Terms of Service

1. Eligibility

Rivara ICU is intended exclusively for use by:

• Licensed medical practitioners registered with the National Medical Commission (NMC) or equivalent state medical council
• Hospitals, clinics, and other licensed healthcare establishments
• Authorised staff operating under the supervision of a licensed practitioner

By creating an account, you confirm that you are a licensed healthcare professional or are authorised by one to use this platform. Use by unlicensed individuals is strictly prohibited.

2. Description of Service

Rivara ICU is a clinical documentation platform that enables ICU doctors to:

• Maintain structured daily notes for ICU patients
• Track vitals, lab values, interventions, and clinical outcomes
• Upload and digitise handwritten medical documents via AI-assisted OCR
• Generate AI-assisted discharge summaries and death summaries
• Export clinical summaries as PDF documents

The platform is provided as a Software-as-a-Service (SaaS) accessible via web browser. We reserve the right to modify, suspend, or discontinue any feature with reasonable notice.

3. Medical Disclaimer — Please Read Carefully

4. Your Obligations

You agree to:

• Use the platform only for lawful purposes and in accordance with applicable laws
• Enter accurate patient information and review all AI-generated content before use
• Not share your account credentials with unauthorised individuals
• Obtain any required patient or guardian consent before digitising their medical records
• Not attempt to reverse-engineer, scrape, or interfere with the platform
• Not use the platform to process data of patients who have not received care at your facility
• Notify us promptly at privacy@rivarahealth.com if you suspect any unauthorised access to your account

5. Account and Security

Your account is personal and non-transferable. You are responsible for all activity that occurs under your account. We use one-time password (OTP) authentication via your registered mobile number. Keep your registered number secure.

We may suspend or terminate your account without notice if we detect suspicious activity, misuse, or a violation of these Terms.

6. Intellectual Property

Our IP: The Rivara ICU platform, its code, design, and AI models are owned by Rivara Health. Nothing in these Terms grants you ownership of any part of the platform.

Your data: You retain full ownership of all patient data you enter into the platform. We have a limited licence to process that data solely to provide the service. We claim no rights over your clinical data.

PDF summaries: The discharge and death summary PDFs generated by the platform are yours. You may use, print, and share them without restriction.

7. Subscription and Payment

Rivara ICU is currently in early access. Pricing terms will be communicated before any paid subscription is required. We will provide at least 30 days' advance notice before any free tier ends or pricing changes take effect.

All fees, if applicable, are exclusive of GST. GST will be charged additionally at the prevailing rate (currently 18% under SAC code 998314).

8. Limitation of Liability

To the maximum extent permitted by applicable law:

• Rivara Health is not liable for any clinical outcomes, patient harm, or medicolegal consequences arising from use of the platform or its AI-generated summaries.
• Our total aggregate liability for any claim arising under these Terms is limited to the amount you paid us in the three months preceding the claim.
• We are not liable for indirect, consequential, or incidental damages of any kind.
• We do not warrant that the platform will be uninterrupted, error-free, or 100% accurate.

9. Termination

By you: You may close your account at any time. On account closure, we will delete all patient data within 30 days. We recommend exporting all required PDFs before closing.

By us: We may terminate or suspend your account for material breach of these Terms, non-payment, or if we cease to operate. We will provide 30 days' notice where possible, except in cases of fraud or serious violation.

Sections 3 (Medical Disclaimer), 6 (IP), 8 (Liability), and 10 (DPA) survive termination.

10. Data Processing Addendum

10.1 Roles

• Data Controller / Data Fiduciary: You — the hospital or licensed doctor who determines the purpose and means of processing patient data.
• Data Processor / Data Processor: Rivara Health — who processes patient data on your instructions to provide the documentation service.

10.2 Nature and Purpose of Processing

We process patient data only to provide the Rivara ICU service — specifically: storing clinical records, generating AI-assisted summaries, enabling PDF export, and maintaining the platform. We will not process patient data for any other purpose without your written consent.

10.3 Types of Data Processed

• Patient identity: name, age, sex, UHID
• Clinical data: diagnoses, vitals, lab values, medications, interventions
• Uploaded documents and their extracted text
• Generated clinical summaries

10.4 Sub-processors

We use the following sub-processors to deliver the service. By accepting these Terms, you consent to their use:

Sub-processor	Purpose	Location
Google Cloud / Firebase	Database (Firestore), file storage (Cloud Storage), authentication (Firebase Auth)	Google Cloud regions (see Firebase privacy page)
Google Gemini API	AI-assisted clinical summary generation	Google Cloud regions

We will notify you of any material changes to sub-processors with at least 14 days' notice.

10.5 Security Measures

We implement the following technical and organisational measures:

• All data encrypted in transit (TLS 1.2+) and at rest (AES-256 via Firebase)
• Firestore security rules ensuring per-user data isolation
• OTP-based authentication with no stored passwords
• Access limited to minimum necessary personnel

10.6 Data Breach Notification

In the event of a personal data breach that is likely to result in risk to your patients, we will notify you within 72 hours of becoming aware of the breach, to the email address registered on your account.

10.7 Data Deletion

Upon termination of your account or written request, we will delete all patient data within 30 days. You may request a confirmation of deletion in writing.

10.8 Audit and Compliance

You may request a written summary of our security practices once per calendar year by emailing privacy@rivarahealth.com.

11. Governing Law and Disputes

These Terms are governed by the laws of India. Any dispute arising out of or in connection with these Terms shall be subject to the exclusive jurisdiction of courts in India. We will make reasonable efforts to resolve disputes amicably before pursuing formal proceedings.

12. Contact

For any questions about these Terms or the Data Processing Addendum: