Master Services Agreement

Product: Caresoft eICU (tele-ICU platform)  •  Version: 1.1  •  Effective: 01/04/2026

This Master Services Agreement ("Agreement") is made between Caresoft Systems Private Limited, CIN : U72900MH2022PTC387875, registered office 311, Mahesh Industrial Estate , Silver Park, Mira Road East , Thane -401107 ("Caresoft"), and the hospital or healthcare organisation identified in the Order ("Hospital"), and governs the supply of the Caresoft eICU platform and related services (the "Services").

The following documents are incorporated into this Agreement and, in a conflict, take precedence in this order: the signed Order; this Agreement; the Intended Use & Clinical Safety Statement; the Device Interfacing & Integration Policy; the Data Processing Addendum; the Service Level Agreement; and the Privacy Policy. Exception: the Intended Use Statement prevails over all other documents on any question of clinical safety or intended use.

1. Definitions

• "Platform" — the Caresoft eICU software, edge agents, APIs and portals supplied under this Agreement.
• "Patient Data" — all clinical, physiological, demographic and device-derived data relating to the Hospital's patients, processed through the Platform.
• "Clinical Owner" — the registered medical practitioner named by the Hospital as accountable for clinical use of the Platform at a site.
• "Technical Owner" — the person named by the Hospital as accountable for infrastructure, devices and integration at a site.
• "Go-Live Gate" — the conditions in Section 4 that must be satisfied before clinical use begins.
• "Patient Safety Incident" — any event in which the Platform caused or may have caused, or failed to prevent where it was intended to assist, harm or potential harm to a patient.
• "Order" — the signed order form, quotation or schedule specifying sites, licensed beds, modules, term and fees.

2. Scope of Services

Caresoft grants the Hospital a non-exclusive, non-transferable right, during the term and within the licensed bed and user limits, to access and use the Platform for the internal clinical operations of the sites named in the Order, in accordance with the Intended Use Statement.

The Services comprise: platform access across the administrative, hospital-admin and clinical portals; device interfacing within the validated scope; ADT integration; storage, trending, notification, documentation, reporting and export; audit; support per the SLA; and any implementation, training or managed services stated in the Order.

The Hospital must not exceed licensed bed or user counts, sublicense, resell, or provide access to any third party other than its own personnel and contracted clinicians bound by equivalent obligations.

3. Clinical responsibility

• 3.5 Clinical notification thresholds, escalation protocols, staffing of the command centre, and the decision to place any patient under remote observation are the Hospital's clinical decisions.
• 3.6 The Hospital appoints a Clinical Owner and a Technical Owner per site and keeps those appointments current.
• 3.7 The Hospital's clinical governance process must review the Platform's clinical use at least [annually] and after any Patient Safety Incident.

4. Implementation and go-live gate

• Device validation and signed Site Acceptance Tests per the Device Interfacing Policy.
• Clinical Owner and Technical Owner appointed in writing.
• Written escalation protocol issued.
• Written downtime procedure issued to all clinical areas.
• Notification thresholds approved by clinical governance.
• All clinical users trained and recorded.
• Time synchronisation verified.
• ADT feed validated, or manual admission workflow agreed for pilot.
• Signed acknowledgement of the Intended Use Statement.

The Hospital may proceed to clinical use before the gate is complete only under a written, signed exception recording what is outstanding, the compensating controls in place, and the Hospital's acceptance of the resulting risk. Caresoft's obligations and warranties in respect of the affected function do not apply during such a period.

5. Hospital obligations

• Provide and maintain devices, cabling, edge hardware, network, power and biomedical support per the Device Interfacing Policy.
• Ensure ADT information is accurate and timely, and that bed and device moves are recorded promptly.
• Maintain the bed–device mapping and the site validated device list.
• Notify Caresoft in writing at least [14] days before firmware upgrades, device replacement, new device types, or network changes.
• Monitor integrity signals and act on them per the Device Interfacing Policy §11.
• Train users, control access, and revoke access promptly on role change or exit.
• Maintain and rehearse the downtime procedure.
• Obtain all patient consents and give all patient notices required for remote monitoring and data processing.
• Comply with its own accreditation, licensing and medical-records obligations.
• Report Patient Safety Incidents immediately per Section 14.

6. Caresoft obligations

• Supply the Platform in accordance with the documentation and the Intended Use Statement.
• Maintain availability and support per the SLA.
• Maintain the security measures in Section 10 and in the DPA.
• Validate device drivers and support Site Acceptance Testing.
• Maintain audit trails and integrity monitoring, and make them available for incident investigation.
• Notify clinically significant changes per Section 13.
• Investigate and report on Patient Safety Incidents per Section 14.
• Issue field safety notices where a defect affects patient safety at more than one site.
• Maintain documented development, testing, release and defect-management practices, and make a summary available to the Hospital on request.

7. Device interfacing

Device interfacing is governed by the Device Interfacing & Integration Policy, which allocates responsibility in detail. In summary: devices, their maintenance, their calibration and their vendor relationships are the Hospital's; drivers, mapping and ingest are Caresoft's; validation is joint and must be signed by both.

The interface is read-only. Caresoft will not introduce any capability to write to, control or alter a bedside device without a separate written agreement and a documented regulatory and clinical assessment.

Where a device vendor declines to enable, license or document an interface, that device cannot be integrated. This is outside Caresoft's control and is not a breach of this Agreement or the SLA.

8. Patient data — ownership and records

• The Hospital owns all Patient Data. Caresoft claims no ownership and acquires no right to use it except to provide the Services.
• Caresoft acts as the Hospital's data processor in respect of Patient Data, under the Data Processing Addendum.
• Medical records. The Hospital determines whether and to what extent the Platform forms part of its legal medical record, and remains responsible for medical-record retention, integrity and production under applicable law and its accreditation standards. Caresoft's retention settings are configured to support, not to determine, that obligation.
• The Platform maintains an immutable audit trail of access and clinical entries. Records are not deleted by ordinary users; corrections are recorded as amendments with author, timestamp and reason, preserving the original.
• Caresoft does not use Patient Data for its own purposes, does not sell it, and does not use it to train artificial intelligence models. Aggregated, de-identified statistics may be used for capacity planning and product improvement only where they cannot identify any patient, clinician or the Hospital, and only as permitted by the DPA.
• Export in a documented, machine-readable format is available throughout the term and on exit per Section 23.

9. Data protection

Each party complies with applicable data protection law, including the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000 and rules thereunder. The Hospital is the data fiduciary / controller; Caresoft is the data processor. Processing terms, sub-processors, transfer mechanisms, breach notification and audit rights are in the Data Processing Addendum, which is incorporated into this Agreement.

Health data is sensitive. Both parties will apply the heightened care that reflects this, including access minimisation, purpose limitation and masking of identifiers in notifications and support channels.

10. Security

• Caresoft maintains the technical and organisational measures set out in the DPA, including role-based access control, multi-factor authentication for administrative access, encryption in transit and at rest, signed device ingest, immutable audit logging, segregated environments, vulnerability management and periodic penetration testing.
• Security responsibility is shared. The Hospital is responsible for its network, device segment, edge agent physical security, endpoint security, and user access hygiene.
• Each party notifies the other of any suspected security incident affecting the Platform or Patient Data immediately, and in any event within [6] hours of becoming aware, so that regulatory reporting deadlines can be met.
• Caresoft maintains system logs as required under applicable Indian directions and will produce them for incident investigation.

11. Availability, downtime and continuity

• Availability commitments, severities and credits are in the SLA.
• The Hospital must be able to deliver safe care indefinitely without the Platform. A written downtime procedure is a condition of go-live and must be rehearsed at least [annually].
• Planned maintenance is notified at least [7] days in advance and scheduled to minimise clinical impact. The Hospital determines whether additional bedside cover is required.
• Edge agents buffer locally during network interruption; buffered data uploads on restoration. The Hospital must review the outage period for events once data is restored.
• Caresoft maintains documented backup and disaster recovery for the Platform, with the recovery point and recovery time objectives stated in the SLA. These are Platform-level objectives and are not a substitute for the Hospital's own clinical continuity arrangements.

12. Support and maintenance

Support hours, severities and response targets are in the SLA. Patient Safety Incidents are escalated ahead of all other tickets regardless of contractual severity. The Hospital must provide a reachable technical contact and, for clinical issues, a reachable clinical contact, at all times during which the Platform is in clinical use.

13. Change control

• Changes affecting intended use, scoring, notification behaviour, attribution logic or the validated device list are clinically significant and are notified at least [30] days in advance with a description of clinical impact.
• The Hospital may require re-validation, re-training or clinical governance approval before adopting a clinically significant change, and may defer adoption for a reasonable period. Caresoft will support a reasonable deferral but is not obliged to maintain more than [two] concurrent versions.
• Emergency changes correcting a patient safety defect may be deployed immediately, with notice at the time and a written explanation within [2] working days.
• Caresoft will not remove or materially degrade a clinically relevant feature without [90] days' notice.

14. Patient safety incidents

• Caresoft acknowledges within [4] hours, preserves evidence, investigates, and provides a written finding within [10] working days or an interim report where the investigation is longer.
• The parties cooperate fully, including making personnel and records available.
• The Hospital remains responsible for its own clinical incident management, disclosure to patients and families, and reporting to its governance body, accreditation body and any regulator.
• Caresoft is responsible for any manufacturer or vigilance reporting applicable to it, and for field safety notices to other affected sites.
• Cooperation and participation in an investigation is not an admission of liability by either party.

15. Regulatory and accreditation

• Caresoft is responsible for the regulatory status of the Platform as a product, and will state its classification and registration position in the Intended Use Statement and maintain it.
• The Hospital is responsible for its own licensing, accreditation (including NABH or equivalent where applicable), clinical governance, and for any approval required for tele-ICU operation in its jurisdiction.
• Each party notifies the other promptly of any regulatory action, inspection finding or condition that materially affects the Platform or its use.
• If a regulator requires a change to the Platform or to its permitted use, the parties will implement it; if compliance is not reasonably possible, either party may terminate the affected scope on notice with a pro-rata refund of prepaid unused fees.

16. Fees and payment

• Fees, licensed bed count, modules and term are as stated in the Order. Fees are exclusive of GST and other taxes, which the Hospital pays.
• Invoices are payable within [30] days. Overdue amounts attract interest at [1.5]% per month or the maximum permitted by law, whichever is lower.
• Bed count increases are chargeable pro-rata; decreases take effect at renewal.
• Annual escalation, where applicable, is as stated in the Order.

17. Intellectual property

Caresoft and its licensors retain all rights in the Platform, its software, drivers, documentation and marks. The Hospital retains all rights in Patient Data and in its own protocols, content and configurations. Feedback provided by the Hospital may be used by Caresoft without restriction, provided it incorporates no Patient Data and does not identify the Hospital without consent.

Neither party may use the other's name or marks publicly without prior written consent, save that Caresoft may state internally and to regulators that the Hospital is a customer.

18. Confidentiality

Each party protects the other's confidential information with at least reasonable care, uses it only for this Agreement, and discloses it only to personnel and contractors bound by equivalent obligations, or as required by law with notice where permitted. Patient Data is confidential without limit of time. Obligations survive termination for [5] years, and indefinitely for Patient Data and source code.

19. Warranties

Caresoft warrants that: it has the right to grant the licence; the Platform will perform materially in accordance with its documentation and the Intended Use Statement; it will provide the Services with reasonable skill and care in accordance with good industry practice for clinical software; it maintains documented development, testing and release practices; and it will not knowingly introduce malicious code.

The Hospital warrants that: it holds all licences and approvals required to operate its facilities and to conduct remote monitoring; it has obtained all necessary patient consents and given all necessary notices; its clinicians are appropriately qualified and registered; and it will use the Platform only in accordance with the Intended Use Statement.

20. Limitation of liability

21. Indemnities

• By Caresoft: against third-party claims that the Platform as supplied infringes intellectual property rights, and against regulatory penalties directly caused by Caresoft's breach of the DPA, in each case subject to prompt notice, control of defence and cooperation.
• By the Hospital: against claims arising from clinical care, from use outside the Intended Use Statement, from the Hospital's breach of its data protection obligations to patients, from inadequate consent or notice to patients, and from the acts or omissions of its personnel and contracted clinicians.

22. Insurance

• Caresoft maintains, for the term and for [3] years after, professional indemnity / technology errors and omissions cover of not less than [amount] per claim, and cyber liability cover of not less than [amount]. Certificates are provided on request.
• The Hospital maintains medical professional indemnity and public liability cover appropriate to its operations, and confirms that its cover is not invalidated by the use of remote monitoring.
• Neither party's insurance limits its liability under this Agreement.

23. Term, termination and exit

• Term as stated in the Order, renewing automatically for equal periods unless either party gives [90] days' notice.
• Either party may terminate for material breach not cured within [30] days of written notice, or immediately on insolvency.
• The Hospital may terminate immediately on written notice where a defect creates an unacceptable risk to patient safety that Caresoft has not remedied within a period reasonable in the circumstances.
• Caresoft may terminate on [90] days' notice for persistent non-payment or persistent use outside the Intended Use Statement after written warning.

• Data return. Caresoft will export all Patient Data in a documented, machine-readable format, together with the audit trail, within [30] days of request, at no charge on a standard export and at the professional-services rate for anything bespoke.
• Retention and deletion. Caresoft retains Patient Data for [the period the Hospital specifies in writing, consistent with its medical-record retention obligations], then deletes it and certifies deletion. Where the Hospital gives no instruction, Caresoft will retain for [the default period stated in the Order] and seek instruction before deleting.
• Sections 8, 14, 17, 18, 20, 21 and this Section survive termination.

24. Force majeure

Neither party is liable for delay or failure to perform (other than payment) due to causes beyond its reasonable control. The affected party must notify promptly, mitigate, and — where clinical care could be affected — cooperate to implement contingency measures. Force majeure does not excuse either party from the patient safety obligations in Sections 3 and 14, or from preserving evidence.

25. Governing law and disputes

Governed by the laws of India. The parties will escalate to senior representatives for [30] days. Failing resolution, disputes are finally settled by arbitration under the Arbitration and Conciliation Act, 1996 by a sole arbitrator appointed by agreement, seated at [Mumbai, Maharashtra], in English. Subject to arbitration, the courts at [Mumbai, Maharashtra] have exclusive jurisdiction. Either party may seek urgent interim relief from a competent court, including to preserve evidence relating to a Patient Safety Incident.

A dispute, including a payment dispute, does not entitle either party to take any step that would compromise patient safety.

26. General

• Entire agreement — this Agreement and its incorporated documents supersede all prior discussions. Hospital purchase-order terms have no effect.
• Assignment — neither party may assign without written consent, save to a successor of substantially the whole business on notice; the Hospital may withhold consent where an assignment would materially affect patient safety or data protection.
• Subcontracting — Caresoft may subcontract but remains fully responsible; sub-processors are governed by the DPA.
• Notices — in writing to the addresses in the Order, with clinical safety notices also by phone.
• Personnel — neither party solicits the other's personnel during the term and for [12] months after, excluding general advertising.
• Severability, waiver, counterparts, electronic execution — standard. This Agreement may be executed electronically and constitutes an electronic record under the Information Technology Act, 2000.
• Amendment — only in writing signed by both parties, save that Caresoft may update the incorporated policies per Section 13 with the notice stated there.