Terms of Service

1. The Service

SurgyCRM is a customer relationship and operations platform for hospitals, clinics and other healthcare organisations. It helps Customer staff manage enquiries and leads, patient journeys, follow-ups, feedback tickets, field sales visits and related communications. Each Customer works in its own isolated workspace.

The specific modules, user limits and fees for a Customer are set out in its order form or commercial agreement with Surgy (the "Order"). If an Order conflicts with these Terms, the Order prevails for that Customer.

2. Accounts and access

• The Customer decides who in its organisation receives a SurgyCRM account and with what role. The Customer's administrators are responsible for adding and removing users promptly.
• Users must keep their login credentials confidential and must not share accounts.
• The Customer is responsible for all activity under its workspace and must tell us promptly at info@surgyy.com if it suspects unauthorised access.

3. Customer data

• Ownership. The Customer owns all data it enters into, imports into, or receives through the Service, including lead, patient and staff information ("Customer Data").
• Our role. We process Customer Data only on the Customer's behalf and instructions, to provide, secure and support the Service, as described in our Privacy Policy. We do not sell Customer Data.
• Customer responsibilities. The Customer is responsible for having a lawful basis and any required notices and consents for the personal data it collects and processes through the Service, including under the Digital Personal Data Protection Act, 2023 (India) and any other law that applies to it.
• Isolation. Customer Data is kept logically separate per workspace. One Customer's data is never visible to another Customer.

4. Third-party integrations, including Meta

The Service can connect to third-party services that the Customer chooses to enable, such as Meta (Facebook and Instagram) Lead Ads and the Meta Conversions API, WhatsApp Business messaging, telephony and AI providers ("Integrations").

• An Integration is enabled only when an authorised Customer administrator connects it. The Customer can disconnect it at any time from SurgyCRM settings or from the third party's own settings.
• When the Customer connects a Facebook Page, SurgyCRM receives that Page's lead form submissions and related campaign details only for the Pages the Customer's administrator approved, and uses them only inside that Customer's workspace.
• The Customer remains responsible for complying with the third party's terms and policies that apply to it, including Meta's Advertising Policies, Lead Ads terms and Business Tools Terms. In particular, the Customer must not use lead forms or events to collect or send information that those policies prohibit.
• Third-party services are provided by those third parties, not by Surgy. We are not responsible for their availability, changes or decisions, though we will make reasonable efforts to keep our Integrations working.

5. Acceptable use

The Customer and its users must not:

• use the Service in breach of any law, including data protection, medical confidentiality, telemarketing and anti-spam laws;
• send unsolicited or misleading communications to leads or patients through the Service;
• attempt to access another Customer's data, probe or bypass the Service's security, or interfere with its operation;
• reverse-engineer, resell or sublicense the Service except as allowed in the Order;
• upload malicious code or content that infringes someone else's rights.

6. Security

We use reasonable technical and organisational measures to protect Customer Data, including encrypted connections, encryption at rest for third-party credentials, workspace-level access controls, and audit logs of sensitive actions. No system is perfectly secure; we will notify the Customer without undue delay if we become aware of a security incident affecting its Customer Data.

7. Fees

Fees, billing periods and payment terms are set out in the Customer's Order. Unless the Order says otherwise, fees are exclusive of taxes, which the Customer will pay as applicable.

8. Suspension

We may suspend access to the Service, or to a specific Integration, if it is reasonably necessary to prevent harm to the Service, other Customers or third parties, to comply with law, or if fees remain unpaid after notice. We will give notice where reasonably possible and restore access once the issue is resolved.

9. Term, termination and data return

• These Terms apply for as long as the Customer uses the Service or as set out in its Order.
• Either party may terminate as provided in the Order, or immediately on written notice if the other party materially breaches these Terms and does not cure the breach within 30 days.
• On termination, the Customer may request an export of its Customer Data within 30 days. After that period, we delete Customer Data from the Service, except where we must keep it longer to comply with law. Backups are overwritten on our normal backup cycle.
• Connected Integrations, including Meta Page connections, are disconnected when a workspace is closed.

10. Confidentiality

Each party will keep the other's non-public information confidential, use it only for the purposes of the relationship, and protect it with at least reasonable care. This does not apply to information that is public through no fault of the receiving party, already known to it, or independently developed.

11. Warranties and disclaimers

We will provide the Service with reasonable skill and care. Except as expressly stated in these Terms or the Order, the Service is provided "as is" and we disclaim all other warranties to the extent permitted by law. SurgyCRM is an administrative and communication tool; it does not provide medical advice, diagnosis or treatment, and clinical decisions remain the Customer's responsibility.

12. Limitation of liability

To the extent permitted by law, neither party is liable for indirect, incidental, special or consequential damages, or for loss of profits, revenue or goodwill. Each party's total liability arising out of these Terms is limited to the fees paid or payable by the Customer to Surgy in the 12 months before the event giving rise to the claim. These limits do not apply to a party's fraud, wilful misconduct, or obligations that cannot be limited by law.

13. Changes to these Terms

We may update these Terms as the Service changes. We will give Customers at least 30 days' notice of material changes by email or in the Service. Continued use after the effective date means the Customer accepts the updated Terms.

14. Governing law

These Terms are governed by the laws of India. The courts at Bengaluru, Karnataka have exclusive jurisdiction, unless the Customer's Order specifies otherwise.

15. Grievances

Concerns about personal data in SurgyCRM can be raised with our grievance officer, Mohammed Jamil Nasir (Founder, Product & Technology), at nasir@surgyy.com or +91 76193 13365. See the Privacy Policy for response times.

16. Contact