Terms of Service

By accessing or using the Medivis platform (the "Service"), you agree to be bound by these Terms of Service (the "Terms"). If you are agreeing on behalf of a business or other legal entity, you represent that you have the authority to bind it.

If you do not agree with any part of these Terms, you must not use the Service.

• "Business" — the organisation registered with Medivis to use the Service. A Business may operate in any industry: a clinic, a marketing agency, a professional services firm, or any other business that communicates with the people it serves.
• "End User" — an individual who communicates with a Business through the Service, or whose Personal Data a Business holds in it. Depending on the Business, an End User may be its patient, its customer, its client or its lead.
• "Service" — the Medivis platform: appointment and booking management, the WhatsApp conversation desk, the AI agent, and the reporting that sits on top of them
• "User" — any staff member of a Business authorised to access the Service
• "Workspace" — an isolated area within a Business's account. A Business may hold several; data in one is not reachable from another.
• "Mode" — the configuration installed on a Workspace, which determines what the Service does there and how its AI agent behaves
• "Personal Data" — as defined under the Personal Data Protection Act 2010 (Act 709)

Accounts are created by Medivis when a Business subscribes. Each Business receives its own account on its own subdomain, and manages its own staff accounts within it. Workspaces and the Mode installed on each are created by Medivis; the Business supplies the content its own operation depends on. You agree to:

• Provide accurate, current and complete registration information
• Keep staff accounts up to date and deactivate those that are no longer needed
• Keep sign-in credentials confidential and unshared
• Notify us immediately of any unauthorised use of an account

All of a Business's Workspaces are managed under that one account.

Permissible Use

• Managing bookings, appointments and conversations with End Users
• Sending transactional messages to End Users
• Sending marketing messages only to End Users who have consented and have not opted out
• Using the AI agent within its configured guardrails

Prohibited Use

• Sending spam or unsolicited marketing, or ignoring an opt-out
• Sharing End User data without authorisation
• Using the Service to provide medical diagnoses or treatment recommendations. This applies to every Business without exception, including a healthcare Business: the AI agent is not a clinical tool and its guardrails refuse such requests by design.
• Using the Service to give regulated financial, legal or other professional advice that the Business is not licensed to give, or that the licence requires a qualified human to deliver
• Reverse-engineering, copying or otherwise misusing the platform

Medivis is a general-purpose platform. It does not know, and does not assume, what industry a Business operates in — and it makes no representation that the Service, on its own, satisfies the requirements of any particular regulator.

Where a Business operates in a licensed or regulated sector, the obligations of that sector rest with the Business. Medivis processes data on the Business's instructions; it does not assume the Business's regulatory position. This includes, without limitation:

• Healthcare — Ministry of Health (MOH) requirements, the Private Healthcare Facilities and Services Act 1998, professional confidentiality obligations, and any duty attaching to a clinical record
• Financial services — Bank Negara Malaysia requirements, including those on outsourcing, technology risk management and data residency, and any obligation of banking secrecy
• Any other regulated sector — the licensing, record-keeping, disclosure and supervision requirements that apply to it

A Business in such a sector should satisfy itself, before and during use, that the way it uses the Service meets its own regulator's requirements. Where a regulator requires a specific contractual arrangement with a service provider, that arrangement must be agreed separately with Medivis in writing; these Terms alone do not create it.

Medivis is billed manually. A Business is invoiced a one-off setup fee plus a monthly fee per Workspace, billed twelve months in advance. Current rates are quoted at the point of sale and restated on every invoice; a negotiated rate stays with the Business and is not changed by a later change to the platform default.

• Invoices are issued by Medivis and settled by bank transfer. No card is stored.
• Adding a Workspace mid-term is charged for the remaining months of the term. Removing one does not generate a refund; it reduces the next renewal instead.
• When a term ends unpaid, the account enters a grace period. After it, access is locked — but nothing is deleted, WhatsApp messages continue to be received, and the Business keeps access to its billing page.

• Target uptime: 99.5%
• Scheduled maintenance: Sunday mornings (MYT), with advance notice
• Support: by email during Malaysian business hours

We aim for high availability but do not guarantee uninterrupted service. Downtime from scheduled maintenance, force majeure, or a third-party outage — including WhatsApp itself — is excluded from uptime calculations.

• The Business is the data controller for all End User data in its Workspaces
• The Business is responsible for obtaining the consent its own sector and circumstances require
• The Business bears full responsibility for the decisions it makes using the Service. Medivis is not a medical device, not a financial adviser, and holds no clinical record.
• The Business must comply with applicable law, including the Personal Data Protection Act 2010 (Act 709) and any sector requirements described under Regulated Industries above
• The Business is responsible for the content it supplies — the FAQ, the price list and the business information its AI agent answers from. The agent quotes what the Business has written and adds no facts of its own.

• Maintain platform availability and security
• Keep each Business's data isolated from every other Business, and each Workspace's from every other Workspace
• Encrypt credentials at rest and enforce access controls
• Perform regular, encrypted backups
• Notify the Business of a data breach within the timeframe required by law
• Process Personal Data only on the Business's instructions and for the purpose of providing the Service

Either party may terminate with 30 days' written notice. We may suspend access immediately if:

• You breach these Terms
• Your use of the Service violates applicable law
• An invoice remains unpaid beyond its grace period

On termination, the Business's data is exported and made available for download. It is securely deleted 90 days later.

To the maximum extent permitted by Malaysian law, Medivis shall not be liable for:

• Indirect, incidental or consequential damages
• Loss of profits, data or business opportunity
• Damages arising from decisions made by the Business, including clinical, financial or commercial decisions

Our total liability shall not exceed the fees paid by the Business in the 12 months preceding the claim.

The Business agrees to indemnify and hold Medivis harmless from any claim, damage or expense arising from:

• Use of the Service in violation of these Terms
• Violation of applicable law by the Business
• Decisions or actions taken by the Business, including those in a regulated sector

These Terms shall be governed by and construed in accordance with the laws of Malaysia.

Disputes shall first be addressed through amicable negotiation. Failing that, they shall be resolved in the courts of Malaysia or through arbitration as agreed by both parties.