Legal

Subscription Agreement

Effective 25 July 2026 · Last updated 26 July 2026

We may update this Agreement from time to time as described in the "Changes to this Agreement" terms below; the "Last updated" date above records the current version.

This Subscription Agreement (the "Agreement") is a binding contract between Vanta (Private) Limited, a private limited company incorporated in Pakistan ("Vanta", "we", "us", "our") and the organisation that accepts these terms or signs an Order Form referencing them (the "Customer", "you", "your"). It governs your access to and use of HealthEase, our clinic and hospital management software. Company registration particulars and our registered office address are available on request from info@healthease.app.

By creating an account, signing an Order Form, clicking to accept, or using the Service, you agree to this Agreement. The person accepting represents that they are authorised to bind the Customer. If you do not agree, do not use the Service.

Related documents incorporated by reference (each available at healthease.app/legal unless stated otherwise):

the Acceptable Use Policy ("AUP");
the Data Processing Agreement ("DPA") — executed with each Customer at onboarding;
the Product Privacy Policy — describing how patient and Customer data is processed in the Service;
the End User Licence Agreement ("EULA") — for the Windows, Android, and iOS applications;
the Free Trial & Promotional Offer Terms (the "Trial Offer Terms") — summarised in the free-trial terms below, with the full document at healthease.app/legal;
the Service & Medical Disclaimer;
the Refund & Cancellation Policy;
any Order Form or written quotation signed or confirmed by both parties.

If these documents conflict, the order of precedence is: Order Form → DPA (for data-protection matters) → this Agreement → AUP → EULA — except that, on data-protection matters, the DPA prevails over the Order Form unless the Order Form expressly amends the DPA. On questions of clinical responsibility, the Service & Medical Disclaimer prevails.

Definitions
The Service
Accounts and Users
Subscription and Free Trial
Fees, Billing and Taxes
Customer Obligations
Acceptable Use
Medical Disclaimer
Data Protection, Hosting and Sub-processors
Intellectual Property
Confidentiality
Warranties and Disclaimers
Limitation of Liability
Indemnity
Term, Termination and Data Return
Suspension
Force Majeure
Governing Law and Dispute Resolution
Changes to this Agreement
General

1. Definitions

"Agreement" — this Subscription Agreement together with the documents it incorporates.
"Authorised User" — an individual (e.g. an employee, doctor, or contractor of the Customer) whom the Customer authorises to use the Service under the Customer's account.
"Customer Data" — all data submitted to the Service by or for the Customer, including Patient Data.
"Documentation" — the user guides and help materials we make available for the Service.
"Order Form" — a written or electronic ordering document (including a countersigned quotation) agreed by both parties that specifies the modules, scale, fees, and any special terms.
"Patient Data" — Customer Data relating to identified or identifiable patients, including health information. Patient Data is a category of personal data for which the Customer is the data controller and Vanta is the data processor (see the data-protection terms below).
"Service" — the HealthEase hosted software service, including its web application, the Windows/Android/iOS applications, and any modules the Customer has subscribed to. The Service does not include Third-Party Services.
"Subscription Term" — the period of paid subscription stated in the Order Form, including renewals.
"Third-Party Services" — services not provided by Vanta that the Customer elects to use with the Service (for example a payment provider, SMS gateway, or the app stores through which the applications are distributed).

Headings are for convenience only. "Including" means "including without limitation".

2. The Service

2.1 Provision. During the Subscription Term (or the free trial), we will make the Service available to the Customer in accordance with this Agreement, the Documentation, and the Order Form. The Service is administrative and operational software for healthcare facilities: patient registration and records, queues and tokens, billing and receipts, pharmacy and inventory, wards, staff attendance, dashboards and reports, and related modules.

2.2 Modules and entitlements. The Service is modular. The Customer receives access only to the modules and usage scale stated in its Order Form or trial plan. We may technically enforce module entitlements and usage limits.

2.3 Updates. We may update and improve the Service from time to time, including security patches and new features. We will use commercially reasonable efforts not to materially degrade the core functionality of the modules the Customer has paid for during a Subscription Term, except where a change is required for security, legal, or regulatory reasons, is needed to address a material risk, or results from the withdrawal or change of a Third-Party Service beyond our reasonable control. Some updates to the installed applications may be required for continued use (see the EULA).

2.4 Support. We provide reasonable support via wecare@healthease.app and via any other channels stated on healthease.app. Any service-level commitments apply only if set out in an Order Form or a separate signed service-level agreement.

2.5 Offline operation. Parts of the Service are designed to keep working during internet outages by keeping a local working copy of data on the Customer's devices. The Customer is responsible for the physical and operating-system security of its devices (see the Customer obligations below and the DPA).

3. Accounts and Users

3.1 Account. The Customer must provide accurate, current registration information and keep it up to date.

3.2 Authorised Users. Only Authorised Users may use the Service. The Customer must ensure that:

each Authorised User has their own individual login — credentials must not be shared;
Authorised Users keep credentials confidential and use any required multi-factor authentication;
access rights assigned within the Service reflect each user's actual role and are removed promptly when a person leaves or changes role;
Authorised Users comply with this Agreement and the AUP.

3.3 Responsibility. The Customer is responsible for all activity under its account and its Authorised Users' logins, except to the extent caused by Vanta's breach of this Agreement. The Customer must notify us promptly at wecare@healthease.app of any suspected unauthorised access.

4. Subscription and Free Trial

4.1 Subscriptions. Paid subscriptions begin on the start date in the Order Form and continue for the Subscription Term. Unless the Order Form says otherwise, subscriptions renew for successive periods equal to the initial term unless either party gives notice of non-renewal at least thirty (30) days before the end of the then-current term.

4.2 Free trial (promotional offer terms). Where we offer a free trial (including under our free-trial flyer and QR-code promotion), the following terms apply:

Duration. The free trial runs for the trial period stated when you sign up, starting from activation of the trial account.
Patient cap. The trial is capped at 100 patients per calendar month. When the cap is reached in a given calendar month, registration of further new patients for that month is blocked until the account is upgraded to a paid subscription; existing patient records remain readable and already-registered patients can continue to be served.
No AI features. No AI features are included during the trial. AI capabilities are available only if separately agreed in advance and in writing with Vanta.
No payment card required. No payment card is required to start a trial; billing is arranged separately (see the fees and billing terms below).
One trial per organisation. Each organisation is eligible for one trial only.
After the trial. Continued use after the trial requires a paid subscription. If the account is not upgraded, it enters a read-only grace period and then locks — except that read access to patient records is never hard-locked (see the patient-safety read-access commitment below).
Changes to the offer. Vanta may modify, suspend, or withdraw the promotional offer at any time. Changes do not shorten a trial already activated.
Trial basis. Trial use is provided "AS IS", free of charge, for evaluation. Notwithstanding anything else in this Agreement, our total liability arising out of trial use is limited to the nominal fallback amount stated in the limitation of liability below — the fees (in PKR) for one (1) month of Vanta's lowest-priced generally available paid subscription plan — to the maximum extent permitted by applicable law and subject always to the liabilities that cannot lawfully be excluded or limited, as described in the limitation of liability below.

4.3 Beta features. We may offer optional beta or preview features, identified as such. They are provided "AS IS", may change or be withdrawn at any time, and should not be relied on for production operations.

5. Fees, Billing and Taxes

5.1 Fees. The Customer will pay the fees stated in the Order Form or agreed quotation. Fees are based on the selected modules, scale, and usage tier. Unless the Order Form states otherwise, fees are stated, invoiced, and payable in Pakistani Rupees (PKR).

5.2 Billing and payment collection. Fees may be collected in one or both of the following ways, as stated in the Order Form or otherwise agreed between the parties:

Online payment. We accept online card payments (for example, debit or credit card) processed on our behalf via the payment gateway of United Bank Limited ("UBL"), a licensed commercial bank in Pakistan acting as our payment processor and acquiring bank. Payment details submitted for online payment are collected and processed by UBL under its own PCI-DSS-compliant terms; Vanta does not receive or store full card numbers. Where the Customer opts into online payment, it authorises Vanta and UBL to charge the fees due to the Customer's selected payment method; where the Customer opts into recurring online payment, it further authorises charges to that payment method for the subscription fees due at each billing interval — including on renewal as described in the subscription terms above — until the subscription is cancelled or the authorisation is withdrawn in accordance with the Refund & Cancellation Policy. UBL acts as a permitted sub-processor as described in the sub-processor terms below and in the DPA, where it is named as a sub-processor for online payment processing.
Invoice billing. We may issue invoices (electronically), payable by bank transfer or another mutually agreed method.

Refunds and cancellations — including refund eligibility, the method and timeframe of refunds, and how to request one — are governed by the Refund & Cancellation Policy at healthease.app/legal. No payment card is required for the free trial (as stated in the free-trial terms above).

5.3 Payment terms. Unless the Order Form says otherwise, invoices are payable within thirty (30) days of the invoice date, and online payments are due at the time of purchase or at the start of each billing interval. Amounts payable are non-refundable except where this Agreement or the Refund & Cancellation Policy expressly says otherwise or applicable law requires a refund.

5.4 Late payment. If undisputed fees are overdue, we may (a) charge late-payment interest at the rate stated in the Order Form or, if none is stated, a reasonable rate not exceeding the maximum permitted by applicable law, and/or (b) suspend the Service as described in the suspension terms below after at least fourteen (14) days' written notice of non-payment.

5.5 Taxes. Fees are exclusive of taxes. The Customer is responsible for all applicable taxes, duties, and withholdings on its purchases (other than taxes on Vanta's income). If the Customer is required to withhold, the parties will cooperate in good faith on documentation.

5.6 Fee changes. We may change fees on renewal by giving notice at least thirty (30) days before the renewal date. Fee changes never apply retroactively within a paid term.

6. Customer Obligations

The Customer acknowledges and agrees that, as between the parties, the Customer is responsible for:

Lawful basis and consent. Establishing and maintaining the lawful basis for processing Patient Data, including obtaining and recording any patient (or guardian) consents required by law — the Service provides consent-capture tooling, but the legal responsibility for obtaining valid consent rests with the Customer as data controller;
Data accuracy. The accuracy, quality, and legality of the Customer Data it and its Authorised Users enter into the Service;
Clinical and business decisions. All clinical, professional, and business decisions made using the Service (see the medical disclaimer below);
User management. Managing its Authorised Users as described in the accounts-and-users terms above, including prompt deactivation of departed staff;
Regulatory compliance. Its own compliance with the laws and regulations that apply to it as a healthcare provider — including licensing, medical-record-keeping, retention, confidentiality, and pharmacy/drug regulations in its jurisdiction;
Devices and premises. The security of the devices, networks, and premises from which the Service is accessed, including screen-lock policies, operating-system encryption where available, and the physical handling of printed outputs (tokens, receipts, prescriptions);
Backups of exports. Safekeeping of any data exports it downloads from the Service.

7. Acceptable Use

Use of the Service is subject to the Acceptable Use Policy, which is incorporated into this Agreement. Material or repeated breach of the AUP is a material breach of this Agreement and may lead to suspension or termination, each as described later in these terms.

8. Medical Disclaimer

IMPORTANT — PLEASE READ.

HealthEase is administrative and management software for healthcare facilities. It is NOT a medical device, and it does NOT provide medical advice, diagnosis, treatment recommendations, or clinical decision-making. Any information presented by the Service (including records, summaries, reports, alerts, or any AI-assisted output where separately enabled) is for administrative and informational purposes only.

Qualified clinicians remain solely responsible for all diagnosis, treatment, prescribing, and patient care. The Customer must ensure its clinical staff exercise independent professional judgment and do not rely on the Service as a substitute for that judgment. To the maximum extent permitted by applicable law, and subject always to the liabilities that cannot lawfully be excluded or limited (as described in the limitation of liability below), Vanta is not liable for clinical outcomes.

9. Data Protection, Hosting and Sub-processors

9.1 Roles. For Patient Data and other personal data processed in the Service on the Customer's behalf, the Customer is the data controller and Vanta is the data processor, acting on the Customer's documented instructions as set out in the DPA. (For visitor and lead data on our marketing website, Vanta is the controller — see the website privacy policy at healthease.app.)

9.2 DPA. The parties will execute the DPA at or before onboarding. The DPA governs the details of processing: subject matter, duration, security measures, sub-processing, assistance with data-subject rights, breach notification (Vanta notifies affected customers without undue delay and within seventy-two (72) hours of confirming a personal-data breach affecting their data), audit rights, and deletion/return on termination. If the Customer requires a HIPAA-style Business Associate–equivalent annex, one is available on request.

9.3 Hosting and data location. The Service is hosted with a reputable international cloud hosting provider, acting as our hosting sub-processor and operating under appropriate data-protection safeguards. The primary data region is Asia-Pacific (Singapore). The hosting region is customer-selectable where we offer a choice; patient data is not stored in India or the Middle East. Any disaster-recovery copies are encrypted and stored only in regions consistent with this commitment. We will give notice as described in the DPA before any change to the storage region applicable to the Customer.

9.4 Data subject rights. The Service includes tooling to help the Customer respond to patient requests — access/copy (human-readable and machine-readable export), rectification, erasure (subject to legal retention floors), portability, and an accounting of disclosures. Patients exercise their rights through the Customer as controller; Vanta assists within the SLAs stated in the DPA. These provisions are written to accommodate rights of the kind granted under the EU/UK GDPR, Singapore PDPA, and similar laws where they apply to the Customer.

9.5 Sub-processors. We use a limited set of sub-processors: our cloud hosting provider (hosting, storage, and compute — Singapore, as described in the hosting terms above), an email/SMS delivery provider (account and notification messages), United Bank Limited (UBL) (online payment processing / card acquiring, Pakistan — only if and when online billing is enabled, as described in the billing terms above), and error-monitoring/analytics tooling operating on non-clinical operational data. The current sub-processor list is available on request from info@healthease.app and at healthease.app/legal. The DPA sets out the notification and objection mechanism for sub-processor changes.

9.6 Security. We take reasonable administrative, technical, and organisational measures to protect Customer Data, as described in the DPA's security annex. We design our security program with reference to recognised frameworks such as ISO/IEC 27001 and SOC 2, and we do not currently hold, or claim, certification against those standards. However, no method of transmission or storage is completely secure, and — to the maximum extent permitted by applicable law and subject always to the liabilities that cannot lawfully be excluded or limited (as described in the limitation of liability below) — we do not warrant or guarantee absolute security or that the Service or Customer Data will be free from unauthorised access, loss, or alteration.

9.7 AI features. AI features (where offered) are optional, separately agreed, and subject to additional terms, including the patient-consent and data-handling controls described in the Product Privacy Policy and DPA. AI features are never enabled during a free trial (as stated in the free-trial terms above).

9.8 Aggregated data. We may use data that is aggregated and de-identified such that neither the Customer nor any patient can be identified, for purposes of operating, securing, benchmarking, and improving the Service, in accordance with the DPA.

10. Intellectual Property

10.1 Our IP. Vanta and its licensors own all rights in the Service, the applications, the Documentation, and all related intellectual property, including improvements and modifications. The Customer receives only the limited rights expressly granted in this Agreement and the EULA — no other rights are granted, by implication or otherwise.

10.2 Customer Data. As between the parties, the Customer owns the Customer Data. The Customer grants Vanta a non-exclusive licence to host, process, transmit, and display Customer Data solely to provide and support the Service, as instructed under the DPA, and as permitted by the aggregated-data terms above.

10.3 Feedback. If the Customer gives us feedback or suggestions, we may use them without restriction or obligation, provided we do not identify the Customer without consent.

10.4 Trademarks. "HealthEase" and associated logos are marks of Vanta. Neither party may use the other's name or marks publicly without prior written consent, except that Vanta may identify the Customer as a customer in factual lists with the Customer's consent (which may be given in the Order Form).

11. Confidentiality

11.1 Definition. "Confidential Information" is non-public information disclosed by one party to the other that is marked confidential or that a reasonable person would understand to be confidential — including Customer Data, security information, pricing, and the terms of an Order Form. It excludes information that is or becomes public without breach, was already lawfully known, is independently developed, or is lawfully received from a third party.

11.2 Obligations. The receiving party will (a) use the disclosing party's Confidential Information only to perform under this Agreement, (b) protect it with at least reasonable care, and (c) not disclose it except to personnel and contractors who need it and are bound by comparable confidentiality duties.

11.3 Compelled disclosure. A party may disclose Confidential Information where required by law or a valid order of a court or authority, provided it gives prompt notice to the other party where lawfully permitted and discloses only the minimum required. Vanta's handling of law-enforcement requests concerning Customer Data is further described in the DPA.

11.4 Duration. Confidentiality obligations survive termination for five (5) years; for Patient Data and trade secrets, they survive for as long as the information remains confidential or the law requires.

12. Warranties and Disclaimers

12.1 Mutual warranties. Each party warrants that it has the legal power to enter into this Agreement.

12.2 DISCLAIMER. EXCEPT AS EXPRESSLY STATED IN THIS AGREEMENT, AND TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW:

THE SERVICE, THE APPLICATIONS, AND THE DOCUMENTATION ARE PROVIDED "AS IS" AND "AS AVAILABLE";
VANTA DISCLAIMS ALL OTHER WARRANTIES AND CONDITIONS, EXPRESS, IMPLIED, OR STATUTORY, INCLUDING ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT;
VANTA DOES NOT WARRANT THAT THE SERVICE WILL BE UNINTERRUPTED, TIMELY, SECURE, OR ERROR-FREE, THAT DEFECTS WILL BE CORRECTED, OR THAT THE SERVICE WILL MEET THE CUSTOMER'S REQUIREMENTS;
NO ORAL OR WRITTEN INFORMATION OR ADVICE GIVEN BY VANTA CREATES A WARRANTY NOT EXPRESSLY STATED HERE.

12.3 Statutory rights. Some jurisdictions do not allow the exclusion of certain warranties or conditions, or the Customer may have non-waivable statutory rights. Nothing in these warranty disclaimers limits any warranty, condition, or right that cannot lawfully be excluded; in that case, the disclaimers above apply to the maximum extent the law allows.

13. LIMITATION OF LIABILITY

This limitation of liability is important. It allocates risk between the parties and is reflected in the pricing. Please read it carefully.

13.1 Excluded damages. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, NEITHER PARTY WILL BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, OR PUNITIVE DAMAGES, OR FOR ANY LOSS OF PROFITS, REVENUE, GOODWILL, BUSINESS OPPORTUNITY, OR DATA (OTHER THAN VANTA'S OBLIGATIONS UNDER THE DPA TO MAINTAIN THE SAFEGUARDS IT DESCRIBES), ARISING OUT OF OR RELATED TO THIS AGREEMENT, HOWEVER CAUSED AND UNDER ANY THEORY OF LIABILITY (CONTRACT, TORT INCLUDING NEGLIGENCE, STATUTE, OR OTHERWISE), EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

13.2 Specific exclusions. To the maximum extent permitted by applicable law, and subject always to the exceptions below (liabilities that cannot lawfully be excluded or limited), Vanta is not liable for loss or damage to the extent arising from:

the Customer's or its Authorised Users' misuse of the Service or breach of this Agreement or the AUP;
unauthorised access resulting from the Customer's or its users' handling of credentials or devices (e.g. shared logins, unrevoked departed-staff accounts, unsecured devices);
Customer Data content, including inaccurate or unlawful data entered by the Customer;
Third-Party Services and integrations the Customer elects to use;
clinical decisions and patient care (see the medical disclaimer above);
events of force majeure (as described later in these terms); or
use of the Service other than in accordance with the Documentation.

13.3 Aggregate cap. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, AND SUBJECT ALWAYS TO THE EXCEPTIONS BELOW (LIABILITIES THAT CANNOT LAWFULLY BE EXCLUDED OR LIMITED), VANTA'S TOTAL AGGREGATE LIABILITY ARISING OUT OF OR RELATED TO THIS AGREEMENT — WHETHER FOR ONE CLAIM OR MANY, AND ACROSS ALL CLAIMS IN AGGREGATE — WILL NOT EXCEED THE GREATER OF:

(a) THE TOTAL FEES ACTUALLY PAID BY THE CUSTOMER TO VANTA FOR THE SERVICE IN THE TWELVE (12) MONTHS IMMEDIATELY BEFORE THE FIRST EVENT GIVING RISE TO LIABILITY; OR

(b) A NOMINAL FALLBACK AMOUNT EQUAL TO THE FEES (IN PKR) FOR ONE (1) MONTH OF VANTA'S LOWEST-PRICED GENERALLY AVAILABLE PAID SUBSCRIPTION PLAN FOR THE SERVICE AS AT THE DATE OF THE FIRST EVENT GIVING RISE TO LIABILITY.

THIS CAP APPLIES PER CLAIM AND IN THE AGGREGATE, AND THE EXISTENCE OF MULTIPLE CLAIMS DOES NOT ENLARGE IT.

13.4 Basis of the bargain. Each party acknowledges that the warranty disclaimers and the limitations of liability in this Agreement are a fundamental basis of the bargain and that the fees reflect this allocation of risk.

13.5 Exceptions — nothing excluded that cannot be excluded. NOTHING IN THIS AGREEMENT EXCLUDES OR LIMITS EITHER PARTY'S LIABILITY FOR:

death or personal injury caused by its negligence;
fraud or fraudulent misrepresentation;
any liability under applicable data-protection or consumer-protection law that cannot lawfully be excluded or limited; or
any other liability that cannot be excluded or limited under applicable law.

Where applicable law permits limitation but not exclusion of a liability, that liability is limited to the maximum extent the law allows.

14. Indemnity

14.1 By the Customer. The Customer will defend, indemnify, and hold harmless Vanta and its officers, directors, and employees from and against third-party claims, and resulting damages, penalties, costs, and reasonable legal fees, to the extent arising from:

Customer Data, including any claim that Customer Data or the Customer's collection or use of it infringes rights or violates law (including a failure to obtain required patient consent);
the Customer's or its Authorised Users' use of the Service in breach of this Agreement, the AUP, or applicable law;
clinical or professional services provided by or on behalf of the Customer; or
Third-Party Services the Customer elects to connect to the Service.

14.2 By Vanta. Vanta will defend the Customer against a third-party claim that the Service, as provided by Vanta and used in accordance with this Agreement, infringes the claimant's intellectual-property rights, and will pay damages finally awarded or agreed in settlement. If such a claim arises or is likely, Vanta may (a) modify the Service to be non-infringing, (b) procure the right to continue use, or (c) terminate the affected subscription and refund prepaid unused fees. This defence-and-remedy obligation is Vanta's entire liability for IP infringement. It does not apply to claims arising from Customer Data, combinations with items not provided by Vanta, or use in breach of this Agreement.

14.3 Procedure. The indemnified party must give prompt notice of the claim, allow the indemnifying party sole control of the defence and settlement (provided any settlement fully releases the indemnified party without admission of fault by it), and give reasonable cooperation at the indemnifying party's expense.

15. Term, Termination and Data Return

15.1 Term. This Agreement starts when accepted and continues for as long as any trial or Subscription Term is active, unless terminated earlier as described in the termination terms below.

15.2 Termination for convenience. Either party may elect not to renew as described in the subscription terms above (by giving notice of non-renewal at least thirty (30) days before the end of the then-current term). Order Forms may provide additional termination rights.

15.3 Termination for cause. Either party may terminate this Agreement (or the affected Order Form) with immediate effect by written notice if the other party (a) materially breaches this Agreement and fails to cure within thirty (30) days of written notice (fourteen (14) days for non-payment), or (b) becomes insolvent, enters liquidation, or makes an arrangement with creditors.

15.4 Effect of termination. On expiry or termination: the Customer's access rights end (subject to the patient-safety read access and the data-export window described below); unpaid fees for the period up to termination become due; and each party returns or destroys the other's Confidential Information as the other reasonably instructs, subject to legal retention duties.

15.5 Patient-safety read access. Where an account lapses (trial expiry, non-payment, or non-renewal), access is restricted progressively: first to a read-only grace period, then to a locked state. Read access to already-created patient records is never hard-locked while the data remains on the platform — this is a patient-safety commitment. It does not extend the data-retention period described in the data return and deletion terms below and does not apply where the Customer has instructed deletion or where continued access would be unlawful.

15.6 Data return and deletion. After termination, the Customer has a sixty (60)-day window to export its Customer Data using the Service's export tooling (or to request an export). After that window, we delete Customer Data from the Service (including rendering backup copies unreadable through key destruction) and issue a deletion confirmation, except for minimal records we must retain for legal, tax, or audit purposes, which remain protected under this Agreement's confidentiality and security terms. Details are in the DPA.

15.7 Survival. The following survive termination: the definitions; the fees terms (as to accrued fees); the medical disclaimer; the data-protection terms (as applicable to retained data); intellectual property; confidentiality; warranties and disclaimers; the limitation of liability; indemnity; the effect-of-termination, patient-safety read-access, and data-return terms above, together with this survival provision; governing law and dispute resolution; and the general terms.

16. Suspension

16.1 Grounds. We may suspend the Service, wholly or partly, if in our reasonable judgment: (a) the Customer or an Authorised User materially breaches the AUP; (b) undisputed fees remain unpaid after the late-payment notice described in the fees terms above (at least fourteen (14) days' written notice of non-payment); (c) suspension is necessary to prevent or mitigate a security incident or harm to the Service, other customers, or data; or (d) suspension is required by law.

16.2 Manner. Where practicable we will give advance notice and suspend only to the extent and for the time reasonably necessary. We will restore the Service promptly when the ground for suspension is resolved. Suspension does not relieve the Customer of the obligation to pay fees for the affected period unless the suspension was caused by Vanta's error, and does not limit our termination rights. Consistent with the patient-safety read-access commitment above, suspension mechanisms are designed not to hard-lock read access to existing patient records except where required by law or security necessity.

17. Force Majeure

Neither party is liable for failure or delay in performance (other than payment obligations) caused by events beyond its reasonable control — including natural disasters, epidemics, war, terrorism, civil unrest, labour disputes, governmental action, power or telecommunications failures, denial-of-service or similar attacks, and failures of upstream infrastructure providers — provided the affected party uses reasonable efforts to mitigate. If a force-majeure event continues for more than sixty (60) days, either party may terminate the affected Order Form on notice, and Vanta will refund prepaid fees for the undelivered period.

18. Governing Law and Dispute Resolution

18.1 Governing law. This Agreement and any dispute arising out of or in connection with it are governed by the laws of the Islamic Republic of Pakistan, without regard to conflict-of-laws rules.

18.2 Forum. The courts at Islamabad, Pakistan have exclusive jurisdiction, and each party submits to that jurisdiction. An Order Form may specify an alternative dispute-resolution mechanism (such as arbitration) for a particular Customer; where it does, the Order Form prevails.

18.3 Mandatory local rights. If the Customer is located in a jurisdiction whose law grants it protections that cannot be waived by contract, nothing in this Agreement deprives the Customer of those protections.

18.4 Injunctive relief. Either party may seek interim or injunctive relief in any court of competent jurisdiction to protect its intellectual property or Confidential Information.

19. Changes to this Agreement

We may update this Agreement from time to time. For material changes we will give at least thirty (30) days' notice (by email to the account owner and/or in-product notice). Material changes take effect for an existing paid Subscription Term only on renewal, unless the change is required by law or applies to new features the Customer chooses to use. If the Customer objects to a material change required to take effect sooner, it may terminate the affected subscription and receive a pro-rata refund of prepaid unused fees. The "Last updated" date at the top records the current version.

20. General

Entire agreement. This Agreement (with the documents it incorporates and any Order Forms) is the entire agreement between the parties about the Service and supersedes all prior discussions. Terms on a Customer purchase order are void.
Assignment. Neither party may assign this Agreement without the other's consent, except that Vanta may assign it to an affiliate or in connection with a merger, reorganisation, or sale of substantially all assets, with notice to the Customer and provided data-protection commitments are preserved.
Notices. Legal notices to Vanta go to info@healthease.app and, where a postal notice is required, to our registered office address (available on request from that email address); notices to the Customer go to the account owner's email and any address in the Order Form. Notices are deemed given on confirmed delivery.
Severability. If a provision is held unenforceable, it will be enforced to the maximum extent permissible and the rest remains in effect.
Waiver. Failure to enforce a provision is not a waiver.
Independent contractors. The parties are independent contractors; no partnership, agency, or employment is created.
No third-party beneficiaries. Except as expressly stated (e.g. the persons indemnified under the indemnity terms above), there are no third-party beneficiaries.
Export and sanctions. Each party will comply with applicable export-control and sanctions laws.
Language. This Agreement is executed in English. Translations are for convenience; the English version controls.
Counterparts / electronic acceptance. Order Forms may be signed electronically or in counterparts; click-through acceptance is valid.

Contact. Vanta (Private) Limited — a company incorporated in Pakistan General, legal, and privacy enquiries: info@healthease.app Support and help requests: wecare@healthease.app Website: healthease.app · Legal documents: healthease.app/legal