Terms of use

1.Purpose and definitions

These terms of use (the “Terms”) govern access to and use of the Clinoly service (the “Service”), published by Clinoly (the “Publisher”).

• Client: the practice, clinic or healthcare establishment that subscribes to the Service for the purposes of its professional activity.
• User: any natural person holding an account — a member of the Client’s staff, a patient invited by the Client to the patient portal, or a member of the Publisher’s staff.
• Health data: data concerning a person’s physical or mental health, within the meaning of Law No. 09-08, recorded by the Client in the Service.
• Account: a User’s personal access, protected by their credentials.

The commercial terms of the subscription are set out in the Terms of sale. The Publisher’s processing of data on the Client’s behalf is governed by the Data processing agreement.

2.Acceptance and changes

The User accepts the Terms by ticking the box provided when the account is created. That acceptance is recorded electronically with the version accepted, the date, the time and the IP address, in accordance with Law No. 53-05 on the electronic exchange of legal data, and has the same force as a written acceptance.

The Publisher may change the Terms, in particular to reflect a change in the law or in the Service. Any substantial change produces a new version, which the User is asked to accept at their next sign-in. Every version remains available with its number and the date it came into force.

A User who declines the new version stops using the Service; the Client may then terminate its subscription as set out in the Terms of sale.

3.Access to the Service

The Service is accessible from a recent browser on a computer, tablet or phone, over an internet connection whose cost is borne by the User.

The Service is reserved for healthcare professionals and establishments and for the people they invite. The Client’s staff gain access only by the Client’s invitation, and the Client gives each of them a role determining what they may see and do.

4.Account and credential security

• The Account is strictly personal and may not be shared, including between members of the same clinic.
• The User chooses a strong password, keeps it confidential and enables two-factor authentication, which is strongly recommended for any access to health data.
• Any action taken from an Account is deemed to have been taken by its holder, unless fraudulent use is reported without delay.
• The User immediately reports any loss, disclosure or unauthorised use of their credentials to the Client, and to the Publisher at security@clinoly.com.

Access to records, views, changes and downloads are logged. That log, which the Client can consult, can be neither altered nor deleted.

5.Acceptable use

The User uses the Service for its intended purpose, in accordance with the law and the rules of their profession. In particular, the User shall not:

• access or attempt to access data outside the scope of their duties, in particular the record of a patient they are not caring for;
• record data without a legal basis, or use it for any purpose other than patient care and the running of the establishment;
• circumvent security measures, test the Service for vulnerabilities without written authorisation, or disrupt its operation;
• upload malicious files or unlawful content;
• extract data by automated means other than the export functions provided;
• copy, decompile or commercially exploit all or part of the software.

A breach may lead to suspension of the Account concerned, without prejudice to the other rights of the Publisher and the Client.

6.The Client’s responsibilities

The Client is the controller of its patients’ data: it decides why and how that data is collected. In particular, it is for the Client:

• to inform its patients that their data is processed and to obtain their consent where the law requires it — the Service lets it record those consents, channel by channel;
• to complete with the CNDP the prior formalities that fall to it for its own processing;
• to invite only authorised people who are bound by professional secrecy or a duty of confidentiality, and to give each the appropriate role;
• to deactivate without delay the Account of any member of staff who leaves;
• to check the accuracy of the information it records and of what it passes to patients.

7.Medical secrecy and confidentiality

The Service is designed to let the Client respect medical secrecy: strict separation between establishments, role-based access, separation of administrative from clinical data, and practitioners’ private notes that are never visible to the patient.

The Publisher’s staff do not access medical records. Exceptional access for support purposes is possible only with explicit authorisation, for a limited period, for a recorded reason, and it is logged. The people concerned are bound by a duty of confidentiality.

8.Patient portal

A patient invited by the Client sees in their portal only what the Client has chosen to share: appointments, prescriptions, documents, invoices. The Client is responsible for what the portal contains.

9.Artificial intelligence assistant

Where the Client enables it, the assistant helps draft summaries and administrative documents. It makes no diagnosis, prescribes nothing and never writes to a record on its own. Every suggestion must be reviewed and confirmed by the practitioner, who alone remains responsible for it. Its limits are described in the Medical and AI notice.

10.Availability and changes to the Service

The Publisher uses reasonable means to keep the Service continuously available. Interruptions may occur for maintenance, preferably outside working hours, or in the event of an incident. The availability commitments that apply to paid subscriptions are set out in the Service level agreement.

The Publisher develops the Service and may add, change or withdraw features. The consequences of a withdrawal for a subscribing Client are governed by the Terms of sale.

11.Intellectual property

The software, its documentation and its graphics belong to the Publisher. The Client and its Users receive a personal, non-exclusive and non-transferable right of use for the duration of the subscription.

The data the Client records belongs to the Client. The Publisher uses it only to provide the Service, within the limits of the Data processing agreement, and the Client can export it at any time.

12.Liability

The Service is a management tool. Medical decisions, prescriptions and the information given to patients are the sole responsibility of the healthcare professionals who make them.

The Publisher is not liable for loss resulting from use of the Service contrary to these Terms, from a fault of the User or the Client, from credentials being disclosed to a third party, or from force majeure. The limits of liability that apply to the Client are set out in the Terms of sale.

13.Suspension and closure of an Account

The Client may deactivate a staff member’s Account at any time. The Publisher may suspend an Account in the event of a serious breach of the Terms, a risk to the security of the Service or the data, or at the request of a competent authority, informing the Client as soon as possible.

Closing an Account does not delete the data recorded on the Client’s behalf: that data remains the Client’s and follows the rules described in Data retention.

14.Personal data

The Publisher’s processing of Users’ personal data is described in the Privacy policy. The processing of patients’ data, which the Publisher carries out on the Client’s behalf, is governed by the Data processing agreement.

15.Governing law and disputes

These Terms are governed by Moroccan law. In the event of a dispute, the parties first seek an amicable solution. Failing that, jurisdiction lies with the Tribunal de commerce de Casablanca.