Terms & Conditions

1. Definitions

• "Service" means Ostron HMIS, including its web application at hmis.ostron.in, any on-premise installation, mobile interfaces, APIs, modules (such as registration, OPD, IPD, nursing, OT, laboratory, radiology, blood bank, pharmacy, billing, insurance/TPA, MIS, HR/payroll and multi-branch), documentation, updates, and related implementation, training and support services.
• "Customer" or "you" means the hospital, nursing home, clinic, diagnostic centre or other health facility, or the individual practitioner, that subscribes to the Service, and includes its authorised representatives.
• "Authorised User" means an employee, doctor, nurse, technician, consultant or other person to whom the Customer grants login credentials.
• "Patient Data" means all personal data, health data and health records of patients entered into, generated in, or fetched through the Service.
• "Customer Data" means Patient Data and all other data the Customer or its Authorised Users enter into the Service (including staff, financial, inventory and operational data).
• "ABDM" means the Ayushman Bharat Digital Mission administered by the National Health Authority ("NHA"), Government of India; "ABHA" means the Ayushman Bharat Health Account; and "HFR" and "HPR" mean the Health Facility Registry and the Healthcare Professionals Registry.
• "Order" means any quotation, proposal, order form, invoice or agreement accepted by the Customer that sets out the package, modules, number of users, hosting model and fees.
• "Applicable Law" includes the Information Technology Act, 2000 and rules thereunder, the Digital Personal Data Protection Act, 2023 ("DPDP Act") and rules thereunder, ABDM policies (including the Health Data Management Policy), the Clinical Establishments (Registration and Regulation) Act, 2010 or corresponding State laws, the Drugs and Cosmetics Act, 1940, the Narcotic Drugs and Psychotropic Substances Act, 1985, National Medical Commission regulations, the PCPNDT Act, 1994, and GST laws, each as amended.

2. Eligibility & account

1. The Service is intended for use by healthcare establishments and registered healthcare professionals in India and their staff. It is not a consumer service for patients.
2. The person accepting these Terms on behalf of a Customer represents that they are at least 18 years of age and have authority to bind the Customer.
3. The Customer must provide accurate registration details and keep them updated, including facility registration, HFR ID (where ABDM features are used), GSTIN and contact information.
4. Access uses role-based permissions and OTP sign-in on registered mobile numbers. The Customer is responsible for creating, assigning, reviewing and promptly revoking Authorised User access (for example, when staff leave), and for all actions performed under its accounts.
5. Credentials and OTPs must not be shared. The Customer must notify us immediately at admin@ostron.in or on +91 63932 90670 on becoming aware of any unauthorised access or security incident.

3. The Service

1. We grant the Customer a limited, non-exclusive, non-transferable, non-sublicensable right, during the subscription term and subject to payment of fees, to access and use the Service for its internal healthcare and administrative operations, within the package, modules and user limits in the Order.
2. The Service is offered in packages (such as Clinic, Nursing Home and Bedded Hospital) and optional add-ons. Features in each package are as described on our website or in the Order at the time of subscription. Where the Order and the website differ, the Order prevails.
3. The Service may be provided on our hosted cloud or installed on a server controlled by the Customer ("on-premise"). Some obligations in these Terms (such as hosting, uptime and backups) apply differently depending on the model chosen, as set out in Section 9.
4. We may improve, modify or discontinue features, provided we do not materially reduce the core functionality of the package paid for during a paid term without reasonable notice.

4. ABDM integration

1. Ostron HMIS has cleared functional testing for ABDM Milestones M1 (ABHA creation and verification), M2 (linking health records to ABHA) and M3 (fetching health records with patient consent), as evidenced by Certificate No. ATPL/FT-CERT/2609/160 issued on 16 September 2026 by Avasure Technologies Pvt. Ltd., a CERT-In empanelled organisation. Availability of each milestone depends on the Customer's package.
2. To use ABDM features, the Customer must hold a valid HFR registration and, where required, ensure that its doctors are registered on the HPR, and must comply with ABDM policies, guidelines, technical standards and consent requirements issued by NHA from time to time.
3. ABHA creation or verification, record linking and record fetching take place only with the patient's knowledge and consent obtained through ABDM-prescribed flows (such as Aadhaar/mobile OTP or ABHA QR scanning, and consent requests approved by the patient). The Customer shall not create, link or fetch records without such consent, and shall not deny treatment to a patient for not having or not sharing an ABHA.
4. ABDM services (including gateways, the ABHA system, consent manager and registries) are operated by NHA and other third parties. We do not control and are not responsible for their availability, accuracy, policy changes or outages. We will make reasonable efforts to keep the Service compatible with ABDM changes as they are notified.
5. ABDM certification relates to the functional compliance of the software at the time of testing. It is not an endorsement by NHA or the Government of India of Ostron, the Customer, or any clinical outcome.

5. Customer responsibilities

The Customer is solely responsible for:

• all clinical decisions, diagnoses, prescriptions, treatment and patient care, which must be made by qualified professionals exercising independent judgement;
• the accuracy, completeness and lawfulness of data entered into the Service, including patient demographics, clinical notes, drug and rate masters, tariffs and bills;
• obtaining all consents and giving all notices to patients and staff required under Applicable Law, including under the DPDP Act, for the collection and processing of their personal data;
• compliance with laws governing its establishment and practice, including medical record retention, prescription requirements, scheduled/narcotic drug registers, PCPNDT forms, biomedical and statutory reporting, GST invoicing, and insurance/PM-JAY scheme rules;
• reviewing and verifying reports, discharge summaries, invoices and claim files generated by the Service before signing, issuing or submitting them;
• maintaining suitable computers, printers, internet connectivity, browsers and, for on-premise deployments, server hardware, operating system, power backup, physical security and antivirus; and
• training new staff and ensuring Authorised Users comply with these Terms.

6. Acceptable use

You shall not, and shall ensure Authorised Users do not:

• use the Service for any unlawful purpose, including sex determination of a foetus or any purpose prohibited under the PCPNDT Act;
• access or attempt to access data of any patient without a legitimate treatment, operational or legal purpose;
• upload malware, or probe, scan, penetration-test or attempt to breach the Service's security without our prior written permission;
• copy, modify, reverse engineer, decompile, frame, resell, sublicense or create derivative works of the Service, except as permitted by law;
• use automated tools to scrape or overload the Service, or circumvent user, module or usage limits;
• impersonate any person, or enter false patient, ABHA, HFR or HPR information; or
• use the Service to host or transmit content that is obscene, defamatory, infringing, or otherwise prohibited under Rule 3 of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021.

7. Data ownership & protection

1. Ownership. As between the parties, the Customer owns all Customer Data. Patients retain their rights in their health data under Applicable Law and ABDM policy.
2. Roles. For Patient Data and other Customer Data, the Customer acts as the Data Fiduciary and Ostron acts as a Data Processor, processing such data only on the Customer's documented instructions and to provide, secure, support and improve the Service. For our website visitors and Customer contact and billing information, Ostron acts as a Data Fiduciary. Details are in our Privacy Policy.
3. Security. We implement reasonable security practices and procedures, including encryption in transit (HTTPS/TLS), role-based access control, OTP authentication, audit logs of changes, scheduled backups and periodic security audits. hmis.ostron.in has been audited by a CERT-In empanelled organisation and certified "Safe to Host" (Certificate No. ATPL/SEC-CERT/2609/160, valid 16 September 2026 to 15 September 2027).
4. No sale of data. We will not sell Patient Data, and will not use it for advertising or share it with third parties except as needed to deliver the Service (for example, ABDM gateways, hosting providers or SMS/OTP providers under confidentiality obligations), as instructed by the Customer, or as required by law.
5. Aggregated data. We may generate de-identified, aggregated statistics about use of the Service (such as feature usage and performance metrics) that do not identify any patient, Authorised User or Customer, and use them to operate and improve the Service.
6. Incidents. We will notify the Customer without undue delay on becoming aware of a personal data breach affecting Customer Data, provide reasonable information and assistance, and report to CERT-In and other authorities as required by law.
7. Data localisation. For cloud deployments, Customer Data is stored on servers located in India.
8. Export and return. During the term, and for 30 days after termination, the Customer may request an export of its Customer Data in a commonly used format (such as Excel/CSV/PDF). After that period we may delete Customer Data from active systems, subject to backup cycles and any retention required by law.

8. Fees, billing & taxes

1. Fees for the package, add-ons, users, implementation, data migration, integrations, hardware and on-site visits are as set out in the Order. Fees are exclusive of GST and other applicable taxes, which are payable by the Customer.
2. Subscription fees are payable in advance for the billing cycle in the Order (monthly, quarterly or annually), within [7] days of the invoice date unless the Order states otherwise.
3. If payment is overdue by more than [15] days, we may, after written notice by email or WhatsApp, restrict the Service to read-only access or suspend it until dues are cleared. We will not delete Customer Data merely because of non-payment during the notice and export periods set out in Section 17.
4. Fees paid are non-refundable, except where we terminate for convenience or where required by law, in which case unused prepaid subscription fees will be refunded on a pro-rata basis.
5. We may revise fees at renewal with at least 30 days' prior notice.

9. Hosting, uptime & backups

1. Cloud. We will use commercially reasonable efforts to make the cloud Service available 24×7, excluding scheduled maintenance (normally announced in advance and carried out outside peak hours), emergency security maintenance, and events beyond our reasonable control. Any specific uptime commitment or service credits apply only if stated in the Order.
2. Backups (cloud). We take scheduled automatic backups of Customer Data and will use reasonable efforts to restore it following data loss attributable to our systems.
3. On-premise. For on-premise deployments, the Customer is responsible for the server, network, power, physical and operating-system security, and for running and securely storing backups, unless the Order includes backup management by us. We are not liable for data loss caused by Customer hardware failure, local malware, unauthorised physical access or failure to maintain backups.
4. Internet connectivity at the Customer's premises is outside our control. Customers who require continuity during internet outages should consider the on-premise model.

10. Support, training & updates

1. Phone and WhatsApp support is available Monday to Saturday, 9:00 AM to 8:00 PM IST, on +91 63932 90670. Issues that stop patient care are attended 24×7.
2. Onboarding, masters setup, data migration and role-wise training are provided as included in the package or Order. Additional training, on-site visits outside Lucknow and nearby districts, custom reports and customisations may be charged separately.
3. We provide updates, security patches and ABDM compatibility changes to the cloud Service automatically. For on-premise deployments, updates are provided remotely or on-site as agreed.
4. Support does not cover problems caused by Customer hardware, third-party software, unauthorised changes, misuse, or use contrary to documentation.
5. For data migration, the Customer is responsible for the accuracy and lawful source of data supplied to us and should verify migrated data before go-live.

11. Intellectual property

1. The Service, including its software, source and object code, databases (excluding Customer Data), design, screens, workflows, documentation, and the names and logos "Ostron" and "Ostron HMIS", are owned by or licensed to OSTRON Electronics Private Limited and are protected by Indian and international intellectual property laws. No rights are granted except those expressly stated in these Terms.
2. The Customer grants us a limited licence to host, process, back up and display Customer Data solely to provide the Service and as described in Section 7.
3. If you send us suggestions or feedback, we may use them without obligation to you.
4. The ABDM, NHA and Ayushman Bharat names and logos belong to their respective owners and are used only to indicate integration and certification.

12. Third-party services

The Service may interoperate with third-party services such as ABDM gateways, SMS/OTP and WhatsApp providers, payment gateways, email services, laboratory analysers, PACS, insurer/TPA portals and hosting providers. Your use of these may be subject to their own terms. We are not responsible for the availability, accuracy or acts of third-party services, but we select them with reasonable care and bind them to appropriate confidentiality and security obligations where they process Customer Data on our behalf.

13. Confidentiality

Each party shall keep confidential all non-public information received from the other (including Customer Data, pricing and the Service's non-public features) and use it only for the purposes of these Terms, except where disclosure is required by law or a competent authority, in which case the disclosing party will, where lawful, give prior notice. This obligation survives termination.

14. Warranties & disclaimers

1. We warrant that we will provide the Service with reasonable skill and care, and that the Service will perform materially as described in its documentation. If it does not, your remedy is for us to correct the non-conformity within a reasonable time or, if we cannot, for you to terminate the affected module and receive a pro-rata refund of prepaid fees for it.
2. Except as expressly stated, the Service is provided on an "as is" and "as available" basis. To the maximum extent permitted by law, we disclaim all other warranties, express or implied, including fitness for a particular purpose and uninterrupted or error-free operation.
3. The Service is a records, workflow and administrative tool. It is not a medical device and does not provide medical advice, diagnosis or treatment. Any alerts, reminders, reference ranges, dosage fields or templates are aids only and do not replace professional judgement. See our Disclaimer.

15. Limitation of liability

1. To the maximum extent permitted by law, neither party shall be liable for any indirect, incidental, special, consequential or punitive damages, or for loss of profits, revenue, goodwill or business opportunity, arising out of these Terms, even if advised of their possibility.
2. Ostron shall not be liable for any claim arising from clinical decisions, patient outcomes, medical negligence, billing or claim rejections, or regulatory non-compliance of the Customer or its Authorised Users.
3. Our total aggregate liability arising out of or relating to these Terms or the Service shall not exceed the fees actually paid by the Customer to us for the Service in the twelve (12) months immediately preceding the event giving rise to the claim.
4. These limitations do not apply to liability that cannot be limited under Applicable Law, or to a party's liability for fraud or wilful misconduct.

16. Indemnity

1. The Customer shall indemnify and hold harmless Ostron, its directors, employees and agents from claims, penalties and losses (including reasonable legal fees) arising from: (a) the Customer's clinical services or patient care; (b) Customer Data, including its collection without required consents; (c) breach of these Terms or Applicable Law by the Customer or its Authorised Users; or (d) unauthorised use of the Customer's accounts due to the Customer's failure to secure credentials.
2. Ostron shall indemnify the Customer against third-party claims that the Service, as provided by us, infringes an Indian patent, copyright or trademark, provided the Customer notifies us promptly and lets us control the defence. This does not apply to claims arising from Customer Data, customisations made on Customer specifications, or combination with items not supplied by us.

17. Term, suspension & termination

1. These Terms apply from the date you first access the Service and continue for the subscription term in the Order, renewing automatically for successive terms of the same length unless either party gives at least 30 days' written notice of non-renewal.
2. Either party may terminate on written notice if the other materially breaches these Terms and fails to cure the breach within 30 days of notice, or becomes insolvent.
3. We may suspend access immediately, in whole or part, if reasonably necessary to prevent a security threat, unlawful activity or harm to the Service or other customers, or if required by law or a competent authority. We will restore access as soon as the cause is resolved.
4. On termination, the Customer's right to use the Service ends, all outstanding fees become payable, and Section 7.8 (export and return) applies. Sections on data, fees owed, intellectual property, confidentiality, disclaimers, limitation of liability, indemnity and governing law survive termination.

18. Force majeure

Neither party is liable for delay or failure to perform (other than payment obligations) caused by events beyond its reasonable control, including natural disasters, epidemics, war, riots, government action, failure of ABDM or other government systems, power or telecom failures, internet disruptions, or cyber-attacks despite reasonable safeguards.

19. Governing law & disputes

1. These Terms are governed by the laws of India.
2. The parties shall first attempt to resolve any dispute amicably through the grievance mechanism in Section 21 and good-faith discussions for 30 days.
3. Unresolved disputes shall be referred to arbitration by a sole arbitrator appointed by mutual agreement under the Arbitration and Conciliation Act, 1996. The seat and venue of arbitration shall be Lucknow, Uttar Pradesh, and proceedings shall be in English.
4. Subject to the above, the courts at Lucknow, Uttar Pradesh shall have exclusive jurisdiction.

20. General

• Changes to these Terms. We may update these Terms from time to time. Material changes will be notified by email, in-app notice or on this page at least 15 days before they take effect. Continued use after the effective date constitutes acceptance.
• Entire agreement. These Terms, the Order and the Privacy Policy form the entire agreement on this subject. If a signed agreement between the Customer and Ostron conflicts with these Terms, the signed agreement prevails.
• Assignment. The Customer may not assign these Terms without our consent. We may assign them to an affiliate or successor on notice.
• Severability and waiver. If any provision is held invalid, the rest remains in force. Failure to enforce a provision is not a waiver.
• Notices. Notices may be sent by email to the addresses registered with us, which constitutes written notice under the Information Technology Act, 2000.
• Independent parties. Nothing in these Terms creates a partnership, agency or employment relationship.

21. Grievance redressal & contact

In accordance with the Information Technology Act, 2000 and rules made thereunder, and the DPDP Act, the Grievance Officer is:

We will acknowledge complaints within 24 hours and aim to resolve them within 15 days of receipt.