted from 11 December 2026.

11. Warranties and liability

11.1 The Service is provided "as is" and "as available". To the extent permitted by law, we disclaim all implied warranties, including fitness for a particular purpose.

11.2 Neither party is liable for indirect, incidental, special or consequential losses, or loss of profits, revenue or goodwill.

11.3 Our total liability arising out of or relating to these Terms in any 12-month period is limited to the fees paid by the Customer for the Service in the 12 months before the event giving rise to the claim.

11.4 Nothing limits liability that cannot be limited by law, including for fraud.

12. Indemnity

The Customer will indemnify Nabhaya against third-party claims arising from Customer Data, the Customer's medical services or clinical decisions, or the Customer's breach of these Terms or applicable law, including the absence of patient consent.

13. General

13.1 Changes: we may update these Terms by giving at least 30 days' notice in the application or by email; continued use after that date means acceptance. Material changes to data processing will not apply to the current subscription period without the Customer's agreement.

13.2 Force majeure: neither party is liable for delay caused by events beyond its reasonable control.

13.3 Assignment: the Customer may not assign this agreement without our consent; we may assign it to a successor of our business with notice.

13.4 Governing law and disputes: these Terms are governed by the laws of India. Disputes will first be discussed in good faith for 30 days and then referred to arbitration by a sole arbitrator under the Arbitration and Conciliation Act, 1996, seated in New Delhi, in English. Subject to this, the courts at New Delhi have exclusive jurisdiction.

13.5 Grievance Officer and notices: privacy and data protection matters: [email protected]; other matters: [email protected] or by post to our registered office.

13.6 These Terms, the Data Processing consent and any order or plan details shown at purchase are the entire agreement on this subject. If a provision is unenforceable, the rest remains in force.