This agreement applies to everyone who holds a Roshetta account, according to their role. Part A binds Clinics, Clinic owners, Healthcare Professionals and Staff Users. Part B is the acknowledgement and consent of Patients. Part C applies to all. It forms part of the Terms of Service.
Part A. Clinics and Healthcare Professionals (data controllers)
A1. Roles
For Clinical Data, the Clinic is the data controller and Roshetta is the data processor. A Healthcare Professional who works in a Clinic acts for that Clinic. A Healthcare Professional who practises independently on the Platform is the controller of the data of their own Patients.
A2. Lawful basis and Patient consent
- Before storing any Patient's electronic health record on Roshetta, the controller must have a valid lawful basis under the law that applies to it (for example, the provision of healthcare, a legal duty, or the Patient's explicit consent), and where the law or professional rules require consent, must obtain the Patient's informed, specific, freely given and documented consent.
- The Patient must be told, in a language they understand, that their health information is kept on a cloud software platform operated by a processor, who can access it, why, and how to exercise their rights.
- The controller must keep evidence of that consent, honour its withdrawal as far as the law allows, and must not condition emergency care on it.
- The controller is responsible for the legality of the data it enters. Roshetta does not verify, and is not responsible for, the existence or validity of any Patient's consent or other lawful basis.
A3. Instructions and purpose
Roshetta will process Clinical Data only to provide the Platform to the Clinic and on its documented instructions, which are these terms and the Clinic's use of the Platform's features. Roshetta will tell the Clinic if it believes an instruction breaks the law. Roshetta will not use Clinical Data for its own purposes, sell it, or disclose it except as this agreement allows.
A4. Confidentiality
Roshetta will ensure that everyone who may access Clinical Data is bound by a duty of confidentiality and receives access only when needed. Clinics and Healthcare Professionals remain bound by professional secrecy and must give each Staff User the least access that their duties require.
A5. Security
Roshetta applies the technical and organisational measures described in the Privacy Policy and reviews them regularly. The Clinic is responsible for its own security decisions, including who is given accounts and permissions, safe devices and networks, and the secrecy of credentials.
A6. Sub-processors
The Clinic authorises Roshetta to use sub-processors for hosting, storage, communications, payments and monitoring. Roshetta will bind each by written terms no less protective than these, remains responsible for their performance of those duties, and will give notice of material changes so the Clinic can object on reasonable grounds.
A7. Assistance with Patient rights
Taking into account the nature of the processing, Roshetta will give reasonable help so the Clinic can respond to Patient requests for access, correction, erasure, restriction or portability, and will pass on to the Clinic any such request it receives directly, without answering it itself.
A8. Personal-data breach
Roshetta will notify the Clinic without undue delay, and in any case within seventy-two (72) hours of becoming aware of a breach affecting its Clinical Data, with the information it has to help the Clinic assess and report it. The Clinic is responsible for any notification to Patients and authorities that the law requires of it.
A9. Return and deletion
On termination, Roshetta will make Clinical Data available for export for the period stated in the Terms of Service and then delete it or return it as the Clinic instructs, unless the law requires it to be kept. Backups are overwritten in the ordinary course.
A10. Audits and records
Roshetta will make available the information reasonably needed to show compliance with this agreement and will allow audits, on reasonable notice and without harming the confidentiality or security of other Clinics. The Platform keeps an audit trail of sensitive actions and a tamper-resistant log of consents, which support that purpose.
A11. Local law, HIPAA and GDPR
Each party will comply with the health-information, medical-confidentiality and data-protection laws that apply to it in the countries where the Clinic and its Patients are located. To the extent the Health Insurance Portability and Accountability Act (HIPAA) or the General Data Protection Regulation (GDPR) apply to a Clinic, this agreement is intended to serve as the processor or business-associate terms those laws require, and the parties will sign any further addendum the law requires. Where local law is stricter than this agreement, local law prevails.
A12. Clinical verification
The Clinic and each Healthcare Professional must verify all Patient data, dosages and medical records before taking any clinical action, as set out in the Terms of Service. Roshetta processes data, it does not make or check clinical decisions, and has no liability for clinical outcomes.
Part B. Patients
If you use Roshetta as a Patient, by accepting you confirm that:
- you understand that your Clinics and doctors use Roshetta, a software platform, to keep your appointments, medical records, prescriptions and billing, and that this includes sensitive health information;
- you consent to that information being recorded and processed on Roshetta by your Clinics and doctors, and by Roshetta as their processor, in order to provide and manage your care;
- you understand that only staff your Clinic has authorised can see your record, according to their role, and that Roshetta personnel do not use it for their own purposes;
- you understand that Roshetta is a software tool, not a healthcare provider, and that your care and its results are the responsibility of your doctor and Clinic;
- you may ask your Clinic to see, correct or export your information, and you may withdraw this consent at any time by telling your Clinic or through Technical Support. Withdrawal does not affect earlier processing, and records that the law requires your Clinic to keep may have to be retained; and
- your access to emergency care does not depend on this consent.
Part C. Everyone
- Do not open, copy or share Clinical Data except as your role and your care or business need allow. Each access may be recorded in the audit trail.
- Do not attempt to identify de-identified data, or to access the data of another Clinic.
- Report suspected misuse or a breach immediately through the Technical Support (الدعم الفني) form.
- Your acceptance of this agreement is recorded as described in the Terms of Service, and the record cannot be edited or deleted.
- This agreement is published in Arabic and English. Where they differ, the Arabic text governs.