1. Scope and identity

This policy applies to RuxMed and its sites and services for medical organizations. Digital Planet for Investment and Information Technology (DPI) is the legal service provider and responsible contracting entity. Ruxelio is its brand, and RuxMed is a software product of Ruxelio, not a separate legal entity. Contact is temporarily available through the official support channels in the service or website.

We take account, as applicable, of Egypt's Personal Data Protection Law No. 151 of 2020, its implementing rules and decisions, and applicable health laws and regulations. This is not a claim of certification or absolute compliance, and each organization must assess its own professional and regulatory duties.

2. Roles

• Patient data: the medical organization is the controller, and Ruxelio is its processor acting on documented instructions and the Data Processing Agreement.
• Administrative data: Ruxelio is an independent controller of account, billing, support, security, and anti-fraud data needed to administer and protect the service.

Patients should direct requests about their records to their treating organization; we assist the organization where applicable.

3. Data and sources

We may receive data from providers selected by the organization or integrations it authorizes, limited to what the integration requires.

4. Purposes and legal bases

We process data to provide the service and operate accounts, appointments, records, and billing; perform the contract and provide support; protect the service and investigate misuse; meet legal obligations; and improve performance using appropriate, limited data.

Depending on context, the basis is contract performance or pre-contract steps requested by the customer, legal obligation, balanced legitimate interests such as security and service improvement, or consent where required. Patient-data processing also relies on the basis determined by the organization under data protection and health laws.

We do not sell patient data or use it for marketing medical services or training AI models unless there is a separate, transparent agreement and an appropriate legal basis. We do not use data for an incompatible new purpose without notice or a suitable basis.

5. Sharing and processors

We may share the necessary minimum with categories of hosting, infrastructure, backup, communications, support, payment, operational analytics, and security providers, and with advisers or competent authorities where there is an obligation or valid legal request. Processors are contractually bound to confidentiality, protection, and purpose limitation; this policy does not invent a list of providers that have not been adopted.

Disclosure may also occur on the organization's instructions or in a lawful reorganization with appropriate safeguards and notice where the law permits.

6. Transfers outside Egypt

This policy does not assume a particular hosting location. If the service requires a transfer of personal data outside Egypt, it will occur only under applicable legal requirements and an appropriate safeguard, such as required approval or authorization, contractual commitments and equivalent protection, with assessment of the data and destination.

7. Security and incidents

We apply technical and organizational measures reasonably proportionate to risk, including access and permission controls, protection of transmission and storage where appropriate, logging and monitoring, backups, vulnerability management, and awareness for authorized personnel. No method can guarantee 100% security.

Following a personal-data incident, we take steps to contain, investigate, and remediate it and notify the organization without undue delay with available information, in accordance with law and the Data Processing Agreement, so the parties can meet notification duties.

8. Retention

We retain data for the period needed for the stated purposes, the organization's instructions, the contract, legal obligations, dispute resolution, and security. The applicable Data Retention Policy specifies deletion and backup cycles, including the 30/60/95-day arrangements after service termination, subject to legally required preservation. Patient-data periods may differ where lawfully requested by the organization.

9. Rights and choices

Subject to legal conditions, rights may include access, correction, deletion, restriction, objection, withdrawal of consent where it is the basis without affecting earlier lawful processing, and complaint to the competent Egyptian data-protection authority. We may verify identity and retain what law requires.

Patients should contact their medical organization. Account-data subjects can use account features or official support channels. We currently make no solely automated decisions that produce legal or similarly significant effects on individuals.

10. Minors, changes, and contact

RuxMed is a B2B service for medical organizations, not a direct service to minors, and it provides no patient accounts. If an organization enters a minor's data, it is responsible for authority, legal basis, and required health safeguards, and we process it on its instructions.

We may update this policy. We will give 30 days' notice before material changes where practicable, unless law or security requires faster effect, and will identify the update date. For questions, rights, or a suspected incident, use the official support channels available in RuxMed or its website; this is the temporary contact method until a dedicated channel is announced.

1. Parties and acceptance

Digital Planet for Investment and Information Technology (DPI) is the Service provider and contracting party under these Terms. Ruxelio is its brand, and RuxMed is a software product of Ruxelio, not a separate legal entity. These Terms are solely for facilities and medical professionals using the Service for business purposes in Egypt. By creating an account, signing an order, or using the Service, the facility confirms that its representative has legal capacity and authority to bind it. A person without that authority must not accept or use the Service.

2. Service and licence

RuxMed is a SaaS tool for managing medical operations, such as appointments, patient files, billing, communications, and reporting, according to the plan. During the subscription only, Ruxelio gives the facility a limited, non-exclusive, non-transferable, non-sublicensable right to access and internally use the Service under these Terms and the plan.

The subscription is not a sale or transfer of ownership. It gives no right to receive or own source or executable code, system files, the native database or its structure or schemas, algorithms, internal APIs, servers, or internal copies. Customer Data remains owned by the facility or its owners under applicable law, but that does not give the facility ownership of the database or its structure. The facility grants Ruxelio a limited licence to process Customer Data as needed to provide, secure, and support the Service and comply with law.

3. Restrictions and accounts

• No copying, modification, reverse engineering, decompilation, or attempt to discover the Service's code or structure, except to the extent a restriction is prohibited by law.
• No resale, sublicensing, access for unauthorised parties, circumvention of plan or security limits, or use of the Service or its outputs to build a competing product.
• The facility must keep registration details accurate, set user permissions, protect credentials, and promptly report suspected compromise through official support channels. It is responsible for account activity except to the extent caused by Ruxelio's failure.

4. Facility and care responsibilities

The facility is the care provider and is responsible for lawful and accurate data collection, required patient consents and notices, the legal basis for processing, access controls, and retention of medical records for legally and professionally required periods. Professionals must review every decision, prescription, and alert. The Medical Disclaimer applies.

5. Confidentiality and data

Each party will protect the other's confidential information with reasonable care and use it only to perform the agreement. Confidential information excludes information that becomes public without breach, was lawfully known, was independently developed, or must be disclosed by law after notice where legally permitted. The Data Processing Agreement governs personal-data processing, and the Data Retention Policy governs retention, deletion, and export.

6. Subscription and payment

The plan or order states fees, term, and limits. Billing, renewal, cancellation, refunds, and SLA credits are governed by the Financial Policy. Fees buy only the right to use the SaaS during the subscription.

7. Suspension, termination, and export

Ruxelio may suspend access for a security threat, unlawful or harmful use, or non-payment under the Financial Policy, with notice and a reasonable opportunity to cure where feasible. Either party may terminate for a material breach not cured within 30 days after written notice, or immediately where the breach cannot be cured, insolvency occurs, or law requires it. On termination the licence ends, and the facility has a 30-day window to export its data under the Data Retention Policy; termination does not mean immediate deletion.

8. Availability, maintenance, and support

Paid subscriptions target 99.5% monthly availability, subject to the calculation, exclusions, and SLA credits in the Financial Policy; free plans have no SLA. Planned maintenance may total up to four hours per month, with 48 hours' notice where feasible. Standard paid support runs Sunday through Thursday, 9:00 a.m. to 5:00 p.m. Cairo time, with an always-available P1 channel through official support channels.

Response times are targets, not guaranteed resolution times. Ruxelio targets daily backups, a 24-hour RPO, and a 12-hour RTO. These are operational objectives dependent on plan and incident capabilities, not absolute technical guarantees.

9. Intellectual property and feedback

Ruxelio and its licensors retain all rights in RuxMed, its technology, design, and developments. The facility retains rights in its Customer Data. Ruxelio may freely use general feedback without disclosing the facility's confidential or personal data.

10. Disclaimers and liability

The Service is provided as available and is not guaranteed to be entirely uninterrupted, error-free, or suitable for a particular medical purpose. To the fullest extent permitted by law, neither party is liable for indirect or consequential loss or lost profits. Each party's total aggregate liability arising from the agreement will not exceed the fees paid by the facility in the 12 months before the event. Exclusions and the cap do not apply to fraud, wilful misconduct, gross negligence, or liability that cannot legally be excluded or limited.

11. Indemnity

The facility will defend and indemnify Ruxelio against third-party claims directly resulting from data the facility supplied unlawfully, its material breach of these Terms, or its users' prohibited use, provided it receives prompt notice, control of defence and settlement, and reasonable cooperation. This does not cover Ruxelio's breach or negligence, and no settlement may admit Ruxelio's liability or impose an obligation on it without consent.

12. General

Neither party is liable for delay beyond its reasonable control if it works to mitigate it; force majeure does not excuse amounts already due. Ruxelio will give 30 days' notice of material changes. Egyptian law governs. The parties will attempt amicable settlement for 30 days from dispute notice, after which the competent Egyptian courts have jurisdiction.

These Terms, the order, and referenced policies are the entire agreement. If a provision is invalid, the remainder survives. Failure to enforce is not a waiver. The facility may not assign without Ruxelio's consent; Ruxelio may assign in a reorganisation or business sale without materially reducing rights. In a conflict, the Data Processing Agreement prevails for data matters, followed by the order, these Terms, then policies. The Arabic version controls over the English translation.

13. Contact

Notices and support requests must use the official support channels Ruxelio makes available to the facility until published contact details are updated.

1. Scope and fees

This Policy supplements the Terms of Service. The order or plan states fees and user, branch, or usage limits. All fees pay for a temporary right to use the SaaS Service; the facility does not purchase source or executable code, a database or its structure, or any Ruxelio technology asset.

2. Billing cycles and renewal

Subscriptions are paid monthly or annually in advance before the period begins. Ruxelio enables automatic renewal only after the facility gives clear, demonstrable consent. It sends an annual-renewal reminder at least 30 days in advance. Any price change is notified at least 30 days before taking effect and applies from the next cycle; the facility may cancel before it applies.

3. Cancellation and refunds

The facility may cancel at any time through official account or support channels. Cancellation takes effect at the end of the current paid period, with access continuing until then. Unused time is not refunded pro rata, except for a duplicate or incorrect charge, where law requires, or where Ruxelio terminates without a facility breach; in the last case, prepaid fees for the remaining term are refunded pro rata.

4. Failed payment

After payment fails, the facility has seven days to correct it. If unpaid, the account may become read-only for a further 14 days and access may then be suspended after notice. Payment failure or suspension does not cause immediate deletion; the periods and export window in the Data Retention Policy apply. Amounts due remain payable.

5. Plan changes

An upgrade applies immediately, with the increase charged pro rata for the rest of the cycle. A downgrade applies from the next cycle, when limits and features may change. Before then, the facility should export or address data exceeding the new plan's limits.

6. Free plan

The free plan has no SLA commitment or service credits. Ruxelio may change or discontinue it with 30 days' notice where feasible and a reasonable export opportunity under the Data Retention Policy, unless security or law requires faster action.

7. Taxes, currencies, and invoices

Fees exclude taxes unless stated otherwise. The facility bears taxes and statutory charges applicable to it, excluding taxes on Ruxelio's net income. The plan or invoice states accepted currency; the customer bears third-party conversion or payment-provider charges. Invoices are issued electronically using facility-supplied details, and the facility must keep billing and tax-registration information, if any, accurate.

8. Payment disputes

A good-faith dispute must be reported through official support channels within 15 days after the invoice or charge, with its number, amount, and reason. The parties will cooperate to verify it, and undisputed amounts remain due on time. This does not limit a right that cannot legally be restricted.

9. SLA and availability

Paid plans have a 99.5% monthly availability target. Availability is calculated from total monthly minutes and non-excluded downtime. Exclusions include planned maintenance within stated limits, force majeure, customer systems or connectivity providers, prohibited use, and lawful suspension. Service credits are the specific financial remedy for missing the target, subject to liabilities that cannot be limited.

A credit request must be submitted through official support channels within 15 days after the affected month ends, with outage details. Total credit is capped at 20% of affected monthly Service fees, is applied to a future invoice, and is not paid or converted to cash. No credit applies if the invoice is unpaid or the account is in material breach.

10. Contact

Billing matters and credit requests must use the official support channels Ruxelio makes available until published contact details are updated.

1. Administrative tool, not a care provider

RuxMed is administrative SaaS for recording, organising, and displaying information and supporting workflows. Ruxelio is not a hospital, clinic, clinician, pharmacy, or healthcare provider and does not practise medicine or issue a diagnosis or prescription. Product use creates no clinician-patient relationship or duty of care between Ruxelio and any patient or user.

2. Not an emergency service

The Service is not designed to receive emergency calls, monitor critical conditions, or guarantee delivery of an urgent alert. For a suspected emergency, contact local emergency services or go to the nearest emergency department; do not wait for a message, response, or RuxMed availability.

3. Independent professional judgement

The licensed clinician alone is responsible for patient assessment, examination, diagnosis, treatment plan, follow-up, and referral. RuxMed templates, lists, reports, or alerts do not replace independent clinical judgement, and the professional must verify suitability for the case, law, and professional standards.

4. Medicines and prescriptions

Before approving or sending a prescription, a qualified prescriber must review patient identity, medicine, dose, form, route, frequency, duration, allergies, contraindications, drug interactions, therapeutic duplication, alerts, and relevant test results. Alerts may be incomplete, excessive, or late, and no alert does not establish safety. The facility is responsible for prescribing controls and human review.

5. Input and output accuracy

Outputs depend on user inputs and available integrated sources. The facility must verify identity, accuracy, completeness, and timing, correct inaccurate data, and prevent patient-file mismatches. Critical information must be checked against its original clinical source, and incomplete or automated input must not be relied on without review.

6. Outage and delay

The Service, messages, synchronisation, or reports may be unavailable or delayed because of maintenance, connectivity, third-party systems, or other events. The facility must maintain suitable continuity procedures, including alternatives for critical information, prescribing, communications, and care documentation, and reconcile records when service returns. See Service objectives in the Terms of Service.

7. Electronic prescriptions

If the facility uses functions to create or transmit a prescription electronically, it is responsible for prescriber authority, required signature or approval, recipient verification, record retention, and compliance with Egyptian local rules for prescribing and dispensing medicines and controlled substances. Availability of a field or template does not itself establish that a prescription is lawful.

8. Current and future tools

RuxMed does not currently include artificial-intelligence tools as a medical feature. If suggestion, summarisation, or prioritisation tools are added later, they will only assist, may be wrong or omit context, and will not replace a clinician, professional judgement, or human review. They must be assessed and their outputs verified before clinical use.

9. Facility responsibilities

The facility must ensure users are qualified and trained, permissions are appropriate, and patient consents, medical records, disclosures, prescriptions, and communications comply with law and professional standards. It is responsible for configuring, testing, and monitoring workflows, alerts, and integrations. The Data Retention Policy applies to retention and export.

10. Limits of disclaimer

The disclaimers and liability limits in the Terms of Service apply to the fullest extent permitted by law. Nothing here excludes or limits liability for fraud, wilful misconduct, gross negligence, or any liability that cannot legally be excluded or limited, or reduces a facility's or practitioner's professional duties to a patient.

11. Contact

Issues must be reported through the official support channels Ruxelio makes available until published contact details are updated. Support channels are not a substitute for emergency services.

1. Scope and roles

This Policy applies to data Ruxelio processes when providing RuxMed. The facility is responsible for determining medical data, retention periods, processing instructions, and the lawfulness of retention. Ruxelio follows documented instructions under the Terms of Service and applicable agreements.

2. Retention schedule

3. Data export

Export is available while the subscription is active and for 30 days after termination. A standard request is targeted within 10 business days after identity and authority verification. A large or customised request is targeted within 20 business days after scope and reasonable cost, if any, are agreed.

Formats may include CSV, XLSX, PDF, or ZIP depending on data type. Export excludes the raw database, code, system structure and schemas, algorithms, and third-party data. Ruxelio may request information needed to verify the requester's identity and authority and protect patient and third-party data.

4. Backup and recovery

Ruxelio targets daily backups on a rolling 35-day cycle and quarterly restoration testing. It targets a 24-hour RPO and a 12-hour RTO. These are operational objectives dependent on plan, data volume, incident, and system availability, not absolute guarantees of zero data loss or a fixed recovery time. Backups are for recovery and are not the facility's replacement archive.

5. Legal hold and exceptions

Deletion may be suspended to the extent and for the period needed for a court order, legal obligation, active dispute, or documented security investigation (legal hold). Data held for that purpose is restricted from ordinary use and deleted under the schedule when the reason ends. Ruxelio may also retain aggregate or de-identified data that cannot identify individuals again.

6. Secure deletion

When due, operational data is deleted or de-identified using methods appropriate to storage media and risk. Backup data is removed as the rotation expires and is not restored into production except for recovery; if an older copy is restored, relevant deletion requests and restrictions are reapplied.

7. Medical-record responsibility

The facility, not Ruxelio, is responsible for identifying and keeping the legal copy of medical records under Egyptian law and professional rules. It must export before the window ends and keep independent copies where its obligations require. See also the Medical Disclaimer.

8. Requests and contact

Export and deletion requests and questions must use the official support channels Ruxelio makes available until published contact details are updated. Ruxelio may decline to act on an undocumented request or one made by an unauthorised person.

1. Incorporation, scope, and priority

This Data Processing Agreement (the "DPA") forms part of the RuxMed terms or contract between the medical-organization customer (the "Organization") and Ruxelio as operator of RuxMed. It applies when Ruxelio processes personal data for the Organization. If terms conflict on data processing, this DPA prevails; the service terms otherwise remain effective.

The parties take account, as applicable, of Egypt's Personal Data Protection Law No. 151 of 2020 and applicable health laws, without claiming unverified certification or absolute compliance.

2. Roles and definitions

The Organization is controller of patient data and personal data it enters or collects through RuxMed, and Ruxelio is its processor. "Processing," "personal data," and "data incident" have their legally applicable meanings.

Ruxelio acts as an independent controller, not processor, for account, business-relationship, billing, support, security, and anti-fraud data whose purposes and means it independently determines; the Privacy Policy covers that processing.

3. Processing details

Subject: operation of RuxMed and its organization- and patient-management functions. Duration: the service term and limited period needed for return, deletion, backups, or legal preservation. Nature: collection, recording, organization, hosting, retrieval, display, restricted transmission, support, protection, and deletion. Purpose: functions requested by the Organization, support, security, and continuity on its instructions.

4. Instructions and Organization duties

Ruxelio processes data only on documented instructions in the contract, service settings, and lawful support requests, unless law requires otherwise; it will first notify the Organization where law permits. If Ruxelio considers an instruction contrary to applicable law, it will notify the Organization and may suspend that instruction pending clarification or amendment.

The Organization warrants that collection, instructions, and processing are lawful, that it has given notices and obtained required consents or authorizations, and that it has authority to enter patient and representative data. It must maintain accuracy and data minimization, control users and permissions, and avoid entering data unnecessary for care or another lawful purpose.

5. Confidentiality and security

Ruxelio limits access to personnel and contractors who need it for their duties and subjects them to appropriate confidentiality continuing after their work ends. It applies general technical and organizational measures proportionate to risk, such as identity and permission management, transmission and storage protection where appropriate, logging and monitoring, backup and recovery, update and vulnerability management, incident response, continuity, and awareness.

Measures are reviewed in light of risk, technology, cost, and data nature. These provisions do not guarantee complete security or claim use of a particular certification or technology not shown to be implemented.

6. Subprocessors and international transfers

The Organization generally authorizes Ruxelio to use subprocessors necessary for the service, provided they are bound in writing to materially equivalent protection duties and Ruxelio remains responsible for its obligations to the Organization. This DPA does not invent a subprocessor list.

Ruxelio will give reasonable advance notice of adding or replacing a subprocessor. The Organization may object during the notice period for documented data-protection reasons; the parties will seek a reasonable alternative, and if none is available, the affected service may be terminated under the contract.

Personal data is transferred outside Egypt only with an appropriate legal basis and safeguard and any required approval or authorization, with the recipient bound to relevant protection. This DPA states no uncertain hosting location.

7. Assistance, requests, and authorities

Considering the nature of processing and available information, Ruxelio reasonably assists with data-subject rights, processing security, data-protection impact assessments, and consultations or requests from competent authorities. It refers a patient request to the Organization and does not answer for it except on instructions or where law requires.

The Organization remains responsible for decisions, deadlines, and regulatory communications. It may be charged reasonable costs of unusual or burdensome assistance not caused by Ruxelio's breach, after notice of expected costs.

8. Data incidents

Ruxelio notifies the Organization without undue delay after becoming aware of a personal-data incident affecting Organization data. To the extent available, notice describes the incident, data and individual categories and approximate numbers, likely consequences, measures taken or proposed, and an available coordination point. Information may be supplied in phases.

Ruxelio cooperates in containment, investigation, remediation, and required notices. Notice and cooperation are not an admission of fault or liability. The Organization must promptly report a discovered incident or account misuse through support.

9. Information and audits

Ruxelio provides reasonable information to demonstrate these duties. The Organization may conduct one audit annually, itself or through an independent non-competing auditor, on at least 30 days' written notice, in business hours, with proportionate scope, confidentiality, no service disruption, and no access to other customers' data. The Organization bears its costs and Ruxelio's reasonable costs.

The annual and notice limits do not apply where a competent authority requires an audit or a material incident reasonably justifies an additional audit; confidentiality and minimized disruption still apply where practicable.

10. Return and deletion

After service termination, Ruxelio lets the Organization request a usable return of its data within 30 days, subject to available export features. After that export window, it deletes or renders active data irretrievable within a further 30 days and no later than 60 days after service termination, and cycles remaining copies out of backups no later than 95 days after that termination date, under the Data Retention Policy.

Data legally required to be preserved or not immediately isolatable in a protected backup is excepted; it remains isolated and protected, is processed only for preservation or recovery, and is deleted on the scheduled cycle. The parties may agree in writing to other legally permitted periods.

11. Law and disputes

This DPA is governed by Egyptian law, subject to mandatory data-protection and health rules. Competent Egyptian courts have jurisdiction unless the valid service contract specifies another applicable Egyptian mechanism. Confidentiality, deletion, and assistance provisions that by nature extend beyond termination survive.

For DPA matters, the Organization uses the official support channels available in RuxMed or its website.

1. Scope and responsible operator

This policy applies to RuxMed sites and applications operated by Ruxelio for medical organizations, with Egypt as the primary country. It supplements the Privacy Policy and takes account, as applicable, of Egypt's Personal Data Protection Law No. 151 of 2020 and applicable health rules, without claiming certification or absolute compliance.

2. What are these technologies?

A cookie is a small text item stored by a browser for a session or set period. RuxMed may also use local storage, session storage, identifiers, and similar technologies that save settings or protect requests. In this policy, "cookies" includes those technologies where appropriate.

3. Categories and periods

These are categories, not names of actual cookies. We do not invent unknown names or providers. If a preference panel is enabled, it will show the detailed list then available, including names, purposes, periods, and providers; we do not claim that the panel currently exists.

4. Basis and choice

We use what is needed to provide the service requested by the user and protect the account and network. A non-essential technology is not placed or read before valid consent where legally required, and consent can be withdrawn without affecting earlier lawful use. Rejecting non-essential technologies does not disable core functions, but may reduce some preferences or optional measurement.

There are currently no cookies for marketing, behavioral advertising, or cross-site patient tracking, and these technologies are not used to build medical-marketing profiles about patients. A change to this approach requires notice, appropriate choices, and a legal basis.

5. Managing cookies

When a consent banner or preference center is available, it can be used to accept or reject non-essential categories or withdraw consent. This statement does not imply that a banner or center certainly exists in every interface today. Cookies can also be deleted or blocked, and local storage managed, in browser settings.

Blocking session, authentication, or security cookies may prevent sign-in or safe operation. Browser steps differ, and local storage may need to be cleared separately.

6. Third parties

Approved third parties may provide functions such as hosting, security, support, or operational performance measurement. If they place technologies through RuxMed, we contractually limit them to the necessary purpose and apply consent where the technology is non-essential. External sites voluntarily visited by a user may have independent policies.

This policy does not identify a provider or cookie unless it is known and enabled. Details will appear in the preference panel if enabled or in an appropriate notice.

7. Changes and contact

We may update this policy when technologies or legal requirements change, update its date, and give appropriate notice of a material change. For questions or to report unexpected cookie behavior, use the official support channels available in RuxMed or its website; this is the temporary contact channel.

1. Scope and responsibility

This policy applies to every organization, user, or system accessing RuxMed, a B2B product operated by Ruxelio for medical organizations, with Egypt as its primary country. It forms part of the service terms.

The Organization must ensure its users comply with this policy, Egypt's Personal Data Protection Law No. 151 of 2020, and applicable health, professional, and other laws and regulations. This does not claim certification or absolute compliance by RuxMed.

2. Lawful and prohibited use

RuxMed may be used only to administer the medical organization's work and for purposes allowed by contract and law. The following are prohibited:

• Any unlawful, fraudulent, or deceptive activity, or impersonating a person, organization, or professional status.
• Threatening, harassing, abusive, or discriminatory conduct or infringement of others' rights.
• Uploading, copying, or distributing content that infringes intellectual property, privacy, confidentiality, or contractual rights.
• Collecting, entering, disclosing, or using personal or health data without a right, authority, or suitable legal basis.
• Using the service for misleading medical claims or to avoid a practitioner's professional duties.

3. Patient and data protection

• Enter only patient data needed for care or another lawful purpose, and verify patient identity and the correct record before use or disclosure.
• Show records only to authorized people who need them, and do not export or send them through an insecure channel or to an unverified recipient.
• Do not use real data for training, testing, or demonstrations where dummy data is sufficient, and do not attempt to re-identify de-identified data.
• Meet patient-rights, consent, notice, retention, and medical-confidentiality duties resting on the Organization.

4. Accounts and access

Each authorized user must have an individual account and keep credentials confidential. Account or password sharing, enabling an unauthorized user, and bypassing authentication or permissions are prohibited. The Organization must update roles, revoke access when duties change or a user leaves, use available protections, and promptly report lost credentials or suspicious activity to support.

5. System and communications security

Without Ruxelio's express, specific written authorization, the following are prohibited:

• Attempting to breach or bypass controls, exploit a vulnerability, or access an unauthorized account, data set, or system.
• Uploading or transmitting malware, ransomware, backdoors, or code that disrupts the service or monitors others.
• Phishing, spam, unsolicited bulk communications, or source spoofing.
• Port or vulnerability scanning, penetration testing, traffic interception, or testing RuxMed resources.
• Uploading harmful or unlawful content or files designed to conceal code or cause damage.

6. Automation and resources

Automated extraction or scraping; unauthorized bots, scripts, integrations, or APIs; and bypassing rate limits, quotas, or technical restrictions are prohibited. So are excessive load, stress tests, unnecessary bulk downloads or exports, and activity that disrupts or degrades service for others.

Only authorized integration interfaces, documentation, and limits may be used. Ruxelio may rate-limit requests to protect security and availability.

7. Product protection

To the extent law permits, reverse engineering, decompiling, or disassembling RuxMed; copying its design, functions, or protected content; or selling, reselling, sublicensing, or making it a third-party service outside the contract is prohibited.

Direct access to databases or internal infrastructure, and export of data, metadata, screens, or workflows to reconstruct the product or create a substitute, are prohibited. This does not prevent the Organization lawfully exporting its own data for clinical, legal, or migration use through service features and under the contract.

8. Monitoring and logs

Ruxelio may reasonably monitor service use and investigate reports to protect patients, customers, and the service and enforce this policy. Security, access, and investigation logs may be retained for up to 12 months, or longer where law, a dispute, or an active investigation requires, with limited access and data minimization.

9. Enforcement

Ruxelio considers the violation's nature, severity, repetition, harm, and cooperation. Where practicable, enforcement is graduated: notice, a request for information or to stop activity, reasonable opportunity to cure, restriction of a function or user, and suspension or termination under the contract. Harmful content may be removed or isolated where lawful.

Immediate suspension or restriction without prior notice may occur for urgent risk to patients, data, security, or continuity; potentially unlawful activity; or a binding authority request. We will state the reason, scope, and expected duration where legally and securely possible and restore access when risk is addressed.

10. Appeal

The Organization may appeal through official support, identifying the decision, facts, and corrective measures. Where practicable, an appropriate person who did not make the decision reviews available information, and Ruxelio communicates an outcome within a reasonable period. An appeal does not stay action needed to contain an existing risk.

11. Responsible vulnerability disclosure

Privately report a vulnerability to official support with reproduction steps and potential impact. Do not exploit it, exceed the minimum needed to verify it, access third-party data or accounts, alter or delete data, disrupt service, or publish details before allowing reasonable remediation time and agreeing on disclosure.

This policy grants no general testing authorization. Any commitment not to take action ("safe harbor") applies only to good-faith research strictly within prior written authorization defining scope, time, and methods, and subject to its terms and law. It does not cover out-of-scope activity, negligence, or extortion.

12. Reporting and contact

Promptly report misuse, harmful content, unauthorized access, or a security incident through the official support channels available in RuxMed or its website. Include the time, affected account or resource, description, and safely collected evidence without sending unnecessary patient data. These channels are the temporary contact method until a dedicated channel is announced.