Terms of service
Version 2026-08-01 · between CareBoon Health and the clinic that accepts them.
Sections 5 to 9 are the data-processing agreement. A clinic accepting these terms accepts those obligations; we record which version was accepted, when, and from where.
1. What we provide
CareBoon is hospital-management software provided as a service: patient records, clinical workflow, billing, pharmacy and stock, and optional AI assistance. We host it and keep it running.
2. What CareBoon is not
CareBoon does not practise medicine. It records decisions and offers checks and suggestions; the clinician is responsible for every clinical decision. Allergy warnings, interaction checks and AI suggestions are aids, not authority, and none of them removes the duty to exercise professional judgement.
This is a limit on what the software does, not an attempt to disclaim our own failures. If we lose your data through our negligence, saying "the software is advisory" would not be an answer, and we are not offering it as one.
3. The clinic's responsibilities
- Obtain patient consent as the law requires. Our terms bind us and the clinic; they do not reach patients, who never see this page. A template notice is provided, but taking consent is the clinic's duty.
- Keep accounts to one person each, and remove staff who leave.
- Enter accurate catalogue and pricing data — in particular, drug ingredients, because the allergy check reads them and cannot warn about a drug whose ingredients it does not know.
- Comply with the clinic's own licensing and record-keeping obligations.
4. Fees
Fees are as agreed at signup. We give 30 days' notice of a price change, and a clinic may leave before it takes effect, exporting its data.
5. Data ownership and roles
The clinic is the data controller and owns all patient data it enters. CareBoon Health is the data processor and processes it only on the clinic's instructions, to provide the service. We do not sell patient data or use it for advertising.
6. Sub-processors
| Provider | Where | What for |
|---|---|---|
| Database Mart | United States | Server hosting — the database and uploaded files. |
| Cloudflare | United States / global | DNS and domain registration. No patient data. |
| Google Drive | United States | Encrypted backup storage. Files are encrypted with AES-256 before upload; Google cannot read them. |
| OpenRouter | United States | Optional AI decision support. Receives de-identified clinical context only — never a name, patient number or phone. Off unless the clinic enables it. |
| Brevo | European Union | Sending email, e.g. insurance claim statements. |
We give 30 days' notice before adding one, and a clinic may object on reasonable data-protection grounds. Hosting is in the United States: a cross-border transfer, which the clinic instructs and consents to by accepting these terms.
7. AI decision support
Off by default. When enabled, no patient identifiers are sent from the record — no name, patient number or phone.
Scan images are the exception, and the Clinic must understand it before enabling imaging AI. An image is transmitted as captured. Its file metadata is stripped, but pixels are not inspected and nothing is cropped — a crop that hides a printed name can hide a finding. Many X-ray and ultrasound machines print the patient's name or number onto the image itself, and where they do, that text is transmitted with the image to the processors listed above, outside Uganda.
CareBoon advises configuring modalities not to print patient details onto images. Where that is not possible, enabling imaging AI is the Clinic's decision as data controller, and the Clinic is responsible for having a lawful basis for it — in particular a patient consent notice stating that scans may be transmitted outside Uganda for automated interpretation. Imaging AI can be left off, and the assistant will read the written report instead. Every run is logged and metered, and the AI is advisory.
8. Security and breach
Encrypted transport, role-based access, audit logging of clinical and safety-critical actions, encrypted off-site backups, least-privilege server access. We notify the clinic of a personal-data breach without undue delay and within 72 hours of becoming aware.
9. Ending it
A clinic may leave at any time and export everything to CSV from inside the product, without asking us. On termination we delete our copies, backups included, within 30 days.
10. Availability
We aim to keep the service up and we take backups we test by restoring them, but we do not offer a guaranteed uptime figure and would rather say so than print one we cannot hold to. Clinical work must never depend on the service being reachable — keep a paper fallback.
11. Liability
We do not exclude liability for death or personal injury caused by our negligence, for fraud, or for anything the law does not permit us to exclude. Otherwise our total liability in any 12 months is limited to the fees paid in that period.
12. Law
The laws of the Republic of Uganda, and the courts of Uganda.
13. Changes
We give 30 days' notice of material changes. Each version is kept; the version a clinic accepted is recorded against that clinic.
Contact
See also the privacy notice.