A User-Centric Electronic Health Record + AI for Caribbean Clinics

These Terms of Service (“Terms”) are a binding agreement between MedRegis Inc. (“MedRegis”, “we”, “us”, or “our”) and the organisation that subscribes to or uses the Service (the “Subscriber”, “you”, or “your”). They govern access to and use of the MedRegis website at https://medregis.com, the MedRegisEHR web and mobile applications, and all related products, features, and documentation (together, the “Service”).

The Service is a clinical and administrative tool intended for use by licensed healthcare organisations and their personnel. By creating an account, accepting these Terms electronically, or accessing or using the Service, you confirm that you have authority to bind the Subscriber and that the Subscriber agrees to these Terms, the MedRegis Privacy Policy, and the MedRegis Data Processing Addendum, which are incorporated by reference. If you do not agree, you must not access or use the Service.

(a) “Authorized User” means an individual who is a member of the Subscriber’s own workforce (such as an employed or contracted clinician, nurse, pharmacist, or administrative staff member) whom the Subscriber permits to access the Service solely for the Subscriber’s internal healthcare and business operations.

(b) “Administrator” means an Authorized User whom the Subscriber designates to manage its account, including the creation, modification, and removal of other Authorized Users.

(c) “Subscriber Data” means all data the Subscriber or its Authorized Users submit to or generate within the Service, including Patient Data.

(d) “Patient Data” means personal data and sensitive personal data relating to the Subscriber’s patients, including medical records, that is processed within the Service.

(e) “Confidential Information” means non-public information disclosed by one party to the other, including the non-public features, functionality, user interfaces, workflows, screens, design, and know-how of the Service, which are the Confidential Information of MedRegis.

(f) “Documentation” means the user guides and materials MedRegis makes available for the Service.

3.1 Authorized Users only. The Subscriber may permit access to the Service only to its own Authorized Users. Each Authorized User must be assigned unique credentials tied to a named individual. The Subscriber’s Administrators are responsible for creating, modifying, and removing Authorized Users and for maintaining an accurate and current record of them.

3.2 No third-party or competitor access. The Subscriber must not create accounts or profiles for, share credentials with, or otherwise grant access to the Service to any person or entity that is not an Authorized User. Without limiting the foregoing, the Subscriber must not grant access to, or create any account or profile for, any competitor of MedRegis or any developer, operator, or agent of a product or service that competes with the Service. Any such grant is a material breach of these Terms.

3.3 Credential security. The Subscriber is responsible for maintaining the confidentiality of all account credentials, for restricting access to authorised devices, and for all activities that occur under its account, whether or not authorised by the Subscriber. The Subscriber must not permit credential sharing among individuals.

3.4 Notification. The Subscriber must notify MedRegis immediately at privacy@medregis.com upon becoming aware of any actual or suspected unauthorised access to, disclosure of, or use of the Service or of any Subscriber Data.

3.5 Accuracy and age. The Subscriber warrants that account information is accurate and current, and that all Authorized Users are at least eighteen (18) years of age and authorised by the Subscriber to use the Service.

Subject to these Terms, MedRegis grants the Subscriber a limited, non-exclusive, non-transferable, non-sublicensable licence to access and use the Service and Documentation solely for the Subscriber’s internal healthcare and business operations during the subscription term. All rights not expressly granted are reserved by MedRegis.

The Subscriber must not, and must not permit any Authorized User or third party to:

(a) use the Service other than for the Subscriber’s internal healthcare and business operations, or for the benefit of any third party;

(b) reverse engineer, decompile, disassemble, or otherwise attempt to derive the source code, structure, or underlying ideas of the Service, except to the extent this restriction is prohibited by applicable law;

(c) access or use the Service to build, train, support, or improve a competing or similar product or service, or to benchmark or evaluate the Service for a competitor;

(d) copy, reproduce, screenshot, record, or recreate the features, functionality, user interfaces, workflows, or design of the Service, in whole or in part;

(e) use any robot, spider, scraper, or manual process to monitor, index, or copy any part of the Service without MedRegis’s prior written consent;

(f) circumvent, disable, or interfere with any access control, security, or authentication feature of the Service;

(g) attempt to gain unauthorised access to the Service or to any server, network, or database connected to it;

(h) introduce any virus, worm, or other harmful code, or take any action that impairs the integrity or performance of the Service;

(i) remove or obscure any proprietary notice; or

(j) use the Service in any way that violates any applicable law or regulation, or infringes the rights of any person.

6.1 Obligations. Each party must protect the other’s Confidential Information using at least reasonable care, must not disclose it except to personnel with a need to know who are bound by confidentiality obligations, and must use it only to perform under these Terms. The Subscriber acknowledges that the non-public elements of the Service are the Confidential Information of MedRegis and must not be disclosed to, or made accessible by, any third party or competitor.

6.2 Exclusions and survival. These obligations do not apply to information that is or becomes public through no fault of the receiving party, or that is independently developed without use of the Confidential Information. The obligations in this clause survive termination.

7.1 Ownership. The Service, and all intellectual property in it, including its original content, features, functionality, and design (but excluding Subscriber Data), are and remain the exclusive property of MedRegis and its licensors, and are protected by the laws of Barbados and other jurisdictions. Nothing in these Terms transfers any ownership of the Service to the Subscriber.

7.2 Feedback. If the Subscriber or its Authorized Users provide suggestions, ideas, or other feedback about the Service, MedRegis may use that feedback to operate, improve, and develop the Service without restriction or obligation. This does not transfer to MedRegis any pre-existing intellectual property of the Subscriber.

8.1 Ownership. As between the parties, the Subscriber owns all Subscriber Data, including Patient Data.

8.2 Roles and Data Processing Addendum. For the purposes of the Data Protection Act, 2019-29 of Barbados (the “DPA”) and any other applicable data protection law, the Subscriber is the data controller of Patient Data and MedRegis is the data processor. The MedRegis Data Processing Addendum governs that processing, forms part of these Terms, and satisfies the DPA requirement for a written contract between controller and processor.

8.3 Subscriber responsibilities. The Subscriber warrants that it has a lawful basis to process Patient Data, that it has provided all required notices and obtained all required consents, and that its grant of access to Authorized Users complies with applicable law. The Subscriber is responsible for any exposure of Subscriber Data that results from its own acts or omissions, including the provisioning of access in breach of clause 3.

8.4 Security. MedRegis maintains administrative, technical, and physical safeguards designed to protect Subscriber Data, including role-based access controls, encryption of data in transit and at rest, and audit logging of access to Patient Data, as further described in the Privacy Policy and the Data Processing Addendum.

8.5 Incident notification. MedRegis will notify the Subscriber without undue delay after becoming aware of a personal data breach affecting the Subscriber’s Patient Data, and will provide reasonable assistance to enable the Subscriber, as controller, to meet its obligation to notify the Data Protection Commissioner without undue delay and, where feasible, within 72 hours, and to notify affected data subjects where required under the DPA.

8.6 Licence to process Subscriber Data. The Subscriber grants MedRegis a limited, non-exclusive, worldwide licence to host, store, process, and transmit Subscriber Data solely to provide, maintain, secure, and support the Service, and to comply with the Subscriber’s documented instructions and applicable law. MedRegis acquires no other rights in Subscriber Data.

9.1 Billing. Parts of the Service are billed on a subscription basis in advance on a recurring monthly or annual cycle, as selected at purchase. A valid payment method is required, and the Subscriber authorises MedRegis to charge all applicable fees.

9.2 Automatic renewal. Each subscription renews automatically for a further term of the same length under the then-current Terms and fees, unless cancelled before the end of the current term through the account management page or by contacting MedRegis support.

9.3 Fee changes. MedRegis may modify fees effective at the start of the next renewal term, on reasonable prior notice. Continued use after a fee change takes effect constitutes acceptance of the change.

9.4 Refunds. Except where required by law, fees are non-refundable.

10.1 Suspension. MedRegis may suspend access to the Service immediately, in whole or in part, where it reasonably believes there is a security risk, unauthorised or third-party access, or a breach of clause 3 or clause 5, or as necessary to protect Subscriber Data or the Service.

10.2 Termination. Either party may terminate for material breach that remains uncured 30 days after written notice. MedRegis may terminate or suspend immediately for a breach of clause 3 (Access Control) or clause 5 (Restrictions), or where required by law.

10.3 Effect and data export. On termination, the Subscriber’s right to use the Service ends. Before the termination date, MedRegis will make the Subscriber Data available for export in a commonly used format, whether through self-service tools or by performing the export at the Subscriber’s request within a reasonable period. For sixty (60) days after termination (the “Retention Period”), MedRegis will retain the Subscriber Data and continue to apply the protections of these Terms and the Data Processing Addendum, during which the Subscriber may request a final export. On expiry of the Retention Period, MedRegis may delete the Subscriber Data, subject to any legal retention requirement and to the return-or-deletion terms of the Data Processing Addendum. The Subscriber remains solely responsible for retaining patient and medical records for the periods required by applicable law. Clauses that by their nature should survive termination will survive.

The Service is a tool to assist licensed healthcare providers and does not provide medical advice or clinical recommendations. All clinical decisions — including diagnosis, treatment, prescribing, and the interpretation of information within the Service — are the sole responsibility of the Subscriber and its qualified providers. MedRegis is not liable for any clinical decision, act, omission, or patient outcome arising from use of the Service.

Certain features of the Service use artificial intelligence, including AI-assisted transcription and documentation. AI-generated output may contain errors, omissions, or inaccuracies, is provided as a draft aid only, and must be reviewed and verified by a qualified provider before it is relied upon or entered into a patient record. The Subscriber and its providers remain solely responsible for the accuracy, completeness, and clinical appropriateness of any content derived from AI-assisted features. MedRegis does not warrant the accuracy of AI-generated output and is not liable for any decision made or action taken in reliance on it.

13.1 Changes to the Service. MedRegis may modify, update, add, or discontinue features of the Service from time to time. Where a change would materially reduce core functionality, MedRegis will provide reasonable prior notice.

13.2 Third-party dependencies. The Service relies on third-party services outside MedRegis’s control, including hosting, connectivity, clearinghouses, messaging channels, payment processors, and AI providers. MedRegis is not liable for failures, delays, or interruptions caused by such third-party services, though it will use reasonable efforts to address them.

Except as expressly stated in these Terms, the Service is provided “as is” and “as available”, and MedRegis disclaims all warranties, whether express, implied, or statutory, including warranties of merchantability, fitness for a particular purpose, and non-infringement, to the fullest extent permitted by law. MedRegis does not warrant that the Service will be uninterrupted or error-free. This clause does not exclude any warranty that cannot be excluded under applicable law.

15.1 General limitation. To the fullest extent permitted by law, neither party will be liable for any indirect, incidental, special, consequential, or punitive damages, or for any loss of profits, revenue, or data, arising out of or relating to these Terms, even if advised of the possibility. Except for the Subscriber’s payment obligations, a party’s indemnification obligations, and either party’s breach of confidentiality, each party’s total aggregate liability arising out of or relating to these Terms will not exceed the fees paid by the Subscriber to MedRegis in the twelve (12) months preceding the event giving rise to the liability. Nothing in these Terms limits liability that cannot be limited under applicable law, including liability to data subjects or the Commissioner under the DPA.

15.2 Customer-caused incidents. MedRegis is not liable for any security incident, unauthorised access, data exposure, or loss arising from the Subscriber’s own acts or omissions, including the sharing of credentials, failure to manage or revoke Authorized User access, or the granting of access to any person in breach of clause 3.

The Subscriber will defend, indemnify, and hold harmless MedRegis and its officers, directors, employees, and agents from and against any claims, damages, losses, and reasonable expenses arising out of or relating to: (a) the Subscriber’s breach of clause 3 or clause 5; (b) any access to the Service granted by the Subscriber to a third party or competitor; (c) the Subscriber’s Patient Data or its instructions for processing it; or (d) the Subscriber’s violation of any law or of the rights of any person.

Neither party is liable for any failure or delay in performance (other than payment obligations) caused by events beyond its reasonable control, including acts of God, natural disasters, power or internet failures, acts of government, or third-party service failures. The affected party will use reasonable efforts to mitigate and resume performance.

These Terms are governed by the laws of Barbados, without regard to conflict-of-law principles. The parties submit to the exclusive jurisdiction of the courts of Barbados. Before commencing proceedings, the parties will attempt in good faith to resolve any dispute through discussion between senior representatives.

MedRegis may amend these Terms by posting the revised Terms and updating the “Last updated” date, and, for material changes, by providing reasonable notice by email or in-Service notice. Continued use of the Service after the revised Terms take effect constitutes acceptance. If the Subscriber does not agree, it must stop using the Service and may cancel in accordance with clause 9.

20.1 Entire agreement and non-reliance. These Terms, together with the Privacy Policy and Data Processing Addendum, are the entire agreement between the parties regarding the Service and supersede prior agreements on that subject. The Subscriber acknowledges that, in entering into these Terms, it has not relied on any statement, representation, or assurance that is not expressly set out in these documents.

20.2 Assignment. The Subscriber may not assign these Terms without MedRegis’s prior written consent. MedRegis may assign to an affiliate or in connection with a merger or sale of assets.

20.3 Waiver and severability. A failure to enforce a provision is not a waiver. If any provision is held unenforceable, it will be limited to the minimum extent necessary and the remaining provisions will remain in effect.

20.4 Notices. Notices to MedRegis must be sent to legal@medregis.com; notices to the Subscriber may be sent to the account’s registered contact.

Email: legal@medregis.com

MedRegis Inc. (“MedRegis”, “we”, “us”, or “our”) operates https://medregis.com and the MedRegisEHR web and mobile applications (together, the “Service”). This Privacy Policy explains how we collect, use, disclose, and safeguard personal data, and the rights available to individuals under the Data Protection Act, 2019-29 of Barbados (the “DPA”) and other applicable data protection law.

2.1 MedRegis as controller. For personal data about our website visitors, prospective customers, and the account and contact details of the staff of subscribing organisations, MedRegis is the data controller. This Policy governs that processing.

2.2 MedRegis as processor. For patient data and clinical records that a subscribing organisation (a “Subscriber”) processes within the Service (“Patient Data”), the Subscriber is the data controller and MedRegis is the data processor. MedRegis processes Patient Data only on the Subscriber’s documented instructions and in accordance with our Terms of Service and the Data Processing Addendum. If you are a patient, please direct privacy requests to the clinic that holds your records; we will assist that clinic in responding.

Where we act as controller, we may collect: (a) identity and contact data, such as name, email address, telephone number, and mailing address; (b) account data, such as username, role, and affiliated organisation; (c) billing data, noting that payment card details are handled by our payment processors and are not stored by us; and (d) usage and device data, such as IP address, browser and device type, pages visited, and diagnostic data collected through cookies and similar technologies.

Where we act as processor, the Service stores and processes Patient Data entered by the Subscriber’s Authorized Users, which may include patient identifiers, demographic information, medical history, clinical notes, prescriptions, laboratory and diagnostic information, and related administrative and scheduling data. This is sensitive personal data under the DPA and is subject to enhanced safeguards. We do not use Patient Data for our own purposes, and we do not sell personal data.

AI-assisted features. Certain features, such as AI-assisted transcription and documentation, process Patient Data to generate draft content for the Subscriber. This processing is carried out as processor on the Subscriber’s instructions; MedRegis does not use Patient Data processed through these features for its own purposes, and AI-generated output is subject to provider review as set out in the Terms of Service. Third-party AI providers are engaged through their business/API terms as sub-processors under the Data Processing Addendum and do not train their models on this data.

As controller, we use personal data to: provide, maintain, and secure the Service; manage accounts and subscriptions; provide support; process billing; communicate service and, where permitted, marketing messages (from which you may opt out); improve the Service; and comply with legal obligations. We rely on the lawful bases available under the DPA, including performance of a contract, our legitimate interests (balanced against your rights), compliance with a legal obligation, and consent where required.

We use session, preference, security, and analytics cookies to operate and improve the Service. You can control cookies through your browser settings, though disabling some cookies may affect functionality.

We may disclose personal data: to service providers and sub-processors who process data on our behalf under written obligations of confidentiality and security; where required by law or valid request of a public authority; to protect the rights, property, or safety of MedRegis, our customers, or others; and in connection with a merger, acquisition, or asset sale. We do not sell personal data, and we do not disclose Patient Data except on the Subscriber’s instructions or as required by law.

We engage vetted sub-processors to help deliver the Service, including cloud hosting, file storage, content delivery, messaging and email delivery, AI-assisted features, analytics, application monitoring, and payment processing. Each is bound by contractual obligations consistent with this Policy and applicable law. The current list, with functions and locations, is maintained in Schedule 3 of the Data Processing Addendum, which MedRegis may update from time to time.

The Service is hosted on cloud infrastructure located in the United States, and Patient Data is processed and stored in the United States. Content delivery and security are provided through Cloudflare. Because this involves a transfer of personal data outside Barbados, MedRegis relies on appropriate safeguards — including the data protection terms offered by these providers — to ensure an adequate level of protection consistent with the DPA. The specific providers are listed in Schedule 3 of the Data Processing Addendum.

We maintain administrative, technical, and physical safeguards appropriate to the sensitivity of the data, including: role-based access controls limiting users to what their role requires; unique credentials for each user; multi-factor authentication that is available and can be enforced across a clinic; encryption of Patient Data in transit and at rest; audit logging of changes to patient records with the user’s identity and timestamp; confidentiality obligations and least-privilege access for personnel and contractors; backup and recovery procedures; and routine security patching. Physical and infrastructure security is provided by our cloud hosting providers. No method of transmission or storage is entirely secure, but we work to protect personal data and to respond promptly to security events.

Where MedRegis acts as controller and becomes aware of a personal data breach that is likely to result in a risk to the rights and freedoms of individuals, we will notify the Data Protection Commissioner without undue delay and, where feasible, within 72 hours of becoming aware of it, and will notify affected individuals where required by the DPA. Where MedRegis acts as processor, we will notify the affected Subscriber without undue delay and assist that Subscriber, as controller, in meeting its own notification obligations within the same timeframe.

We retain personal data only for as long as necessary for the purposes described in this Policy or as required by law.

Account and billing records: retained for the period required by applicable company and tax law — generally between 5 and 7 years after account closure, depending on the applicable financial record-keeping obligation — after which they are deleted.

Usage and diagnostic data: retained for up to 14 months, then deleted or aggregated.

Patient Data: retained in accordance with the Subscriber’s instructions and the post-termination Retention Period set out in the Terms of Service and the Data Processing Addendum. The Subscriber, as controller, remains responsible for retaining patient and medical records for the periods required by applicable law.

Subject to the DPA, individuals have rights to access their personal data, to request rectification or erasure, to restrict or object to certain processing, to data portability, and to prevent processing for direct marketing. To exercise these rights in respect of data for which we are controller, contact us using the details below, and we will respond within the timeframe required by the DPA. For Patient Data held within a clinic’s records, please contact the relevant clinic, which is the controller; we will support the clinic in responding. Individuals also have the right to lodge a complaint with the Data Protection Commissioner of Barbados.

The Service is intended for use by Authorized Users aged eighteen (18) or older. This Policy does not restrict a clinic, as controller, from maintaining records of patients of any age within the Service in the course of providing care; such records are Patient Data processed on the clinic’s instructions.

We may update this Policy from time to time. We will post the updated Policy, update the effective date, and, for material changes, provide notice by email or a prominent notice within the Service before the change takes effect.

For privacy questions or to exercise your rights, contact our Data Protection Officer at privacy@medregis.com.

This Data Processing Addendum (“Addendum”) applies where MedRegis processes Patient Data on behalf of the Subscriber under the Terms of Service. For that Patient Data, the Subscriber is the data controller and MedRegis is the data processor. In the event of a conflict between this Addendum and the Terms of Service in relation to the processing of Patient Data, this Addendum prevails.

Terms such as “personal data”, “sensitive personal data”, “processing”, “data controller”, “data processor”, “data subject”, and “personal data breach” have the meanings given in the Data Protection Act, 2019-29 of Barbados (the “DPA”). “Patient Data” and other capitalised terms have the meanings given in the Terms of Service. “Applicable Data Protection Law” means the DPA and any other data protection law applicable to the Subscriber’s processing of Patient Data.

3.1 MedRegis processes Patient Data only on the Subscriber’s documented instructions, including as set out in the Terms of Service, this Addendum, and Schedule 1, unless required to act otherwise by law, in which case MedRegis will inform the Subscriber of that legal requirement before processing, unless the law prohibits it.

3.2 MedRegis will inform the Subscriber if, in its opinion, an instruction infringes Applicable Data Protection Law. MedRegis will not sell Patient Data and will not use it for its own purposes.

MedRegis ensures that persons authorised to process Patient Data are bound by confidentiality obligations and are trained on their data protection responsibilities, and that access is limited to those who need it to deliver the Service.

MedRegis implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk, taking account of the sensitive nature of Patient Data. These measures are described in Schedule 2.

6.1 The Subscriber authorises MedRegis to engage the sub-processors listed in Schedule 3, including the third-party providers of AI-assisted features. MedRegis imposes data protection obligations on each sub-processor no less protective than those in this Addendum and remains responsible for their performance.

6.2 MedRegis will give the Subscriber prior notice of any intended addition or replacement of a sub-processor, allowing the Subscriber a reasonable period to object on reasonable data protection grounds.

Taking account of the nature of the processing, MedRegis will provide reasonable assistance to the Subscriber, by appropriate technical and organisational measures, to enable the Subscriber to: (a) respond to requests from data subjects exercising their rights under Applicable Data Protection Law; (b) meet its security, breach-notification, and data protection impact assessment obligations; and (c) consult with the Data Protection Commissioner (the “Commissioner”) where required.

MedRegis will notify the Subscriber without undue delay after becoming aware of a personal data breach affecting Patient Data, and will provide the information reasonably necessary for the Subscriber to meet its own obligation, as controller, to notify the Data Protection Commissioner without undue delay and, where feasible, within 72 hours, and to notify affected data subjects where required. MedRegis will take reasonable steps to mitigate and remediate the breach.

9.1 Retrieval before termination. Before the termination date, MedRegis will make the Patient Data available for export in a commonly used format, whether by providing the Subscriber with self-service export tools or by performing the export at the Subscriber’s request within a reasonable period. The Subscriber is responsible for requesting or performing its export before the termination date.

9.2 Retention period. For a period of sixty (60) days following termination (the “Retention Period”), MedRegis will retain the Patient Data and continue to apply the security and confidentiality protections of this Addendum, during which the Subscriber may request a final export.

9.3 Return and deletion. On expiry of the Retention Period, MedRegis will restrict its processing of the Patient Data to secure storage pending its return or deletion. At the Subscriber’s request, MedRegis will return or delete the Patient Data and existing copies. Absent such a request, MedRegis may delete the Patient Data on reasonable prior notice to the Subscriber, except to the extent retention is required by law, in which case MedRegis will continue to store it securely and process it only as required by law.

9.4 Subscriber’s retention obligations. The Subscriber remains solely responsible for retaining patient and medical records for the periods required by applicable law, and for meeting its own records-retention, archiving, and legal-hold obligations. MedRegis’s retention or deletion of Patient Data under this clause does not discharge the Subscriber of those obligations.

MedRegis maintains records of its processing of Patient Data and will make available to the Subscriber information reasonably necessary to demonstrate compliance with this Addendum. On reasonable prior notice, and no more than once per year unless required by the Commissioner or following a breach, MedRegis will allow and contribute to audits conducted by the Subscriber or an independent auditor bound by confidentiality, subject to reasonable security and confidentiality controls.

MedRegis will not transfer Patient Data outside Barbados except where the destination ensures an adequate level of protection or appropriate safeguards are in place consistent with the DPA, and subject to the Subscriber’s instructions. The Service and Patient Data are hosted in the United States as described in Schedule 1, under the data protection terms offered by the relevant providers.

Each party’s liability under this Addendum is subject to the limitations and exclusions in the Terms of Service. Nothing in this Addendum limits either party’s liability to data subjects or to the Commissioner to the extent such liability cannot be limited under Applicable Data Protection Law.

This Addendum is governed by the laws of Barbados. For Subscribers established outside Barbados, additional or overriding requirements of the Subscriber’s local data protection law may apply and should be addressed in a local-law schedule.

Subject matter: Provision of the MedRegisEHR electronic health record service, including AI-assisted transcription and documentation features.

Duration: The term of the Subscriber’s subscription and any wind-down period.

Nature and purpose: Hosting, storage, retrieval, and processing of health records to enable the Subscriber to deliver and administer healthcare, including generation of draft documentation through AI-assisted features.

Types of personal data: Patient identifiers and demographics; contact details; medical history and clinical notes; prescriptions; laboratory and diagnostic data; appointment and administrative data.

Categories of data subjects: The Subscriber’s patients and, as applicable, their guardians or representatives.

Hosting and data location: The Service is hosted on cloud infrastructure in the United States (Heroku and Amazon Web Services), with content delivery and security through Cloudflare. Patient Data is processed and stored in the United States. Transfers outside Barbados are subject to appropriate safeguards consistent with the DPA.

Access control. Role-based access controls restrict each user to the functions and data appropriate to their role. Each user is assigned unique credentials tied to a named individual, and clinic administrators can add, modify, and revoke user access. Multi-factor authentication is available and can be enforced across a clinic through account settings.

Encryption. Patient Data is encrypted in transit and at rest.

Audit logging. The system maintains audit logs of changes to patient records, recording the action, the timestamp, and the identity of the user who made it.

Confidentiality and least privilege. Personnel and contractors who may access Patient Data are bound by confidentiality obligations, and access is limited to those who require it to deliver the Service.

Resilience. Patient Data is backed up, with backup and recovery procedures in place.

Maintenance. Security updates and patches are applied to the platform in the normal course.

Physical security. Physical and infrastructure security is provided by MedRegis’s cloud hosting providers.

MedRegis engages the following sub-processors. The list may be updated from time to time in accordance with clause 6.