Terms of Use & Platform Service Agreement
Welcome to OneHealthGrid (owned and operated by Routeget Technologies Consulting Pvt. Ltd.). These Terms of Use govern your access to our website, B2B/B2G digital healthcare platform (HIS, EHR, LIMS, Pharmacy, Telemedicine, and Public Health modules), Ayushman Bharat Digital Mission (ABDM) integrations, HL7 FHIR® APIs, and inbuilt Model Context Protocol (MCP) servers. We have structured this agreement with plain-English TL;DR summaries alongside legally binding clauses so healthcare leaders, developers, and citizens can read with clarity and confidence.
Terms at a Glance: 4 Core Rules of Our Platform
1. Technology, Not Medical Advice
OneHealthGrid provides digital healthcare software and AI/MCP tools. We do not practice medicine; licensed clinicians remain 100% responsible for diagnoses, prescriptions, and patient care.
2. You Own Your Clinical Data
Hospitals, government agencies, and patients retain full ownership of their health records. Routeget owns the OneHealthGrid software, FHIR engines, APIs, and brand IP.
3. Strict API, ABDM & AI Rules
You must obtain valid patient consent before querying ABHA/ABDM records, safeguard API/HPR credentials, and keep a qualified human-in-the-loop for all AI/MCP workflows.
4. Enterprise MSA & Liability Cap
Signed B2B/B2G Master Services Agreements (MSAs) take precedence for enterprise clients. Aggregate liability is capped at 12 months of paid subscription fees under Indian law.
Agreement Sections
Enforced during Hospital/Clinic Admin Onboarding, Developer API Key creation, and Consultation requests.
Need a signed Master Services Agreement (MSA), B2G Tender Addendum, or API License?
✉ legal@onehealthgrid.com →
01. Acceptance of Terms, Scope & Eligibility
By accessing OneHealthGrid or clicking ‘I Agree’ during account onboarding, API registration, or consultation requests, you enter into a binding legal contract with Routeget Technologies Consulting Pvt. Ltd. If a signed B2B/B2G Master Services Agreement (MSA) exists with your institution, that signed MSA governs in the event of any conflict.
These Terms of Use (“Terms” or “Agreement”) constitute a legally binding electronic record under the Indian Contract Act, 1872 and the Information Technology Act, 2000 (and rules framed thereunder) between Routeget Technologies Consulting Pvt. Ltd., the owner and operator of the OneHealthGrid platform (“OneHealthGrid”, “Routeget”, “we”, “us”, or “our”), and you—either individually or on behalf of the hospital, clinic, diagnostic laboratory, pharmacy, government health department, NGO, or technology partner you represent (“Customer”, “User”, or “you”).
✓ Eligibility & Organizational Authority
You must be at least 18 years of age and legally competent to contract under Section 11 of the Indian Contract Act, 1872. If you register or use the platform on behalf of a Healthcare Institution, Government Authority, NGO, or Business Entity, you represent and warrant that you hold full legal authority to bind that organization to these Terms.
✓ Order of Precedence (B2B/B2G MSAs)
Where an enterprise hospital network, state health mission, or public health agency has executed a bespoke written Master Services Agreement (MSA), Government Tender Contract (RFP/SLA), or Data Processing Addendum (DPA) with Routeget Technologies Consulting Pvt. Ltd., the terms of that signed instrument shall prevail to the extent of any direct conflict with these online Terms.
02. Account Registration, HPR/HFR Verification & Security
Enterprise administrators must assign individual Role-Based Access Control (RBAC) accounts to verified clinicians and staff. Sharing clinical logins, falsifying Healthcare Facility/Professional Registry (HFR/HPR) IDs, or exposing OAuth2/MCP API keys is strictly prohibited.
Access to OneHealthGrid’s clinical modules (HIS, EHR, LIMS, RIS, Pharmacy, Telemedicine), Developer Portal, and ABDM interoperability gateways requires an authorized account:
- Accurate Institutional & Registry Credentials: Healthcare Providers and Practitioners must provide accurate registration details, including valid corporate identifiers (CIN/GSTIN), clinical establishment registrations, and—where ABDM interoperability is enabled—verified Healthcare Facility Registry (HFR) and Healthcare Professional Registry (HPR) identifiers issued under the National Health Authority (NHA).
- Zero Credential Sharing & Named RBAC Seats: Every medical practitioner, nurse, lab technician, pharmacist, and billing operator must access the platform through an individual, named user account governed by Role-Based Access Control (RBAC). Sharing passwords or clinical session tokens across multiple personnel violates healthcare audit-trail integrity and is strictly prohibited.
- Safeguarding API Keys & MCP Tokens: Technology Partners and Developers issued OAuth2 client secrets, JWT signing keys, HL7 FHIR sandbox tokens, or inbuilt Model Context Protocol (MCP) server credentials must store them in encrypted secret vaults and never embed them in client-side code or public repositories.
- Immediate Incident Notification: You agree to notify our Security Operations Center at security@onehealthgrid.com immediately (and no later than 6 hours after discovery) of any suspected credential compromise, unauthorized clinical session, or API key leak.
03. Acceptable Use Policy (AUP) & Prohibited Conduct
To protect patient safety, national digital health infrastructure (ABDM), and platform stability, you must never query patient records without verifiable electronic consent, bypass AI/MCP safety guardrails, scrape clinical data, or run unauthorized vulnerability scans.
Your use of OneHealthGrid is conditioned upon strict adherence to this Acceptable Use Policy. You shall not, directly or indirectly, engage in or permit any of the following prohibited activities:
⚠ Strictly Prohibited Activities
- Unconsented ABDM / ABHA Queries: Initiating Health Information User (HIU) data pulls or linking ABHA Health IDs without capturing a valid, verifiable electronic consent artefact from the patient.
- AI & MCP Guardrail Circumvention: Attempting prompt injection, jailbreaking, cross-tenant context probing, or feeding unconsented PII into external LLMs via our inbuilt MCP servers.
- Scraping, Reverse Engineering & Malware: Decompiling our HIS/EHR engines, running automated data scrapers, introducing ransomware/Trojans, or performing DDoS/load testing against production endpoints.
- Fraudulent Claims & Unlawful Medical Practice: Submitting fabricated Ayushman Bharat (PM-JAY) pre-authorizations/claims, issuing unlawful e-prescriptions for controlled substances, or impersonating licensed practitioners.
✓ Permitted & Sandboxed Engineering
- Synthetic Data Only in Sandbox: All developer testing, HL7 FHIR payload validation, and MCP agent prototyping in the OneHealthGrid Developer Sandbox must exclusively use synthetic, non-identifiable test records.
- Rate-Limit Compliance: API integrations must respect published OAuth2 rate limits, retry-after headers, and webhook concurrency thresholds.
- Coordinated Vulnerability Disclosure: Security researchers and enterprise penetration testers must obtain prior written authorization before conducting any security assessment.
- Lawful Healthcare Operations: Using the platform strictly for legitimate clinical care, diagnostics, pharmacy dispensation, public health surveillance, and financial administration.
04. Intellectual Property Rights, Data Ownership & Licenses
We own the OneHealthGrid platform, source code, HL7 FHIR engines, and inbuilt MCP servers. You (and your patients) retain 100% ownership of all Clinical, Institutional, and Patient Data uploaded to or generated within your workspace.
We maintain a rock-solid boundary between Platform Intellectual Property and Customer / Patient Health Data:
A. OneHealthGrid Platform IP (Owned by Routeget)
Routeget Technologies Consulting Pvt. Ltd. exclusively owns all right, title, and interest (including copyrights, patents, trade secrets, and trademarks) in and to the OneHealthGrid website, cloud software, HIS/EHR/LIMS/RIS modules, HL7 FHIR transformation engines, inbuilt MCP server architecture, OpenAPI specifications, documentation, and visual design. Subject to these Terms and timely fee payment, we grant you a limited, non-exclusive, non-transferable, revocable right to access and use the subscribed services during your active subscription term.
B. Customer & Patient Health Data (Owned by You)
As between OneHealthGrid and Customer, you (and your respective patients/citizens) retain 100% ownership of all electronic health records, clinical notes, lab results, billing ledgers, and institutional records (“Customer Data”). You grant OneHealthGrid a strictly limited license to host, encrypt, transmit, transform into HL7 FHIR bundles, and process Customer Data solely as necessary to provide, secure, and support the platform in accordance with your instructions and our Privacy Policy.
De-Identified Operational Telemetry & Voluntary Feedback: We may compile strictly de-identified, aggregated system performance metrics (such as API response latencies and uptime benchmarks) that can never identify any patient or institution. If you voluntarily submit feature suggestions or bug reports, you grant us a royalty-free, perpetual license to incorporate that feedback into our standard product roadmap without obligation.
05. Subscriptions, Payments, Taxes (GST) & Refund Policy
Enterprise SaaS subscriptions, implementation milestones, and managed services fees are billed according to your Order Form or MSA. All fees are exclusive of applicable Indian GST, processed via PCI-DSS compliant payment gateways or enterprise ERP transfers, and non-refundable except where expressly stated in a signed SLA.
Commercial deployments of OneHealthGrid across hospitals, clinics, diagnostic chains, and government health programs are governed by the following billing terms:
- Subscription Tiers & Implementation Fees: Pricing for SaaS licenses (per-facility, per-bed, per-practitioner, or API volume tier), custom ABDM/Dynamics 365 integrations, and 24×7 Managed Services is specified in your mutually executed Order Form, Statement of Work (SOW), or Government Work Order.
- Payment Gateways & Enterprise Invoicing: Online payments are processed through RBI-authorized, PCI-DSS Level 1 compliant payment gateways. Enterprise B2B/B2G invoices are synchronized via our Microsoft Dynamics 365 Finance billing engine and are payable within the net payment window (typically Net 15 or Net 30 days) specified on the invoice.
- Taxes (GST) & Statutory Withholding (TDS): All stated fees are exclusive of applicable Indian Goods and Services Tax (GST) and other statutory levies. Where Customer deducts Tax Deducted at Source (TDS) under the Income Tax Act, 1961, Customer shall furnish valid Form 16A TDS certificates within statutory timelines.
- Late Payments & Service Continuity Protection: Undisputed overdue invoices may accrue interest at 1.5% per month (or the maximum rate permitted by law). To protect patient safety, OneHealthGrid will always provide at least fifteen (15) days’ prior written cure notice to institutional leadership before restricting non-critical administrative access for payment default.
- Cancellations & Refund Policy: Subscription renewals may be cancelled in writing prior to the end of the current billing cycle. Because enterprise cloud infrastructure, dedicated onboarding engineering, and regulatory sandbox provisioning are allocated upfront, paid implementation fees and active subscription fees are non-refundable, except where expressly provided under a signed Enterprise SLA credit/refund clause.
06. Term, Suspension & Termination (With Data Portability Guarantee)
We may immediately suspend an account or API token if it poses an active cybersecurity threat or violates ABDM/DPDP laws. Upon termination or expiry, we provide a mandatory 30-to-90-day Data Portability & HL7 FHIR Export Window so clinical care is never interrupted.
We balance strict platform security enforcement with an unwavering commitment to healthcare continuity:
- Emergency Security & Regulatory Suspension: We reserve the right to immediately suspend or throttle any specific user account, API client secret, or MCP connector without prior notice if we reasonably determine that: (a) the account is the source of an active cyberattack, malware upload, or unauthorized data exfiltration; (b) the integration violates NHA/ABDM gateway rules or the DPDP Act, 2023; or (c) suspension is ordered by CERT-In, NHA, or a court of competent jurisdiction. We will promptly notify your designated administrator and restore access once the threat is remediated.
- Termination for Cause: Either party may terminate a subscription or agreement for material breach if the breaching party fails to cure such breach within thirty (30) days after receiving written notice specifying the breach.
- Post-Termination Clinical Data Portability & Transition Window: Healthcare institutions cannot afford sudden data lock-in. Upon expiration or termination of an enterprise agreement (including after resolution of any billing dispute), OneHealthGrid provides a dedicated 30-to-90-day Transition & Data Export Window during which the Customer may export all clinical records, patient histories, and financial ledgers in standardized HL7 FHIR® JSON/XML, CSV, or PDF formats before cryptographic erasure of our active production replicas.
07. Clinical Disclaimers, AI/MCP Advisories & Limitation of Liability
OneHealthGrid is a software provider, not a hospital or licensed medical practitioner. All clinical outputs and AI/MCP co-pilot insights must be verified by a qualified doctor. Outside signed Enterprise SLAs, our maximum aggregate liability is capped at the fees paid by you in the preceding 12 months.
OneHealthGrid does not practice medicine or dispense medical advice. Our EHR/HIS workflows, drug-interaction alerts, diagnostic LIMS summaries, and AI/MCP-powered clinical assistants are informational decision-support tools designed exclusively to assist qualified healthcare professionals. A licensed medical practitioner (Human-in-the-Loop) must independently review and verify all clinical records, AI-generated summaries, diagnostic interpretations, and prescriptions before acting upon them in patient care.
- External Ecosystem & Third-Party Dependencies: While OneHealthGrid engineers high-availability cloud infrastructure (targeting ≥99.9% uptime under enterprise SLAs), we are not liable for downtime, latency, or rejection caused by external national gateways (such as NHA ABDM HIE-CM, UIDAI Aadhaar e-KYC, or PM-JAY TMS portals), third-party LLM providers connected by Customer via MCP, or hospital local-area network outages.
- Warranty Baseline (“As-Is” for Public Website & Sandbox): Except for the express uptime and performance warranties committed in a signed B2B/B2G Master Services Agreement (MSA), the public website, Developer Sandbox, and evaluation modules are provided on an “as-is” and “as-available” basis without implied warranties of merchantability, fitness for a particular clinical purpose, or non-infringement.
- Exclusion of Consequential Damages: To the maximum extent permitted by applicable law, neither Routeget Technologies Consulting Pvt. Ltd. nor its directors, officers, or engineers shall be liable for any indirect, incidental, special, exemplary, or consequential damages (including loss of revenue, lost profits, or business interruption), regardless of the theory of liability.
- Aggregate Monetary Liability Cap: Except for liabilities that cannot be limited by statute, Routeget’s total cumulative liability arising out of or relating to these Terms or the platform shall in no event exceed the total subscription fees actually paid by the Customer to Routeget in the twelve (12) months immediately preceding the event giving rise to the claim (or INR ₹25,000 for free website visitors / sandbox users with no paid subscription).
08. Indemnification, Dispute Resolution, Arbitration & Governing Law
You agree to indemnify OneHealthGrid against claims arising from unconsented data uploads, AUP breaches, or clinical malpractice. These Terms are governed by the laws of the Republic of India, with 30-day amicable executive escalation followed by binding arbitration under the Arbitration and Conciliation Act, 1996.
To ensure fair, rapid, and predictable resolution of any commercial or technical disagreements, the parties agree as follows:
- Customer Indemnification: You agree to defend, indemnify, and hold harmless Routeget Technologies Consulting Pvt. Ltd., its affiliates, officers, and employees from and against any third-party claims, regulatory penalties, or damages arising out of: (a) medical malpractice, clinical negligence, or treatment decisions made by Customer’s personnel; (b) Customer’s upload or querying of health records without valid patient consent under the DPDP Act, 2023 or ABDM guidelines; or (c) your breach of the Acceptable Use Policy.
- Governing Law: These Terms and any dispute or claim arising out of or in connection with them shall be governed by and construed in accordance with the laws of the Republic of India, without regard to conflict-of-law principles.
- Step 1 — 30-Day Executive Amicable Resolution: Before initiating formal legal proceedings, the aggrieved party shall send a written Notice of Dispute to the other party. Designated senior executives of both parties shall meet (in person or via video conference) within fifteen (15) days and negotiate in good faith for a period of thirty (30) days to resolve the dispute amicably.
- Step 2 — Binding Arbitration & Exclusive Venue: Any dispute remaining unresolved after the 30-day negotiation window shall be referred to and finally resolved by binding arbitration in accordance with the Arbitration and Conciliation Act, 1996 (as amended) by a sole arbitrator mutually appointed by the parties. The seat and venue of arbitration shall be Chennai, Tamil Nadu, India (unless an alternative Indian seat such as New Delhi is expressly designated in a signed B2G/Enterprise MSA), and proceedings shall be conducted in English. Subject to arbitration, the courts in Chennai, India shall have exclusive jurisdiction for interim injunctive relief to protect intellectual property or confidential health data.
Corporate Entity: Routeget Technologies Consulting Pvt. Ltd. (Operating OneHealthGrid)
Legal & Contracts Desk: legal@onehealthgrid.com | Privacy & DPO Desk: privacy@onehealthgrid.com
Expandable Domain-Specific Schedules (APIs, MCP & B2G Tenders)
Click any schedule below to inspect supplemental binding terms for developers, AI integrators, and enterprise procurement teams.
1. Sandbox Isolation: Developers accessing the OneHealthGrid Developer Portal must test exclusively against designated sandbox endpoints using synthetic patient records. Uploading real patient Aadhaar/ABHA identifiers into sandbox environments is grounds for immediate API key revocation.
2. OAuth2 & Rate Limits: Production API keys are issued only after security verification and execution of an Enterprise Integration Addendum. Applications must respect HTTP 429 rate-limit headers and implement exponential backoff.
1. Customer-Controlled AI Connectivity: When a Healthcare Institution connects an external LLM or AI agent (e.g., Azure OpenAI, Claude, Gemini, or Amazon Bedrock) to OneHealthGrid’s inbuilt MCP servers, the Customer controls which MCP tools and resources are exposed.
2. Mandatory Clinician Verification: AI-generated clinical summaries, discharge drafts, or triage recommendations must be reviewed and signed off by a qualified clinician prior to entry into the official medical record.
1. Precedence Order: For institutional customers with an executed contract, the order of precedence shall be: (i) Executed B2B/B2G Order Form or Government Work Order; (ii) Signed Master Services Agreement (MSA) and Service Level Agreement (SLA); (iii) Signed Data Processing Addendum (DPA); and (iv) these online Terms of Use.
2. Force Majeure: Neither party shall be liable for delays caused by events beyond reasonable control, including natural disasters, nationwide telecom backbone failures, or statutory government mandates.
Need an Enterprise Master Services Agreement (MSA) or Custom B2G Tender SLA?
Our legal, procurement, and solution architecture teams work directly with hospital networks, state health missions, diagnostic chains, and technology partners to execute tailored MSAs, SLAs, and Data Processing Addendums.