Master Service Agreement

Contract note: Customer-specific commercial variables belong in an Order Form.

This Master Service Agreement ("MSA") is entered into between Dial In Doctor LLP ("DID") and the Customer identified in the applicable Order Form ("Customer"), and is effective on the date specified in the applicable Order Form.

1. Agreement structure

The agreement consists of:

1. signed Order Form(s);
2. this MSA;
3. the Data Processing Agreement where applicable;
4. the Data Liability & Security Allocation Addendum;
5. security/SLA schedules, if any.

If documents conflict, the priority is: Order Form → negotiated addendum → DPA for data-processing matters → MSA → standard policy, unless expressly stated otherwise.

2. Services

DID will provide the services described in each Order Form, which may include:

• telehealth platform access;
• patient portal;
• doctor/staff dashboard;
• appointment/follow-up workflow;
• health documents;
• laboratory/order features;
• payment/receipt features;
• implementation/configuration;
• support;
• reporting/integration services.

Features not listed or not technically enabled are not included.

3. Customer responsibilities

Customer will:

• provide accurate implementation information;
• ensure its users are authorized;
• manage workforce access promptly;
• use the Services lawfully;
• maintain appropriate devices/networks;
• obtain consents/authority for data it instructs DID to process;
• ensure its clinicians hold required registrations/licences/credentials;
• not bypass security controls;
• promptly notify DID of suspected compromise.

4. Clinical responsibility

Unless an Order Form expressly states DID is providing the clinical service through its own contracted clinical workforce, Customer and its healthcare professionals remain responsible for:

• professional licensing/registration;
• clinical judgment;
• diagnosis/treatment;
• prescriptions;
• record quality;
• patient consent;
• professional supervision;
• clinical escalation/emergency procedures.

The software is not a substitute for professional judgment.

5. Access and acceptable use

DID grants Customer a limited, non-exclusive, non-transferable right to use the Services during the term for Customer's authorized operations.

Customer may not:

• reverse engineer except where law requires otherwise;
• resell without authorization;
• access another customer's data;
• perform destructive security testing without permission;
• upload malicious code;
• use the Services unlawfully.

6. Fees and taxes

Fees, billing frequency, currency, taxes, payment due date, implementation fees, and any usage limits will be defined in the Order Form.

Unless stated otherwise:

• undisputed invoices are payable by the due date;
• taxes are handled as required by applicable law;
• Customer must raise good-faith billing disputes promptly.

7. Service changes

DID may make reasonable changes necessary for:

• security;
• law/regulation;
• provider/API changes;
• performance;
• bug fixes;
• usability.

DID will not materially remove a contracted core feature during a committed term without an appropriate replacement, amendment, or remedy, except where required for safety, law, or third-party discontinuation.

8. Support and SLA

Support channels, hours, response targets, uptime commitments, planned maintenance, and service credits (if any) must be defined in the Order Form/SLA.

No uptime percentage is promised unless expressly written.

9. Information security

Each party will maintain safeguards appropriate to its role.

DID security responsibilities are further described in the DPA and security schedules.

Customer is responsible for:

• authorized-user lifecycle;
• secure endpoints;
• keeping credentials confidential;
• promptly disabling departed/compromised users.

10. Privacy and data processing

Each party will comply with applicable privacy/confidentiality obligations.

Where DID processes Customer Personal Data on Customer's behalf, the DPA applies.

Where DID independently processes data for its own legal, billing, security, fraud, or direct patient-service purposes, it may act as an independent controller to that extent.

11. Data ownership

As between the parties:

• Customer retains rights to Customer-provided data, subject to patient/individual rights and applicable law;
• DID retains rights to its software, systems, templates, know-how, and platform IP;
• neither party receives ownership of the other's pre-existing IP merely by using the Services.

Aggregated/de-identified information may be used for service security, analytics, and improvement only where it cannot reasonably identify individuals and where such use is lawful and contractually permitted.

12. Confidentiality

Each party will protect the other's non-public confidential information using reasonable care and use it only for the Agreement.

Exclusions include information that is:

• lawfully public;
• already known without confidentiality obligation;
• independently developed;
• lawfully received from a third party.

Lawfully compelled disclosure is permitted subject to notice where legally allowed.

13. Third-party services

The Services may rely on third parties such as cloud infrastructure, payment processors, email/communications services, and approved healthcare partners.

DID remains responsible for its own contractual obligations but does not warrant that an independent third party will never experience an outage.

Critical third-party dependencies should be managed through continuity/recovery processes.

14. Intellectual property

DID owns/retains all right, title, and interest in:

• platform source/object code;
• product design;
• APIs/documentation created by DID;
• trademarks/branding;
• reusable know-how.

Customer owns/retains Customer materials and data, subject to applicable individual rights.

Feedback may be used by DID without transferring Customer confidential information or personal data into public material.

15. Warranties

Each party warrants it has authority to enter the Agreement.

DID warrants it will provide the Services with reasonable professional care consistent with the Order Form.

Except as expressly stated and to the extent permitted by law, no implied guarantee is made that the Services will be uninterrupted or suitable for every clinical/business circumstance.

16. Regulatory changes

If a legal/regulatory change materially affects the Services, the parties will cooperate in good faith on required changes.

DID may suspend a feature if continued operation would create a material legal/security/patient-safety risk.

17. Indemnities

Customer

Customer will be responsible, to the extent caused by Customer, for third-party claims arising from:

• unlawful Customer data/instructions;
• Customer's clinical malpractice/professional misconduct;
• Customer's infringement;
• Customer's unauthorized use/security breach;
• unlicensed/unauthorized Customer personnel.

DID

DID will be responsible, to the extent caused by DID, for third-party claims arising from:

• DID's infringement of third-party intellectual property by the core platform;
• DID's unlawful processing contrary to the Agreement;
• DID's security breach caused by failure to meet its contractual security obligations.

Indemnity procedures require prompt notice, reasonable cooperation, and control of defense subject to protection of the indemnified party.

18. Liability

Liability allocation is supplemented by the Data Liability & Security Allocation Addendum.

No limitation applies where applicable law prohibits it, including fraud, willful misconduct, or other non-excludable liability.

Unless an Order Form expressly states a different negotiated cap, each party's aggregate liability arising out of or relating to the Agreement (excluding the non-excludable categories below) will not exceed the fees paid or payable by Customer to DID under the affected Order Form during the 12 months immediately preceding the event giving rise to the claim.

For confidentiality, data-protection, and security obligations, the same 12-month-fee cap applies unless the Order Form expressly provides an enhanced cap.

No cap or exclusion applies to the extent prohibited by applicable law, including fraud, willful misconduct, deliberate unlawful disclosure, or other liability that cannot lawfully be limited.

19. Term and termination

Term is stated in each Order Form.

Either party may terminate:

• for uncured material breach after the agreed cure period;
• for insolvency where lawful;
• where continued performance becomes unlawful;
• as otherwise stated in the Order Form.

Immediate suspension may be used for urgent security/patient-safety risk while preserving proportionality.

20. Exit / data return

At termination:

• access ends according to the Order Form;
• agreed data export/return is provided where applicable;
• deletion follows the DPA and legal/clinical retention rules;
• unpaid valid charges remain due;
• confidentiality, IP, accrued rights, data retention and liability provisions survive as necessary.

21. Publicity

Neither party may use the other's name/logo in public marketing without permission, except factual vendor/customer identification where already agreed.

22. Assignment

Neither party may assign the Agreement without the other's consent, except as part of a bona fide corporate restructuring/sale where obligations continue, subject to applicable law and any healthcare/privacy restrictions.

23. Notices

Formal notices:

Dial In Doctor LLP

• Email: info@dialindoctor.com
• Phone: +92 330 000 13 01
• Business/contact address: Plot 942, Adyala Rd, Rawalpindi, Punjab 46000, Pakistan
• Website: www.dialindoctor.com

Customer — as stated in Order Form.

24. Governing law

The Agreement is governed by the laws of Pakistan.

Subject to any mandatory jurisdiction rule, the courts of competent jurisdiction in Rawalpindi, Punjab, Pakistan will have jurisdiction.

25. Entire agreement

The Agreement is the complete agreement for its subject matter and supersedes prior proposals/communications on that subject, except fraud or expressly preserved obligations.

Order Form minimum fields

• Customer legal name
• registered address
• service description
• start date
• term/renewal
• authorized users/locations
• implementation scope
• fees/taxes
• support/SLA
• data residency requirements
• security requirements
• integrations
• liability caps
• signatories