Practitioner SaaS Agreement and Data Processing Agreement

1. Appointment and licence

The Company grants the Practitioner a non-exclusive, non-transferable right to use Oriva OS for the duration of the subscription to create and administer meal plans and monitor patients/clients.

2. Practitioner responsibility

The Practitioner remains responsible for:

• the professional services rendered to each patient/client;
• determining the appropriateness of any meal plan or nutritional programme;
• ensuring that the Practitioner is appropriately registered and authorised to provide the relevant services;
• obtaining all clinical and other consents required by law;
• ensuring that information uploaded to the App has been lawfully obtained;
• ensuring that information entered into the App is accurate and appropriately maintained;
• maintaining professional confidentiality; and
• complying with applicable HPCSA rules, ethical guidelines and legislation.

3. No transfer of professional responsibility

• The App is a technological platform and does not replace the professional judgement, supervision or responsibility of the Practitioner.
• The Company does not provide healthcare or medical advice to patients merely by providing the App.

4. User accounts

The Practitioner must:

• maintain confidentiality of login credentials;
• not permit unauthorised persons to use the Practitioner account;
• use appropriate devices and secure connections;
• immediately notify the Company of suspected unauthorised access; and
• ensure that staff members accessing patient information are authorised and appropriately bound by confidentiality obligations.

5. Clinical records

• The Practitioner acknowledges that information concerning patients may constitute health records.
• The Practitioner must comply with applicable recordkeeping requirements.
• The Company will provide reasonable technical functionality to allow the Practitioner to access, export, maintain and retain records.

6. Subscription

• The Practitioner shall pay the subscription fee specified in the applicable order or subscription plan.
• Payments may be processed through PayFast.

7. Suspension

• The Company may suspend access where necessary for security, unlawful use, non-payment or material breach.
• Suspension will not automatically result in destruction of patient health records.

8. Roles

For patient health information processed by the Company on behalf of the Practitioner:

• the Practitioner is the responsible party/controller to the extent that the Practitioner determines the purpose and means of processing;
• the Company acts as operator/processor to the extent that it processes information on the documented instructions of the Practitioner.

For information relating to the Company's own subscribers, accounts, billing and administration, the Company may act as the responsible party in its own right.

9. Processing instructions

The Company shall process patient information only:

• To provide the App;
• to store and display meal plans;
• to facilitate calorie and nutritional tracking;
• to enable authorised professional monitoring;
• to provide technical support;
• to maintain security;
• to comply with law; and
• on other documented lawful instructions of the Practitioner.

The Company shall not use identifiable patient health information for unrelated purposes.

10. Confidentiality

The Company shall ensure that persons authorised to process patient information are subject to confidentiality obligations.

11. Security

The Company shall implement appropriate technical and organisational safeguards, including:

• encryption;
• access control;
• role-based permissions;
• authentication;
• audit logging;
• backups;
• vulnerability management;
• incident-response procedures; and
• appropriate security monitoring.

12. Sub-processors

• The Practitioner authorises the use of the following service providers: Supabase; Vercel; PayFast, to the extent necessary for payment processing; and other sub-processors notified to the Practitioner from time to time (listed in the Privacy Notice).
• The Company shall ensure that relevant sub-processors are contractually bound by appropriate confidentiality, security and data-protection obligations.

13. Security incidents

• The Company shall notify the Practitioner without undue delay after becoming aware of a security incident affecting patient information.
• The Company shall provide reasonable assistance in investigating, containing and responding to the incident.

14. Data subject requests

The Company shall reasonably assist the Practitioner with:

• access requests;
• correction requests;
• deletion requests where legally permissible;
• objections;
• complaints; and
• regulatory enquiries.

15. Retention

• The Company shall maintain patient health information for the period specified by the Practitioner, subject to applicable professional and legal requirements.
• Where the information constitutes a patient health record, the parties acknowledge that records may need to be retained for at least six years after dormancy and longer in specified circumstances.

16. Termination

• Termination of the Practitioner subscription shall not automatically result in destruction of patient health records where retention is legally or professionally required.
• The Company shall provide the Practitioner with a reasonable opportunity to export required records.

17. Audit and compliance

The Company shall maintain appropriate records demonstrating compliance with this Agreement and applicable data-protection law.

18. No sale of patient information

The Company shall not sell identifiable patient health information.

19. Aggregated/anonymised information

The Company may use properly anonymised or aggregated information for analytics, product development and research where the information can no longer reasonably be associated with an identifiable individual and such use is lawful.

20. Priority of professional obligations

Nothing in this Agreement authorises the Practitioner or Company to act contrary to applicable HPCSA requirements, POPIA or other applicable law.