Conditions Générales d'Utilisation (CGU)

Document control

Document

Terms of Use (Conditions Générales d’Utilisation)

Platform

Doctopass

Provider

DOCTOPASS SARL

Version

1.0

Governing law

Republic of Tunisia

1. Definitions

In these Terms of Use (“Terms”), the following capitalised terms have the meanings set out below.

• “Provider”, “we”, “us”, “our” — DOCTOPASS SARL, a company incorporated under the laws of the Republic of Tunisia.
• “Platform” — the Doctopass software-as-a-service application (web application and, where later released, mobile and desktop applications), together with all associated services, application programming interfaces, and documentation.
• “Service” — the functionality made available through the Platform as described in Section 4.
• “User” — any natural person who accesses or uses the Platform, in any Role.
• “Role” — the functional profile assigned to a User, being one of: Doctor, Patient, or Secretary.
• “Doctor” — a licensed healthcare professional who uses the Platform to operate a practice, manage patients, conduct consultations, and issue clinical documents.
• “Patient” — a natural person who uses the Platform to access their own health information, communicate with Doctors, upload records, and receive prescriptions.
• “Secretary” — a natural person authorised by one or more Doctors to perform administrative tasks on the Platform within permissions granted by that Doctor.
• “Content” — any data, text, files, images, medical records, notes, messages, or other material submitted to, stored on, or generated through the Platform.
• “Clinical Content” — Content that constitutes health or medical information relating to an identified or identifiable Patient, including consultations, diagnoses, prescriptions, examination findings, imaging, and medical records.
• “AI Features” — features of the Platform that use artificial-intelligence processing to assist Doctors, as described in Section 7.
• “Account” — a registered User profile enabling access to the Platform.
• “Privacy Policy” — the DOCTOPASS Privacy Policy, as amended from time to time.
• “Data Processing Agreement” or “DPA” — the Advanced Data & Privacy Agreement governing the processing of Clinical Content, incorporated by reference for Doctors and healthcare-provider Users.
• “Applicable Law” — all laws, regulations, and professional rules applicable to a User’s use of the Platform, including in Tunisia Loi organique n° 2004-63 du 27 juillet 2004 relative à la protection des données à caractère personnel, and, where applicable, Regulation (EU) 2016/679 (the “GDPR”) and the U.S. Health Insurance Portability and Accountability Act (“HIPAA”).

2. Identity of the Provider and Purpose of these Terms

2.1The Platform is published and operated by DOCTOPASS SARL. The Provider can be contacted at contact@doctopass.com, including for data-protection matters.

2.2These Terms govern access to and use of the Platform by all Users. They form a binding agreement between the Provider and each User. Distinct provisions apply to each Role, and additional agreements (in particular the DPA) apply to Doctors and healthcare-provider Users.

2.3The Platform is a practice-management and clinical-workflow tool. The Platform does not itself provide medical care, medical advice, diagnosis, or treatment. All clinical decisions are made by Doctors exercising their own professional judgement.

3. Acceptance and Eligibility

3.1Acceptance. By creating an Account, accessing, or using the Platform, the User acknowledges having read, understood, and accepted these Terms and the Privacy Policy. A User who does not accept these Terms must not use the Platform.

3.2Capacity. The User represents that they have the legal capacity to enter into these Terms.

3.3Age. The Platform is intended for Users who are at least eighteen (18) years of age. A natural person under the age of eighteen (18), or who otherwise lacks legal capacity, may be a Patient only where a parent or legal guardian, acting on that person’s behalf, has accepted these Terms and exercises the associated rights and controls. The Platform is not directed to, and must not be used without supervision by, children.

3.4Professional eligibility (Doctors). A User registering as a Doctor represents and warrants that they hold a valid, current authorisation to practise medicine in the jurisdiction in which they operate, and that their use of the Platform complies with all professional, ethical, and licensing obligations applicable to them.

3.5Authorisation (Secretaries). A User registering as a Secretary represents that they are authorised by the relevant Doctor(s) to act on the Platform, and will act only within the permissions granted.

4. Description of the Service

4.1The Platform provides, subject to the Role of the User and the plan subscribed to, functionality that may include:

• practice overview dashboards, key indicators, and reporting;
• patient connection and management, including invitation by email, SMS, secure link, patient identifier, and QR code;
• consultation workflows, including symptom capture, clinical notes, examination findings, diagnostic coding, treatment planning, and AI-assisted report drafting;
• a shared medical record, accessible across Doctors only with the relevant Patient’s consent;
• appointment scheduling with conflict detection and availability management;
• secretary management with granular, per-Doctor permissions and activity logging;
• messaging between Users;
• billing, invoicing, and payment processing;
• notifications; and
• a marketplace for optional extensions.

4.2Evolving Service. The Provider may add, modify, or discontinue features. Certain features may be offered on a scaffolded or preview basis and may not be fully operational.

4.3No guarantee of clinical outcome. The Service is a tool to support Users. The Provider does not warrant any clinical, administrative, or financial outcome arising from its use.

5. Accounts, Credentials, and Security

5.1Registration. Users must provide accurate, current, and complete information when creating an Account and keep it up to date.

5.2Credentials. Users are responsible for maintaining the confidentiality of their credentials and for all activity under their Account. Passwords are stored using a strong, salted password-hashing function; the Provider never has access to a User’s plaintext password.

5.3Two-factor authentication. The Platform supports two-factor authentication (time-based one-time passwords). Doctors and Secretaries with access to Clinical Content are strongly encouraged, and may be required, to enable it.

5.4Unauthorised use. Users must notify the Provider without undue delay at contact@doctopass.com on becoming aware of any unauthorised use of, or security incident affecting, their Account.

5.5Session management. For security, the Provider may expire sessions, require re-authentication, and revoke access tokens.

6. Roles, Responsibilities, and Data-Protection Status

6.1Doctors as controllers. With respect to Clinical Content concerning their Patients, the Doctor (or the practice or clinic on whose behalf the Doctor acts) is the data controller (and, where HIPAA applies, the covered entity). The Doctor determines the purposes and means of processing that Clinical Content. The Provider processes such Clinical Content as a data processor (and, where HIPAA applies, a business associate), on the Doctor’s documented instructions and in accordance with the DPA.

6.2Doctor obligations. Each Doctor is responsible for:

1. having a valid legal basis and, where required, obtaining and maintaining the necessary consents to collect and process Patient data on the Platform;
2. the accuracy, lawfulness, and clinical appropriateness of Clinical Content they create;
3. all clinical decisions, diagnoses, prescriptions, and documents issued through the Platform;
4. informing their Patients about the processing of their data as required by Applicable Law; and
5. the acts and omissions of Secretaries to whom they grant access.

6.3Patients. Patients are responsible for the accuracy of the information they provide, for managing their own consents (including consent to sharing records across Doctors), and for the security of their Account. Patient data submitted directly by a Patient for the Provider’s own account, authentication, and billing purposes is processed by the Provider as an independent controller, as described in the Privacy Policy.

6.4Secretaries. Secretaries must act strictly within the permissions granted by the relevant Doctor, must keep Clinical Content confidential, and must not access, use, or disclose Content beyond what is necessary to perform their authorised tasks. Secretary activity is logged and is visible to the granting Doctor.

6.5Provider as controller for operational data. The Provider acts as an independent controller for account, identity, authentication, security-log, billing, and product-operation data, and for irreversibly anonymised data used to improve the Service, as described in the Privacy Policy.

7. AI-Assisted Features — Nature and Limitations

7.1Purpose. AI Features assist Doctors, for example by converting brief clinician input into a structured draft medical report. AI Features are available to Doctors only. They are not available to Patients and are not intended for patient self-diagnosis or triage.

7.2Draft only; human in the loop. Every output of an AI Feature is a non-binding draft. It is never automatically applied, saved, sent, or acted upon. The Doctor must review, edit as necessary, and explicitly confirm any AI-generated content before it becomes part of a medical record or is otherwise used. The Doctor remains solely responsible for the final content and for any clinical decision.

7.3Not a medical device; not a diagnosis. AI Features do not provide a medical diagnosis, do not constitute medical advice, and are not intended to be, and are not, a certified medical device. Nothing in the Platform should be relied upon as a substitute for the professional judgement of a qualified Doctor.

7.4Privacy safeguards. AI Features are performed on a large language model self-hosted by the Provider within the applicable jurisdiction. No personal data, and no clinical input, is transmitted to any external artificial-intelligence provider or third-party model. Direct identifiers are additionally minimised within the processing pipeline as a defence-in-depth measure. For the Tunisian service, all such processing occurs within Tunisia. Further detail is set out in the Privacy Policy.

7.5Limitations. AI outputs may contain errors, omissions, or content that is not clinically appropriate. The Provider does not warrant the accuracy, completeness, or fitness for any purpose of AI outputs. The Doctor must independently verify all AI-assisted content.

7.6Usage limits. AI Features may be subject to per-User and per-tenant usage budgets and fair-use limits.

8. Prescriptions and Clinical Documents

8.1Prescriptions, invoices, and other documents generated through the Platform are produced under the authority and responsibility of the issuing Doctor.

8.2The Doctor is responsible for ensuring that any prescription or clinical document complies with Applicable Law and applicable professional rules, including as to content, signature, and delivery.

8.3The Provider provides the technical means to generate such documents but does not review, approve, or take responsibility for their clinical content.

9. Acceptable Use

9.1Users must not:

1. use the Platform in violation of Applicable Law or applicable professional rules;
2. access, use, or attempt to access Content or Accounts they are not authorised to access;
3. upload unlawful, infringing, or malicious material, or material they have no right to submit;
4. interfere with, disrupt, probe, or attempt to gain unauthorised access to the Platform, its infrastructure, or other Users’ data;
5. circumvent or attempt to circumvent authentication, authorisation, audit, rate-limiting, or security controls;
6. use the Platform to send unsolicited communications or for any fraudulent purpose;
7. use automated means to extract data from the Platform except through interfaces the Provider expressly makes available;
8. misrepresent their identity, Role, or professional status; or
9. use AI Features other than as permitted by Section 7, including any attempt to defeat the redaction safeguards or to submit prohibited data.

9.2The Provider may investigate suspected violations and may suspend or terminate access in accordance with Section 15.

10. Fees, Billing, and Payments

10.1Fees. Access to the Platform or to certain features may be subject to fees, as set out in the applicable order, plan, or price list.

10.2Payments. Payments may be processed through third-party payment providers, including Stripe (international) and Konnect and Flouci (Tunisia, in Tunisian Dinar). The User’s use of a payment provider is subject to that provider’s own terms.

10.3Currency and taxes. Unless otherwise stated, amounts are expressed in Tunisian Dinar (TND). The User is responsible for any taxes, duties, or charges applicable to them, other than taxes on the Provider’s income.

10.4Invoices. Invoices generated through the Platform in respect of a Doctor’s practice are issued under the responsibility of that Doctor.

10.5No float; accuracy. Monetary amounts are handled with exact-decimal precision. Users should verify all financial records.

10.6Late or failed payment. The Provider may suspend paid features for non-payment, subject to any mandatory notice required by Applicable Law.

11. Intellectual Property

11.1Provider IP. The Platform, including its software, source code, design, structure, databases, trademarks (including Doctopass), and all associated intellectual property, is and remains the exclusive property of the Provider or its licensors. No rights are granted except the limited right to use the Platform under these Terms.

11.2User Content. As between the Provider and the User, the User (or, for Clinical Content, the relevant controller and data subjects) retains all rights in their Content. The User grants the Provider a limited, worldwide, royalty-free licence to host, store, process, transmit, and display Content solely to the extent necessary to provide and secure the Service, and as further governed, for Clinical Content, by the DPA.

11.3Service improvement and research using anonymised data. The Provider may generate irreversibly anonymised data derived from use of the Service — including data derived from the difference between AI-generated drafts and clinician corrections — from which no individual can be identified, and may use such anonymised data, itself or together with research partners it engages, to develop and improve the Service and its models and to conduct scientific, statistical, or clinical research. No directly- or indirectly-identifying personal data, and no patient images containing identifying features, are used or shared for this purpose; the sharing of any identifiable or pseudonymised (coded) data would require a separate agreement, a lawful basis, and any authorisation required by the INPDP, established in advance. This is described further in the Privacy Policy.

11.4Feedback. If a User provides feedback or suggestions, the Provider may use them without restriction or obligation.

12. Third-Party Services and Extensions

12.1The Platform may offer optional extensions or integrations with third-party services. Such extensions may be subject to additional terms and to the third party’s own privacy practices.

12.2The Provider is not responsible for third-party services and does not warrant them. Certain marketplace items may be scaffolded and not yet functional.

13. Confidentiality and Data Protection

13.1The processing of personal data through the Platform is governed by the Privacy Policy and, for Clinical Content, by the DPA, each of which is incorporated by reference.

13.2Users must keep confidential any non-public information of the Provider or of other Users to which they gain access, and must comply with their own confidentiality and data-protection obligations under Applicable Law.

14. Availability, Maintenance, and Support

14.1The Provider will use commercially reasonable efforts to keep the Platform available but does not guarantee uninterrupted or error-free operation.

14.2The Provider may perform scheduled or emergency maintenance and may temporarily suspend access for that purpose, endeavouring to limit disruption.

14.3Support is provided through the channels and within the scope described by the Provider from time to time. Any specific service levels apply only if expressly agreed in a separate written agreement.

15. Suspension and Termination

15.1By the User. A User may stop using the Platform and request closure of their Account at any time. Closure does not relieve the User of obligations accrued before closure. Retention of data after closure is governed by the Privacy Policy and the DPA.

15.2By the Provider. The Provider may suspend or terminate access, in whole or in part, where the User materially breaches these Terms, where required by Applicable Law, where necessary to protect the Platform, other Users, or patient safety, or on reasonable notice for legitimate operational reasons.

15.3Effect. On termination, the right to use the Platform ceases. The Provider will handle Content in accordance with the Privacy Policy, the DPA, and Applicable Law, including obligations not to hard-delete certain clinical data and to apply defined retention periods.

16. Disclaimers and Limitation of Liability

16.1“As available”. To the maximum extent permitted by Applicable Law, and without prejudice to the mandatory protections of any Applicable Law, the Platform is provided “as is” and “as available”, without warranties of any kind other than those that cannot be excluded by law.

16.2Clinical responsibility. The Provider is not a healthcare provider and is not responsible for any clinical decision, diagnosis, treatment, prescription, or document created by a Doctor, whether or not assisted by AI Features.

16.3Limitation. To the maximum extent permitted by Applicable Law, the Provider shall not be liable for indirect, incidental, special, consequential, or punitive damages, or for loss of profits, revenue, data, or goodwill. The Provider’s aggregate liability arising out of or relating to the Platform shall not exceed the amounts paid by the relevant User to the Provider in the twelve (12) months preceding the event giving rise to liability, save where such limitation is not permitted by Applicable Law.

16.4No exclusion of mandatory liability. Nothing in these Terms excludes or limits liability that cannot be excluded or limited under Applicable Law, including liability for death or personal injury caused by negligence, or for fraud.

17. Indemnification

To the maximum extent permitted by Applicable Law, each User (other than a consumer Patient acting outside a professional capacity, to the extent such indemnity is not permitted) shall indemnify the Provider against third-party claims arising from that User’s breach of these Terms, misuse of the Platform, infringement of third-party rights, or violation of Applicable Law.

18. Changes to these Terms

18.1The Provider may amend these Terms. Material changes will be notified to Users by reasonable means before they take effect.

18.2Continued use of the Platform after a change takes effect constitutes acceptance of the amended Terms, save where separate consent is required by Applicable Law. A User who does not accept a change must stop using the Platform.

19. Governing Law and Jurisdiction

19.1These Terms are governed by the laws of the Republic of Tunisia, without prejudice to any mandatory consumer or data-protection protections available to a User under the law of their habitual residence.

19.2Any dispute arising out of or in connection with these Terms shall be submitted to the competent courts of Tunis, Tunisia, without prejudice to any mandatory right of a User to bring proceedings before, or to the jurisdiction of, the courts of their habitual residence.

20. Miscellaneous

20.1Severability. If any provision is held invalid or unenforceable, the remaining provisions remain in force.

20.2No waiver. A failure to enforce a provision is not a waiver of it.

20.3Assignment. A User may not assign these Terms without the Provider’s consent. The Provider may assign these Terms in connection with a reorganisation, merger, or transfer of business, subject to Applicable Law.

20.4Entire agreement. These Terms, together with the Privacy Policy and, where applicable, the DPA and any order form, constitute the entire agreement between the parties on their subject matter.

20.5Notices. Notices to the Provider must be sent to contact@doctopass.com. Notices to a User may be sent to the contact details associated with their Account.

20.6Language. A binding French version (and Arabic where required) shall govern in the Republic of Tunisia. In the event of conflict, the binding French version shall prevail.

21. Contact

General, support, data-protection enquiries & Data Protection Officer

contact@doctopass.com