Terms of Service

1. The service

Medical Solutions lets clinics build custom patient record templates, manage patient records, appointments, prescriptions and price offers, capture signatures, attach files, and export records as PDFs, within a private, tenant-isolated workspace.

It also sends email to a clinic's patients on the clinic's instruction: appointment and check-up reminders, and announcements and other messages whose recipients and content the clinic chooses.

2. Accounts and eligibility

You must be at least 18 years old and authorized to act for the clinic you register.

You must provide accurate information when registering a clinic account and keep your login credentials confidential. Each clinic has a single login, shared by the people at your clinic you choose to give it to. The Service does not offer a separate account for each member of staff. The activity log records every action under the clinic login and shows it with the account holder's name, so it cannot show which person at your clinic actually acted. You are responsible for all activity that occurs under your account, including actions taken by anyone you share the login with. Share it only with staff who need access to patient records, change the password when one of them leaves, and notify us promptly if you suspect unauthorized access to your account.

On a computer that several people share, such as the one at reception, make sure it does not keep patient details for the next person: turn off the browser's saving of what is typed into forms (usually called Autofill), clear the form entries it has already saved, sign out at the end of the day, and where possible give each person their own user account on that computer.

3. Responsibility for patient data

As the clinic, you are the data controller for the patient records you create in the Service. You are responsible for having a lawful basis to collect and store that data, for its accuracy, and for obtaining any patient consent required by the laws that apply to your practice. We store and process that data on your instructions, as described in section 4.

Announcements can be addressed to patients chosen by template or treatment area, by doctor, by gender or by date of last visit. Choosing recipients that way for a promotional message uses information about their health and care for marketing, which needs each patient's consent to that use, and you are responsible for obtaining it before you send. Whatever you choose, the Service emails only patients recorded as having agreed to be contacted by email, and never a patient who has unsubscribed.

4. Data processing agreement

This section is the agreement under which we process personal data on your behalf, and it applies whenever you use the Service. You are the data controller for patient records; ADSH-2014 (NIPT L41804001A, registered address Tiranë, Njësia Administrative nr.6, Rruga 'Hamdi Pepa', Pallati i ri, kati përdhes, Njësi tregtare 2B, zona kadastrale 8240) is the data processor. If this section conflicts with the Privacy Policy, this section prevails.

Subject matter and duration: we store and process the patient records, appointments, documents and related data you enter, for as long as your account is open and for the period after it described below. Nature and purpose: storing, organizing and showing your records, producing your documents, sending email to your patients on your instruction (appointment and check-up reminders, and announcements and other messages whose recipients and content you choose), and automated security monitoring of the activity log that warns you of possible misuse of your account; nothing else. Categories of data subject: your patients, your staff, and the doctors you record. Types of data: identification and contact details, signatures, images and documents, appointment details, and health data, which is a special category.

• We process personal data only on your documented instructions. Using the Service as these Terms describe is such an instruction; anything beyond it is not, and we will tell you if we believe an instruction breaks the law.
• We do not use your data for any purpose of our own, including product research and statistics. Where we need sample records to build or test the Service, we use invented data, or data you have given us written permission to use for that.
• If the law requires us to process or disclose your data, for example on a court or prosecutor's order, we will first ask the authority to go to you as controller. If it cannot, we will tell you before we disclose anything, unless the law forbids it, and we will disclose only what the order covers. Before acting on any such request we check that it is genuine, through the authority's official contact details, and we keep a record of each request and of what, if anything, was disclosed.
• We give access to personal data only to people who have first committed in writing to keep it confidential, or who are under a legal duty of confidentiality, and only when they need it to run and support the Service. We keep a record of who holds access, when it was given and when it was removed, and we remove it as soon as someone no longer needs it.
• We keep appropriate technical and organizational measures, including encryption in transit and at rest, tenant isolation, hashed passwords, encrypted storage of secrets and personal ID numbers, and access logging: the activity log you can read in Settings records each time a patient record is opened, changed, exported or deleted, and each time one of our own maintenance scripts reads your clinic's records.
• We use these sub-processors to run the Service: Vercel (hosting, application functions and file storage), MongoDB Atlas (database), Resend (email delivery, including email to your patients), Google (the Gmail mailbox our addresses on medicalsolutions.al forward to, where we read support requests and replies to our emails), Cloudflare (the security check on the sign-in and other public forms, and our encrypted backup copies, stored in the European Union), ImprovMX (forwarding mail sent to our addresses on medicalsolutions.al to that mailbox), WhatsApp (Meta, for what you choose to send us there) and Anthropic (the AI assistant our team uses to build and maintain the Service). Our payment and fiscalization providers, POK and CONALTUS (Con-Finance), and Fixie, which relays our encrypted calls to Con-Finance from a fixed address, receive billing data only, never patient data. The complete list, with what each one receives, is in section 4 of our Privacy Policy. You give us general written authorization to use them. We will give at least 30 days' written notice before adding or replacing a sub-processor. You may object within that period on reasonable data protection grounds, and if we cannot accommodate the objection you may end this agreement without penalty. We bind every sub-processor by written terms imposing the same data protection obligations as this section. The exceptions are Google and Meta. The Gmail mailbox is a consumer Gmail account, not Google Workspace, and we use it under Google's own terms for Gmail. Our WhatsApp number runs on the WhatsApp app on a phone, and we use it under Meta's own terms for WhatsApp.
• We transfer personal data outside Albania only as part of these documented instructions, to the sub-processors listed in our Privacy Policy and under the safeguards the law requires, which the Privacy Policy describes. A new processing location is notified in the same way as a new sub-processor.
• We assist you in responding to patient requests to access, correct, export or erase their data, and with data protection impact assessments where you need one.
• We notify you immediately, and in any case within 24 hours, after becoming aware of a personal data breach affecting your data, with the detail you need to notify the Commissioner and, where required, your patients.
• You can download all of your clinic's data yourself, with one button, at any time, including after your paid period ends. When this agreement ends, at your choice we return your data (through that download, with our help if you need it) and delete it: when you ask us to close your account, the dashboard is locked, your records stay available for export for 30 days in case the request was a mistake, and then we erase them, except billing records the law requires us to keep. Backup copies are deleted on their own schedule: the encrypted copies of the database after 35 days, and the copies of your uploaded files within 60 days of the erasure.
• We make available the information needed to show these obligations are met, and allow audits on reasonable notice.

5. Acceptable use

• Do not use the Service for any unlawful purpose or in a way that violates the rights of patients or third parties.
• Do not attempt to access another clinic's data, probe the Service for vulnerabilities, or interfere with its normal operation. Good-faith security research is the exception: if you find a vulnerability, report it to the security contact published at /.well-known/security.txt and access no more data than you need to show the problem. We welcome such reports and will not pursue anyone for making one.
• Do not upload content you do not have the right to store, or that infringes someone else's intellectual property.

6. Intellectual property

The Service, including its design, branding, and underlying software, is owned by us and our licensors. These Terms do not transfer any ownership rights to you. You retain ownership of the patient record content your clinic enters into the Service.

7. Directory and listings

Medical Solutions may operate a public directory of clinics and practitioners using the Service. Your clinic's business information, meaning the clinic name, address, contact details, opening hours, the practitioners you list, the services and prices you publish, and the appointment times you have free, may be included in that directory and shown to prospective patients.

This never includes patient records or any information about an identifiable patient. Availability is published as free time only, with no detail of who is booked or why.

No clinic is listed unless it asks to be. The directory is not open yet; before it opens we will show you what a listing looks like and ask whether you want one. If you later change your mind, tell us and your clinic is removed within a reasonable period.

8. Fees and payment

Each clinic may have one free trial. A registration that uses an email address or clinic name that has already had a trial starts on the paid plan instead. If you are a different clinic, contact us and we will open your trial.

The Service is paid for in advance. You choose to pay for 1, 3, 6 or 12 months at a time, and the full price of the period you choose is shown beside the pay button before you pay. Prices include VAT where VAT applies, and the checkout says so. Payment is taken by card through POK, our payment processor, on POK's own page; we never see or store your card number.

Each payment is a one-time payment. It does not renew automatically, and nothing further is charged unless you choose to pay again. We email you before your paid period ends.

Paid access starts when you pay or, if you pay during your free trial or while time you have already paid for is still running, when that trial or that time ends, so no day is paid for twice and no paid day is lost. It ends at the same time of day 1, 3, 6 or 12 calendar months later, as shown at checkout and in Settings. When it ends, the dashboard closes until you pay again; your records are kept and can still be exported.

The Service is sold by the company named beside the pay button and on every invoice, which also shows its NIPT and registered address. A fiscal invoice is issued for every payment and kept for you in Settings.

Payments are final and are not refunded, in whole or in part, including when you stop using the Service or close your account before your paid period ends. Time you have already paid for is never charged again: paying while paid time is still running adds the new months after it.

9. Suspension and termination

You may stop using the Service and close your clinic account at any time. We may suspend or terminate access if we reasonably believe these Terms have been violated, if required by law, or to protect the security or integrity of the Service. Where practical, we will give notice before doing so.

10. Disclaimers

The Service is provided "as is" and "as available." We do not warrant that it will be uninterrupted, error-free, or fit for every clinical workflow. Medical Solutions is a record-keeping tool; it does not provide medical advice and is not a substitute for a clinic's own professional and regulatory obligations.

Supported browsers: Chrome or Edge 111 or later, Firefox 128 or later, and Safari 16.4 or later. Older browsers may show the Service partly or not at all. Windows 7 and 8.1 cannot run a supported browser.

11. Limitation of liability

To the maximum extent permitted by law, we will not be liable for indirect, incidental, or consequential damages arising from your use of the Service. Nothing in these Terms limits liability that cannot be excluded under applicable law.

12. Governing law, courts and language

These Terms are governed by the laws of the Republic of Albania, without regard to conflict-of-law principles, unless a separate written agreement between you and us states otherwise.

Any dispute arising out of or in connection with these Terms is subject to the jurisdiction of the competent courts of Tirana, Republic of Albania.

These Terms, including the data processing agreement in section 4, are published in Albanian and English. If the two versions differ, the Albanian version prevails.

13. Changes to these terms

We may update these Terms from time to time. If we make material changes, including any change to the data processing agreement in section 4 or to the list of sub-processors, we update the date above and ask your clinic to accept the new version in the dashboard, with the notice section 4 describes.

14. Contact us

Questions about these Terms, notices about unlawful content, rights claims and requests from authorities can be sent to info@medicalsolutions.al or through the contact form at www.medicalsolutions.al/contact. We act promptly on a substantiated notice and tell the clinic concerned, unless the law forbids it. You can also call us on +355 67 56 54 602, or write to us on WhatsApp at +32 45 607 1631.

The company you contract with is ADSH-2014 (NIPT L41804001A, registered address Tiranë, Njësia Administrative nr.6, Rruga 'Hamdi Pepa', Pallati i ri, kati përdhes, Njësi tregtare 2B, zona kadastrale 8240).