Terms of Service

Last updated: 27 May 2026

1. Acceptance of Terms

These Terms of Service ("Terms") govern access to and use of Axon, a cloud-based electronic medical records (EMR) platform operated by Virelia Health System (Private) Limited ("Virelia", "we", "us", or "our").

By registering for, accessing, or using the Service, you agree to be bound by these Terms.

If you access or use the Service on behalf of a Clinic or other organisation, you represent and warrant that you have authority to bind that organisation to these Terms.

These Terms should be read together with our Privacy Policy and any applicable Service Agreement or written commercial terms entered into between Virelia and a Clinic.

2. Definitions

  • Service — the Axon platform, including related websites, applications, APIs, offline functionality, support services, and associated infrastructure
  • Clinic — a healthcare provider, practice, or healthcare organisation registered to use the Service
  • Clinic User — an individual authorised by a Clinic to access or use the Service
  • Patient Data — medical records, health information, and personal data relating to patients entered into or managed through the Service
  • Clinic User Data — personal data relating to Clinic Users, including account details, authentication information, security logs, and support communications
  • Account — the registered account through which a Clinic accesses the Service
  • Applicable Law — laws and regulations applicable to the parties, including the Cyber and Data Protection Act [Chapter 12:07], related regulations, and applicable healthcare recordkeeping obligations in Zimbabwe

3. Service Description

Axon is a cloud-based EMR and clinic operations platform designed to support healthcare providers with patient registration, appointments, triage, consultations, diagnoses, prescriptions, medical record management, and related administrative functions.

Certain features may be released in beta, preview, or limited-availability form and may be modified, suspended, or discontinued at any time.

4. Account Registration, Security, and Access Controls

  • Clinics must provide accurate and current registration information and keep such information updated.
  • Each Clinic User must maintain individual login credentials. Shared accounts and credential sharing are prohibited.
  • Devices accessing the Service may be registered, monitored, or restricted for authentication and security purposes.
  • Clinics are responsible for configuring user permissions and access controls appropriate to their operational and confidentiality requirements.
  • Clinics are responsible for promptly disabling access for Clinic Users who no longer require access.
  • Clinics must maintain appropriate password, device security, and internal confidentiality procedures.
  • You must notify us promptly at info@virelia.co.zw of any suspected unauthorised access, credential compromise, or security incident affecting the Service.

5. Acceptable Use

You agree to use the Service only for lawful and authorised healthcare and administrative purposes and in compliance with Applicable Law.

You must not:

  • Use the Service for unlawful, fraudulent, or unauthorised purposes
  • Attempt to access data belonging to another Clinic
  • Share login credentials with unauthorised persons
  • Upload, process, or disclose personal data without appropriate authority or lawful basis
  • Reverse engineer, copy, modify, or attempt to extract source code from the Service except where expressly permitted by law
  • Interfere with the security, integrity, or availability of the Service
  • Introduce malware, malicious code, or harmful automated processes into the Service
  • Conduct vulnerability scanning, denial-of-service attacks, credential attacks, scraping, or other abusive technical activities against the Service

We may suspend or restrict access where necessary to investigate suspected misuse, protect the Service, or comply with Applicable Law.

6. Privacy, Patient Data, and Data Protection Roles

6.1 Clinic as Data Controller; Virelia as Data Processor

For Patient Data, the Clinic acts as the data controller and Virelia acts as a data processor, processing Patient Data only on the Clinic's documented instructions, including instructions communicated through the Clinic's use of the Service.

For Clinic User Data, Virelia may act as a data controller to the extent necessary to operate, secure, maintain, support, and improve the Service.

6.2 Clinic Responsibilities

The Clinic is responsible for:

  • Ensuring it has an appropriate lawful basis to collect, use, and process Patient Data
  • Obtaining patient consents, notices, or authorisations where required by Applicable Law
  • Ensuring only authorised personnel access Patient Data
  • Maintaining appropriate confidentiality, access-control, and operational policies
  • Ensuring the accuracy and completeness of Patient Data entered into the Service
  • Configuring user roles and permissions appropriately
  • Determining and complying with regulatory, registration, licensing, and reporting obligations applicable to the Clinic
  • Maintaining operational procedures appropriate for continuity of patient care

6.3 Virelia Responsibilities

For Patient Data, Virelia will:

  • Process Patient Data solely for purposes necessary to provide, maintain, secure, and support the Service
  • Implement reasonable technical, organisational, and administrative safeguards designed to protect Patient Data
  • Restrict access to Patient Data to authorised personnel and contractors subject to confidentiality obligations
  • Not sell Patient Data
  • Provide reasonable assistance to Clinics responding to lawful data subject requests or regulatory inquiries where required by Applicable Law and reasonably related to the Service
  • Maintain records and security measures appropriate to our role as processor

Access to Patient Data by authorised Virelia personnel is limited to operational purposes such as technical support, maintenance, troubleshooting, security monitoring, and legal compliance.

6.4 Data Protection Officer

Virelia maintains responsibility for oversight of its own data protection and privacy obligations.

Clinics remain responsible for determining whether they are required to appoint their own data protection officer or equivalent role under Applicable Law.

Nothing in these Terms appoints Virelia as the Clinic's compliance officer, legal representative, or data protection officer.

6.5 Sub-processors

To provide the Service, Virelia may engage third-party infrastructure, hosting, communication, analytics, monitoring, authentication, and support providers ("Sub-processors").

Virelia will take reasonable steps to ensure Sub-processors handling Patient Data are subject to confidentiality and security obligations appropriate to the nature of the data processed.

7. Cross-border Processing and Hosting

The Service may store and process data using infrastructure located outside Zimbabwe, including infrastructure located primarily in the United Kingdom (London) and other jurisdictions where our service providers operate.

The Clinic authorises such cross-border processing and transfers to the extent reasonably necessary to provide the Service.

Virelia will implement reasonable contractual, technical, and organisational safeguards designed to protect personal data during such transfers.

8. Security Incidents and Breach Notification

A "Security Incident" means a confirmed or reasonably suspected unauthorised access to, disclosure of, loss of, or compromise of personal data or the confidentiality, integrity, or availability of the Service.

Where a Security Incident affects Patient Data:

  • Virelia will notify the affected Clinic without undue delay after becoming aware of the incident
  • Virelia will provide reasonable information and assistance necessary to help the Clinic meet its legal and regulatory obligations

Clinics remain responsible for determining and fulfilling their own reporting and notification obligations as data controllers unless Applicable Law specifically requires Virelia to notify in a particular context.

Clinics are responsible for maintaining current administrative and emergency contact information for incident notifications.

9. Medical Record Integrity and Clinical Responsibility

Axon includes safeguards intended to support medical record integrity, including audit trails, encounter locking, and amendment tracking.

Locked records may not be permanently deleted through ordinary system workflows. Corrections and updates may occur through documented amendment or supplemental record processes.

The Service is a technology tool intended to support healthcare recordkeeping and clinic administration. The Service does not provide medical advice and does not replace professional medical judgment, legal obligations, or independent clinical verification procedures.

The Clinic remains solely responsible for:

  • Clinical decisions and patient care
  • The completeness and accuracy of records
  • Compliance with professional and legal obligations
  • Maintaining continuity-of-care procedures, including during downtime, outages, offline operation, or connectivity interruptions

10. Intellectual Property and Data Ownership

Virelia and its licensors retain all intellectual property rights in and to the Service, including software, branding, designs, workflows, documentation, and underlying technology.

Clinics retain ownership of Patient Data and clinical content entered into the Service.

Subject to these Terms and any applicable Service Agreement, Clinics may request export of their Patient Data in a reasonably accessible format.

Virelia may generate aggregated and de-identified statistical information derived from use of the Service for analytics, security, operational improvement, and service development purposes, provided such information does not identify Clinics or patients.

11. Service Availability, Support, and Changes

The Service depends on internet connectivity, third-party infrastructure providers, user devices, and supporting systems, all of which may affect availability or performance.

While we aim to maintain reliable operation, the Service is provided on an "as available" basis and uninterrupted availability is not guaranteed.

Axon may include offline functionality to support continued operation during temporary connectivity disruptions.

Support services do not include medical, legal, regulatory, or compliance advisory services.

We may modify, suspend, update, or discontinue portions of the Service from time to time for operational, security, compliance, maintenance, or product development purposes.

Clinics are encouraged to maintain operational backup and continuity procedures appropriate to their professional and regulatory obligations.

12. Fees and Payment

The Service may be offered free of charge during promotional, testing, pilot, or pre-launch periods.

Virelia reserves the right to introduce subscription fees or paid plans in the future upon reasonable prior notice to Clinics.

Once paid plans are introduced:

  • Fees will be billed in accordance with the applicable pricing plan
  • Failure to pay applicable fees may result in suspension or restriction of access following reasonable notice
  • Continued use of the Service after pricing changes take effect constitutes acceptance of the updated pricing

13. Data Export, Retention, and Deletion

Upon termination of a Clinic's Account and subject to Applicable Law:

  • Clinics may request export of Patient Data within 30 days following termination
  • Export requests may be subject to reasonable verification, technical limitations, and applicable security procedures
  • Following the export period, Virelia may delete, anonymise, archive, or restrict access to Patient Data except where retention is required or permitted by law, regulatory obligation, backup processes, dispute resolution, security purposes, or legal claims

Backup copies may persist temporarily as part of standard disaster recovery and operational continuity processes.

14. Disclaimers

Except as expressly stated in these Terms, the Service is provided on an "as is" and "as available" basis.

To the maximum extent permitted by Applicable Law, Virelia disclaims all implied warranties, including implied warranties of merchantability, fitness for a particular purpose, non-infringement, and uninterrupted availability.

Virelia does not warrant that the Service will be error-free, uninterrupted, or suitable for every clinical workflow or regulatory requirement.

15. Limitation of Liability

To the maximum extent permitted by Applicable Law:

  • Virelia is not responsible for clinical decisions, diagnoses, prescriptions, or patient-care outcomes arising from use of the Service
  • Virelia is not liable for indirect, incidental, special, consequential, or punitive damages, including loss of profits, revenue, business opportunity, goodwill, or data
  • Virelia's total aggregate liability arising out of or relating to the Service shall not exceed the greater of: (a) the total fees paid by the Clinic to Virelia during the 12 months preceding the claim; or (b) US$1,000

Nothing in these Terms excludes liability for fraud, wilful misconduct, or liability that cannot legally be excluded under Applicable Law.

16. Indemnification

The Clinic agrees to indemnify and hold harmless Virelia, its directors, employees, contractors, and affiliates against claims, liabilities, damages, losses, and expenses arising from:

  • The Clinic's misuse of the Service
  • Breach of these Terms
  • Violation of Applicable Law
  • Unauthorised or unlawful processing of Patient Data by the Clinic or its users

17. Suspension and Termination

Either party may terminate the Service relationship upon 30 days' written notice unless otherwise agreed in writing.

Virelia may suspend or terminate access immediately where reasonably necessary to:

  • Protect the security or integrity of the Service
  • Prevent unlawful or harmful activity
  • Comply with Applicable Law or regulatory obligations
  • Address material breaches of these Terms
  • Respond to non-payment under applicable paid plans

Upon termination, access to the Service may be revoked and data handling will proceed in accordance with Section 13.

18. Force Majeure

Neither party shall be liable for delays, failures, or inability to perform caused by circumstances beyond reasonable control, including power outages, internet failures, cyberattacks, labour disputes, natural disasters, acts of government, infrastructure failures, or telecommunications disruptions.

19. Governing Law

These Terms are governed by the laws of Zimbabwe.

Any disputes arising from or relating to these Terms or the Service shall be subject to the jurisdiction of the courts of Zimbabwe.

20. Changes to Terms

We may update these Terms from time to time.

Where changes are material, we will provide reasonable notice to Clinics, including notification through the Service or by email.

Continued use of the Service after updated Terms become effective constitutes acceptance of the revised Terms.

21. Contact

Virelia Health System (Private) Limited
info@virelia.co.zw