Terms of Service

These Terms of Service ("Terms") constitute a legally binding agreement between you ("Customer," "User," or "Tenant") and Novascape Technologies Ltd ("Company," "we," "us," or "our"), the developer and operator of PharmaSync. These Terms govern your access to and use of the PharmaSync platform, including all features, integrations, APIs, mobile applications, and related services (collectively, the "Service" or "Platform").

By clicking "I Agree," creating an account, or otherwise accessing or using the Platform, you acknowledge that you have read, understood, and agree to be bound by these Terms and all policies incorporated by reference, including our Privacy Policy available at pharmasync.co.ke/privacy.

If you are accepting these Terms on behalf of an organization, you represent and warrant that you have the authority to bind that organization, and "you" and "your" will refer to that organization.

Novascape Technologies Ltd is incorporated and operates under the laws of the Republic of Kenya.

For the purposes of these Terms, the following definitions apply:

To access or use PharmaSync, you must:

• Be at least 18 years of age.
• Have the legal capacity to enter into binding contracts under Kenyan law.
• If acting on behalf of an organization, have authority to legally bind that organization to these Terms.
• Not be barred from receiving services under applicable laws of Kenya or any other jurisdiction.
• Have a legitimate, lawfully operating pharmacy or healthcare business.

You are responsible for maintaining the security of your account credentials. Specifically, you agree to:

• Provide accurate, complete, and current registration information and keep it updated.
• Maintain the confidentiality of your login credentials and not share them with unauthorized persons.
• Immediately notify us at security@pharmasync.co.ke of any unauthorized access or suspected breach.
• Ensure all Users under your Tenant account comply with these Terms.
• Implement appropriate access controls, including role-based permissions, for your staff.
• Enable two-factor authentication where available and recommended by PharmaSync.

You are fully responsible for all activities that occur under your account, whether or not authorized by you. We will not be liable for any loss resulting from unauthorized use of your account credentials.

PharmaSync offers multiple subscription tiers to meet the needs of different pharmacy operations. Current pricing, feature breakdowns, and tier comparisons are available at pharmasync.co.ke/pricing and constitute the authoritative and up-to-date pricing reference. Prices listed in these Terms or any other document are for illustrative purposes only and may not reflect current rates.

We reserve the right to modify pricing at any time, provided we give you at least 30 days' written notice before any price change takes effect for your existing subscription. Continued use of the Platform after the effective date of the price change constitutes your acceptance of the new pricing.

New customers may access a 14-day free trial of PharmaSync without providing payment information upfront, subject to the following conditions:

• Only one free trial is permitted per organization. Creating multiple accounts to circumvent this limit is prohibited.
• Trial accounts have access to a defined feature set which may not include all paid-tier features.
• Trial data is retained for 30 days after trial expiry if you do not convert to a paid subscription.
• We reserve the right to modify or terminate trial offers at any time.
• Trial use is subject to fair use limits.

PharmaSync accepts the following payment methods:

• M-Pesa (Safaricom) — via Lipa Na M-Pesa or Paybill.
• Credit and debit cards (Visa, Mastercard).
• Bank transfer — for annual plans or enterprise arrangements (subject to prior arrangement).

All payments are processed in Kenya Shillings (KES) unless otherwise agreed in writing. VAT (where applicable under Kenyan tax law) will be added to your invoice. By providing payment details, you authorize us to charge the applicable subscription fees.

Subscriptions are billed on a recurring basis (monthly or annually) depending on the plan you select. Unless you cancel before the renewal date:

• Your subscription will automatically renew at the end of each billing cycle.
• The fee for the renewal period will be charged to your payment method on file.
• You will receive at least 30 days' notice before any pricing adjustments take effect on renewal.
• Failed payments will result in a 7-day grace period; if not resolved, the account will be downgraded or suspended.

You may upgrade or downgrade your subscription plan at any time through the Platform settings or by contacting our support team. Upgrades take effect immediately and you will be charged a pro-rated amount for the remainder of the current billing cycle. Downgrades take effect at the next billing cycle. Feature access will adjust accordingly at the time of the change.

You may cancel your subscription at any time. Upon cancellation:

• Your access to paid features will continue until the end of the current billing period (no pro-rata refunds on cancellation, except under the 30-day money-back guarantee).
• Your account will enter a 90-day grace period during which your data remains accessible in read-only mode.
• You may export your Customer Data at any time during the grace period using the Platform's data export tools.
• After the 90-day grace period, your data will be deleted from our active systems, subject to mandatory legal retention obligations.
• Certain records (financial, prescription, controlled substances) will be retained as required by law — see Section 15 for the Data Retention Schedule.

PharmaSync provides an integrated pharmacy management platform including the following core capabilities:

• Point of Sale (POS) — retail and wholesale sales processing, cash and M-Pesa payments.
• Inventory Management — stock tracking, batch management, expiry alerts, reorder management.
• Prescription Management — prescription entry, verification, dispensing workflow, history.
• Insurance Claims Processing — claims submission and tracking (SHA integration planned).
• Staff Management — roles, scheduling, payroll computation, attendance, leave management.
• Analytics and Reporting — sales analytics, inventory reports, financial dashboards.
• eTIMS Integration — Kenya Revenue Authority electronic tax invoice management system.
• Online Store — optional e-commerce storefront for your pharmacy.
• OCR (Optical Character Recognition) — automated data extraction from prescription documents.
• Loyalty Programs — customer loyalty and reward scheme management.
• Accounting — income, expense, accounts payable/receivable, and financial statements.
• Multi-Branch Support — management of multiple pharmacy locations under one account.
• Campaigns and Messaging — SMS, WhatsApp, and email marketing campaigns.

Not all features are available on all subscription plans. Feature availability by plan is detailed at pharmasync.co.ke/pricing. We reserve the right to move features between plans with 30 days' notice to affected customers.

PharmaSync is provided as a shared multi-tenant service. To protect the performance and availability of the Platform for all customers, your use is subject to fair use limits, including reasonable limits on:

• API request volumes and data processing throughput.
• Storage usage (document attachments, images, exports).
• Bulk data import and export operations.
• Automated or scripted interactions not supported by documented APIs.

If your usage materially exceeds normal usage patterns, we may contact you to discuss a custom plan or request that you moderate usage.

You agree to use the Platform only for lawful purposes and in accordance with these Terms. You warrant that:

• All information entered into the Platform is accurate and lawfully obtained.
• You will comply with all applicable Kenyan laws and regulations, including PPB, KRA, KDPA, and other applicable statutes.
• You will not use the Platform to process data of individuals without appropriate legal basis or consent.
• Your pharmacy operations are conducted in compliance with all applicable professional and regulatory standards.

You must not use PharmaSync to:

• Process, sell, or dispense controlled substances or prescription drugs in violation of PPB regulations or the Narcotic Drugs and Psychotropic Substances Act.
• Falsify, forge, or manipulate prescription records, patient data, or financial records.
• Submit fraudulent insurance claims or engage in medical billing fraud.
• Access or attempt to access another Tenant's data or systems.
• Reverse engineer, decompile, or attempt to extract source code from the Platform.
• Use the Platform in any manner that could damage, disable, overburden, or impair our servers.
• Transmit malware, viruses, or any malicious code.
• Circumvent any security, authentication, or access control measures.
• Resell, sublicence, or transfer access to the Platform without our written consent.
• Use the Platform for any activity that violates the Computer Misuse and Cybercrimes Act 2018 or any other applicable law.

Violation of these acceptable use provisions may result in immediate suspension or termination of your account without refund, reporting to relevant regulatory authorities (including PPB, KRA, ODPC, NC4, or law enforcement), and civil or criminal liability. We reserve the right to cooperate fully with authorities investigating violations.

All intellectual property rights in the Platform — including but not limited to the software, code, algorithms, designs, user interface, documentation, brand assets, trademarks, and trade names — are owned by or licensed to Novascape Technologies Ltd. Nothing in these Terms transfers any IP rights to you.

"PharmaSync" and the PharmaSync logo are trademarks of Novascape Technologies Ltd. You may not use our trademarks without our prior written consent.

Subject to your compliance with these Terms and payment of applicable fees, we grant you a limited, non-exclusive, non-transferable, revocable licence to access and use the Platform solely for your internal pharmacy operations during the term of your subscription. This licence does not include the right to resell, sublicence, or make the Platform available to third parties.

We may use anonymized, aggregated data that cannot identify individual pharmacies, patients, or customers for industry benchmarking, product improvement, research, and statistical analysis. This data will never be sold to third parties or used to identify your business or your customers.

If you submit feedback, suggestions, feature requests, or improvements to us ("Feedback"), you grant us a perpetual, irrevocable, royalty-free, worldwide licence to use, incorporate, and commercialize the Feedback in any manner without any obligation, compensation, or attribution to you.

We are committed to complying with the Kenya Data Protection Act 2019 (KDPA) and all regulations made thereunder. Our comprehensive Privacy Policy — available at pharmasync.co.ke/privacy — is incorporated into these Terms by reference and governs how we collect, process, store, and protect personal data.

With respect to Customer Data (including patient records, staff records, and sales data), PharmaSync acts primarily as a Data Processor on your behalf. You, as the Tenant, are the Data Controller responsible for determining the purposes and means of processing that data.

As Data Controller, you are responsible for ensuring you have the appropriate legal basis and consents to collect and process patient and customer data before entering it into PharmaSync.

PharmaSync (Novascape Technologies Ltd) is registered with the Office of the Data Protection Commissioner (ODPC) as required under the KDPA. Registration Number: ODPC Registration Number — Pending. Registration Date: Registration Date — Pending.

In accordance with the KDPA and best practice for health data processors, we have conducted or are conducting a Data Protection Impact Assessment (DPIA) for our health data processing activities. DPIA Completion Date: DPIA Date — Pending. Our DPO is available at dpo@pharmasync.co.ke to discuss data protection matters.

Under the KDPA, individuals whose data is processed through PharmaSync have the following rights, which you as Data Controller must facilitate:

• Right to be informed about data processing.
• Right of access to personal data.
• Right to rectification of inaccurate data.
• Right to erasure ('right to be forgotten') subject to legal retention obligations.
• Right to restriction of processing.
• Right to data portability.
• Right to object to processing.
• Right not to be subject to solely automated decision-making.

For data rights requests related to PharmaSync as a processor, contact: datarights@pharmasync.co.ke.

PharmaSync integrates with the following third-party services to deliver its functionality. By using PharmaSync, you acknowledge that your data may be processed by these services as necessary for the integration:

Use of third-party services is subject to those providers' own terms and privacy policies. We are not responsible for the practices of third-party providers. You are advised to review the relevant terms for each integration you use.

PharmaSync shall not be liable for any service interruptions, data loss, errors, or failures caused by third-party service providers, including but not limited to M-Pesa downtime, KRA eTIMS unavailability, or SMS delivery failures. We will make commercially reasonable efforts to communicate known third-party outages and provide workarounds where possible.

PharmaSync provides pharmacy management tools to assist licensed pharmacists in their operations. We expressly disclaim:

• Any responsibility for dispensing errors, incorrect drug interactions flagged or not flagged, or patient harm arising from use of the Platform.
• Any warranty that drug databases, formularies, or reference information within the Platform are complete, current, or accurate.
• Any liability for reliance on the Platform's clinical or pharmaceutical data without independent professional verification.

Insurance claims processing features are provided to assist in submission and tracking only. PharmaSync does not guarantee claim approval, reimbursement amounts, or compliance with any insurer's specific requirements. You remain responsible for ensuring claims are accurate, complete, and comply with the relevant insurer's policies and applicable law.

The Platform's Optical Character Recognition (OCR) feature extracts data from prescription images and documents. OCR accuracy depends on image quality, handwriting legibility, and document formatting. OCR outputs must always be verified by a qualified pharmacist before acting on the extracted data. PharmaSync is not liable for errors arising from OCR inaccuracies.

Features marked as "Beta," "Preview," or "Experimental" are provided as-is, without any warranty of fitness, accuracy, or availability. We may modify, restrict, or permanently discontinue beta features at any time without notice or liability. Use of beta features is at your own risk.

To the maximum extent permitted by applicable Kenyan law:

• The Platform is provided 'AS IS' and 'AS AVAILABLE' without warranties of any kind, express or implied.
• Our total aggregate liability arising out of or related to these Terms or the Service shall not exceed the fees paid by you in the 12-month period immediately preceding the event giving rise to the claim.
• We shall not be liable for any indirect, incidental, special, consequential, punitive, or exemplary damages, including loss of profits, data, goodwill, or business interruption.
• Some jurisdictions do not allow the exclusion of certain warranties or limitation of liability — in such cases, our liability is limited to the maximum extent permitted by law.

You acknowledge that as a licensed pharmacy operator, you are required to hold appropriate professional indemnity and liability insurance as required by your professional body and applicable Kenyan law. PharmaSync is a software tool and does not provide professional liability coverage for your pharmacy operations.

You agree to indemnify, defend, and hold harmless Novascape Technologies Ltd, its officers, directors, employees, and agents from and against any claims, liabilities, damages, losses, costs, and expenses (including reasonable legal fees) arising out of or related to: (a) your use or misuse of the Platform; (b) your violation of these Terms; (c) your violation of any applicable law or regulation; (d) your pharmacy operations; or (e) any claim by a third party (including patients, staff, or regulators) arising from your actions or omissions.

• You must hold and maintain a current PPB operating licence and ensure all pharmacy staff hold valid professional registration.
• PharmaSync provides tools to assist with record-keeping obligations under the Act, including prescription registers, stock records, and controlled substance logs.
• You must retain prescription and dispensing records for the periods required by PPB regulations — see Section 15.
• You must cooperate with PPB inspections and, where required, provide access to records maintained on PharmaSync.
• PharmaSync features do not guarantee PPB compliance — you are responsible for verifying that your use of the Platform meets all PPB requirements.

• PharmaSync integrates with KRA's eTIMS system to assist with electronic tax invoice management and submission.
• You are responsible for ensuring all transactions are accurately recorded and that eTIMS submissions are complete and timely.
• Financial records, including sales records and tax invoices generated through PharmaSync, must be retained for a minimum of 7 years as required by the Tax Procedures Act.
• PharmaSync is a tool; tax advice and compliance strategy are your responsibility. Consult a qualified tax advisor for tax matters.

• As a Data Controller of patient and customer personal data, you must register with the ODPC where required and comply with all KDPA obligations.
• You must ensure you have a lawful basis for processing all personal data entered into PharmaSync.
• You must implement appropriate consent mechanisms for collecting and processing patient data.
• Data subjects have rights under the KDPA (see Section 6.5) and you must be prepared to fulfil those rights.
• In the event of a personal data breach, you must notify the ODPC within 72 hours of becoming aware of the breach, where required under the KDPA.
• You must ensure any data sharing with insurers, referral hospitals, or other third parties is KDPA-compliant.

• You must respect patient rights to health information and confidentiality as established under the Health Act 2017.
• Patient health information stored in PharmaSync must be managed in accordance with the confidentiality obligations under the Act.
• You must maintain the integrity and security of patient health records.

• You must implement reasonable cybersecurity measures to protect your PharmaSync account and the data within it, including strong passwords, access controls, and staff training.
• Any cybersecurity incident involving your PharmaSync account that constitutes a cybercrime or material data breach must be reported to NC4 within 24 hours of detection.
• NC4 Contact: incident@nc4.go.ke | https://www.nc4.go.ke
• You must not use PharmaSync in any manner that constitutes unauthorized access, data interception, or any other offence under the Act.

• PharmaSync's messaging features (SMS, WhatsApp, email campaigns) must only be used with the explicit consent of recipients.
• You must maintain records of consent for all marketing communications sent through PharmaSync.
• All marketing messages must include an opt-out mechanism and must comply with KICA requirements for electronic communications.
• You may not use PharmaSync's messaging features for unsolicited bulk communications.

• You must ensure your pharmacy operations comply with the Consumer Protection Act 2012, including fair pricing, accurate product labelling, and honest trading.
• PharmaSync's POS and inventory features should be used in a manner consistent with your obligations under the Act.

• Staff data processed through PharmaSync (including payroll, attendance, and personal records) must be handled in compliance with the Employment Act 2007.
• Payroll records generated by PharmaSync must be maintained for the duration of employment plus the legally required period.
• Staff must be informed of how their personal data is used within your pharmacy management systems.

• Pharmacies handling significant cash transactions must comply with the Proceeds of Crime and Anti-Money Laundering Act (POCAMLA).
• You must report suspicious transactions to the Financial Reporting Centre (FRC) where required.
• Financial records, including transaction records generated through PharmaSync, must be retained for a minimum of 7 years as required by POCAMLA.
• PharmaSync's transaction reporting features may assist in identifying unusual patterns, but AML compliance decisions remain your responsibility.

M-Pesa payment processing through PharmaSync is facilitated via Safaricom's licensed payment infrastructure. You must comply with all applicable requirements of the National Payment System Act 2011 and CBK regulations relating to your acceptance of electronic payments. You must not use PharmaSync to process payments in violation of applicable financial regulations.

• Insurance claims submitted through PharmaSync must be accurate, complete, and comply with the relevant insurer's requirements and the Insurance Act, Cap 487.
• Insurance records, including claim submissions, approvals, and payment records, must be retained for a minimum of 7 years.
• Upon availability of the SHA integration, use of that feature will be subject to SHA's own terms, regulations, and processing requirements.
• Submission of false or fraudulent insurance claims is a criminal offence and PharmaSync will cooperate with investigations of suspected fraud.

We target 99.9% monthly uptime for the PharmaSync Platform. We guarantee a minimum uptime of 99.0% per calendar month. Uptime is measured on a calendar month basis, excluding scheduled maintenance windows.

Additional SLA parameters:

• Backup Retention: 30 days
• Recovery Point Objective (RPO): 24 hours
• Recovery Time Objective (RTO): 8 hours
• Breach Notification: 72 hours

Scheduled maintenance is performed during the maintenance window of 1:00 AM – 5:00 AM EAT. We will provide at least 72 hours advance notice of scheduled maintenance via email and in-app notification. Emergency maintenance may be performed without advance notice in critical circumstances such as active security threats.

Response times are measured during business hours (Mon–Sat 8:00 AM – 6:00 PM EAT) unless the severity is Critical (Sev 1), which is monitored 24/7.

If we fail to meet the guaranteed uptime minimum of 99.0%, you may be eligible for service credits applied to your next invoice:

SLA credits are subject to the following limitations:

• Credits must be requested within 30 days of the relevant downtime event by contacting support@pharmasync.co.ke.
• Credits are the sole and exclusive remedy for SLA breaches and do not entitle you to a cash refund.
• Credits are capped at 20% of your monthly subscription fee in any calendar month.
• Credits do not apply to downtime caused by third-party services (e.g., M-Pesa, eTIMS), your own actions or infrastructure, force majeure events, or scheduled maintenance.
• Accounts in arrears are not eligible for SLA credits.

These Terms and any dispute arising out of or in connection with them shall be governed by and construed in accordance with the laws of the Republic of Kenya, without regard to its conflict of law provisions.

Subject to the dispute resolution process below, both parties submit to the exclusive jurisdiction of the courts of Nairobi, Kenya, for resolution of any disputes that cannot be resolved through negotiation or mediation.

In the event of a dispute, the parties agree to first attempt to resolve the matter through good-faith negotiation. Either party may initiate the negotiation process by providing written notice to the other party describing the dispute in reasonable detail. The parties shall have 14 calendar days from delivery of the notice to resolve the dispute through negotiation before proceeding to mediation or arbitration.

If the dispute is not resolved through negotiation within 14 days, the parties agree to submit the dispute to mediation in Nairobi, Kenya. If mediation is unsuccessful within 30 calendar days of commencement, the dispute shall be referred to binding arbitration in Nairobi in accordance with the Arbitration Act (Cap 49) of Kenya. The arbitration shall be conducted in the English language. The arbitral award shall be final and binding on both parties.

All disputes must be brought in the parties' individual capacity. Neither party may bring or participate in class action, consolidated, or representative proceedings against the other. This waiver applies to all claims, regardless of the forum.

Any claim or cause of action arising out of or related to these Terms or the Service must be filed within 12 months of the date on which the claim arose. Claims filed after this period are permanently barred.

We may modify these Terms at any time. Material changes will be communicated by email to your registered address and by prominent in-app notice at least 30 calendar days before the changes take effect. Continued use of the Platform after the effective date of the changes constitutes your acceptance of the revised Terms. If you do not agree to the revised Terms, you must discontinue use and may cancel your subscription in accordance with Section 12.3.

We reserve the right to modify, add, or remove Platform features at any time. We will use reasonable efforts to provide advance notice of material feature removals. We will not be liable for any modification or discontinuation of features, provided we have met our notice obligations.

You may terminate your subscription at any time through the Platform's account settings or by contacting our support team. Termination takes effect at the end of the current billing period. You remain responsible for all fees incurred prior to termination.

We may suspend or terminate your account immediately if:

• You breach any material provision of these Terms.
• Your PPB licence is revoked, suspended, or lapses.
• You fail to pay fees after the applicable grace period.
• We are required to do so by law or a regulatory authority.
• We reasonably believe your account is being used for fraudulent or illegal activity.
• You become insolvent or enter formal insolvency proceedings.

Where possible, we will provide notice before suspension. In cases of serious breach or legal obligation, suspension may be immediate.

Following termination (by either party), your data will be retained for a 90-day grace period in read-only mode during which you may export your Customer Data. After the grace period, your data will be deleted from our active systems, except where we are required to retain records under applicable Kenyan law. See Section 15 for the Data Retention Schedule.

These Terms, together with our Privacy Policy and any order forms, subscription agreements, or addenda executed between the parties, constitute the entire agreement between you and Novascape Technologies Ltd with respect to the subject matter hereof and supersede all prior agreements, representations, and understandings.

If any provision of these Terms is found to be invalid, illegal, or unenforceable by a competent court or regulatory authority, that provision shall be modified to the minimum extent necessary to make it enforceable. The remaining provisions shall continue in full force and effect.

Our failure to enforce any right or provision of these Terms shall not constitute a waiver of that right or provision. A waiver of any breach shall not be deemed a waiver of any subsequent breach of the same or any other provision.

You may not assign or transfer your rights or obligations under these Terms without our prior written consent. We may assign our rights and obligations under these Terms to an affiliate, successor, or acquirer without restriction, provided we notify you within 30 days of such assignment.

Neither party shall be liable for any failure or delay in performance due to causes beyond their reasonable control, including but not limited to:

• Acts of God, natural disasters, floods, earthquakes, or severe weather events.
• Acts of war, terrorism, civil unrest, or government actions.
• Epidemics, pandemics, or public health emergencies declared by government authorities.
• Power grid failures, internet backbone outages, or telecommunications failures beyond our control.
• Actions or failures of third-party service providers (e.g., cloud infrastructure, payment networks).
• Regulatory orders or injunctions requiring suspension of service.
• Cyberattacks or security incidents originating from state-level or sophisticated threat actors.

Notices under these Terms shall be in writing and delivered by:

• Email — to your registered email address (for notices to you) or to legal@pharmasync.co.ke (for notices to us).
• In-app notification within the Platform.
• Registered mail to the addresses provided in Section 1.2.

Notices are deemed received on the day of delivery if delivered by email (absent a delivery failure notification) or within 5 business days if sent by registered mail.

These Terms are written in the English language. In the event of any inconsistency between an English version and any translation, the English version shall prevail.