Terms of Service

These terms are an agreement between Vertex Labs Ltd (“Medly”, “we”, “us”) and the clinic, hospital or practice that uses Medly (“your clinic”, “you”).

Medly is available to clinics and hospitals in Nigeria and Kenya.

Whoever accepts these terms for your clinic, for example by applying to join, signing an order form or creating the first administrator account, confirms they are allowed to agree on the clinic’s behalf. If your clinic has signed a separate written agreement with us, that agreement wins where the two differ.

Anyone simply browsing medly.africa may do so freely, but must not copy the site for commercial use, try to break it, or present it as their own.

• Your administrator invites staff and decides what each role can see and do. Your clinic is responsible for what its staff do in Medly.
• Each person must have their own account. Sharing a sign-in hides who did what and defeats the audit log.
• Keep passwords and authenticator codes private. When someone leaves, deactivate their account the same day.
• Tell us straight away at support@medly.africa if you think someone has got into an account who shouldn’t have.
• You can use any email address your staff can reliably receive mail at. We use it for sign-in links and account notices.

• Plans, prices and limits are shown on our pricing page. Clinics in Nigeria are billed in naira and clinics in Kenya in US dollars. Prices don’t include tax and are billed monthly or yearly in advance; the yearly price is the monthly price less the yearly discount shown for that plan. You pay by card, or by bank transfer using the invoice number as the reference.
• Your administrators can change plan at any time in Medly. A larger plan starts at once, and you pay the difference for the rest of the current period. A smaller plan starts at your next renewal.
• On each renewal date we charge the card you last paid with and email a receipt. For yearly plans we remind you a week before. Every invoice and payment is kept in Medly for your administrators to see and print.
• If a renewal payment fails, we email your administrators and try the card again. You can also pay that invoice by bank transfer; we record it once it reaches us. Your clinic keeps full use of Medly for 14 days. If the invoice is still unpaid after 14 days, Medly pauses for your clinic: staff cannot sign in, and administrators can sign in only to pay. Pausing never deletes records, and access comes back as soon as the invoice is paid.
• We email your administrators at least 30 days before changing your price. A new price applies from your first renewal at least 30 days after that email. New clinics pay the prices on the pricing page on the day they choose a plan.
• Founding clinics that choose yearly billing get their first 3 months free, once, when they first move to a paid plan. Founding clinics billed monthly pay the normal monthly price. Price changes reach founding clinics like any other clinic.
• If we stop offering a plan, clinics already on it can keep it until they change plan.
• When your clinic reaches its plan’s staff or patient limit, you cannot invite more staff or register more patients until you move to a larger plan or, for staff, deactivate someone. We never remove staff or patients, or lock you out of records, because of a plan limit.

Medly keeps records, schedules and lab results organised. It does not diagnose, prescribe or give medical advice. Results flagged as outside a normal range are flagged against ranges your clinic sets or accepts, and your clinicians must still check them.

Your clinicians remain responsible for every clinical decision, for checking that what they record is accurate, and for following the rules of their profession. Do not rely on Medly as the only copy of something you need in an emergency.

Your clinic owns the patient records it keeps in Medly and is the data controller for them under the data protection law of its country: the Nigeria Data Protection Act 2023 in Nigeria, and the Data Protection Act 2019 and Digital Health Act 2023 in Kenya. We are your data processor. That means:

• You decide why records are kept and who at your clinic sees them, and you are responsible for having a lawful reason to keep them.
• You tell your patients that you use Medly to keep their records. Our Privacy Policy can help.
• You register with your data protection regulator where the law requires it: the Nigeria Data Protection Commission, or the Office of the Data Protection Commissioner in Kenya.
• You keep patient records for as long as the medical records law of your country requires. Medly does not delete them while you use it.
• Only enter records of real patients your clinic treats, and only what you need for their care and your clinic’s running.
• We never sell patient records or anything that identifies a person.

This section is the data processing agreement between your clinic and Medly. It is written to meet the requirements for processor contracts in the Nigeria Data Protection Act 2023 and Kenya’s Data Protection Act 2019 and its regulations, and applies to every patient and staff record we hold for your clinic.

1. What we process. Identity, contact and health information about your patients, and account and activity information about your staff, entered by your clinic or by patients through the Medly app. We process it to store, show, share and back up records, send reminders and notices you ask for, keep audit logs, and support your clinic. We process it for as long as the agreement lasts and the time set out in Ending the Agreement.
2. Instructions. We process records only to run Medly for you, as these terms and your use of Medly direct. If a law requires us to do something else, we will tell you first unless the law forbids it. If we think an instruction breaks data protection law, we will tell you.
3. People. Everyone at Medly who can reach your records is bound to keep them confidential, and reaches them only when needed to support your clinic. Those accesses are recorded in your audit log.
4. Security. We protect records with measures suited to health data, including encryption between devices and our servers and where records are stored, role-based access, two-step sign-in, an audit log that cannot be edited, backups, and limits on repeated sign-in attempts. We review these measures regularly.
5. Other providers. We use a small number of providers to run Medly. They are listed, with what each does and where, on our service providers page. By accepting these terms you authorise us to use them. Each is bound by written terms at least as protective as these, and we remain responsible for them. We will email your administrators at least 30 days before adding or replacing a provider that handles records. If you object for a reasonable data protection reason and we cannot resolve it, you can end the agreement and receive a refund for any unused paid period.
6. Location. Records are stored with our cloud hosting provider. For clinics in Kenya, we also keep a complete, up-to-date copy of the clinic’s records in a data centre in Kenya, as Kenya’s Data Protection (General) Regulations 2021 require for health care. When records are stored or processed outside your clinic’s country, we use the safeguards the law there requires: contract terms the Nigeria Data Protection Commission accepts for Nigerian clinics, and the Data Protection Commissioner’s standard clauses for Kenyan clinics.
7. Breaches. If we find that records have been lost, exposed, changed or accessed without permission, we will tell your administrators without undue delay and within 24 hours of finding out. We will say what happened, which records and how many people are affected, the likely consequences and what we are doing about it, and keep you updated. This helps you report to the Nigeria Data Protection Commission or Kenya’s Data Protection Commissioner within the 72 hours the law allows, and tell patients where required.
8. Patients’ requests. Patients can see their own records in the Medly app. When a patient asks your clinic to see, correct, delete or move their information, or objects to its use, we will help you respond within the time the law sets, which in Kenya is 7 days for a copy and 14 days for a correction or deletion. If a patient contacts us directly about your records, we will pass the request to you.
9. Assessments and regulators. We will give you the information you need for a data protection impact assessment, and help you consult your regulator where one is required. We keep a record of the processing we carry out for you, and cooperate with the regulators if they ask.
10. Checks. We will give you the information you reasonably need to show you are meeting your data protection duties and answer your security questions in writing. Once a year, or after a breach, you may audit our compliance yourself or through an independent auditor, with 30 days’ notice and a duty of confidentiality.
11. At the end. When the agreement ends, we follow the steps in Ending the Agreement and then delete your records, including backups and the copy in Kenya, except anything the law requires us to keep.
12. Our own data. Some information, such as patient app accounts, applications to join and aggregated insights, we handle for our own purposes. For that, Medly is the data controller and our Privacy Policy applies.

You and your staff must not:

• use Medly for anything unlawful, or to keep records you have no right to keep;
• try to see another clinic’s records, or records your role does not allow;
• probe, scan or test Medly’s security without our written permission, or try to slow it down or take it offline;
• copy, resell or rent Medly to others, or build a competing product from it;
• upload anything harmful, such as viruses.

If someone at your clinic does, we may suspend their account and will tell your administrator why.

We work hard to keep Medly running and fast, but we cannot promise it will never be unavailable. We will give notice of planned maintenance where we can, and do it outside clinic hours where possible.

Support is by email, and the reply times for your plan are on the pricing page.

We improve Medly all the time, so features will change. We will not remove a feature your clinic relies on without telling you first. Anything described as planned or on our roadmap is an intention, not a promise, until it is released.

• Your clinic can stop using Medly at any time by telling us in writing. Paid months already started are not refunded unless the law requires it.
• We can end the agreement with 60 days’ notice, or sooner if your clinic seriously breaks these terms and does not put it right within 14 days of us telling you.
• After the agreement ends, we keep your clinic’s records for 90 days so you can ask us for a complete copy, then delete them. Ask us at support@medly.africa. Your clinic remains responsible for keeping records for as long as the law requires, so take your copy before then.
• The sections on records, processing, ownership, liability and law keep applying after the agreement ends.

Your clinic owns its records. We own Medly itself: the software, design and name. You may use Medly while the agreement lasts. If you send us ideas or feedback, we may use them freely to improve Medly.

• Our total liability to your clinic in any 12 months is limited to what your clinic paid us in those 12 months. If your clinic is on a free plan, that limit is ₦100,000, or US$100 for a clinic in Kenya.
• Neither of us is liable for indirect losses, such as lost profits, that could not reasonably have been expected.
• These limits do not apply to anything the law does not allow us to limit, such as fraud, or to our duties to protect your records under the data processing terms above.
• Neither of us is responsible for delays caused by events outside our reasonable control, such as a nationwide network outage.

If we change these terms in a way that matters, we will email your administrators at least 30 days before the change takes effect. If your clinic does not agree, it can stop using Medly before then.

These terms are governed by the laws of the Federal Republic of Nigeria. If we disagree, we will first try to settle it by talking for at least 30 days. If that fails, the courts of Lagos State will decide.

This does not take away any protection that the data protection or health records law of your clinic’s country gives your clinic or your patients, or your right to complain to your data protection regulator.

Email: support@medly.africa

Data protection questions: hospitals@medly.africa