Terms of Use

Last updated: 8 October 2026

Effective date: 8 October 2026

Summary. This box is a plain-language overview only. The full Terms below are what legally apply.

Nojdar Clinic is clinic management software for licensed clinics and hospitals. Accounts are by invitation only, and a Clinic is created only after Nojdar approves its application or sets it up directly.

Your Clinic owns its data, including Patient Data. You are responsible for your patients' consent and notices and for the clinical decisions you make. We host and process that data only to provide the Service to you.

Nojdar Clinic is not a medical device and does not give medical advice. The AI Clinic Assistant can be wrong, and a qualified clinician must check everything it produces.

Fees are invoiced by Nojdar and, at launch, paid by cash or another method we accept and record manually. Nothing renews or charges you automatically. Fees are non-refundable except as stated in section 7.11. If a paid period lapses, you get a 7-day grace period, then the Clinic becomes read-only. Trials do not have a grace period. Data is not deleted because a subscription lapses.

If your Clinic is scheduled for deletion, it closes and can be restored for 30 days. After that its patient, clinical and staff data and its files are permanently deleted, apart from copies in backups until they expire. We keep the Clinic's profile and our own billing records with the Clinic as our financial records.

There is no uptime guarantee unless agreed in writing. Our liability is limited as set out in section 23, in most cases to the fees paid in the 12 months before the event that caused the claim.

About these Terms
Definitions
Acceptance and authority
Eligibility, applications and access
Accounts and security
The Service and changes to it
Plans, trials, fees and payment
Plan limits and fair use
Customer Data
Clinic responsibilities
Medical and clinical disclaimer
AI Clinic Assistant
Acceptable use
Third-party services
Intellectual property and feedback
Confidentiality
Data protection and security
Availability, support and backups
Suspension
Term and termination
Effect of termination, export and deletion
Warranties and disclaimers
Limitation of liability
Indemnities
Force majeure
Website Visitors
Governing law and disputes
Language
Changes to these Terms
General terms
Contact us

1. About these Terms

1.1. These Terms of Use ("Terms") are an agreement between Nojdar, the operator of the Nojdar Clinic service at nojdar.app ("Nojdar", "we", "us" or "our"), and:

the clinic, hospital or other healthcare organization that holds a Nojdar Clinic account (the "Clinic" or "Customer", as defined in section 2);
each individual who uses the Service under the Clinic's account (an "Authorized User"); and
each person who visits our marketing website without an account (a "Website Visitor"), to the extent described in section 26.

1.2. These Terms apply to the Service as defined in section 2. Our Privacy Policy explains how we handle personal data. It is provided for information and does not form part of these Terms, except to the extent that these Terms or a Data Processing Addendum expressly refer to a specific part of it.

1.3. If the Clinic has signed a separate written agreement or order form with Nojdar (for example, for an Enterprise plan), that document takes priority over these Terms where the two conflict, but only for the matters it expressly covers. See sections 23.6 and 30.4.

1.4. Nojdar's obligations under these Terms, including those about the Service, Fees, refunds, support, warranties and data, are owed only to the Clinic. Authorized Users and Website Visitors are bound by the parts of these Terms that apply to their own use and have no separate claim against Nojdar under these Terms, except where the law gives them one.

2. Definitions

In these Terms, the following words have these meanings:

"Service" means the Nojdar Clinic clinic application at clinic.nojdar.app, the imaging viewer at imaging.nojdar.app, the marketing website at nojdar.app, the related application programming interfaces (APIs), emails, generated documents, and any updates to them.
"Clinic" or "Customer" means the organization that holds a Nojdar Clinic account. Each Clinic is a separate account with its own subscription and its own data, even if the same people work at several Clinics.
"Authorized User" means a member of the Clinic's staff who has an account in the Clinic, in any role the Service offers: owner (always held together with the doctor or admin role), doctor, admin, assistant, receptionist, pharmacist, lab technician, finance and auditor.
"Clinic Owner" means the Authorized User who holds the owner role for the Clinic.
"Patient" means an individual about whom the Clinic records information in the Service.
"Patient Data" means health and personal data that the Clinic or its Authorized Users enter, upload or generate in the Service about Patients, including medical history, visits, diagnoses, prescriptions, diagnostic results, dental charts, medical images and related billing records.
"Customer Data" means all data that the Clinic or its Authorized Users submit to, store in or generate through the Service, including Patient Data, staff and finance records, files, reports and audit records about the Clinic's activity.
"Account Data" means personal data about Authorized Users that we need to run their accounts, such as name, email address, sign-in credentials, security settings, session and device information, and notification preferences.
"Website Visitor" means a person who uses our marketing website at nojdar.app without signing in to the Service.
"AI Clinic Assistant" means the optional assistant feature described in section 12.
"Plan" means the subscription plan (currently Basic, Pro or Enterprise) that applies to the Clinic.
"Billing Period" means the monthly or yearly period covered by the Clinic's most recent paid invoice.
"Usage Cycle" means a period of one month that starts on the day the Clinic's subscription or trial started, and on the same day of each following month. Monthly plan limits reset at the start of each Usage Cycle, including on yearly Plans.
"Fees" means the amounts payable for the Service under section 7.
"Documentation" means the in-app help and plan descriptions we make available in the clinic app, but not our marketing website, sales materials or social media posts.
"Deletion Grace Period" has the meaning given in section 21.4, and "Security Incident" has the meaning given in section 17.5.

3. Acceptance and authority

3.1. Accepting these Terms. You accept these Terms by ticking the required box confirming that you accept them, which links to these Terms and our Privacy Policy, when you submit an application for a Clinic or when you create your account from an invitation to join a Clinic. If you already have an account when you are invited to another Clinic, you accept these Terms in the same way when you accept that invitation, unless you have already accepted the current version. A Clinic may also accept these Terms by signing an order form that refers to them. We record the version accepted, the date and time, the email address used and where you accepted. You may not use the Service unless you have accepted these Terms. If we publish a new version under section 29, we will ask you to accept it in the same way, and you will not be able to continue using the Service until you do.

3.2. Acting for a Clinic. If you apply for, set up, subscribe for or manage a Clinic account, you confirm that you are authorized to bind that Clinic to these Terms, and "you" includes the Clinic. If you do not have that authority, you must not accept these Terms on the Clinic's behalf. If you accept these Terms for a Clinic without authority, you are personally bound by them and responsible for the Fees and obligations of the Clinic under them, to the extent the law allows.

3.3. Authorized Users. Each Authorized User accepts these Terms personally as they apply to their own use of the Service (in particular sections 5, 11, 12 and 13). The Clinic is responsible for the acts and omissions of its Authorized Users as if they were its own.

4. Eligibility, applications and access

4.1. Who may use the Service. The Service is for healthcare providers and their staff only. It is not a consumer product and it is not available to Patients. The Clinic enters into these Terms for the purposes of its trade or profession and not as a consumer. A Clinic must be a lawfully operating clinic, medical center, hospital or similar healthcare organization, and its practitioners must hold the licenses and registrations that the law requires for the services they provide. Every Authorized User must be at least 18 years old and must use the Service only for their work for the Clinic.

4.2. How a Clinic is created. A Clinic account can be created in only two ways:

a person submits an application through the request-access form in the clinic app, and Nojdar approves it; or
Nojdar creates the Clinic directly and invites the person who will hold the owner role (the Clinic Owner) to accept the invitation.

The Service does not offer any other way to create a Clinic, and you must not try to create one by other means.

4.3. Applications. We review applications at our discretion. We may ask for more information, including evidence of the Clinic's license or registration, and we may approve or reject any application. If we reject it, we will tell the applicant by email and may give a reason, but we are not required to. Approval does not mean we have verified the Clinic's licenses or that the Clinic complies with the law. That remains the Clinic's responsibility.

4.4. Invitation-only accounts. Individual accounts can only be created by accepting an invitation sent from a Clinic (or by Nojdar for the Clinic Owner). The Clinic decides who to invite and which role each person receives.

4.5. Accurate information. You must give accurate, current and complete information when you apply, accept an invitation or manage your account, and keep it up to date.

5. Accounts and security

5.1. Keeping credentials safe. Each Authorized User must keep their password, passkeys, authenticator app, backup codes and sign-in links confidential, must not share their account with anyone, and must sign out of shared devices. Accounts are personal. Each person must have their own account so that the Clinic's records show who did what.

5.2. Two-factor authentication. The Service offers two-factor authentication (an authenticator app code) and passkeys to every Authorized User. For Authorized Users these are optional, but we strongly recommend them, especially for doctors, admins and anyone with access to finance or exports. The Clinic may require them as a matter of its own internal policy. Nojdar requires two-factor authentication for its own staff who have administrative access to the platform.

5.3. Roles and permissions. The Service lets the Clinic assign roles that control what each Authorized User can see and do. The Clinic is responsible for choosing appropriate roles, for removing access promptly when a staff member leaves or changes duties, and for reviewing who has access from time to time.

5.4. Clinic Owner. The Clinic Owner administers the Clinic account. The Clinic Owner, the doctor and any admin can change the Clinic's settings and can schedule or cancel the Clinic's deletion under section 21.4. The Clinic must make sure the owner, doctor and admin roles are held only by people with authority to act for the Clinic. If the Clinic Owner is no longer available, we may, after checks we consider reasonable, help the Clinic transfer the owner role to another person who shows authority to act for the Clinic.

5.5. Reliance on the Clinic's instructions and internal disputes. We may rely on instructions given from the account of the Clinic Owner, the doctor or an admin, or from the Clinic Owner's or the Clinic's email address recorded in the Service, as instructions of the Clinic, including requests to delete or restore the Clinic or to change the owner role. We are not responsible for disputes between the Clinic's owners, partners, practitioners or staff about who may act for the Clinic or who owns its data. If we become aware of such a dispute, we may suspend any deletion, transfer or restore, keep the Clinic read-only, and require a written agreement of the persons involved or a court order before acting. The Clinic will cover any reasonable costs, and indemnify us under section 24.1, for claims arising from such a dispute.

5.6. Tell us about security problems. You must tell us without delay at support@nojdar.app if you suspect that an account has been compromised, that someone has accessed data without authorization, or that there is a security weakness in the Service.

5.7. Responsibility for activity. The Clinic is responsible for all activity that takes place under its Authorized Users' accounts, unless the activity was caused by our breach of these Terms or took place during support access by our staff under section 9.5.

5.8. Users in several Clinics. An Authorized User may belong to more than one Clinic. Each Clinic's data is kept separate, and an Authorized User's access in one Clinic gives no access to another.

5.9. Deleting a personal account. An Authorized User may delete their own account. Records they created in a Clinic remain part of that Clinic's Customer Data, and the Clinic's audit log keeps a reference to the user who made each change. In some cases (for example, where a user recorded dental chart entries) an account cannot be deleted until the Clinic or Nojdar reassigns or resolves those records. The user's AI Clinic Assistant conversations are deleted with the account (see section 12.7).

6. The Service and changes to it

6.1. What the Service is. Nojdar Clinic is a multi-tenant, cloud-based practice management and record system for clinics in Iraq and the Kurdistan Region. Depending on the Plan, it includes patient records, appointments and queues, visits and consultation notes, diagnoses, prescriptions and dispensing, laboratory and imaging orders and results, dental charting, medical image upload and viewing, clinic invoicing, payments and expenses, leads, reports, notifications, an audit log, and the optional AI Clinic Assistant. The Service is available in English, Kurdish (Sorani) and Arabic and supports Iraqi dinar (IQD) and US dollar (USD) amounts.

6.2. What the Service is not. The Service is used by Clinic staff only. It does not include a patient portal, online booking by patients, telemedicine, insurance claims, or messages (email, SMS or WhatsApp) sent to Patients. It does not connect to hospital systems through HL7 or FHIR, or to imaging equipment through PACS. It is not an emergency or real-time monitoring system.

6.3. Changes. We continuously improve the Service, and we may add, change or remove features at any time. If we remove a feature that is material to a Plan the Clinic has paid for during the current Billing Period, we will give reasonable advance notice where practical. If the change substantially reduces the core functionality of the Clinic's Plan, the Clinic may end its subscription and receive a refund under section 7.11 of Fees prepaid for the remaining unused part of the Billing Period, as its only remedy for that change. The AI Clinic Assistant, imaging features and any feature that depends on a third-party provider are additional features. Changing, limiting or withdrawing them because of a change in a provider's terms, pricing or availability, a change in the law, or a security or misuse concern is not a reduction of the Plan's core functionality under this section. If we withdraw the AI Clinic Assistant permanently for all Clinics on a Plan, we will, at our choice, offer the Clinic a move to a lower-priced Plan for future Billing Periods or a reasonable credit.

6.4. Early access and new features. Until we announce general availability, the Service as a whole is provided as an early-access service, and we may change Plans, limits and features more frequently during that period. We may also label some features as early access, beta, preview or similar. They are provided as they are, may be changed or withdrawn without notice, and may be less reliable than the rest of the Service.

6.5. Time and dates. Unless stated otherwise in the Service, dates and times in the Service, in billing, and in these Terms refer to the Asia/Baghdad time zone.

6.6. Descriptions of the Service. Descriptions in these Terms of how the Service works describe it at the date these Terms were last updated. They help explain our respective responsibilities and may change under section 6.3. They are not warranties or service commitments beyond section 22.3.

7. Plans, trials, fees and payment

7.1. Plans

The Plans, their prices and their limits are described on our website, in the clinic app (for example on the plan selection screen and in the Clinic's billing settings), and on each invoice. If those descriptions differ, the description shown in the clinic app or on the Clinic's invoice for the relevant Billing Period applies. For information, at the date these Terms were last updated the list prices were:

Basic: 29,000 IQD per month, or 290,000 IQD per year.
Pro: 49,000 IQD per month, or 490,000 IQD per year.
Enterprise: priced individually for each Clinic, in IQD or USD, under a quote or order form.

A yearly subscription costs the same as ten months. We may agree a different price or different limits with a particular Clinic. Any such agreement applies only to that Clinic and must be recorded in writing or in the Clinic's billing record.

7.2. Free trial

7.2.1. We may offer a Clinic a free trial when it first chooses a Plan. The length of the trial is shown when the trial starts. During the current early-access period it is 30 days, and we expect to shorten it (for example to 7 days) when the Service becomes generally available. A change in trial length does not affect a trial that has already started.

7.2.2. A trial ends automatically at the end of its period. Trials have no grace period. When the trial ends, the Clinic becomes read-only (see section 7.6) until a paid subscription starts. We may offer, extend, shorten or withdraw trials at our discretion, and we may refuse a trial to a Clinic that has already had one.

7.2.3. Complimentary access. Any trial, extension, free period, credit, allowance grant or Plan upgrade we provide without charge is provided at our discretion, may be withdrawn on notice at the end of its stated period, and is treated as a free trial for sections 22.4 and 23.2.

7.3. Invoices

Nojdar issues invoices to the Clinic for each Billing Period, and for any other agreed charges, in the Service and, unless the recipient has switched these emails off, by email. Invoices state the amount, currency, Plan and period covered. Unless an invoice says otherwise, it is payable before the start of the Billing Period it covers, or within 30 days of its date if it is issued during a period.

7.4. How you pay

7.4.1. At launch, Fees are paid in cash, by bank transfer, or by another method that we agree to accept. Nojdar records each payment manually in the Service and the Clinic receives a payment confirmation. A payment counts as received only when we have actually received the funds and recorded the payment. Please keep your receipt.

7.4.2. We do not store payment card details, and we do not charge any payment method automatically. We may later offer online payment methods (for example, local payment services). Those may be subject to additional terms from us and from the payment provider, which we will show to you before you use them.

7.4.3. The Clinic is responsible for any bank, transfer or payment service charges on its side.

7.4.4. Who may receive payment. Cash may be paid only to Nojdar staff or representatives named in writing by us (by email from a nojdar.app address or in the Service) for that purpose. A payment is treated as received only when it appears as recorded in the Clinic's billing page in the Service or in a payment confirmation email from no-reply@nojdar.app. Payment to any other person does not discharge the Clinic's obligation. The Clinic must ask for, and keep, our receipt.

7.5. No automatic renewal

A subscription does not renew automatically. To continue without interruption, the Clinic must pay the invoice for the next Billing Period before the current one ends. We will usually remind the Clinic in the Service and by email starting about 7 days before the end of the current trial or Billing Period (for a paid period, before the 7-day grace period in section 7.6.1 begins), but the Clinic remains responsible for paying on time whether or not it receives a reminder, and whether or not reminder emails have been switched off.

An invoice issued for a future Billing Period of a monthly or yearly Plan is an offer to renew. If the Clinic does not pay it, the subscription simply lapses under section 7.6, and the unpaid invoice is cancelled without further obligation, unless the Clinic has agreed in writing, for example in an Enterprise order form, to a fixed term or a minimum commitment. Charges for additional items the Clinic has ordered, such as extra storage or imaging allowances, are payable once ordered.

7.6. Late payment, grace period and read-only mode

7.6.1. Grace period after a paid period. If a paid Billing Period ends without the next one being paid, the Clinic keeps full access for a grace period of 7 days.

7.6.2. Read-only mode. If payment has still not been recorded when the grace period ends (or, for a trial, when the trial ends), or if we cancel the subscription under these Terms, the Clinic becomes read-only. In read-only mode, Authorized Users can still sign in, view records, download documents and use the export features described in section 21.2, but they cannot create, change or delete patient, clinical, financial or other clinic records, and the AI Clinic Assistant is not available. Managing staff access, renewing the Plan and scheduling the Clinic's deletion remain available. Full access returns once payment is recorded.

7.6.3. No deletion because of non-payment alone; long-term lapse. We do not delete Customer Data merely because a subscription has lapsed. If a Clinic stays unpaid and read-only for more than 12 months, we may either (a) charge a storage fee for continued hosting, notified at least 60 days in advance, or (b) terminate the Clinic's account under section 20.3(b), after giving the Clinic Owner and the Clinic's contact email at least 90 days' written notice and again at least 30 days' notice. Sections 21.3 and 21.4 then apply. The Clinic is responsible for exporting any records it must keep before that date.

7.6.4. When a renewal starts. If the Clinic pays for a new Billing Period before its access ends, or within 7 days after its previous paid period or trial ended, the new Billing Period starts when the previous period or trial ended, so the time since then counts as part of the new Billing Period. If payment is recorded later than that, the new Billing Period starts on the day the payment is recorded.

7.7. Taxes

Prices are stated exclusive of any taxes, duties or government charges that may apply. Our invoices show any tax we are required to charge. If any tax, levy or withholding becomes applicable, the Clinic must pay it in addition to the Fees (or gross up the payment so that we receive the full amount invoiced), except taxes on Nojdar's own income. If we are later required to account for a tax on Fees already invoiced, the Clinic will pay it on our invoice.

7.8. Currency

Fees are payable in the currency shown on the invoice (normally IQD; some Enterprise agreements use USD). If we agree to accept payment in a different currency, we will tell you the exchange rate we will apply before you pay, and the invoice is settled only when the amount received equals the invoiced amount at that rate. Exchange rate differences and currency conversion costs are not a reason to pay less than the invoiced amount.

7.9. Price changes

We may change our prices or Plans. We will give the Clinic at least 30 days' notice by email or in the Service before a price increase applies to it. A price change never affects a Billing Period that has already been invoiced and paid. If the Clinic does not accept the new price, it may choose not to renew.

7.10. Exchange rate and cost changes

Our prices in IQD reflect costs we pay in other currencies. If the official or prevailing market IQD to USD exchange rate changes by more than 10 percent compared with the date of the Clinic's last price notice, or a provider we depend on materially increases its prices, we may adjust prices for future Billing Periods by giving at least 30 days' notice under section 7.9. Prices already invoiced and paid for a Billing Period do not change.

7.11. Refunds

Fees are non-refundable, and there is no refund for partial Billing Periods, unused features, unused seats or allowances, periods in which the Clinic was read-only, or termination by the Clinic for its own convenience, except: (a) where these Terms expressly provide for a refund (sections 6.3, 17.2.5, 20.4, 22.3, 24.2, 25 and 29.3); (b) where we made a billing or recording error, which we will correct; or (c) where the law requires a refund.

Where a refund is due for an unused part of a yearly Billing Period, it equals the Fees paid for that year minus our then-current monthly list price for each month or part of a month that has started, and is never more than the Fees paid. Refunds are paid in the currency of the original payment, in cash or by bank transfer to the Clinic, within 30 days after the refund is confirmed in writing, and against a receipt signed by the Clinic. We may set off any amount the Clinic owes us against a refund.

7.12. Billing disputes

If the Clinic believes an invoice or payment record is wrong, it must tell us in writing within 30 days of the invoice or payment date, with the details. We will review it in good faith. The Clinic must pay any part of the invoice that is not disputed. If the Clinic does not dispute an invoice or payment record within that period, it is treated as accepted, except for obvious errors.

7.13. No set-off

The Clinic must pay Fees in full without any set-off, counterclaim, deduction or withholding, except a withholding required by law under section 7.7.

7.14. Recovery costs

If we have to take formal steps to recover overdue Fees, the Clinic must pay our reasonable costs of recovery, to the extent the law allows.

8. Plan limits and fair use

8.1. Limits. Each Plan has limits, which may include the number of Authorized Users (seats), visits per Usage Cycle, storage for clinic files, medical imaging uploads per Usage Cycle, the maximum size of a single imaging study, total imaging storage, the number of scheduled reports, AI Clinic Assistant usage budgets (per day and per month) and request rates, and the number of rows in a single export. The current limits for the Clinic's Plan are shown in the clinic app. For information, at the date these Terms were last updated:

Basic: up to 5 seats; a soft limit of 500 visits per Usage Cycle; 5 GB of clinic file storage; no medical imaging uploads (the local imaging viewer can still open files on the user's own device); no AI Clinic Assistant; no saved reports, leads or audit log viewer.
Pro: seats and visits subject to fair use; 25 GB of clinic file storage; imaging uploads of up to 20 GB per Usage Cycle, 2 GB per study and 250 GB stored in total; AI Clinic Assistant with daily and monthly usage budgets and per-user rate limits; saved reports, leads, the audit log viewer and up to 5 scheduled reports.
Enterprise: as agreed for the Clinic, with higher defaults (for example 100 GB of clinic file storage, imaging uploads of up to 100 GB per Usage Cycle, 4 GB per study and 1.5 TB stored, larger AI usage budgets and up to 25 scheduled reports).

8.2. What happens at a limit. When a limit is reached, the related action may be blocked until the next Usage Cycle, until the Clinic upgrades, or until we agree a higher limit. Reaching a limit never deletes existing records. For the Basic visit limit, patient care is never blocked: same-day appointments, walk-ins, arrivals, consultations and follow-ups always continue. Once the Clinic has created 120% of its visit limit (600 visits on Basic) in a Usage Cycle, the Service may stop accepting new bookings for later days until the next Usage Cycle or until the Clinic upgrades. Imaging upload allowances are measured by data uploaded in the Usage Cycle, so permanently deleting a study frees storage space but does not restore the upload allowance for that Usage Cycle.

8.3. Fair use. "Unlimited" or "subject to fair use" means use that is normal for a clinic of the Clinic's type and size, using the Service for its intended purpose. We may contact the Clinic, apply reasonable technical limits, or require a Plan change if use is excessive, automated, or harms the Service or other customers. We will normally discuss it with the Clinic first, except where we need to act quickly to protect the Service.

8.4. No workarounds. You must not try to get around limits, for example by creating several Clinics for one practice, sharing accounts, or using automated tools.

9. Customer Data

9.1. The Clinic owns its data. As between the Clinic and Nojdar, the Clinic owns all Customer Data, including Patient Data. We claim no ownership of it.

9.2. Permission for us to process it. The Clinic grants Nojdar a non-exclusive, royalty-free license, in the locations described in section 17.3, for the duration of these Terms and any period after that in which we still hold Customer Data under section 21, to host, store, copy, transmit, display, back up and otherwise process Customer Data only as needed to: (a) provide, secure, maintain and support the Service for the Clinic; (b) prevent or address technical, security or fraud problems; (c) follow the Clinic's instructions; and (d) comply with the law.

9.3. Roles under data protection law. The Clinic decides why and how Patient Data and other Customer Data are processed, and is the controller (the data owner) of that data. Nojdar processes it on the Clinic's behalf, as a processor or service provider, only on the Clinic's documented instructions and under section 17.2. These Terms, the Clinic's configuration of the Service, and the actions of its Authorized Users in the Service are the Clinic's instructions. Nojdar is the controller of Account Data (for running accounts, billing, security and support) and of information about Website Visitors, as explained in our Privacy Policy.

9.4. What we do not do with Customer Data. We do not sell Customer Data. We do not use Patient Data for advertising. We do not ourselves use Customer Data to train artificial intelligence models; what AI providers may do with data sent to them is described in section 12.5. We may produce and use statistics about how the Service is used (for example, how often a feature is used, error rates, storage volumes and performance) to operate, secure and improve the Service, provided those statistics do not identify any Patient, Authorized User or Clinic.

9.5. Access by Nojdar staff. Our staff access Customer Data only when needed to provide support the Clinic or its users ask for, to investigate or fix a technical or security problem, to maintain the Service, or to comply with the law. For support, an authorized Nojdar administrator may temporarily sign in as an Authorized User ("support access"). We use support access only (a) at the request of that user or the Clinic, (b) where it is necessary to investigate or fix a security incident, a serious technical problem or suspected misuse of the Service affecting the Clinic, in which case we will tell the Clinic afterwards where the law and the investigation allow, or (c) where the law requires it. Our staff will not create, change or delete clinical records during support access unless the Clinic has asked them to in writing. Support access is marked as such in the Clinic's audit log: the start of each support sign-in, and its end when the administrator ends it, are recorded in the audit log of every Clinic the user belongs to under the name of the Nojdar administrator, and every change the audit log records during it is recorded under the account of the user whose access is used and labeled as support access with that administrator's name. Our own records also note that the session was started by a Nojdar administrator. On request, we will tell the Clinic when support access to its account took place, where our records allow. We limit this access to a small number of authorized staff who use two-factor authentication and are bound by written confidentiality obligations.

9.6. Audit log. The Service keeps an audit log of changes to important records, including who made the change, when, from which IP address and device, and what the record looked like before and after. Because those snapshots can include Patient Data (for example names, phone numbers, dates of birth and clinical notes), the audit log is itself part of the Customer Data. It is append-only: neither the Clinic nor its Authorized Users can edit or delete audit entries, except that we will erase or anonymize entries on the Clinic's written instruction where needed to comply with law, as described in section 9.7. Access to medical images is logged separately. The audit log and image access log are deleted when the Clinic is permanently deleted under section 21, except the audit entries that record changes to the Clinic's profile and to our billing records with the Clinic, which we keep under section 21.5.

9.7. Removing and erasing records. In normal use, "deleting" a Patient, visit, prescription, invoice, image study or most other records in the Service hides or retires the record rather than erasing it, so that clinical, financial and audit history remains complete. Some files (for example, an imaging study the Clinic chooses to delete permanently) can be erased from storage. The Service does not currently offer a self-service way to permanently erase an individual Patient's whole record. If the Clinic instructs us in writing to erase specific Patient Data to comply with law, we will erase or irreversibly anonymize it across the Service, including audit log snapshots, generated documents, files, report results and AI conversations, within 30 days, keeping only a minimal record of the erasure. Copies in backups are deleted as those backups expire. The Clinic is responsible for deciding that erasure is lawful, taking into account any duty to keep medical records. Where the work goes beyond what the Service supports, it is at the Clinic's reasonable cost, agreed in advance.

9.8. Requests from Patients and authorities. If we receive a request from a Patient about Patient Data (for example, to see, correct or delete it), we will forward it to the Clinic within 5 business days where we can identify the Clinic, and will not respond ourselves except to point the person to the Clinic, unless the law requires otherwise. If a court, regulator or other authority requires us to disclose Customer Data, we will review the request for legal validity, ask the requester to approach the Clinic directly where possible, tell the Clinic first where legally allowed so it can respond or object, and disclose only what is legally required.

10. Clinic responsibilities

The Clinic is responsible for, and must make sure its Authorized Users comply with, the following:

10.1. Lawful basis, notice and consent. Having a lawful basis to collect and use Patient Data, giving Patients any information the law requires about how their data is used (including that it is stored with cloud providers outside Iraq, as explained in our Privacy Policy, and, if the Clinic enables it, sent to AI providers under section 12), and obtaining and recording any consent the law or professional rules require. The Service does not collect or manage Patient consent for the Clinic.

10.2. Minors and people who lack capacity. Following the rules that apply when recording data about children and people who cannot consent for themselves, including involving a parent, guardian or legal representative where required.

10.3. Licensing and professional rules. Holding and maintaining every license, registration and permit needed to operate the Clinic and to provide its services, and following the rules of the Ministry of Health (federal and, where applicable, Kurdistan Regional Government), professional bodies, and the law on medical records, prescribing, dispensing, laboratory work and imaging.

10.4. Accuracy. The accuracy, quality, completeness and legality of the Customer Data it enters, including checking that uploaded images belong to the right Patient. Where the Service warns that the identity in an imaging file does not match the Patient, the Clinic is responsible for any decision to confirm and proceed.

10.5. Record keeping. Keeping medical, financial and other records for as long as the law requires. The Service is a tool to help with this, but it is not a guaranteed archive. Where the law requires the Clinic to keep its own copies, or to keep records for longer than its subscription lasts, the Clinic must use the export features to keep its own copies.

10.6. Appropriate access. Giving each staff member only the access they need, removing access promptly, and keeping devices used to access the Service secure, updated and protected by a screen lock.

10.7. Lawful content. Not uploading or entering content that is unlawful, infringes anyone's rights, contains malware, or is unrelated to providing healthcare and running the Clinic.

10.8. Communications with Patients. Any communication the Clinic sends to Patients outside the Service (for example, sharing a printed prescription or a document), and the content of all documents it issues.

10.9. Its own systems. Its own internet connection, devices, browsers, printers and local network, which must meet the reasonable requirements we publish in the Documentation.

10.10. Staff notice. Telling its Authorized Users that their activity in the Service, including IP address and device information, is recorded in the audit log and may be reviewed by the Clinic.

10.11. Closure. If the Clinic stops operating, telling us in writing who is responsible for its medical records, and exporting or arranging the transfer of those records before its account is deleted.

10.12. Leads. Contacting prospective patients recorded as leads only in line with the law on direct marketing and with their agreement where required.

11. Medical and clinical disclaimer

11.1. Not a medical device and no medical advice. The Service is a practice management and record-keeping tool. It is not a medical device, it is not intended to diagnose, treat, cure, monitor or prevent any disease or condition, and it does not provide medical advice. Nothing in the Service replaces the professional judgment of a qualified clinician. All clinical decisions, and their consequences, are the sole responsibility of the Clinic and its licensed practitioners.

11.2. Reference information. The Service may include reference lists and catalogs, such as diagnosis codes (ICD-10), medicine names and strengths, laboratory test names, units and reference ranges, dental notations and templates. They are provided for convenience, "as is", may be incomplete, out of date or not suitable for a particular Patient, and must be checked by the Clinic. The Clinic is responsible for any reference ranges or catalog entries it adds or edits.

11.3. Flags, alerts and notifications. Features such as abnormal or critical result flags, worklists, reminders and notifications are aids only. They depend on correct data entry and on systems outside our control (such as email delivery and the user's device), and they may be delayed, missed or wrong. The Clinic must not rely on them as the only way to identify urgent findings, and must keep its own procedures for communicating critical results.

11.4. Prescriptions and verification codes. Prescriptions generated by the Service may carry a QR code linking to a public verification page. That page shows only limited information (the Clinic's name and logo, the prescription number, issue date, prescribing doctor's name, a masked patient code and whether the prescription is valid). It does not show the Patient's name, medicines or diagnoses. The Clinic and its prescribers are solely responsible for the content of each prescription, for whether electronically generated prescriptions are legally valid where they are used, and for any signature, stamp or other formal requirement. Anyone who holds a printed prescription can open its verification page, so the Clinic should treat printed prescriptions as confidential documents. A verification result confirms only that a prescription with that number was issued through the Service by the named Clinic and has not been cancelled in the Service. It does not confirm the identity of the person presenting it, that the printed contents match what was issued, whether it has already been dispensed elsewhere, or that it is clinically appropriate or lawful. Nojdar makes no promise to anyone who relies on a verification page, and anyone relying on it must make their own checks.

11.5. Medical images. The imaging viewer is provided to help Clinic staff view medical images. It has not been cleared or approved by any regulator as a medical device for primary diagnostic interpretation. Image quality on screen depends on the original files, the display, the browser and the network. The Clinic must not rely on the viewer for primary diagnosis where the law, professional standards or good practice require a regulated diagnostic workstation. Original imaging files are stored as uploaded, including any identifying information they contain. The local viewer mode opens files from the user's device without uploading them to us.

11.6. Dental charts, reports and calculations. Dental charts, body measurements (such as BMI), financial totals and reports are generated from the data entered. The Clinic must check them before relying on them.

11.7. Not for emergencies. The Service is not designed for use in emergencies or for real-time patient monitoring. If the Service is unavailable, the Clinic must have its own fallback procedures (for example, paper records) so that patient care is not affected.

11.8. No automatic clinical safety checks. Unless a feature expressly says otherwise, the Service does not check prescriptions for drug interactions, allergies, contraindications, duplicate therapy, pregnancy or breastfeeding risks, age or weight dosing, or correct dosage, and the absence of a warning means nothing. Translations of medicine names, instructions, diagnoses or other clinical text in English, Kurdish or Arabic, whether in the interface, catalogs or generated documents, may be inaccurate, and the prescriber is responsible for checking every document before it is issued.

12. AI Clinic Assistant

12.1. Optional and off by default. The AI Clinic Assistant is an optional feature available on Plans that include it. It is switched off for every Clinic until an Authorized User with the doctor or admin role switches it on in the Clinic's settings. While it is off, no Clinic data is sent to an AI provider. At present only Authorized Users with the doctor role can use it. Switching the feature on is the Clinic's decision and instruction to us. By switching the feature on, the person doing so confirms that they are authorized to give this instruction for the Clinic, and the Clinic confirms that it has decided that sending the information described in section 12.5 to providers outside Iraq is lawful for it and that it has given Patients any notice, and obtained any consent, that the law requires.

12.2. What it does. The AI Clinic Assistant answers questions about the Clinic's schedule, queue, patients and finances, and can prepare a limited set of actions (such as creating, rescheduling or cancelling an appointment, marking an arrival, creating a follow-up visit, creating a lead or adding a patient note). It can only reach data through the same permission checks that apply to the user, and records it looks up are given to it in a reduced form (for example, phone numbers are masked and lookups do not return clinical notes, examination findings or diagnoses). However, anything the user types, and the content of any note or appointment the user asks it to prepare, is sent to the AI provider as typed, and lookup results can include Patient Data such as names, dates of birth, blood type, appointment reasons and the names of requested tests. It cannot delete records, change staff or roles, change billing or settings, take payments, or export data in bulk.

12.3. You confirm every action. The AI Clinic Assistant does not carry out any change until the user reviews and confirms it. A confirmed action is the user's action and the Clinic's responsibility. It is recorded in the audit log under the user's name, together with a note that it was prepared by the AI Clinic Assistant.

12.4. Outputs may be wrong. The AI Clinic Assistant uses large language models, which can produce information that is inaccurate, incomplete, out of date or inappropriate, even when it sounds confident. Its outputs are not medical advice and must not be used to diagnose, prescribe or decide treatment. A qualified person must check any output before relying on it.

12.5. Third-party AI providers. To provide the feature, we send the conversation (up to a limited number of recent messages, including the user's messages, earlier replies and earlier lookup results), basic Clinic context (such as the Clinic's name, time zone, currency and the user's language), lookup results as described in section 12.2, and the content of any action the user asks it to prepare, to a third-party AI routing service (OpenRouter), which passes them to a model provider (such as Anthropic models served through a cloud platform like Google Vertex AI or Amazon Bedrock). These providers are located outside Iraq, including in the United States. Every request is sent with settings that instruct OpenRouter to use only endpoints that, under their published policies, do not retain the data after responding and do not use it to train models; if no such endpoint is available, the request fails rather than being sent elsewhere. OpenRouter keeps metadata about each request (such as the time, model and amount of usage) for billing and abuse prevention. More detail is in our Privacy Policy. We may change the AI providers or models we use at any time.

12.6. Do not overshare. Users should not type into the AI Clinic Assistant more Patient Data than is needed for the task, and must not enter passwords, payment card numbers or other secrets.

12.7. Conversations are stored. Conversations are saved in the Clinic's account so the user can return to them. Removing a conversation hides it from the user but does not currently erase it from our database; it is kept until the user's account or the Clinic is permanently deleted, or until we introduce a retention period, which we will announce. The Clinic agrees that a user's conversations are deleted when that user deletes their account. Actions confirmed through the assistant remain recorded in the audit log.

12.8. Usage limits. The AI Clinic Assistant has daily and monthly usage budgets per Clinic and request limits per user, depending on the Plan. When a budget is used up, the feature is unavailable until it resets. We may suspend or withdraw the feature, or change its limits, at any time, including if a provider changes its terms or if we detect misuse, subject to section 6.3.

13. Acceptable use

13.1. You must use the Service only for its intended purpose, in line with these Terms and the law. You must not, and must not help or allow anyone else to:

access or try to access data, accounts or Clinics you are not authorized to access, or try to break the separation between Clinics;
probe, scan or test the vulnerability of the Service, or breach or bypass any security, authentication, permission or rate-limiting measure, except as allowed in section 13.2;
use automated means (such as bots, scrapers or scripts) to access the Service, the verification pages or the APIs, other than features we provide for that purpose;
try to enumerate or guess prescription verification links, file links or other identifiers;
copy, modify, translate, decompile, disassemble or reverse engineer the Service, except to the extent the law allows this despite this restriction;
resell, sublicense, rent or provide the Service to anyone other than the Clinic and its Authorized Users, or use it to provide a service bureau or competing product;
upload viruses, malware or other harmful code, or anything that interferes with or overloads the Service;
upload or share content that is unlawful, defamatory, obscene, or that infringes anyone's intellectual property, privacy or other rights;
use the Service to send spam or unsolicited messages;
try to make the AI Clinic Assistant act outside its intended purpose, ignore its safeguards, or reveal information it is not designed to reveal;
share your account or sign-in details, or impersonate another person;
remove or hide any proprietary notices or labels in the Service; or
use the Service in a way that breaks any law, including laws on health data, medical practice, sanctions and export control.

13.2. Security research. You must not carry out security testing of the Service without our prior written permission. If you believe you have found a security weakness, please report it to support@nojdar.app with enough detail for us to reproduce it, give us reasonable time to fix it before telling anyone else, and do not access, change or keep any data that is not yours. We will not take legal action against good-faith reports made in line with this section.

13.3. Our right to act. We may investigate suspected breaches of this section and may remove content, restrict features or suspend access under section 19.

14. Third-party services

14.1. Service providers. We use third-party providers to run the Service, including for hosting, databases, file storage, email delivery, error monitoring and AI. They are listed in our Privacy Policy. We choose them carefully and require appropriate protections for personal data, but we are not responsible for outages or failures of internet infrastructure or third-party services outside our reasonable control. Section 17.2.5 sets out our responsibility for sub-processors of Customer Data.

14.2. Open-source software. The Service includes open-source software, such as the OHIF medical imaging viewer. Open-source components are licensed under their own licenses, and nothing in these Terms limits your rights under those licenses.

14.3. Links and other services. The Service and our website may link to third-party websites or services. We do not control them and are not responsible for them. Your use of them is governed by their own terms.

15. Intellectual property and feedback

15.1. Our rights. Nojdar and its licensors own all rights in the Service, the software, the design, the Documentation, our trademarks and logos, and everything we create to provide the Service, other than Customer Data. These Terms do not transfer any of those rights to you.

15.2. Your right to use the Service. Subject to these Terms and payment of the Fees, we grant the Clinic a limited, non-exclusive, non-transferable, non-sublicensable right, during its subscription, for its Authorized Users to use the Service for the Clinic's internal business purposes. Documents the Service generates for the Clinic (such as prescriptions, invoices, receipts and reports) may be used freely by the Clinic in its business.

15.3. Feedback. If you send us ideas, suggestions or other feedback about the Service, we may use them without restriction or payment to you. Feedback does not include Customer Data, and we will not identify you or the Clinic as its source without permission.

15.4. Publicity. We will not name the Clinic as a customer, or use its name or logo in our marketing, without the Clinic's prior permission. We may, however, name the Clinic in a private, non-public list of customers given in confidence to prospective investors, acquirers or advisers, without its logo.

16. Confidentiality

16.1. Each party may receive non-public information from the other that is marked as confidential or that a reasonable person would understand to be confidential ("Confidential Information"). Customer Data is the Clinic's Confidential Information. Our non-public pricing, security information and product plans are ours.

16.2. The receiving party will use the other party's Confidential Information only to perform or benefit from these Terms, protect it with at least reasonable care, and share it only with its staff, contractors and service providers who need to know it and are bound by confidentiality duties at least as protective as these.

16.3. This section does not apply to information that is or becomes public through no fault of the receiving party, that the receiving party already knew or independently developed without using the other party's information, or that it lawfully received from someone else without a duty of confidence. A party may disclose Confidential Information where required by law or by an authority, after giving the other party notice where legally allowed.

16.4. Subject to section 21.5, these duties last for the term of these Terms and 5 years after it ends, and for Patient Data and trade secrets, for as long as the information remains confidential.

17. Data protection and security

17.1. Privacy Policy. Our Privacy Policy explains, for information, the personal data we handle, why, which service providers help us, where data is stored, how long we keep it, and the rights people have. Our commitments to the Clinic about Customer Data are set out in sections 9, 16 and 17 of these Terms and in any Data Processing Addendum.

17.2. Processing terms for Customer Data. The terms in this section 17.2 apply to our processing of Customer Data. If the Clinic and Nojdar sign a separate Data Processing Addendum, it applies in addition and, where the two conflict, the Addendum prevails, subject to section 23.6.

17.2.1. Instructions. We process Customer Data only on the Clinic's documented instructions described in section 9.3, including for transfers to the locations described in section 17.3. If the law requires other processing, we will tell the Clinic before processing unless the law prohibits it. We will tell the Clinic promptly if we believe an instruction breaks applicable data protection law.

17.2.2. Subject matter and duration. We process Customer Data to provide the Service under these Terms, for the term in section 20 and the periods in section 21. The people concerned are Patients (including children), their relatives, emergency contacts and payers, prospective patients, Authorized Users, and other people named in Customer Data. The types of data are those described in section 5 of our Privacy Policy, including health data.

17.2.3. Confidentiality of personnel. Everyone we authorize to access Customer Data is bound by a written duty of confidentiality that continues after their work for us ends, has been instructed on handling health data, and accesses Customer Data only for the purposes in section 9.5.

17.2.4. Security. We maintain the measures in section 17.4. We may update them, provided the overall level of protection is not materially reduced.

17.2.5. Sub-processors. The Clinic gives general authorization for us to use the sub-processors listed in our Privacy Policy. We will impose on each sub-processor that processes Customer Data obligations that are, in substance, no less protective than this section 17.2, to the extent relevant to its service, and we remain responsible to the Clinic for their performance. We will give the Clinic Owner at least 30 days' notice, by email or in the Service, before adding or replacing a sub-processor that processes Customer Data. Where an urgent change is needed for security or continuity of the Service, we will give notice as soon as practical. The Clinic may object on reasonable data protection grounds within the notice period. If we cannot reasonably address the objection, the Clinic may end its subscription before the change takes effect and receive a refund under section 7.11 of Fees prepaid for the unused part of the Billing Period.

17.2.6. Requests from individuals. Taking into account the nature of the processing, we will help the Clinic respond to requests from individuals to exercise their rights, through the features of the Service and, where those are not enough, through reasonable additional assistance. Requests we receive directly are handled under section 9.8.

17.2.7. Compliance assistance. Taking into account the information available to us, we will give the Clinic reasonable information and assistance with security, notification of Security Incidents, data protection impact assessments and consultations with authorities. Assistance beyond the Service and the Documentation may carry reasonable fees, agreed in advance.

17.2.8. Deletion and return. At the end of the Service, we will make Customer Data available for export and then delete it as described in section 21. Any copy we must keep by law remains protected by this section 17.2 and is used only for the reason it is kept.

17.2.9. Information and audits. We will provide the information reasonably needed to demonstrate compliance with this section 17.2, including answers to reasonable security questionnaires, and summaries or certifications that our sub-processors make available. Where that information is not enough, or a competent authority requires it, the Clinic may audit our compliance itself or through an independent auditor who is bound by confidentiality and is not our competitor. Audits may take place no more than once in any 12-month period (except after a Security Incident or at an authority's request), on at least 30 days' written notice, during business hours, without access to other customers' data, and at the Clinic's cost. Audits of our sub-processors are carried out through the reports and rights they make available.

17.2.10. No other use. We will not sell Customer Data, use it for advertising, or use it for our own purposes other than those in sections 9.2 and 9.4.

17.3. Where data is stored. The Service's database and application servers are hosted with providers in the European Union (Frankfurt, Germany), and requests may first pass through our hosting provider's servers near the user. Files such as attachments, documents and medical images are stored with a cloud storage provider that chooses the storage location automatically and may store them outside the European Union. Some of our providers, including the AI and analytics providers, are based in the United States or elsewhere. We do not store data in Iraq. By using the Service, the Clinic instructs us to transfer and store Customer Data in these locations, and the Clinic is responsible for any approval, notice or consent that Iraqi or Kurdistan Region law requires for this.

17.4. Security measures. We use technical and organizational measures designed to protect Customer Data, including encryption of data in transit (TLS), the at-rest encryption provided by our hosting and storage providers, separation of each Clinic's data enforced in the database, the APIs and the application, role-based permissions checked on our servers, an audit log of changes, rate limits on sign-in and other sensitive actions, short-lived links for file access, and limited, authorized access by our staff, who must use two-factor authentication for administrative access. No system is completely secure, and we cannot guarantee that unauthorized access will never happen.

17.5. Security incidents. A "Security Incident" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Data that we or our sub-processors process. It does not include unsuccessful attempts that do not compromise the security of Customer Data, such as blocked sign-in attempts, pings or port scans.

Notice to the Clinic. We will notify the Clinic Owner and the Clinic's contact email without undue delay and, where feasible, within 72 hours after becoming aware of a Security Incident. The notice will describe, as far as then known, the nature of the incident, the categories and approximate number of people and records affected, the likely consequences, the measures taken or proposed, and a contact person. Where we cannot provide all of this at once, we will provide it in stages without further undue delay.
Our response. We will take reasonable steps to contain and remedy the incident and keep a record of it. We will give the Clinic the information it reasonably needs to notify Patients or authorities.
Notifying Patients or authorities. We will not notify Patients or authorities about a Security Incident on the Clinic's behalf without the Clinic's agreement, unless the law requires us to. Notifying the Clinic is not an admission of fault.

17.6. The Clinic's part. Security is shared. The Clinic is responsible for the matters in sections 5 and 10, including managing its Authorized Users, protecting their credentials and devices, and how it uses data it exports or downloads from the Service. Once data has been exported or downloaded, protecting it is the Clinic's responsibility.

18. Availability, support and backups

18.1. No service level guarantee. We work to keep the Service available and performing well, but we do not guarantee that it will be uninterrupted, error-free or available at any particular time, unless we have agreed a written service level with the Clinic.

18.2. Maintenance. We may need to carry out maintenance, which may make some or all of the Service temporarily unavailable. We will try to schedule planned maintenance outside normal clinic hours in Iraq and to give notice where practical. Emergency maintenance may happen without notice.

18.3. Support. We provide support by email at support@nojdar.app from Sunday to Thursday, 9:00 to 17:00 Asia/Baghdad time, excluding public holidays, in English, and where we can, in Kurdish or Arabic. We will make reasonable efforts to respond promptly but do not guarantee response or resolution times unless agreed in writing.

18.4. Backups. Our database provider keeps a short rolling recovery window (point-in-time history) of the Service's database, according to the plan and settings we choose, which may change over time. At launch this window is a matter of hours, and we expect to extend it as the Service grows. Backups exist to recover the Service as a whole from a technical failure. They are not an archive for individual Clinics, we do not guarantee that any particular data can be restored from them, and a restore may return the whole database to an earlier point in time. Backups are not a substitute for the Clinic keeping its own copies where the law requires it (see section 10.5).

18.5. Loss of data. If Customer Data is lost or corrupted because of our breach of these Terms, our only obligation, and the Clinic's only remedy, is for us to use reasonable efforts to restore the data from the most recent backup available to us, except where the loss was caused by our gross negligence or wilful misconduct.

19. Suspension

19.1. When we may suspend. We may suspend or limit access to all or part of the Service for a Clinic or an Authorized User if: (a) we reasonably believe there is a security threat or that an account has been compromised; (b) use breaches section 13 or otherwise threatens the Service, other customers or third parties; (c) we are required to do so by law, a court or an authority; (d) Fees remain unpaid, in which case the read-only mode in section 7.6 applies rather than a full suspension; or (e) it is needed to protect Patients or the public from imminent harm, or a Clinic's license appears to have been suspended or revoked.

19.2. Notice. We will give notice before or as soon as practical after a suspension, explain the reason where we are allowed to, and lift the suspension once the reason is resolved. Where we can, we will limit the suspension to the affected users or features. During a suspension, we will not delete Customer Data because of the suspension alone. We are not liable for any loss caused by a suspension made in good faith under this section.

20. Term and termination

20.1. Term. These Terms start when accepted under section 3 and continue until the Clinic's account is terminated and deleted under section 21.

20.2. Termination by the Clinic. The Clinic may stop using the Service at any time by not renewing, and may end its account by scheduling the Clinic for deletion, either through the "Delete clinic" option in the Clinic's settings (available to the Clinic Owner, the doctor and admins) or by writing to us at support@nojdar.app from the Clinic Owner's email address. Deletion follows the process in section 21.4. No Fees are refunded when the Clinic ends its account for its own convenience, except as section 7.11 provides.

20.3. Termination by Nojdar. We may terminate a Clinic's account: (a) if the Clinic materially breaches these Terms and does not fix the breach within 30 days of our written notice (or immediately, if the breach cannot be fixed or involves serious misuse, fraud or illegal activity); (b) under section 7.6.3 for long-term non-payment; (c) if the Clinic becomes insolvent, stops operating, or loses a license it needs to operate; (d) if the law or an authority requires it, or continuing would expose us to legal liability; or (e) for any other reason, by giving at least 90 days' notice.

20.4. Refund on termination for convenience. If we terminate under section 20.3(e), or the Clinic terminates because we materially breached these Terms and did not fix the breach within 30 days of the Clinic's written notice, we will refund under section 7.11 the Fees prepaid for the unused part of the current Billing Period.

20.5. Authorized Users. A Clinic may remove an Authorized User at any time. We may end an individual's access if they breach these Terms. Ending an individual's access does not end the Clinic's account.

21. Effect of termination, export and deletion

21.1. When access ends. When a Clinic's account is terminated, its right to use the Service ends, except as described in sections 21.3 and 21.4. Any unpaid Fees for periods before termination become due immediately. The Clinic must export the data it needs before deletion is scheduled, because the Clinic cannot be used or exported during the Deletion Grace Period.

21.2. Exporting data. While its account is open, including while it is read-only, the Clinic can export Customer Data through the Service. The Service currently provides: downloads of list views (such as patients, appointments and visits, invoices, payments, expenses, leads, prescriptions and diagnostic worklists) in CSV format, each limited to a maximum number of rows per export; report exports in CSV format; audit log exports in CSV format on Plans that include the audit log viewer; individual documents (such as prescriptions, invoices, receipts and diagnostic reports) in PDF format; and imaging studies as archives of their original files. The Service does not currently provide a single complete export of the whole Clinic, a structured export of every part of each Patient's chart, a bulk export of all attachments, or an export in HL7 or FHIR formats. On request before deletion, we will provide the Clinic's audit log as a CSV file whatever its Plan. If the Clinic needs help exporting other data that the self-service tools do not cover, we will provide reasonable assistance on request, which may be subject to reasonable fees that we will agree with the Clinic in advance.

21.3. Export window after termination by us. If we terminate a Clinic's account under section 20.3(b), (c) or (e), the Clinic will first be read-only for 30 days from the termination date so that it can export its data under section 21.2, and the Deletion Grace Period in section 21.4 starts only after that. If we terminate under section 20.3(a) for serious misuse, fraud or illegal activity, or under section 20.3(d), we may shorten or skip this export window where we reasonably consider it necessary, and will then provide an export of the Clinic's data on request where the law allows.

21.4. 30-day deletion grace period. A Clinic is scheduled for deletion when the Clinic Owner, the doctor or an admin chooses "Delete clinic" in the Clinic's settings and types the Clinic's name to confirm, when the Clinic asks us in writing to delete it, or when we terminate the Clinic's account (after any export window under section 21.3). The Clinic then closes at once for all of its Authorized Users, and we email the Clinic Owner, the doctor and the admins. For 30 days after deletion is scheduled (the "Deletion Grace Period"), the Clinic Owner, the doctor or an admin can restore the Clinic from the closed-clinic screen, or ask us to restore it at support@nojdar.app, and we will use reasonable efforts to restore it with its Customer Data as it was when deletion was scheduled. During the Deletion Grace Period no one can use, view or export the Clinic's data in the Service; a Clinic that needs to export can restore the Clinic, export and schedule deletion again. After the Deletion Grace Period ends, normally within one day, we permanently delete the Clinic's Customer Data, including its Patient Data and clinical records, the invoices and payments between the Clinic and its Patients, its AI Clinic Assistant conversations, its staff memberships and pending invitations, and its audit log (except the entries kept under section 21.5), and then its stored files. We keep the Clinic's profile and our own billing records with the Clinic as described in section 21.5. If the Clinic confirms to us in writing that its data must be erased sooner (for example, to comply with a legal erasure request), we may permanently delete a Clinic that is already scheduled for deletion before the Deletion Grace Period ends. Permanent deletion cannot be undone.

21.5. Backups and retained records. Copies of deleted Customer Data may remain in our database provider's recovery history until it rolls off in the normal course (at launch, within a matter of hours). We do not restore deleted Clinics from that history except to recover the Service from a failure. When a Clinic is permanently deleted, we keep, as Nojdar's own records: (a) the Clinic's profile (its name, contact details, address, logo and settings) and our billing records with the Clinic (its subscription, the invoices we issued to it, the payments we received, any prices, plan limits or imaging allowances we agreed with it, and the audit entries for these records and for changes to the profile, including who scheduled the deletion), for as long as accounting and tax law requires; (b) records we need to establish, exercise or defend legal claims; (c) the clinic application the Clinic submitted, as described in our Privacy Policy; and (d) records of acceptance of these Terms. These retained records do not include Patient Data. The personal accounts of the Clinic's Authorized Users are not deleted with the Clinic; their memberships of the Clinic are removed, and each user can delete their own account under section 5.9.

21.6. Survival. Any provision that by its nature should continue after termination continues, including sections 3.3, 5.5, 7 (for Fees, taxes, refunds and set-off relating to periods before termination), 9, 10, 11, 12.4, 12.5, 12.7, 15, 16, 17.2, 17.5, 17.6, 18.4, 18.5, 20.4, 21, 22, 23, 24, 25, 27, 28 and 30.

22. Warranties and disclaimers

22.1. Mutual. Each party confirms that it has the power and authority to enter into these Terms.

22.2. The Clinic. The Clinic confirms that it and its practitioners hold the licenses needed to operate, that it has the rights, lawful basis, notices and consents needed for us to process Customer Data as these Terms describe, and that its use of the Service complies with the law.

22.3. Nojdar. We will provide the Service with reasonable skill and care, and in a way that materially matches the Documentation for the Clinic's Plan. If the Service does not, the Clinic must tell us, and our only obligation, and the Clinic's only remedy, is for us to use reasonable efforts to correct the problem and, if we cannot do so within a reasonable time, for either party to terminate the affected subscription, with a refund under section 7.11 of Fees prepaid for the unused part of the Billing Period.

22.4. Disclaimer. Except as expressly stated in these Terms, and to the fullest extent the law allows, the Service is provided "as is" and "as available", and we make no other warranties or representations of any kind, whether express, implied or statutory, including any warranty of merchantability, fitness for a particular purpose, accuracy, non-infringement, or that the Service will be uninterrupted, secure or error-free, or that it will meet any legal, regulatory or professional requirement that applies to the Clinic. We do not warrant the accuracy of any AI output, reference information or generated content. Free trials and early-access features are provided without any warranty.

23. Limitation of liability

23.1. Things we are not liable for. To the fullest extent the law allows, neither party is liable to the other for any: (a) loss of profits, revenue, business, goodwill or anticipated savings; (b) loss or corruption of data, except for our obligation to restore from backups under section 18.5, and except where caused by our gross negligence or wilful misconduct; (c) cost of substitute services; (d) indirect, incidental, special, consequential or punitive loss or damage, even if the party was told such loss was possible; (e) fines, penalties or sanctions imposed on the Clinic or its practitioners by any authority or professional body; or (f) claims by Patients or other third parties against the Clinic, except to the extent covered by section 24.2.

23.2. Cap. To the fullest extent the law allows, Nojdar's total liability arising out of or relating to these Terms and the Service, for all claims together, is limited to the greater of: (a) the Fees the Clinic paid to Nojdar for the Service in the 12 months before the event that first gave rise to the liability; and (b) 100,000 IQD. This is a single total for all claims by the Clinic, its Authorized Users and anyone claiming through them, and it is not increased by the number of claims or claimants. Our total liability to a Website Visitor, or to an Authorized User acting personally, is limited to 100,000 IQD. The Clinic's total liability, apart from the matters in section 23.3, is limited to the amount in point (a) above.

23.3. Exceptions. The exclusions and caps in sections 23.1 and 23.2 do not apply to: (a) the Clinic's obligation to pay Fees; (b) the Clinic's indemnity obligations under section 24.1; (c) the Clinic's liability for breach of section 13 (acceptable use) or section 10.7 (lawful content); or (d) any liability that cannot be limited or excluded by law, such as liability for fraud, intentional misconduct, gross negligence where the law does not allow it to be limited, or death or personal injury caused by negligence where the law does not allow it to be limited.

23.4. Clinical responsibility. Nojdar is not responsible for clinical decisions, diagnoses, treatments, prescriptions, dispensing or patient outcomes, or for any professional negligence of the Clinic or its practitioners, whether or not the Service, a reference catalog or the AI Clinic Assistant was used in reaching them.

23.5. Contractual basis of claims. The parties agree that the relationship between them about the Service is contractual. To the extent the law allows, any claim by the Clinic or an Authorized User relating to the Service must be brought as a claim under these Terms, and this section 23 applies to it.

23.6. Single cap for all documents. The exclusions and limits in this section 23 apply to all liability arising under or in connection with these Terms, any order form, the Data Processing Addendum and the Privacy Policy, taken together, unless a document signed by Nojdar expressly states that it overrides this section.

23.7. Time limit for claims. To the extent the law allows, a claim against Nojdar must be notified to us in writing within 12 months after the Clinic became aware, or should reasonably have become aware, of the facts giving rise to it.

23.8. Why these limits exist. The Fees reflect the allocation of risk in these Terms, and the limits in this section are an essential part of the agreement between the parties.

24. Indemnities

24.1. By the Clinic. The Clinic will defend Nojdar, its officers, employees and contractors against any claim, demand, investigation or proceeding brought by a third party (including a Patient, a regulator or a professional body) and pay any damages, fines, settlements and reasonable legal costs arising from it, to the extent it arises from: (a) Customer Data, including a claim that the Clinic lacked a lawful basis, notice or consent to collect or process it, to transfer it outside Iraq as described in section 17.3, or to use it with the AI Clinic Assistant; (b) any healthcare services provided by the Clinic or its practitioners, including any claim of medical malpractice or professional negligence; (c) the Clinic's or its Authorized Users' breach of these Terms or of the law; or (d) any use of the AI Clinic Assistant's outputs or actions confirmed by an Authorized User. This section 24.1 does not apply to the extent that the claim, damages, fine or cost was caused by Nojdar's breach of these Terms (including sections 9, 16 and 17), or by the fraud, negligence or wilful misconduct of Nojdar or its sub-processors.

24.2. By Nojdar. Nojdar will defend the Clinic against any claim by a third party that the Clinic's use of the Service in line with these Terms infringes that third party's copyright, trademark or trade secret, and pay any damages and reasonable legal costs finally awarded or agreed in settlement. This does not apply to claims arising from Customer Data, open-source components, third-party services, combination of the Service with things we did not provide, or use in breach of these Terms. If such a claim is made or is likely, we may, at our option, obtain the right for the Clinic to keep using the Service, change the Service so it is no longer infringing, or terminate the affected subscription and refund under section 7.11 the Fees prepaid for the unused part of the Billing Period. This section states our entire liability for infringement claims.

24.3. Process. The party seeking protection must promptly notify the other party of the claim, let it control the defense and settlement (but no settlement that admits fault or imposes obligations on the protected party without its consent), and give reasonable help at the other party's cost. Where the claim is an investigation or proceeding by a regulator, authority or professional body, or could harm the reputation of the protected party, the protected party may control its own defense with counsel of its choice, and the indemnifying party will pay its reasonable costs.

25. Force majeure

Neither party is liable for any delay or failure to perform its obligations (other than payment obligations) caused by events beyond its reasonable control, including power cuts, failures of electricity supply or generators, internet or telecommunications outages, government-ordered internet shutdowns or restrictions (including those during national examinations), failures of hosting, cloud or other providers, cyber-attacks despite reasonable precautions, war, armed conflict, terrorism, civil unrest, curfews, sanctions, embargoes, restrictions on banking, payments or foreign currency (including restrictions on access to US dollars), failures of electricity or internet infrastructure at the Clinic's premises, acts of government, strikes, fire, flood, earthquake, epidemic or pandemic. The affected party will take reasonable steps to limit the effect and to resume performance. If the event prevents performance for more than 60 days, either party may terminate the affected subscription by notice, and we will refund Fees prepaid for the unused part of the Billing Period under section 7.11, which is the Clinic's only remedy for the event.

26. Website Visitors

26.1. Using our website. If you visit nojdar.app, you may use it to learn about Nojdar Clinic, contact us, and join our waitlist. Sections 13, 15, 22.4, 23, 27, 28 and 30 apply to your use of the website, with the necessary changes. Our Privacy Policy explains how we handle your information and our use of cookies.

26.2. Information on the website. The website is for general information. Descriptions, screenshots, features and prices may change and are not an offer that can be accepted. The terms that apply to a Clinic are these Terms, the details shown in the clinic app and any written agreement with us.

26.3. Waitlist and contact form. If you join our waitlist, the information you give is handled by our email list provider and used only as described where you sign up and in our Privacy Policy. The waitlist is free and creates no obligation on either side. Joining the waitlist does not create a Clinic account or guarantee access. Messages you send through the contact form are delivered to our support mailbox.

27. Governing law and disputes

27.1. Governing law. These Terms, and any dispute or claim arising out of or in connection with them or the Service (including non-contractual disputes), are governed by the laws of the Republic of Iraq, as applied in the Kurdistan Region of Iraq.

27.2. Talk to us first. If a dispute arises, the parties will first try in good faith to resolve it by negotiation. Either party may start this by sending a written notice describing the dispute. If it is not resolved within 30 days of that notice, either party may proceed under section 27.3.

27.3. Courts. Any dispute not resolved under section 27.2 will be finally settled by the competent courts of Erbil, Kurdistan Region of Iraq, except that disputes under a signed Enterprise order form may be settled by arbitration if that order form says so.

27.4. Urgent relief. Nothing in this section stops either party from seeking urgent interim or protective relief from a competent court, for example to protect Confidential Information or intellectual property, or Nojdar from bringing a claim for unpaid Fees in the courts where the Clinic is located.

28. Language

These Terms are written in English. We may provide translations into Kurdish (Sorani) and Arabic for convenience. If there is any conflict or difference between the English version and a translation, the English version prevails, to the extent the law allows. If a court requires a translation, the parties will use an Arabic or Kurdish translation approved by Nojdar, and the English version remains the reference for interpreting it to the extent the law allows.

29. Changes to these Terms

29.1. We may update these Terms from time to time, for example to reflect changes to the Service, our Plans or the law. We will post the updated Terms on our website with a new "Last updated" date.

29.2. If a change is material, we will notify the Clinic Owner by email or in the Service at least 30 days before it takes effect, unless the change is required by law or is needed urgently for security reasons, in which case it may take effect sooner.

29.3. Changes do not apply retroactively. If a material change is adverse to the Clinic, and the Clinic tells us in writing before the change takes effect that it does not accept it, the Clinic may terminate its account and we will refund Fees prepaid for the unused part of the Billing Period under section 7.11. This right does not apply to changes required by law, by a provider we depend on, or for security reasons. We will ask the Clinic Owner, and each Authorized User, to accept the updated Terms in the Service (section 3.1). Until the Clinic accepts them, the previous version continues to apply to the Clinic until the end of its current paid Billing Period. After that, the Clinic must accept the updated Terms to renew.

30. General terms

30.1. Assignment. The Clinic may not assign or transfer these Terms without our prior written consent. We may assign or transfer these Terms, by notice to the Clinic, to an affiliate, to any company or entity formed to carry on the Nojdar Clinic business, or in connection with a merger, acquisition, reorganization or sale of all or part of our relevant business or assets. If the Clinic's business is sold or transferred, the Clinic must tell us, and we may require the new operator to accept these Terms before it takes over the Clinic account and its Customer Data.

30.2. Subcontracting. We may use subcontractors and service providers to perform our obligations. We remain responsible for their performance under these Terms.

30.3. Notices. We may give notices to the Clinic by email to the Clinic Owner, by email to the address in the Clinic's profile, or by a notice in the Service. The Clinic must keep the Clinic Owner's email address and the Clinic's contact email current. A notice we send to the latest address in the Service is validly given even if it is not read. Notices to us, including notices of breach, termination or legal claims, must be sent by email to support@nojdar.app, and are effective only when actually received. Email notices from us are treated as received on the next business day after sending, unless we receive a delivery failure message. "Business day" means a day other than a Friday, Saturday or public holiday in the Kurdistan Region of Iraq.

30.4. Order of precedence. If documents conflict, the following order applies: (a) any signed written agreement or order form with the Clinic, for the matters it expressly covers; (b) the Data Processing Addendum, for the processing of Customer Data; (c) these Terms; and (d) the Documentation. Section 23 applies despite this order of precedence, as stated in section 23.6.

30.5. Entire agreement. These Terms, together with the documents referred to in section 30.4, are the entire agreement between the parties about the Service and replace any earlier agreements, proposals or statements about it. Each party confirms that it has not relied on any statement that is not set out in these documents. Any terms on the Clinic's purchase orders or similar documents do not apply.

30.6. Severability. If any part of these Terms is found to be invalid or unenforceable, it will be applied to the maximum extent allowed, and the rest of these Terms will remain in effect.

30.7. No waiver. A failure or delay in exercising a right is not a waiver of it. A waiver is effective only if made in writing.

30.8. Relationship. The parties are independent contractors. Nothing in these Terms creates a partnership, joint venture, agency or employment relationship.

30.9. No third-party rights. These Terms do not give any rights to anyone who is not a party to them, including Patients. This does not affect any rights Patients have directly under the law.

30.10. Electronic communications and records. The parties agree that these Terms may be accepted electronically and that electronic communications, records and acceptance have the same effect as written and signed documents, to the extent the law allows. Our records of acceptance, invoices and payments are evidence of what they record unless shown to be wrong.

30.11. Sanctions and export control. You must not use the Service in breach of any applicable sanctions or export control law, or on behalf of a person subject to such sanctions.

30.12. Headings. Headings and the summary box are for convenience only and do not affect how these Terms are interpreted. Words such as "including" and "for example" do not limit the general words before them.

31. Contact us

If you have questions about these Terms, please contact us:

Email: support@nojdar.app, for support, legal notices, privacy questions and security reports
Website: nojdar.app and our contact page

Contents