Sehtak Terms of Service

Version: 2.1 Effective date: 2026-06-08 Document URL: https://sehtak.ae/legal/terms

Plain-language summary (not legally binding — it's the clauses below that bind): Sehtak is software for UAE healthcare facilities and the patients those facilities serve. The clinic or pharmacy is responsible for clinical decisions; Sehtak is responsible for keeping the software running, the data resident in the UAE, and the security controls in place. By clicking "I agree", you are signing a legally-binding agreement under UAE Federal Decree-Law 46 of 2021 on Electronic Transactions and Trust Services.

These Terms of Service ("Terms") govern your access to and use of the Sehtak software platform, including the Sehtak website at sehtak.ae, the Sehtak patient mobile and web applications, the Sehtak workspace applications for clinics and pharmacies, the Sehtak doctor app, the Sehtak APIs, and any related services (collectively, the "Services").

The Services are operated by Sehtak FZ-LLC, a free-zone limited liability company licensed in Meydan Free Zone, Dubai, United Arab Emirates ("Sehtak", "we", "us", "our"). You can reach us at legal@sehtak.ae or by post at Sehtak FZ-LLC, Meydan Free Zone, Dubai, UAE.

These Terms apply to two categories of users:

• Facility Users — UAE-licensed clinics, pharmacies, polyclinics, diagnostic centres, and the staff working at those facilities ("Customer" when acting in a contractual capacity).
• Patient Users — individuals using the Sehtak patient app or patient web to manage their own health, family members' health, or interact with a facility that uses Sehtak.

Where a section applies only to one category, the section heading says so. Where a section applies to both, it applies to both.

1. Acceptance, Binding Nature, and Click-Through Signature

1.1 How you accept these Terms

You accept these Terms when you do any of the following: (a) tick the "I agree to the Sehtak Terms of Service and Data Processing Agreement" checkbox at signup; (b) create or access a Sehtak account; (c) install or use a Sehtak application; (d) call any Sehtak API or webhook; or (e) on behalf of a Facility, accept these Terms during onboarding.

1.2 Click-through is a legally binding signature

You acknowledge and agree that clicking "I agree" constitutes an electronic signature under UAE Federal Decree-Law No. 46 of 2021 on Electronic Transactions and Trust Services and has the same legal effect as a handwritten signature. Sehtak captures and stores: the version and hash of the document you accepted, the date and time of acceptance (UTC), your IP address, and your user-agent string. That acceptance record is admissible evidence of these Terms binding you.

1.3 Authority to bind a Facility

If you accept these Terms on behalf of a Facility, you warrant that you are the owner, manager, or otherwise duly authorised representative of that Facility, and that you have full legal authority to bind the Facility to these Terms. If you do not have that authority, you must not accept these Terms and must not access the Services.

1.4 These Terms govern; customer paperwork does not

These Terms, together with the Documents incorporated by reference under §1.5, are the entire agreement between you and Sehtak for the Services. Any customer purchase order, vendor onboarding form, supplier code of conduct, template master services agreement, or other customer-supplied document submitted to Sehtak is not binding on Sehtak, has no legal effect on the Services, and does not vary these Terms — even if it bears Sehtak's name or is acknowledged by Sehtak personnel, unless that document is countersigned by an authorised officer of Sehtak FZ-LLC and explicitly references and amends these Terms.

1.5 Documents incorporated by reference

The following documents form part of these Terms and are binding on you when you accept these Terms:

If there is any conflict between these Terms and an Order Form executed in writing by both parties, the Order Form prevails for the specific subject matter it covers. Otherwise, these Terms prevail over any incorporated document.

1.6 No Master Services Agreement required

Sehtak does not require a Master Services Agreement ("MSA") to use the Services. These Terms plus the Documents under §1.5 are the contract. Enterprise and Founding Customers may sign a one-page Order Form covering commercial terms (price, term length, founding-rate lock, custom SLA), but the underlying legal terms are these Terms.

2. What Sehtak Is, and What Sehtak Is Not

2.1 Sehtak is a software vendor

Sehtak is a software-as-a-service ("SaaS") platform providing workflow, communication, scheduling, record-keeping, billing, claims, identity, and AI-assisted documentation tools to UAE-licensed healthcare facilities, and a companion patient application.

2.2 Sehtak is NOT a healthcare provider

Sehtak does not provide medical advice. Sehtak does not practise medicine, dentistry, pharmacy, or any other regulated health profession. Sehtak does not diagnose conditions. Sehtak does not prescribe, dispense, or administer medications. Sehtak does not perform procedures. Sehtak does not own, operate, manage, or supervise any healthcare facility.

2.3 The clinical relationship is between patient and facility

For all medical services provided through the Services: (a) the contractual relationship is between the patient and the Facility; (b) the regulatory relationship is between the Facility and the relevant UAE health authority (DHA, DOH, MOHAP, or SHA); (c) the clinical decision-making responsibility is between the licensed practitioner and the patient. Sehtak is not a party to any of these relationships. Sehtak is a technology layer that supports them.

2.4 AI is decision-support only — the practitioner decides

Any AI-generated output produced by the Services — including the AI Scribe, AI translation, AI decision-support, AI receptionist scripts, drug-interaction warnings, claim pre-validation, document classification, and any other AI-generated text — is advisory only and does not become part of a medical record, prescription, or any binding clinical document until a licensed practitioner has reviewed and explicitly accepted it. The practitioner is solely responsible for verifying the accuracy and clinical appropriateness of any AI output before relying on it. Reliance on AI output without practitioner review is a misuse of the Services and a breach of these Terms.

2.5 Sehtak does not sell medical services to patients

Patients pay the Facility for medical services at the Facility's published prices. Sehtak does not surcharge patients and is not a merchant of record for medical services. Where Sehtak collects payment from a patient through the Services, it does so as a technical payment-facilitation layer on behalf of the Facility's connected payment processor (Stripe, Tap Payments, or another processor as the Facility configures); the contractual obligation to deliver the medical service remains the Facility's.

3. Who May Use the Services

3.1 Patient Users — age and authority

You must be at least 18 years old to create a Sehtak patient account. If you are a parent or legal guardian managing a child's health record through the Sehtak family-link feature, you accept these Terms on the minor's behalf and warrant that you have legal authority to do so. Sehtak does not create independent accounts for under-18s.

3.2 Facility Users — licensure warranty

A Facility may access the Services only if the Facility holds a valid, current, and unrestricted health-facility licence from the competent UAE health authority for the Emirate(s) in which it operates (DHA for Dubai, DOH for Abu Dhabi, MOHAP for the Northern Emirates not covered by SHA, SHA for Sharjah). The Facility warrants on each access that:

• (a) the Facility licence is valid, current, and has not been suspended, restricted, or revoked;
• (b) every practitioner using the Services on behalf of the Facility holds a valid, current practitioner licence under the same authority;
• (c) the Facility complies with all applicable UAE healthcare laws and regulations, including without limitation UAE Federal Law No. 2 of 2019 on the Use of Information and Communication Technology in Health Fields, UAE Federal Decree-Law No. 38 of 2024 on Controlled Substances, and any emirate-specific regulations of the DHA, DOH, MOHAP, or SHA.

3.3 Continuing duty to maintain licensure

The Facility must notify Sehtak in writing at legal@sehtak.ae within forty-eight (48) hours of any: (a) suspension, restriction, or revocation of the Facility licence; (b) suspension, restriction, or revocation of the licence of any practitioner using the Services; (c) regulatory investigation, enforcement action, or formal complaint that could affect the Facility's authority to operate. Failure to notify is a material breach of these Terms.

3.4 Sehtak may suspend on licence concerns

If Sehtak has a credible basis to believe that a Facility's licence has lapsed, been suspended, or been revoked, or that a practitioner is using the Services without licensure, Sehtak may suspend access immediately and without prior notice, pending verification. Sehtak is not liable for any loss arising from a suspension under this clause that is later shown to be warranted.

3.5 Geography

The Services are designed for use within the United Arab Emirates. The Services are not offered to, intended for, or available in any country subject to UAE sanctions or to any sanctioned person. You warrant that you are not a sanctioned person and are not located in a sanctioned jurisdiction.

3.6 Patient identity assurance — UAE Pass SOP3 or equivalent

Access to clinical data through the patient applications requires identity verification at the SOP3 assurance level via UAE Pass, or equivalent verification through a Sehtak-approved alternative (e.g. Entrust IDV — formerly Onfido — for document + face-match eKYC). SOP1 (self-asserted) accounts may book appointments but cannot view clinical records.

4. Customer Warranties (Facility Users)

The Facility warrants on signup and on every continued use of the Services that:

4.1 Authority and capacity

The person accepting these Terms is duly authorised to bind the Facility; the Facility is a validly existing legal entity in the UAE; the Facility has full legal capacity to enter and perform these Terms.

4.2 Licensure (mirrors §3.2)

The Facility holds and will maintain all required UAE health-facility and practitioner licences.

4.3 Insurance

The Facility holds and will maintain professional indemnity insurance (also known as medical malpractice insurance) covering its clinical activities at a level reasonable for its size and specialty, and general liability insurance at a level reasonable for its premises. The Facility must produce evidence of cover within thirty (30) days of a written request from Sehtak.

4.4 Patient consent for processing

The Facility has obtained and will continue to obtain all patient consents required by UAE PDPL (Federal Decree-Law 45 of 2021) and the ICT Health Law (Federal Law 2 of 2019) before instructing Sehtak to process any patient data on its behalf. This includes consents for: cross-emirate HIE submission where applicable (NABIDH opt-out, Malaffi opt-in, Riayati opt-in), AI scribing, telehealth recording where elected, marketing communications, and any cross-border transfer routes documented in the DPA.

4.5 Data accuracy

The Facility is solely responsible for the accuracy, completeness, and clinical appropriateness of any data the Facility (or its staff) inputs into the Services, including patient records, prescriptions, dosages, diagnostic codes (ICD-10-CM), drug codes (DDC), procedure codes (CPT/HCPCS), and insurance claim data.

4.6 Compliance with UAE law

The Facility complies with, without limitation:

• (a) UAE Federal Decree-Law No. 45 of 2021 (Personal Data Protection Law, "PDPL");
• (b) UAE Federal Law No. 2 of 2019 (ICT Health Law);
• (c) UAE Federal Decree-Law No. 38 of 2024 (Controlled Substances);
• (d) UAE Federal Decree-Law No. 4 of 2023 (Medical Liability) and any superseded or amending instrument on medical liability and professional conduct;
• (e) UAE Federal Law No. 14 of 2014 (Combating Communicable Diseases);
• (f) UAE Federal Decree-Law No. 20 of 2018 (Anti-Money Laundering) and Cabinet Resolution 74/2020 on UAE sanctions;
• (g) UAE Federal Law No. 15 of 2020 (Consumer Protection);
• (h) Cabinet Decision No. 31 of 2022 on the Regulation of Health Advertising;
• (i) DHA Telehealth Standards V4 (and any subsequent version) for any telehealth conducted via the Services in Dubai, and the DOH / MOHAP equivalents for other emirates;
• (j) MOHAP narcotics and controlled-drug ledger requirements, including the half-yearly return obligation;
• (k) TDRA Do-Not-Call registry rules and PDPL marketing-consent requirements;
• (l) any other UAE federal or emirate-level law applicable to the Facility's operations.

4.6.1 Patient consent for AI features

Where the Facility enables the AI Scribe, AI translation, AI voice agent, or any other AI feature in a patient encounter, the Facility warrants that it has obtained the patient's informed consent for AI-assisted documentation before the encounter begins, using the in-product consent UX Sehtak provides. The Facility is solely responsible for the validity of that consent.

4.6.2 No misrepresentation of AI output

The Facility, and every practitioner using the Services on the Facility's behalf, will not represent any AI-generated output — including AI Scribe notes, AI translations, drug-interaction warnings, document classifications, or claim pre-validation results — to any patient, regulator, payer, court, or other third party as if it had been authored by a human practitioner. The accepted medical record must reflect the practitioner's professional judgement.

4.7 No controlled substances via telehealth

The Facility will not use the Services to prescribe controlled substances via telehealth in violation of UAE Federal Decree-Law 38/2024. The Services include technical controls to prevent this; the Facility further warrants it will not attempt to circumvent those controls.

4.8 No re-sale, no re-branding

The Facility will not re-sell, sub-licence, re-brand, white-label, or otherwise make the Services available to any third party as if it were the Facility's own product, unless separately agreed in a written Order Form.

4.9 No competitive scraping

The Facility will not access or use the Services for the purpose of: (a) building a competing product or service; (b) benchmarking against a competing product; (c) extracting Sehtak's catalogues, pricing, or model behaviour for use in a competing product; (d) training a machine-learning model on Sehtak's outputs.

4.10 Insurance — minimum cover

The Facility shall maintain throughout the term, with insurers licensed by the UAE Central Bank or with a credit rating no lower than "A−" (S&P or equivalent):

• (a) professional indemnity / medical malpractice insurance with a per-claim limit of no less than AED 1,000,000 and an annual aggregate limit of no less than AED 3,000,000;
• (b) public / general liability insurance with a per-claim limit of no less than AED 1,000,000;
• (c) where the Facility operates a pharmacy or stores Controlled Substances, dishonesty / fidelity cover with a limit reasonable for its inventory value.

The Facility must produce certificates of insurance within thirty (30) days of a written request from Sehtak. The minimums in this §4.10 do not cap the Facility's underlying liability and do not limit the Facility's indemnification obligations under §14.

4.11 Staff training and access provisioning

The Facility is responsible for: (a) training every member of its staff who uses the Services on the safe and lawful operation of the features the staff member is given access to (clinical documentation, AI Scribe, controlled-drug ledger, eClaims, HIE submission, etc.); (b) keeping the Facility's user-roster on the Services current, including immediately revoking access for any staff member who leaves, is dismissed, or has their practitioner licence suspended; (c) ensuring every staff account uses multi-factor authentication and does not share credentials. Sehtak provides the tooling; the Facility operates it.

4.12 Customer cybersecurity hygiene

The Facility shall implement reasonable cybersecurity measures on its own end, including: workstation antivirus / endpoint protection; an up-to-date operating system on every device used to access the Services; password-manager use; secure Wi-Fi; locking screens when unattended; an off-boarding checklist for departing staff. A Security Incident caused by the Facility's failure of basic cybersecurity hygiene is not a Sehtak Security Incident and is excluded from Sehtak's notification and remediation obligations under the DPA.

4.13 Accuracy of submissions to authorities and payers

For any data the Services submit on behalf of the Facility to a UAE health authority, HIE (NABIDH, Malaffi, Riayati), insurance payer, eClaims gateway, Tatmeen, or other regulator, the Facility is solely responsible for the clinical accuracy and completeness of the source data the Facility entered into the Services. Sehtak provides the transport, formatting, and validation layer; it does not validate clinical truth. The Facility indemnifies Sehtak under §14.1 for any claim arising from inaccurate data the Facility entered.

4.14 Patient-record stewardship on departing practitioners

When a practitioner ceases to be authorised at the Facility, the Facility remains the Controller and steward of the patient records that practitioner created. The Facility must not transfer those records, or grant the departing practitioner access to those records, except where UAE law expressly permits a clinical hand-off to another licensed Facility with patient consent. Sehtak is not a party to any such hand-off.

5. Account, Identity, and Security

5.1 Account creation

Patient accounts are created with a phone number and a one-time passcode delivered by SMS or WhatsApp. Facility accounts are created via the Sehtak signup flow with email verification and admin approval. You agree to provide accurate, current, and complete information and to keep it current.

5.2 Identity verification

Where required by law or by a feature you use, you must complete identity verification through UAE Pass (SOP3) or, where you are not a UAE resident, through Sehtak's eKYC partner. Identity verification is governed by the providers' own terms; Sehtak stores only the minimum identifier required to recognise your verified status.

5.3 Account security

You must: (a) keep your credentials confidential; (b) not share your account; (c) enable multi-factor authentication on Facility staff accounts (Sehtak mandates this on staff roles); (d) notify Sehtak immediately at security@sehtak.ae if you suspect compromise. You are responsible for all activity under your account until you notify Sehtak of compromise.

5.4 Sehtak may suspend on security concerns

If Sehtak has a credible basis to believe your account has been compromised, is being used to attack the Services, or is being used in violation of these Terms, Sehtak may suspend your account immediately, pending investigation.

6. Acceptable Use

You must comply with the Acceptable Use Policy at sehtak.ae/legal/aup at all times. In summary and without limitation, you must not:

• (a) use the Services to provide medical services if you are not a UAE-licensed practitioner;
• (b) impersonate any person or facility;
• (c) upload content you do not have the right to share;
• (d) attempt to access another patient's records, another facility's data, or any part of the Services you are not authorised to access;
• (e) reverse engineer, decompile, disassemble, scrape, or otherwise attempt to derive the source code of, or bypass the security controls of, the Services;
• (f) interfere with the Services through denial-of-service techniques, malware, or excessive automated requests;
• (g) use the Services for any unlawful purpose, including without limitation selling controlled substances outside lawful channels, soliciting minors, facilitating fraud, or violating sanctions;
• (h) send unsolicited marketing communications in violation of TDRA rules or PDPL marketing-consent requirements;
• (i) use AI features to fabricate clinical records, falsify documentation, or generate misleading medical information;
• (j) circumvent any rate limit, tier limit, or feature gate;
• (k) misrepresent the source of any AI-generated output (you must not present an AI-Scribed note as a manually-written note when communicating with patients, regulators, or third parties).

Breach of the AUP is a material breach of these Terms and entitles Sehtak to suspend or terminate access immediately.

7. Data and Privacy

7.1 Two data-protection roles

Sehtak handles personal data in two distinct roles:

• As Data Processor — for patient data the Facility uses Sehtak to process. The Facility is the Data Controller. The processing is governed by the Data Processing Agreement at sehtak.ae/legal/dpa, which you accept together with these Terms.
• As Data Controller — for Sehtak's own operational processing of Facility admin contact data, billing data, account credentials, audit logs, and de-identified service-improvement analytics. That processing is governed by the Privacy Policy at sehtak.ae/legal/privacy.

7.2 PDPL "in writing" satisfied by click-through

You acknowledge that click-through acceptance of the DPA, captured under §1.2, satisfies the "in writing" requirement under UAE PDPL Article 26 by virtue of Federal Decree-Law 46/2021 (Electronic Transactions and Trust Services).

7.3 UAE-resident data

Patient health information processed under the DPA is hosted on UAE-resident infrastructure (currently du Cloud for compute and Moro Hub for PHI storage and database). The narrow exceptions for non-clinical metadata (transactional email, WhatsApp routing metadata, error tracking, tourist eKYC) are documented in DPA §7.

7.4 Sub-processors

You consent to Sehtak's use of the sub-processors listed at sehtak.ae/legal/sub-processors. Sehtak will give thirty (30) days' notice of any material change to that list. Your remedy if you object on reasonable data-protection grounds is to terminate under §13 — no other remedy applies.

7.5 Audit log

Sehtak maintains an append-only audit log of all access to and changes of patient data. The audit log is retained for at least ten (10) years. Customers may request audit-log extracts for their own tenant on reasonable notice.

7.6 Retention

Clinical records are retained for at least twenty-five (25) years from the date of the last encounter, as required by UAE Federal Law No. 2 of 2019. This retention obligation survives termination of these Terms and the Customer cannot demand deletion of clinical records inside the 25-year window. Non-clinical data retention is set out in the Privacy Policy.

7.7 De-identified data for product improvement

Sehtak may use de-identified, aggregated data derived from use of the Services to maintain, improve, and develop the Services and to publish anonymous benchmarks. "De-identified" means processed so that the data cannot reasonably be linked back to an individual or facility. Sehtak does not use Customer-identifiable data or PHI for model training.

7.8 You may not transfer data extra-territorially

You must not export, copy, transmit, or otherwise move patient data processed through the Services outside the UAE without an explicit written authorisation from Sehtak's DPO and a documented lawful basis under PDPL Articles 22–24. The Services are configured to prevent this; circumvention is a material breach.

8. Fees, Billing, Taxes, and Refunds

8.1 Published rate card

Facility fees are at the rate published at sehtak.ae/pricing, at the tier you select during onboarding. Patient use of the patient applications is free.

8.2 Founding rates require an Order Form

Promotional, founding-customer, or otherwise non-published pricing is not available by acceptance of these Terms alone and is not implied by any sales conversation or marketing material. Non-published pricing requires an Order Form countersigned by an authorised officer of Sehtak FZ-LLC. Without an Order Form, the published rate applies.

8.3 Billing cycle and auto-renewal (opt-in)

Subscriptions are billed monthly in advance, or annually in advance where the Customer selects the annual cycle. Subscriptions auto-renew at the end of each billing cycle at the then-current published rate; you affirmatively opt in to auto-renewal when you accept these Terms, as required by UAE Federal Law 15/2020 (Consumer Protection). You may cancel auto-renewal at any time from the Subscription page in your dashboard; cancellation takes effect at the end of the then-current billing cycle.

8.4 Per-event fees

Where the Services include per-event fees (e.g. the AED 1.00 per Sehtak-routed Rx on the Free pharmacy plan, per-message overage fees, per-claim fees), those fees are calculated monthly in arrears and invoiced with the next regular billing cycle. The Services display a usage meter so the Customer can monitor accrual.

8.5 VAT and other taxes

All fees are stated exclusive of UAE Value Added Tax. VAT at the prevailing rate (currently 5%) is added to invoices. The Customer is responsible for any other taxes, withholding obligations, or import duties applicable to its location. The Customer must not deduct any tax or withholding from amounts owed to Sehtak unless required by UAE law, in which case the Customer must gross up the payment so Sehtak receives the net amount it would have received absent the deduction.

8.6 Late payment

Invoices are due fourteen (14) days from the invoice date. Late payment accrues interest at one percent (1%) per month or the maximum lawful rate, whichever is lower. Sehtak may suspend the Services after seven (7) days' written notice if any invoice is more than thirty (30) days overdue.

8.7 No refunds, except SLA credit

Software-subscription fees are non-refundable, including without limitation if the Customer downgrades, cancels, terminates, has its licence revoked, or stops using the Services. The Customer's only refund-like remedy for unavailability of the Services is the SLA credit set out in the SLA at sehtak.ae/legal/sla, capped at the SLA's stated maximum.

8.8 Disputed invoices

The Customer must dispute any invoice in writing within thirty (30) days of the invoice date or the invoice is conclusively deemed accepted.

8.9 Payouts to facilities

Where Sehtak collects payment from patients on behalf of a Facility through Tap Marketplace or Stripe Connect, payouts to the Facility's nominated UAE bank account follow the cadence stated on the Facility's connected-account dashboard, minus: (a) the connected payment processor's fees, (b) Sehtak's platform fee at the published rate or as set in the Facility's Order Form, (c) VAT on Sehtak's platform fee, and (d) any refunds, chargebacks, or fraud reversals. Sehtak is not a bank, is not a custodian of the Facility's funds, and provides no banking services.

9. Service Levels and Beta Features

9.1 Uptime and SLA

Sehtak commits to a monthly availability target of 99.5% of the Services, excluding scheduled-maintenance windows (notified at least 48 hours in advance), force-majeure events, and outages of third-party services that the Customer has independently elected to integrate. SLA credits and the credit cap are set out in the SLA at sehtak.ae/legal/sla. SLA credits are the Customer's sole remedy for Service unavailability.

9.2 Maintenance

Sehtak may take the Services offline for scheduled maintenance during off-peak hours. Sehtak will give 48 hours' notice for planned maintenance and may apply emergency maintenance without notice where required to protect security, data integrity, or regulatory compliance.

9.3 Beta and preview features

Some features are released as "Beta", "Preview", or "Early Access". Beta features are provided AS IS, AS AVAILABLE, WITHOUT WARRANTY OF ANY KIND, are excluded from the SLA, and may be modified or withdrawn at any time without notice. The Customer's use of a Beta feature is at the Customer's risk; the Customer must not rely on a Beta feature for any regulated activity, clinical decision, or external regulatory submission.

9.4 AI features

AI features (AI Scribe, AI translation, AI decision-support, AI receptionist, claim pre-validation, document classification) are decision-support tools within §2.4. AI features are excluded from the SLA, may be temporarily unavailable for capacity, retraining, or compliance reasons, and may produce inaccurate output. The licensed practitioner is responsible for verifying every AI output before relying on it.

9.5 Third-party services

Where the Services interoperate with third-party services (UAE Pass, NABIDH, Malaffi, Riayati, DHPO eClaimLink, Shafafiya, Stripe, Tap Payments, Twilio, Unifonic, Resend, Entrust IDV / Onfido, Sentry, LiveKit, and others listed at sehtak.ae/legal/sub-processors), Sehtak is not responsible for the availability, performance, or content of those third-party services. The third-party services are subject to their own terms.

10. Modifications to the Services and to these Terms

10.1 Modifications to the Services

Sehtak may modify, enhance, deprecate, or discontinue any feature of the Services at any time. For material adverse modifications (deprecation of a feature the Customer relies on, material reduction in capacity or functionality), Sehtak will give at least thirty (30) days' notice in-app and by email to the registered admin contact.

10.2 Modifications to these Terms

Sehtak may modify these Terms by publishing a new version at sehtak.ae/legal/terms and notifying you in-app and by email at least thirty (30) days before the new version takes effect. Continued use of the Services after the effective date of the new version constitutes acceptance.

10.3 Material adverse changes require active re-consent

Where a modification under §10.2 is materially adverse to the Customer's rights — including without limitation a material increase in fees outside an annual price-review window, a material reduction in liability protection for the Customer, or a material change to the data-protection terms — Sehtak will require the Customer to actively re-consent (click-through) before the change takes effect.

10.4 Archived versions

Past versions of these Terms are archived at sehtak.ae/legal/terms/archive and are available on request.

11. Intellectual Property

11.1 Sehtak's IP

Sehtak and its licensors own all intellectual property rights in and to the Services, including without limitation all software, source code, models, model weights, designs, documentation, trademarks, trade dress, and "Sehtak" name. Nothing in these Terms transfers any ownership interest to you. You receive only the limited, non-exclusive, non-transferable, revocable right to use the Services in accordance with these Terms.

11.2 Customer data

As between Sehtak and the Customer, the Customer owns the Customer's data (the data the Customer or its patients upload to or generate on the Services). The Customer grants Sehtak a worldwide, royalty-free, non-exclusive licence to host, process, transmit, display, and otherwise use the Customer's data solely as necessary to provide and improve the Services, to comply with UAE law, and to enforce these Terms. The licence terminates on termination of these Terms, subject to the retention obligations in §7.6.

11.3 De-identified data

Sehtak may create de-identified, aggregated data derived from Customer data and use it under §7.7. Sehtak owns the de-identified, aggregated data.

11.4 Feedback

If the Customer or any User provides Sehtak with suggestions, feature requests, or feedback about the Services, the Customer grants Sehtak a perpetual, worldwide, royalty-free, irrevocable licence to use, modify, and incorporate the feedback into the Services with no obligation of attribution or compensation.

11.5 Trademarks

"Sehtak" and the Sehtak logo are trademarks of Sehtak FZ-LLC. You must not use Sehtak's trademarks except as expressly permitted in a separate trademark-use guideline issued by Sehtak.

11.6 No reverse engineering

You must not reverse engineer, decompile, disassemble, derive the source code of, or extract the model weights of any part of the Services, except to the extent expressly permitted by UAE law that cannot be excluded by contract.

12. Disclaimers

12.1 AS IS, AS AVAILABLE

To the maximum extent permitted by UAE law, the Services are provided AS IS and AS AVAILABLE. Sehtak makes no representations and gives no warranties of any kind, whether express, implied, statutory, or otherwise, including without limitation any implied warranty of merchantability, fitness for a particular purpose, accuracy, completeness, uninterrupted availability, security, freedom from defects, freedom from harmful code, or non-infringement.

12.2 No clinical warranty

Without limiting §12.1, Sehtak gives no warranty that any AI output, clinical-decision-support suggestion, drug-interaction alert, dosing recommendation, document classification, claim pre-validation, or other Service output is medically accurate, complete, or appropriate for any patient. The licensed practitioner is solely responsible for clinical decisions.

12.3 No regulatory warranty

Sehtak gives no warranty that use of the Services will satisfy any specific UAE health-authority requirement, HIE submission requirement, eClaims submission requirement, or audit requirement. Compliance is the Customer's responsibility; the Services are tools the Customer may use to achieve compliance.

12.4 What is not excluded

Nothing in these Terms excludes or limits liability that cannot lawfully be excluded or limited under UAE law, including liability for death or personal injury caused by Sehtak's gross negligence, liability for fraud or fraudulent misrepresentation, or liability under any consumer protection law that cannot be excluded.

13. Limitation of Liability

13.1 Liability cap

Subject to §13.3, Sehtak's total aggregate liability to the Customer (or to any patient User on the free patient app, where capped lower) arising out of or relating to these Terms or the Services, whether in contract, tort (including negligence), strict liability, statute, or otherwise, is capped at:

• (a) for paid Facility Customers: the fees actually paid by the Customer to Sehtak in the twelve (12) months preceding the event giving rise to the claim, or AED 50,000, whichever is greater;
• (b) for free patient app Users: AED 1,000.

13.2 No indirect damages

Subject to §13.3, neither party is liable for indirect, incidental, special, consequential, exemplary, or punitive damages, lost profits, lost revenue, loss of business opportunity, loss of goodwill, loss of data (other than Sehtak's own data-restoration obligation under §13.4), or cost of substitute services, even if advised of the possibility.

13.3 Carve-outs from the cap

The cap in §13.1 and the exclusion in §13.2 do not apply to:

• (a) the Customer's payment obligations under §8;
• (b) the Customer's indemnification obligations under §14;
• (c) either party's breach of confidentiality;
• (d) Sehtak's breach of the cross-border-transfer prohibitions in DPA §7.3 (no PHI to non-UAE inference endpoints) where the breach causes a security incident;
• (e) either party's fraud or wilful misconduct;
• (f) any liability that cannot be limited under UAE law.

13.4 Data-loss remedy

If Sehtak loses Customer data through Sehtak's negligence and the loss is not recoverable from backup within the SLA's recovery-point-objective window, Sehtak's sole and entire obligation is to restore the data to the last available backup and to credit the Customer one month's subscription fees. Sehtak is not liable for the Customer's separate obligation to reproduce or reconstruct the data.

13.5 Sehtak is not liable for clinical decisions

Without limitation of any other provision, Sehtak is not liable, in any circumstances, for: (a) any clinical decision made by a practitioner using the Services; (b) any harm to a patient arising from a clinical decision; (c) any liability of the Facility to a patient, regulator, or insurer arising from the Facility's clinical practice. The Customer agrees this allocation of risk is fair given Sehtak's role as a software vendor and the Customer's role as the licensed healthcare provider.

13.6 Allocation of risk

The Customer agrees that the limitations in this §13 are a fundamental basis of the bargain between the parties and reflect the Services' pricing. Without these limitations, Sehtak would not be able to offer the Services at the published price.

14. Indemnification

14.1 Customer indemnifies Sehtak (Facility Users)

The Customer (Facility) will indemnify, defend, and hold harmless Sehtak, its affiliates, officers, employees, and sub-processors from and against any claim, demand, loss, liability, damage, fine, regulatory penalty, settlement, and reasonable legal cost arising out of or related to:

• (a) any clinical decision made by a practitioner at the Facility, any patient injury, any allegation of malpractice, or any allegation of misdiagnosis or mistreatment;
• (b) the Facility's failure to maintain valid licensure (§3.2);
• (c) the Facility's breach of UAE healthcare laws, including without limitation Federal Decree-Law 38/2024 (controlled substances) and the ICT Health Law;
• (d) the Facility's failure to obtain or maintain patient consents (§4.4);
• (e) the inaccuracy or incompleteness of any data the Facility input into the Services (§4.5);
• (f) the Facility's misuse of the Services in breach of the AUP;
• (g) any claim by a patient, regulator, insurer, or third party relating to medical services delivered at or by the Facility;
• (h) the Facility's failure to obtain or maintain professional indemnity insurance (§4.3) where insurance would have covered the loss.

14.2 Sehtak indemnifies Customer for IP infringement

Sehtak will indemnify, defend, and hold harmless the Customer from and against any third-party claim that the Customer's authorised use of the Services infringes that third party's UAE intellectual property rights, provided the Customer: (a) gives prompt written notice; (b) lets Sehtak control the defence and any settlement; (c) reasonably cooperates with Sehtak. Sehtak's sole obligation is to: (i) settle or defend the claim; (ii) at Sehtak's option, modify the Services to remove the alleged infringement, procure the right for the Customer to continue using the Services, or terminate the affected portion of the Services with a pro-rata refund of any prepaid fees. Sehtak has no obligation under this §14.2 for claims arising from: (1) use of the Services in combination with anything not supplied by Sehtak, (2) modification of the Services by anyone other than Sehtak, (3) use of the Services outside the scope of these Terms, or (4) Customer data.

14.3 Procedure

The indemnifying party will have sole control of the defence and any settlement, but cannot settle in a way that admits liability of the indemnified party without the indemnified party's written consent.

15. Suspension and Termination

15.1 Termination by the Customer (Facility)

The Customer may terminate by giving thirty (30) days' written notice to legal@sehtak.ae. Termination does not entitle the Customer to a refund of prepaid fees, except where required by UAE Consumer Protection Law.

15.2 Termination by the patient User

A patient User may delete their account from inside the Sehtak patient app at any time, or by emailing privacy@sehtak.ae.

15.3 Termination by Sehtak for cause

Sehtak may terminate immediately and without refund on written notice if:

• (a) the Customer materially breaches these Terms or the AUP and does not cure within thirty (30) days of written notice (or, where the breach is incurable, immediately);
• (b) the Customer fails to pay any undisputed invoice more than thirty (30) days overdue and does not pay within seven (7) days of a final demand;
• (c) the Customer loses, has suspended, or has revoked its health-facility licence (§3.4);
• (d) the Customer becomes insolvent, files for bankruptcy, ceases trading, or enters administration or liquidation;
• (e) a UAE regulator, court, or other competent authority orders Sehtak to suspend or terminate the Customer's access;
• (f) Sehtak has a credible basis to believe continued access would expose Sehtak, any other Customer, or any patient to material legal or safety risk.

15.4 Termination by Sehtak for convenience

Sehtak may terminate any free-tier account, or terminate the Services as a whole, for convenience on thirty (30) days' written notice. Sehtak may not terminate a paid account for convenience inside a paid billing cycle; instead, Sehtak will let the cycle run and not renew.

15.5 Effect of termination

On termination: (a) your right to access the Services ends; (b) all fees accrued before the termination date remain due; (c) the Customer's data is retained for thirty (30) days post-termination for export, then deleted, subject to the 25-year clinical-record retention in §7.6; (d) the surviving provisions in §15.7 continue in force.

15.6 Data export window

On termination, the Customer has thirty (30) days from the termination date to export the Customer's data through the in-product export functionality or via the export API. After the thirty (30) days, Sehtak deletes the data, subject to §7.6. Sehtak will not preserve the data beyond the thirty (30) days, except as required by UAE law.

15.7 Survival

The following provisions survive termination: §2 (Sehtak is not a healthcare provider), §7.6 (retention), §11 (IP), §12 (Disclaimers), §13 (Limitation of Liability), §14 (Indemnification), §15 (Termination), §16 (Confidentiality), §17 (Governing Law), §18 (General), and any other provision that by its nature is intended to survive.

16. Confidentiality

Each party will keep confidential any information disclosed by the other party that is marked as confidential or that would reasonably be understood to be confidential, and use it only to perform under these Terms. Confidentiality obligations survive termination for five (5) years. Confidentiality does not apply to information that is or becomes public through no fault of the receiving party, was independently known before disclosure, was independently developed, or is required to be disclosed by law (with prompt notice to the disclosing party where lawful).

17. Governing Law and Disputes

17.1 Governing law

These Terms are governed by the federal law of the United Arab Emirates and the laws of the Emirate of Dubai. The UN Convention on Contracts for the International Sale of Goods does not apply.

17.2 Disputes (default — self-serve customers)

Any dispute arising out of or relating to these Terms is subject to the exclusive jurisdiction of the Courts of Dubai (Dubai Courts), United Arab Emirates. Each party submits to that jurisdiction and waives any objection of inconvenient forum.

17.3 Disputes (Enterprise and Founding customers with an Order Form)

Where the Order Form so provides, disputes are referred to arbitration under the rules of the Dubai International Arbitration Centre (DIAC) — seat Dubai, language English or Arabic as the Order Form specifies, one arbitrator. The arbitral award is final and binding.

17.4 Equitable relief

Either party may seek injunctive or other equitable relief in any court of competent jurisdiction to prevent or stop a breach of confidentiality, IP infringement, or other irreparable harm, without first proceeding under §17.2 or §17.3.

18. General

18.1 Entire agreement

These Terms, together with the Documents under §1.5 and any Order Form, are the entire agreement and supersede any prior agreements or representations.

18.2 Order of precedence

In case of conflict: (a) a signed Order Form prevails over these Terms for its specific subject matter; (b) the DPA prevails over these Terms on data-protection matters within the DPA; (c) otherwise these Terms prevail over any incorporated document.

18.3 Assignment

The Customer may not assign these Terms without Sehtak's prior written consent. Sehtak may assign in connection with a merger, acquisition, sale of substantially all assets, or corporate reorganisation, without consent.

18.4 Sub-contracting

Sehtak may sub-contract performance to its sub-processors (under DPA §6) and to other sub-contractors, but remains responsible for performance.

18.5 Notices

Notices to Sehtak: legal@sehtak.ae, with a copy to the registered office. Notices to the Customer: the registered admin email on the account. In-app banner notice is sufficient for general changes.

18.6 Force majeure

Neither party is liable for any failure or delay in performance caused by events outside its reasonable control, including without limitation:

• (a) natural disasters, fire, flood, earthquake;
• (b) war, armed conflict, civil disturbance, riot, insurrection;
• (c) sanctions, embargoes, government orders, regulatory suspensions, court orders;
• (d) pandemics or public-health emergencies declared by the UAE government or the World Health Organization;
• (e) regional telecommunications or power outages;
• (f) cyberattacks, distributed denial-of-service attacks, ransomware, or other malicious activity targeting Sehtak, a Sub-processor, or critical UAE infrastructure;
• (g) failure or unavailability of UAE Pass, NABIDH, Malaffi, Riayati, DHPO, Shafafiya, Tatmeen, or any other government or regulator-operated system that the Services depend upon;
• (h) the act or omission of any government, regulator, or upstream telecommunications, power, or cloud provider.

The affected party must give prompt notice and resume performance as soon as reasonably possible. Force-majeure events do not relieve the Customer of any obligation to pay fees that have already accrued.

18.7 Independent contractors

The parties are independent contractors. Nothing in these Terms creates any partnership, joint venture, agency, fiduciary, or employment relationship.

18.8 No waiver

No failure or delay in exercising any right under these Terms operates as a waiver. A waiver of any breach is not a waiver of any other or subsequent breach.

18.9 Severability

If any provision is held invalid or unenforceable, the remainder of these Terms remains in force, and the invalid provision will be reformed to the minimum extent necessary to achieve validity while preserving the original intent.

18.10 No third-party beneficiaries

These Terms do not create any rights for third parties. Patients, payers, and regulators are not third-party beneficiaries.

18.11 Headings

Headings are for convenience only and do not affect interpretation.

18.12 Language

These Terms are published in English. An Arabic translation is published at sehtak.ae/legal/terms/ar for convenience. In case of conflict between the English and Arabic versions for self-serve customers, the English version governs, except where UAE law requires Arabic to prevail (in which case Arabic governs only the specific provision UAE law affects). For Enterprise and Founding customers, the Order Form may specify Arabic as the governing language.

18.13 Anti-bribery and sanctions

Each party warrants that it complies with UAE anti-money-laundering laws (Federal Decree-Law 20/2018 and amendments), UAE counter-terrorist-financing laws, UAE sanctions (Cabinet Resolution 74/2020), and the UAE Local Terror List published at uaeiec.gov.ae. Neither party will use the Services or any consideration paid under these Terms in a manner that violates these laws.

18.14 Export controls

The Services are subject to UAE export controls. The Customer must not export, re-export, or transfer the Services or any technology derived from them to any sanctioned country or person.

18.15 Audit of tier compliance

Sehtak may, on reasonable notice and not more than once per calendar year, audit the Customer's use of the Services to verify compliance with the licence tier the Customer has purchased (doctor-seat counts, facility counts, AI Scribe seat counts, fair-use limits). Where the audit shows under-payment, the Customer will pay the shortfall within thirty (30) days. Where the audit shows over-use of more than 10%, the Customer will reimburse Sehtak's reasonable audit costs.

18.16 Right to refuse onboarding

Sehtak may refuse to accept a new Customer, or refuse to renew an existing Customer, without giving a reason. Sehtak is not obliged to do business with any particular person or Facility. Sehtak will not exercise this right unlawfully, and in particular not on a ground prohibited by UAE anti-discrimination law.

18.17 Use of Customer name and logo

Sehtak may identify the Customer by name and logo as a customer of Sehtak in Sehtak's marketing materials, website, investor decks, and press releases, once the Customer has been live on the Services for at least sixty (60) days and provided the Customer has not given written notice opting out at marketing@sehtak.ae. Sehtak will not disclose the Customer's pricing, volume, clinical data, or any other confidential information without the Customer's prior written consent.

18.18 Non-solicitation of Sehtak personnel

During the term of these Terms and for twelve (12) months afterwards, the Customer will not directly solicit, hire, or engage as an independent contractor any Sehtak employee or contractor with whom the Customer has had material contact through the Customer's use of the Services, without Sehtak's prior written consent. General job advertising and untargeted recruitment campaigns are not breaches of this §18.18.

18.19 Class-action waiver

To the maximum extent permitted by UAE law, the Customer waives any right to participate in or to be represented in any class, collective, or representative action against Sehtak. Each dispute is resolved on an individual basis under §17. This waiver does not apply to any right that cannot be waived under UAE law.

18.20 Cross-default with Order Form

A material breach of any Order Form executed under §1.6 is also a material breach of these Terms, and a material breach of these Terms is also a material breach of every Order Form between Sehtak and the Customer.

18.21 Service continuity on Sehtak insolvency

In the event Sehtak ceases operations or becomes insolvent, Sehtak will use commercially reasonable efforts to: (a) give Customers no less than ninety (90) days' notice; (b) extend the data-export window in §15.6 from thirty (30) days to ninety (90) days; (c) where commercially viable, transfer hosting of the Customer's data to a UAE-resident, regulator-approved successor of the Customer's choice, at the Customer's cost.

18.22 No partnership, no franchise, no fiduciary

Nothing in these Terms creates a partnership, franchise, joint venture, agency, fiduciary, or employment relationship. The Customer has no authority to act for or on behalf of Sehtak or to bind Sehtak in any way.

18.23 Reference to "Sehtak" in patient-facing communications

The Customer must not state or imply that Sehtak provides medical services, has reviewed any specific clinical decision, has approved any treatment plan, or stands behind any clinical outcome. The Customer must accurately represent Sehtak's role as a software vendor. Sehtak may instruct the Customer to correct any patient-facing representation that misstates Sehtak's role; the Customer will correct within seven (7) days.

18.24 Independent advice

The Customer has had the opportunity to obtain independent legal, tax, and regulatory advice on these Terms before accepting them and is not relying on any statement made by Sehtak that is not in these Terms.

19. Contact

20. Acceptance Record

When you click "I agree" at signup, Sehtak records: the document version (currently 2.0), the document hash, the timestamp (UTC), your IP address, and your user-agent string. You may request a copy of your acceptance record by emailing legal@sehtak.ae.

By clicking "I agree to the Sehtak Terms of Service and Data Processing Agreement", you confirm that you have read, understood, and agreed to be legally bound by these Terms and the documents they incorporate. If you do not agree, do not use the Services.

Sehtak FZ-LLC · Meydan Free Zone · Dubai · United Arab Emirates · sehtak.ae