Pisgah Health — Terms of Service

1. Effective Date & Version

These Terms of Service (“Terms”) are effective as of 1 June 2026 (Version 1.0). They supersede all prior agreements, letters of intent, and pilot-study terms between Pisgah and the Subscriber relating to the Platform.

The version of the Terms accepted by a Subscriber is recorded at the time of account activation and is available in the Subscriber’s billing portal.

2. Definitions and Parties

In these Terms, the following words have the meanings set out below.

• Pisgah:[PLACEHOLDER: full registered company name and RC number, e.g. Pisgah Health Technologies Limited (RC 0000000)], a company incorporated under the laws of the Federal Republic of Nigeria.
• Platform:The Pisgah software-as-a-service application, APIs, mobile interfaces, and related infrastructure made available by Pisgah under these Terms.
• Subscriber:The hospital, clinic, diagnostic centre, or healthcare facility that has executed an Order Form or accepted these Terms on behalf of its organisation.
• Authorised User:Any individual (clinician, nurse, administrator, or other staff member) to whom the Subscriber grants access to the Platform.
• Patient:An individual whose personal and health data is processed on the Platform in connection with the Subscriber's clinical services.
• Patient Data:All personal data, health information, and clinical records relating to Patients that are input into, generated by, or stored on the Platform.
• Order Form:A written or electronic agreement (including a digital activation form) that incorporates these Terms and sets out subscription details, fees, and other commercial terms.
• DPA:The Data Processing Agreement entered into between Pisgah and the Subscriber, which is incorporated into these Terms by reference.
• NDPA:The Nigeria Data Protection Act 2023 and any regulations, guidelines, and codes of practice issued under it.

3. Service Description

Pisgah provides software infrastructure for clinical record management. It does not provide medical advice, does not employ clinicians, and is not a healthcare provider. All clinical decisions made using the Platform remain the professional responsibility of the licensed clinicians employed by the Subscriber.

The Platform currently includes, without limitation:

• Electronic health record management and patient registration
• Diagnostic order management and laboratory result routing
• Inpatient admission, ward, and bed management
• Clinical referral management across the Pisgah network
• Population health analytics and clinical insights reporting
• NHMIS-aligned regulatory reporting tools
• Role-based access control for clinical and administrative staff

Pisgah may update, extend, or discontinue features of the Platform on reasonable notice. Discontinuation of a material feature that the Subscriber relies on will be communicated at least 90 days in advance, or at the earliest practicable date where discontinuation is required by law or third-party constraint.

4. Subscriber Obligations

The Subscriber must:

• Ensure that all Authorised Users have been trained on the Platform before accessing Patient Data.
• Maintain accurate and up-to-date account information, including contact details for the Subscriber’s data protection contact.
• Obtain and document all consents required under the NDPA before enrolling Patients on the Platform.
• Comply at all times with the National Health Act 2014, the NDPA, the Medical and Dental Practitioners Act, and all other applicable Nigerian healthcare laws and regulations.
• Promptly notify Pisgah of any suspected security breach, data loss, or unauthorised access to the Platform involving the Subscriber’s account.
• Maintain current payment of all fees due under the Order Form.
• Not grant access to the Platform to persons who are not bona fide Authorised Users of the Subscriber’s organisation.

5. Authorised User and Patient Obligations

Authorised Users must access the Platform only for the clinical or administrative purposes for which their role permits, and only in relation to Patients under the care of the Subscriber.

Each Authorised User is personally responsible for maintaining the confidentiality of their login credentials. Shared credentials are prohibited. An Authorised User who suspects that their credentials have been compromised must notify the Subscriber’s administrator immediately.

Patient access to the Platform (via the patient-facing mini-app, if enabled) is governed by the patient-specific consent terms presented at registration. Patients may not circumvent access controls, attempt to access records of other patients, or use the Platform for any purpose other than managing their own health information.

6. Prohibited Uses

The following uses of the Platform are strictly prohibited. Any breach of this section is grounds for immediate suspension or termination of the Subscriber’s account:

• Accessing, copying, or exporting Patient Data outside the scope of the Subscriber’s own patient population without the data subject’s explicit consent.
• Attempting to reverse-engineer, decompile, or extract source code from the Platform.
• Introducing malicious code, automated bots, scraping tools, or denial-of-service attacks.
• Using the Platform to process data for a purpose other than providing clinical care or healthcare administration.
• Reselling, sublicensing, or otherwise making the Platform available to a third party without Pisgah’s written consent.
• Circumventing, disabling, or interfering with any security, authentication, or audit feature of the Platform.
• Using the Platform in any way that violates Nigerian law or the professional obligations of the Subscriber’s licensed clinicians.

7. Intellectual Property

All rights in the Platform — including software, algorithms, interfaces, documentation, and brand assets — remain the exclusive property of Pisgah. These Terms grant the Subscriber a limited, non-exclusive, non-transferable licence to access and use the Platform solely for the purposes described in the Order Form.

Patient Data belongs to the Subscriber and to the Patients as data subjects. Pisgah acquires no ownership interest in Patient Data by virtue of processing it.

De-identified, aggregated statistical insights derived from the Platform (population health trends, disease prevalence patterns) may be used by Pisgah for platform improvement and published research, provided: (a) the data is irreversibly de-identified before use; and (b) no individual patient or hospital is identifiable in any output.

Any feedback, suggestions, or enhancement requests that the Subscriber or its Authorised Users provide to Pisgah may be incorporated into the Platform without restriction or compensation. Pisgah will not attribute such feedback to the Subscriber in any publication without the Subscriber’s consent.

8. Data Processing

The Data Processing Agreement (“DPA”) is incorporated by reference and forms part of these Terms. In the event of conflict between the Terms and the DPA on any data processing matter, the DPA governs. Pisgah processes Patient Data as a Data Processor on behalf of each hospital subscriber (the Data Controller), acting solely on the Subscriber’s written instructions as required by the Nigeria Data Protection Act 2023 (“NDPA”), Section 29.

The DPA sets out, in particular:

• The subject-matter, duration, and nature of the processing
• The type of personal data and categories of data subjects
• Pisgah’s obligations and rights as Data Processor
• Sub-processor arrangements and transfer safeguards
• Security measures and breach notification obligations

The Subscriber, as Data Controller, is responsible for ensuring that its collection and use of Patient Data complies with the NDPA, including obtaining any required consent and honouring data subject rights requests.

9. Data Ownership and Export Rights

All Patient Data uploaded to or generated through the Platform belongs to the Subscriber and, ultimately, to the patients as data subjects.

On termination of the Subscriber’s agreement, Pisgah will:

1. Provide the Subscriber a complete export of all their data in machine-readable format within 30 days of the termination effective date.
2. Securely delete all copies of the Subscriber’s Patient Data within 90 days following export confirmation, except where retention is required by law.

Retention during this wind-down period is lawful under NDPA Section 24, with the 30-day export plus 90-day deletion schedule as the documented post-purpose retention period.

During the term of the agreement, the Subscriber may export its Patient Data at any time using the data export tools available in the Platform. Pisgah will not impose technical barriers to export or charge additional fees solely for data export.

10. Service Availability

Pisgah targets 99.5% monthly uptimefor the Platform, excluding scheduled maintenance, events outside Pisgah’s reasonable control, and any degradation attributable to the Subscriber’s own network or devices.

Scheduled maintenance windows will be communicated at least 48 hours in advance where practicable, and will be scheduled during low-usage periods. Emergency maintenance required to address a security threat may proceed without advance notice, with notification as soon as practicable after the event.

The Platform does not constitute life-critical or mission-critical medical device software. The Subscriber is responsible for maintaining offline or paper-based contingency procedures for clinical operations during any period of unavailability.

11. Fees, Payment, and Suspension

Fees are set out in the Order Form and are invoiced monthly (or on such other frequency as agreed). All fees are payable in Nigerian Naira (NGN) unless otherwise specified in the Order Form.

Invoices unpaid within 30 days of the invoice date will attract a late payment interest charge at the rate of 2% per month compounded monthly, or the maximum rate permitted by Nigerian law, whichever is lower.

If an invoice remains unpaid for more than 45 days, Pisgah may suspend the Subscriber’s access to the Platform. On suspension for non-payment, read-only access to historical patient records will be maintained to ensure Subscriber compliance with National Health Act 2014 Section 25 record-keeping obligations.

Suspension does not release the Subscriber from the obligation to pay outstanding fees. Full access will be restored within one business day of receipt of full payment.

12. Limitation of Liability

1. (a) No exclusion of mandatory liability. Nothing in these Terms excludes liability for: death or personal injury caused by negligence; fraud or fraudulent misrepresentation; or any liability that cannot be excluded by Nigerian law.
2. (b) Aggregate cap. Subject to (a), Pisgah’s total aggregate liability in any 12-month period is capped at the greater of: the total fees paid by the Subscriber in the preceding 12 months; or ₦500,000.
3. (c) Excluded losses. Neither party shall be liable for indirect, consequential, or punitive damages; loss of profit; loss of data (except as provided in the DPA); or business interruption.
4. (d) Clinical outcomes. Pisgah is not liable for any clinical outcome, misdiagnosis, or patient harm resulting from a clinician’s reliance on information displayed on the Platform. All clinical decisions are the professional responsibility of the licensed clinicians employed by the Subscriber.

13. Term, Termination, and Suspension

These Terms commence on the date the Subscriber activates their account (or signs an Order Form, whichever is earlier) and continue for the initial term set out in the Order Form. Unless either party gives at least 30 days’ written notice before the end of the then-current term, the agreement will automatically renew for successive one-year periods.

Either party may terminate the agreement immediately by written notice if:

• The other party commits a material breach that it fails to remedy within 30 days of written notice describing the breach; or
• The other party becomes insolvent, enters into any arrangement with creditors, or is subject to winding-up proceedings.

Pisgah may terminate immediately if the Subscriber violates Section 6 (Prohibited Uses) or if continued operation of the Subscriber’s account would expose Pisgah to material legal or regulatory risk.

On termination, the rights and obligations in Sections 7, 8, 9, 12, 14, 16, and this Section 13 survive.

14. Governing Law and Dispute Resolution

These Terms are governed by the laws of the Federal Republic of Nigeria. The parties submit to the non-exclusive jurisdiction of the courts of Lagos State for interim and injunctive relief.

All substantive disputes shall be referred first to good-faith negotiation (30 days), then to mediation (30 days), and if unresolved, to binding arbitration under the Rules of the Lagos Chamber of Commerce International Arbitration Centre (LACIAC), with Lagos as the seat of arbitration, under the Arbitration and Mediation Act 2023.

The language of any arbitration proceedings shall be English. The arbitral award shall be final and binding on both parties.

15. Force Majeure

Neither party will be liable for delay or failure to perform any obligation (other than a payment obligation) to the extent that such delay or failure is caused by a circumstance beyond that party’s reasonable control, including natural disasters, acts of government, national grid failures, internet backbone disruption, or declared public health emergencies.

A party seeking to rely on this clause must notify the other party promptly, describe the event and its expected duration, and use reasonable efforts to mitigate the impact. If a force majeure event continues for more than 60 consecutive days, either party may terminate the agreement on written notice without liability.

16. Confidentiality

Each party (“Receiving Party”) agrees to keep confidential all non-public information received from the other party (“Disclosing Party”) that is designated as confidential or that should reasonably be understood to be confidential given its nature and the circumstances of disclosure (“Confidential Information”).

Patient Data is the Subscriber’s Confidential Information and is additionally governed by the DPA and applicable data protection law.

The obligation of confidentiality does not apply to information that: (a) is or becomes publicly known through no breach of this Section; (b) was known to the Receiving Party before disclosure; (c) is independently developed without use of the Confidential Information; or (d) must be disclosed by law or court order (provided the Receiving Party gives reasonable advance notice to the Disclosing Party where permitted by law).

The confidentiality obligations in this Section survive termination of these Terms for a period of 5 years, except in relation to Patient Data, where the obligations are perpetual (unless the DPA specifies otherwise).

17. Amendments

Pisgah may amend these Terms at any time by publishing the updated version at pisgahhealth.ng/legal/terms and notifying Subscribers by email at least 30 days before the amended Terms take effect.

If a Subscriber does not accept the amended Terms, it may terminate the agreement by written notice before the effective date of the change, without penalty. Continued use of the Platform after the effective date constitutes acceptance of the amended Terms.

No variation to the commercial terms in an individual Order Form (pricing, committed volumes, custom SLAs) will take effect unless agreed in writing by both parties.