FlowMed Subscription Agreement

1. About this Agreement

This FlowMed Subscription Agreement ("Agreement") is between OnLocum ("OnLocum", "we", "us") and the healthcare facility that subscribes to FlowMed ("the Facility", "you").

It applies together with our Terms of Service, which cover the rules for every OnLocum account, including conduct and staffing. If this Agreement and the Terms of Service say different things about FlowMed, this Agreement applies. Your order form applies over both where it sets out your specific figures or terms.

You accept this Agreement by signing an order form that refers to it, or by activating FlowMed for your facility.

2. Definitions

• FlowMed means the hospital management information system OnLocum provides, including its web application and the integrations it offers.
• Order form means the document or contract you sign with OnLocum that states your facility's level, fees, usage cap, term start date and any setup fee.
• Facility Data means all information you or your staff put into FlowMed, including patient records ("Patient Data").
• Billed encounter means a patient visit for which a bill is raised in FlowMed.
• Inpatient bed-day means each day a patient is admitted to a bed in your facility as recorded in FlowMed.
• The Act means the Kenya Data Protection Act, 2019, and the regulations made under it.

3. The FlowMed Service

We will provide FlowMed to your facility for the term, with the modules and number of branches stated in your order form. We may improve and change FlowMed over time, but we will not remove a core function you rely on during a paid term without telling you in advance.

FlowMed is a tool for your staff. It does not provide medical advice, and clinical decisions remain the responsibility of your licensed professionals.

4. Fees

FlowMed is priced in Kenya Shillings (KES). Your order form states your figures. The structure is:

• Annual base fee: set by your facility's KEPH level and billed once a year, in advance.
• Usage fees: charged per billed encounter and per inpatient bed-day, invoiced monthly.
• Monthly usage cap: the usage fees you pay in any month will not exceed the cap in your order form. The cap is based on the patient volume you declare, and we review it once, after your third month, against your actual usage. Any change from that review is confirmed to you in writing before it applies.
• Setup fee: where one applies, a one-time setup fee is stated in your order form.

4.1 Facilities that joined during the trial

If your facility joined FlowMed during the 30-day trial, you keep your free period until 30 October 2026. Billing under this Agreement starts after that date.

4.2 Taxes

Fees are exclusive of taxes unless your order form says otherwise. Applicable taxes are added to invoices as required by Kenyan law.

5. Invoices and Payment

Invoices are due within 14 days of the invoice date. You can pay by M-Pesa or by the other methods shown on the invoice.

5.1 Overdue invoices: read-only access

If an invoice is more than 30 days overdue, your facility moves to read-only access until it is paid:

• Your records stay viewable, and you can still export them.
• New visits and new billing are blocked.
• Patient records are never deleted because of non-payment.
• Full service is restored once the overdue amount is paid.

6. Term, Renewal and Cancellation

• The term is one year from the start date in your order form, and renews for a further year at the end of each term.
• The annual base fee is billed yearly and is non-refundable once the term has started.
• You may cancel by giving us written notice at least 30 days before the renewal date. Your service then continues until the end of the current term and does not renew.

7. Termination and Exit

7.1 Ending the Agreement

Either party may end this Agreement if the other seriously breaches it and does not put the breach right within 30 days of written notice.

7.2 Getting your data out

After the Agreement ends you have 90 days to export your Facility Data. During that time your access is read-only. After the 90 days we delete Facility Data, except where Kenyan law requires us to keep it for longer, in which case we keep only what the law requires, for as long as it requires, and keep protecting it under this Agreement.

8. Your Data

You own your Facility Data. For Patient Data and other personal data in FlowMed, your facility is the data controller and OnLocum is the data processor under the Act. We process that data only on your documented instructions, as set out in the Data Processing Annex, which forms part of this Agreement.

We do not sell Facility Data, and we do not use Patient Data for our own purposes.

9. Your Responsibilities

• Have a lawful basis under the Act for the personal data you put into FlowMed, and give patients the notices the Act requires.
• Control who on your staff has access, give each person only the role they need, and remove access promptly when someone leaves.
• Keep login details confidential and tell us promptly of any suspected misuse.
• Check that the records your staff enter are accurate.

10. Limitation of Liability

OnLocum's total liability to you arising out of or in connection with FlowMed and this Agreement is limited to the fees you paid to OnLocum for FlowMed in the 12 months before the claim arose.

Neither party is liable to the other for indirect or consequential loss, including loss of profit.

Nothing in this Agreement limits or excludes any liability that cannot be limited or excluded by law, or either party's obligations under the Act.

Staffing services remain subject to the limitation of liability in our Terms of Service.

11. General

11.1 Changes to this Agreement

We may publish a new version of this Agreement. Each version has a version number and an effective date. A new version applies to you from your next renewal, unless the change is required by law, in which case we will tell you when it applies.

11.2 Governing law and disputes

This Agreement is governed by the laws of the Republic of Kenya. We will first try to resolve any dispute informally. If that fails, the dispute will be resolved by arbitration in Nairobi under the Arbitration Act, 1995.

Annex: Data Processing

This Annex sets out how OnLocum processes personal data in FlowMed on your behalf, as required by the Act.

A1. Purpose and scope

We process personal data only to provide, support and secure FlowMed for your facility, and only on your documented instructions: this Agreement, your order form, your configuration of FlowMed, and any further written instructions you give us. The data includes patient identity and contact details, clinical and billing records, and staff user details. If we think an instruction breaks the Act, we will tell you.

A2. Confidentiality of personnel

Only OnLocum staff and contractors who need access to provide the service can access personal data, and each of them is bound by a duty of confidentiality.

A3. Security measures

• Encryption in transit: connections to FlowMed use HTTPS, and FlowMed's connection to its database is encrypted.
• Encryption at rest: selected sensitive fields, such as national identity numbers, sign-in secrets and integration credentials, are encrypted in the database, and offsite backup copies are encrypted.
• Role-based access: each user is given a role, and what they can see and do in FlowMed depends on that role.
• Tenant separation: each facility's records are kept separate, and one facility's users cannot see another facility's records.

A4. Sub-processors

We use the following categories of sub-processor. We bind each to data protection obligations no weaker than this Annex, and we will tell you before we add a new category.

• Cloud hosting: servers, database and storage.
• Offsite backup storage: encrypted backup copies.
• National health integrations: the national health information systems your facility chooses to connect to.
• Payments: mobile money payment processing.
• Messaging: email and SMS delivery, used to send notifications.
• AI-assisted features: AI service providers, when your facility uses those features.
• Error monitoring: technical error reports.

A5. Personal data breaches

If we become aware of a personal data breach affecting your data, we will notify you without undue delay, tell you what we know, and help you meet your own duty to notify the Data Commissioner and affected patients.

A6. Data subject requests

If a patient or other person asks to exercise their rights under the Act, we will help you respond. If a request comes to us directly, we will pass it to you.

A7. Return, export and deletion

You can export your data at any time while the Agreement is in force. At exit, the 90-day export period and deletion in section 7.2 apply.

A8. Audits

On reasonable notice, we will give you the information you need to show that this Annex is being followed, and will cooperate with an audit by you or an auditor you appoint who is bound by confidentiality.

Contact Us