Thawra CMS Subscriber Terms

These Subscriber Terms form a binding agreement between Thawra Technology (SSM No. RA0137290-H), proprietor Muhammad Nor Adzha bin Nor Azizi, of No.40, Jalan Cerdik 4, Taman Universiti, 43000 Kajang, Selangor (“Thawra”, “we”, “us”), and the Subscriber. The specific package, modules, and fee are those selected and confirmed by the Subscriber at sign-up (the “Subscription Particulars”), which form part of this agreement.

1. The Service

1.1 Thawra provides the Subscriber with access to Thawra CMS, a cloud-hosted clinic management system (the “Service”), on a subscription basis.

1.2 The Service is provided as software-as-a-service. The Subscriber receives a non-exclusive, non-transferable, non-sublicensable right to access and use the Service for its own clinical operations for the duration of the subscription. No software, source code, or intellectual property is sold or assigned to the Subscriber.

1.3 The package subscribed to, and the modules included, are those set out in the Subscription Particulars confirmed at sign-up.

1.4 Thawra may improve, modify, or update the Service from time to time. Thawra shall not materially reduce core functionality during a subscription period without the Subscriber’s consent.

2. Subscription and Fees

2.1 The Subscriber shall pay the subscription fee shown at sign-up, monthly in advance, by the payment method agreed.

2.2 Fees are exclusive of any applicable service tax, which is added where chargeable by law.

2.3 Fee review. Thawra may revise the subscription fee on not less than sixty (60) days’ written notice, effective from the next subscription period. The Subscriber may terminate under Clause 9.2 if it does not accept the revision.

2.4 Late payment. Amounts unpaid after their due date are subject to compensation by way of ta’widh at a rate not exceeding the actual loss and costs incurred by Thawra as a result of the delay, consistent with the principles of the Shariah Advisory Council of Bank Negara Malaysia. No conventional interest is charged under this agreement.

2.5 Suspension. Where any amount remains unpaid more than thirty (30) days after its due date, Thawra may suspend access to the Service on seven (7) days’ written notice until payment is received. Subscriber data is not deleted during a suspension.

2.6 One-time fees. Onboarding, data migration, and training fees, where applicable, are shown at sign-up and are payable in advance. They are non-refundable once the relevant work has commenced.

3. Onboarding and Subscriber Responsibilities

3.1 Thawra shall provision the Subscriber’s environment within the period stated at sign-up.

3.2 The Subscriber is responsible for: providing accurate setup information; the accuracy and completeness of all data it enters; managing its own user accounts and access rights; maintaining the confidentiality of user credentials; ensuring its staff are trained in the use of the Service; and providing its own internet connectivity, devices, and peripherals.

3.3 The Subscriber shall use the Service only for lawful purposes and in accordance with all applicable laws, including the Private Healthcare Facilities and Services Act 1998, the Medical Act 1971, and the Personal Data Protection Act 2010.

3.4 The Subscriber shall not: reverse engineer, decompile, or attempt to derive the source code of the Service; resell, sublicense, or provide access to the Service to any third party; use the Service to store data unrelated to its clinical operations; or circumvent any access control or usage limit.

4. Support

4.1 Thawra is the Subscriber’s sole point of contact for all support. The Subscriber shall direct all questions, faults, and requests to Thawra through the channel notified to it.

4.2 Support is provided during business hours, Monday to Friday, 9:00 to 18:00 (MYT), excluding Malaysian public holidays.

4.3 Support covers: guidance on use of the Service; investigation of reported faults; and user account assistance. It does not cover: the Subscriber’s own hardware, devices, printers, or network; data entry or data cleaning; or training beyond that included at sign-up.

4.4 New features and customisation requested by the Subscriber are not included in the subscription and are quoted separately.

5. Service Availability

5.1 Thawra targets availability of 99.0% per calendar month, excluding planned maintenance.

5.2 Planned maintenance is notified not less than forty-eight (48) hours in advance and scheduled outside clinic peak hours where practicable. Emergency maintenance may be performed without notice where necessary to preserve security, data integrity, or availability.

5.3 Availability excludes: planned and emergency maintenance; faults in the Subscriber’s own equipment or connectivity; third-party outages outside Thawra’s reasonable control; force majeure; and any period of suspension under Clause 2.5.

5.4 The Service is a clinic management tool. It is not a medical device and does not provide clinical decision support. Clinical judgement remains at all times the responsibility of the Subscriber’s registered practitioners.

6. Data — Ownership, Protection and Retention

6.1 The Subscriber owns its data. All patient records, clinical notes, billing records, and other data entered into the Service by or on behalf of the Subscriber (“Subscriber Data”) remain the property of the Subscriber.

6.2 The Subscriber is the data user in respect of Subscriber Data for the purposes of the Personal Data Protection Act 2010. The Subscriber is responsible for issuing a patient privacy notice in English and Bahasa Malaysia as required by section 7 of that Act, obtaining and recording patient consent for the processing of sensitive personal data, and complying with its own obligations as a data user. A ready-to-use patient privacy notice template is made available to the Subscriber at onboarding for this purpose.

6.3 Thawra and its platform provider act as data processors, processing Subscriber Data solely to provide the Service. Thawra engages Words Connect PLT as its platform provider, which processes Subscriber Data under written processor obligations including per-tenant data isolation, encryption in transit and at rest, access controls, daily backups, and breach notification.

6.4 Isolation. Subscriber Data is logically separated from the data of other subscribers. No other subscriber can access the Subscriber’s data.

6.5 Breach notification. Thawra shall notify the Subscriber without undue delay, and in any event within seventy-two (72) hours, of becoming aware of a personal data breach affecting Subscriber Data, with sufficient detail for the Subscriber to meet its own notification obligations to the Personal Data Protection Commissioner and affected patients.

6.6 Backups. Automated daily backups are taken with thirty (30) day retention. The Subscriber may request restoration; restoration required as a result of Subscriber error may be chargeable.

6.7 Export on termination. On termination or expiry, the Subscriber may request an export of Subscriber Data in a standard machine-readable format. The request must be made within thirty (30) days of termination. Thawra shall provide the export within fourteen (14) days of a valid request, subject to all outstanding fees being paid.

6.8 Deletion. Subscriber Data is deleted from the platform within ninety (90) days of termination, and from backups within a further one hundred and twenty (120) days.

6.9 Medical record retention is the Subscriber’s obligation. The Subscriber acknowledges that it is subject to statutory medical record retention requirements and that it is responsible for obtaining and retaining its own export before deletion. Thawra is not the Subscriber’s record-keeper of last resort.

7. Intellectual Property

7.1 All intellectual property in the Service, including its software, architecture, interfaces, and documentation, belongs to Thawra or its licensors. Nothing in these terms transfers any such right to the Subscriber.

7.2 The Subscriber grants Thawra a limited licence to process Subscriber Data solely to provide the Service.

7.3 Thawra may use aggregated, irreversibly anonymised operational data that cannot identify the Subscriber, any patient, or any individual, for the purpose of improving the Service.

8. Confidentiality

8.1 Each party shall keep the other’s confidential information confidential and use it only for the purposes of this agreement. Obligations survive termination for three (3) years.

8.2 Patient information is confidential in all circumstances and is subject to Clause 6 and to applicable law and professional ethics.

9. Term and Termination

9.1 This agreement commences on the commencement date confirmed at sign-up and continues for the initial term selected, renewing automatically for successive periods of equal length unless either party gives thirty (30) days’ written notice before the end of the then-current period.

9.2 The Subscriber may terminate on thirty (30) days’ written notice where Thawra revises fees under Clause 2.3 and the Subscriber does not accept the revision.

9.3 Either party may terminate immediately for material breach not cured within thirty (30) days of written notice, or on the other party’s insolvency.

9.4 On termination: access to the Service ceases; accrued fees remain payable; and Clauses 6.7 to 6.9, 7, 8, and 10 survive.

9.5 Fees paid in advance for a period after the effective date of termination are refunded on a pro-rata basis, save where termination is by Thawra for the Subscriber’s material breach.

10. Liability

10.1 Nothing in this agreement limits liability for death or personal injury caused by negligence, for fraud, or for any liability that cannot be limited by law.

10.2 Subject to Clause 10.1, neither party is liable for indirect, consequential, or special loss, loss of profit, revenue, goodwill, or anticipated savings.

10.3 Subject to Clause 10.1, Thawra’s total cumulative liability in any twelve (12) month period is limited to the subscription fees paid by the Subscriber in that period.

10.4 Thawra is not liable for any loss arising from: the Subscriber’s own data entry errors; the Subscriber’s failure to maintain its own records or obtain a data export; clinical decisions made by the Subscriber’s practitioners; or the Subscriber’s own equipment or connectivity.

11. General

11.1 Assignment. The Subscriber may not assign this agreement without Thawra’s written consent. Thawra may assign to a successor of its business on written notice.

11.2 Force majeure. Neither party is liable for failure to perform caused by events beyond its reasonable control, save that payment obligations are not excused.

11.3 Entire agreement. These terms, the Privacy & Data Notice, and the Subscription Particulars constitute the entire agreement between the parties on its subject matter.

11.4 Variation. Thawra may amend these terms on not less than thirty (30) days’ notice; continued use after the effective date constitutes acceptance of the amended terms. Fee revisions are governed by Clause 2.3.

11.5 Record of acceptance. Thawra records, for each acceptance, the account identity, date and time, terms version, and IP address, as evidence of agreement.

11.6 Governing law. This agreement is governed by the laws of Malaysia and the parties submit to the exclusive jurisdiction of the courts of Malaysia.

End of Thawra CMS Subscriber Terms