HEMASYNC LEGAL
1. Introduction & Definitions — These Terms & Conditions govern use of the “HemaSync” platform, owned by Hema Blood Infrastructure Company (“Company”/“HemaSync”/“Platform”), and constitute the master contractual document governing the legal relationship between HemaSync and all its users — patients, laboratories, hospitals, insurance companies, and any other party dealing with the Platform. Definitions: “User” includes any individual or entity using the Platform in any capacity. “Founding Partner” means laboratories, hospitals, and healthcare facilities integrated with the Platform. “Data” means any personal or health data processed via the Platform per the Privacy Policy. “Derived Insights” means any analysis, model, or indicator produced by HemaSync’s systems from data processing.
2. Acceptance of Terms — User registration on, or any use of, the Platform constitutes explicit, binding agreement to these Terms and the associated Privacy Policy. If the User does not agree to any provision, they must refrain from using the Platform.
3. Service Description — HemaSync provides neutral infrastructure to consolidate a patient’s historical lab results from multiple sources (labs, hospitals, healthcare facilities) into a unified record, analyzes this data via AI to provide health indicators/insights, and enables insurance companies to detect duplicate-test patterns without revealing patient identity. HemaSync is not a healthcare provider and is not a substitute for existing medical facilities.
4. Eligibility & Registration — Individual users must be 18+ and fully legally competent to register directly. For minors, an account may only be created / data processed via the legal guardian, per the Privacy Policy’s controls.
5. Account Types — The Platform offers multiple account types with different permissions: Patient account (data owner), Lab/Hospital account (Founding Partner), and Insurance Company account (recipient of aggregated analytics). Each account type is subject to its own additional terms of use.
6. Patient Consent Mechanism for Data Sharing — No patient health data is shared with any party without HemaSync obtaining the patient’s explicit, detailed consent, which lets the patient specify exactly which party/parties may receive their data, per the mechanism described in the Privacy Policy.
7. Platform Obligations — HemaSync commits to operating the Platform with reasonable care, protecting user data per the Privacy Policy, not sharing data except under explicit consent or legal obligation, and dealing transparently with users about how their data is processed.
8. User Obligations — The User must provide accurate information at registration, not use the Platform for unlawful purposes, not attempt unauthorized access to other users’ data, and keep their login credentials confidential.
9. Founding Partner Obligations — Each Founding Partner (lab/hospital) must verify it has obtained the patient’s lawful consent before uploading data to the Platform, ensure the accuracy of uploaded data, and comply with PDPL and relevant SFDA regulations, per the acknowledgments in the Privacy Policy.
10. Facility KYC Verification Before Technical Access — Before granting any lab, hospital, or insurance company access to the Platform’s APIs or any direct technical integration, HemaSync conducts Know-Your-Business verification, including confirming a valid commercial registration, required health/regulatory licenses (e.g., SFDA license for healthcare facilities), and the authority of the person signing on the entity’s behalf. HemaSync may refuse or suspend access if these requirements aren’t met or a subsequent violation is discovered.
11. Intellectual Property — HemaSync owns all rights related to the Platform, its design, source code, trademark, and analytical models. No user may copy the Platform or any part of it, reverse-engineer it, or use the HemaSync trademark without prior written permission.
12. Ownership of the Derived Analytics Layer — Raw health data remains owned by the data owner (patient) at all times, and HemaSync may not use it beyond the scope of granted consent. In return, HemaSync owns the models, analyses, and Derived Insights resulting from its systems’ processing of the data, so long as such insights don’t reveal the data owner’s identity without their permission. No Founding Partner or analytics recipient may claim ownership of these insights or reuse them beyond the agreed purpose.
13. Revenue Model & Explicit No-Data-Sale Statement — HemaSync’s revenue model rests on providing aggregated, anonymized analytics services to recipients (e.g., duplicate-test detection for insurers) and integration/subscription fees from Founding Partners. HemaSync explicitly affirms it does not and will not sell identifiable data to any third party for commercial purposes in any form. Any commercial dealing in user data is limited to aggregated or anonymized form, consistent with data owners’ consents.
14. Data Portability — Patients may at any time request a complete copy of their data and health record stored with HemaSync in a readable, portable electronic format, for use with any other party of their choosing. HemaSync must fulfill this request within a reasonable period not exceeding what PDPL’s implementing regulations specify.
15. Technical Integration & APIs — HemaSync provides approved Founding Partners with APIs for integration with their internal systems. The Founding Partner is solely responsible for securing its technical environment and API keys, and bears sole responsibility for any breach or misuse arising from its failure to protect its own technical environment. HemaSync bears no responsibility for integration disruptions arising from changes the Founding Partner makes to its systems without prior coordination.
16. Medical Disclaimer — Content and analytics provided by the Platform, including AI-based analytics, are guidance-only information of a statistical nature and do not constitute medical diagnosis, medical advice, or a substitute for consulting a qualified physician. The User alone bears responsibility for any medical decision based on the Platform’s analytics, and HemaSync bears no responsibility for medical decisions made solely relying on the Platform’s analytics without consulting a qualified professional.
17. Limitation of Liability — HemaSync exercises necessary care in operating the Platform and protecting data, but bears no liability for indirect, consequential, or lost-profit damages arising from Platform use, to the narrowest extent permitted by law, without prejudice to the Company’s liability for fraud, gross negligence, or obligations imposed by PDPL in its capacity as data controller.
18. Indemnification — The User or Founding Partner must indemnify HemaSync for any claim, damage, or cost (including reasonable legal fees) arising from providing inaccurate information, unauthorized use of the Platform, or breach of these Terms, the Privacy Policy, or applicable law.
19. Confidentiality — All HemaSync personnel (employees and contractors) are bound by confidentiality agreements regarding any information they access while performing their duties. Any Founding Partner must likewise keep confidential any technical or commercial information accessed through its Platform integration, and not disclose it to any third party without HemaSync’s written permission.
20. Cyber Risk & Professional Liability Insurance — HemaSync maintains active insurance covering cyber incident risks and professional liability arising from operating the Platform and processing health data, commensurate with the scale of its operations and the type of data it processes.
21. Force Majeure — HemaSync bears no liability for any delay, interruption, or loss of data/service arising from events beyond its reasonable control, including natural disasters, national/regional power or telecom outages, cyberattacks targeting the storage provider’s infrastructure despite it meeting agreed security standards, or any disruption in government infrastructure not directly attributable to HemaSync’s fault.
22. No Uninterrupted-Service Guarantee — HemaSync strives to provide continuous, reliable service but does not guarantee uninterrupted or error-free operation at all times, given its partial reliance on third-party infrastructure and providers. No liability beyond what these Terms specify arises from any temporary service disruption caused by maintenance or a technical circumstance outside HemaSync’s direct control.
23. Contractual Liability Pass-Through to Service Providers & Right of Recourse — HemaSync enters a Data Processing Agreement with each storage/critical technical service provider, binding them to specified protection and security standards. If damage or data loss occurs due to that provider’s breach of its contractual obligations or failure to apply agreed protection standards, HemaSync retains full recourse against the at-fault provider to recover any compensation it paid the affected party — without prejudice to HemaSync’s original obligation to the data owner as Data Controller under PDPL.
24. Suspension or Termination of an Individual User Account — HemaSync may suspend, restrict, or terminate any individual user’s access if suspected of fraudulent activity, platform misuse, or breach of these Terms, pending verification, with notice to the user of the action taken unless doing so conflicts with legal requirements.
25. Termination or Rejection of an Institutional Partnership — HemaSync may, independent of any action regarding individual patient accounts, reject a Founding Partner’s application, or suspend/terminate its partnership agreement, if it breaches its legal or contractual obligations, is found to have provided false information during KYC verification (Section 10), or becomes subject to a regulatory action affecting its eligibility to handle health data. The Founding Partner will be notified in writing of the termination decision and its grounds, subject to any separate contractual obligations governing the relationship.
26. Assignment Upon Acquisition or Merger — HemaSync may assign these Terms and the rights/obligations under them to any party acquiring ownership of the Company or its business, whether via acquisition, merger, or full/partial asset sale, without needing prior consent from each individual user, provided the new party maintains the same level of protection set out in these Terms and the Privacy Policy.
27. Survival of Certain Provisions After Termination — Provisions relating to confidentiality, limitation of liability, indemnification, intellectual property, dispute resolution, and class-action waiver remain in effect and binding on both parties even after account closure, partnership termination, or end of the Platform relationship for any reason.
28. Class Action Waiver — The User acknowledges that any claim or dispute relating to them is to be brought individually, and may not be joined to any class or representative action against HemaSync, to the extent permitted by law.
29. Arbitration as the Primary Dispute Resolution Method — The parties must attempt to amicably resolve any dispute arising from these Terms or Platform use within a reasonable period. Failing that, the dispute is referred to the Saudi Center for Commercial Arbitration (SCCA), without prejudice to either party’s right to resort to courts where arbitration agreements aren’t permitted under applicable Saudi law.
30. Governing Law — These Terms are governed by and construed according to the laws of the Kingdom of Saudi Arabia, including PDPL and its implementing regulations, and relevant SFDA regulations.
31. Relationship With the Privacy Policy — These Terms and the Privacy Policy are to be read together as one integrated contractual document. In case of any apparent conflict regarding liability limits, arbitration, indemnification, IP, force majeure, or other foundational legal matters, these Terms & Conditions prevail as the master document.
32. Amendments to the Terms — HemaSync reserves the right to amend these Terms from time to time in line with regulatory developments or service evolution. Any material amendment is published on the Platform with an effective date, and continued use of the Platform after publication constitutes implied acceptance.
33. Notices, Communication & General Provisions — For any inquiry or notice related to these Terms, contact: support@hemasync.co. If any provision is found invalid or unenforceable, the remaining provisions remain valid and effective. These Terms, together with the Privacy Policy, constitute the entire agreement between HemaSync and the User regarding Platform use, superseding any prior oral or written agreement or understanding between the parties on this subject.