{"Version 2026-10-03"}
{"Effective: the date it is published on the API site."}
{"This addendum is between Bettar Platforms, Inc. (\"we\") and the organization that accepts it (\"you\"). It applies when you receive patient information through the ClinikEHR API. It adds to the API Terms of Use. It is accepted only by an organization that will receive patient information; an organization that will not does not accept it."}
## 1. WHO IS WHO{"1.1 The clinic decides what its patients' information is used for. We handle it on the clinic's instructions."}
{"1.2 When a clinic grants you a permission that includes patient information, the clinic is disclosing it to you. We carry out that disclosure on the clinic's instruction."}
{"1.3 You receive it as an independent controller, for the purpose the clinic agreed to and no other. You decide how you protect and use it within that purpose, and you are responsible for doing so lawfully."}
{"1.4 We are not your processor, and you are not the clinic's processor, for what you receive."}
## 1A. APPROVAL{"1A.1 You may receive patient information only after we approve your organization for it, and only the kinds of information we approved (for example demographics, appointments, notes)."}
{"1A.2 We may refuse an application, limit the kinds approved, or suspend or withdraw approval at any time — including if information you gave us is inaccurate, after an incident, or if you breach this addendum. Access stops on the next request."}
{"1A.3 Approval is not a clinic's permission: a clinic still decides whether to grant you any permission, and on what basis."}
## 2. THE BASIS FOR EACH DISCLOSURE{"2.1 Before a clinic grants you a permission that includes patient information, the clinic records the basis on which it may share it with you. The bases the clinic can record are:"}
{"(a) treatment, payment or health-care operations: the sharing is for the person's care, for payment for it, or for the clinic's or your health-care operations, as the law allows;"}
{"(b) a business associate agreement is in place between the clinic and you;"}
{"(c) patient authorization: the patient has authorized the sharing;"}
{"(d) de-identified, not patient information: the information has been de-identified and does not identify a person."}
{"2.2 You confirm that the basis the clinic recorded is true for every person whose information you request."}
{"2.3 You will request information only about people within the group the clinic agreed to."}
## 3. MINIMUM NECESSARY{"3.1 You will ask for the least information that serves your purpose. The API returns a defined set of fields for each permission; fields a clinic restricts are not returned."}
## 4. WHAT YOU MUST DO WITH IT{"4.1 Keep it secure, with safeguards appropriate to health information: encryption in transit and at rest, access limited to people who need it, a record of who accessed it."}
{"4.2 Use it only for the purpose the clinic agreed to."}
{"4.3 Keep it only as long as that purpose and the law require."}
{"4.4 Do not pass it on except to someone bound by terms at least as protective, and tell the clinic who, on request."}
{"4.5 Help the clinic answer a patient who asks what was shared, or asks for a correction or erasure."}
## 5. A RECORD OF WHAT WAS SHARED{"5.1 We record every disclosure of patient information made to you: which patient, which kind of record, when, under which connection and basis."}
{"5.2 The clinic can see that record. The patient can see, in the clinic's patient portal, which organizations received their information, when, and what kind — never the information itself."}
{"5.3 We keep these records for seven years."}
## 6. INCIDENTS{"6.1 If you become aware of unauthorised access to patient information you received, you will tell us at support@clinikehr.com, marked \"Security incident\", and tell the clinic, without undue delay and in any case within 72 hours, with what you know."}
{"6.2 If we become aware of unauthorised access to patient information through the API, we will tell the clinic, and you where it concerns you, within 72 hours."}
## 7. WHEN A CONNECTION ENDS{"7.1 When a clinic withdraws a permission, the API stops returning that information on the next request."}
{"7.2 You will stop using what you hold for that clinic's patients, and return or destroy it, unless the law requires you to keep it. Where the law requires you to keep some of it, you will keep only what it requires, for as long as it requires, protect it as this addendum requires, and use it for no other purpose."}
## 8. TRANSFERS BETWEEN COUNTRIES{"8.1 Each party is responsible for making sure that any transfer of patient information it makes across a border is lawful where the information comes from and where it goes."}
{"8.2 You will not transfer patient information you received to a country in which you cannot protect it as this addendum requires. Where the law requires a safeguard for a transfer, you will put it in place before the transfer and give it to the clinic or us on request."}
{"8.3 The clinic's own agreements govern where the clinic sends its patients' information. Nothing here changes them."}
## IF YOU ARE ESTABLISHED IN NIGERIA{"8.4 This clause applies if you are established in Nigeria, or process the information of people in Nigeria. You are a data controller for what you receive and you will comply with the Nigeria Data Protection Act, including its rules on the lawful basis for processing, on sensitive personal data, on the rights of the person, on security, on breach notification, and on transfers out of Nigeria."}
{"8.5 Where the Act requires you to register with, or notify, the Nigeria Data Protection Commission, you will do so, and you will tell us if the Commission asks you about information received through the API. Bettar Platforms, Inc. is registered with the Nigeria Data Protection Commission."}
{"8.6 Where the Act and this addendum both apply, you will follow whichever protects the person more."}
## 9. AUDIT{"9.1 Each party may ask the other, on reasonable notice, to show that it is meeting this addendum. It may do so once a year, and again after an incident that involves patient information."}
{"9.2 We meet a request from you by written answers and reports about our controls. We do not give access to our sites or systems."}
{"9.3 You meet a request from us, or from a clinic that asks through us, in the same way, by written answers and reports, and by showing your records of who has accessed the information."}
{"9.4 Each party bears its own costs of an audit."}
## 10. LIABILITY{"10.1 Our liability to you under this addendum is limited in the same way as under the API Terms of Use: to the fees you paid us in the 12 months before the claim arose."}
{"10.2 Your responsibility to a clinic and to patients for what you do with the information you receive is not limited by these terms."}
{"10.3 Nothing here limits liability that cannot be limited by law."}
## 11. PROVIDERS{"We use providers of hosting, email and similar services to run ClinikEHR. They are described by category, not by name. We give their names on request, in confidence."}
{"ClinikEHR is a product of Bettar Platforms, Inc."}
This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.