Terms of Service

1. The provider and your acceptance

Flow Clinic is clinic management software delivered as an online service, built and operated by KENGTECH Co., Ltd. (“we”). These terms form an agreement between us and the entity or person who subscribes to the service (“the clinic” or “you”).

By activating an account, signing in, or continuing to use the service, you confirm that you have read and agree to these terms and to the Privacy Policy at /privacy, which forms part of this agreement. If you do not agree, please stop using the service.

Whoever accepts these terms on the clinic's behalf must be at least 20 years old and authorised to bind the clinic. The service is provided for business use and is not a consumer service. We may decline to open an account or accept a request for service, for example where the business is not a clinic or a business the service is designed for, or where we reasonably believe the use would breach these terms.

2. Definitions

• Service — the Flow Clinic software, website, applications, add-ons, and the support we provide under the agreed package.
• Clinic account — one clinic's data space in the system, access-scoped separately from every other clinic.
• Account administrator — the person the clinic designates with the highest privileges in its account, and the person whose instructions we act on.
• Users — staff, doctors, contractors, or other people the clinic grants access to its account.
• Clinic data — data the clinic or its users import, create, or receive through the service, including customer records, medical records, financial documents, attachments, and conversation history.
• Chat channels — the LINE Official Account, Facebook Messenger, and Instagram connections a clinic chooses to enable.

3. Accounts, users, and the clinic's responsibility

We grant you a non-exclusive, non-transferable, non-sublicensable right to use the service in your own clinic's business, within the package, branch count, and user count agreed.

The clinic creates, permissions, suspends, and revokes its own user accounts. The clinic is responsible for the acts of every one of its users as if they were its own, whether or not the clinic was aware of them — including access to medical records, edits to financial documents, and messages sent to customers.

We act on instructions about a clinic account from the account administrator only. We may decline requests from other users or from outside parties claiming authority unless the account administrator confirms them. This exists to protect the clinic's own data.

You must keep usernames, passwords, and verification codes confidential, must not share one account between people, and must tell us immediately if you suspect unauthorised access. We will respond reasonably once notified, but activity through a correctly authenticated account counts as the clinic's own.

4. Trial, packages, and fees

We offer a 30-day free trial with no credit card required. During a trial, parts of the service may be limited and are provided on an “as is” basis to an even greater degree than a paid account. We may change or end trials at any time.

Fees, billing cycle, and the number of branches and users follow the package set out in the quotation or invoice agreed between us. Prices shown on the website are indicative and exclude VAT unless stated otherwise.

We invoice in advance for each cycle. Payment is due by the date stated on the invoice. Withholding tax is handled as the law requires, and transfer charges are borne by the payer.

If an invoice is overdue we will send reasonable reminders and may suspend access to the clinic account until it is settled. Suspension for non-payment does not cancel fees already due, and does not delete your data immediately. While suspended you may still request an export of clinic data under clause 12, because clinic data is yours.

We may change fees on at least 30 days' notice before the next billing cycle. A new price never applies retroactively to a cycle already paid. If you do not wish to continue at the new price, you may cancel under clause 5.

Usage-based charges from third parties — LINE messaging fees or payment-processor fees, for example — are the clinic's own responsibility directly with that provider, unless agreed otherwise in writing.

5. Renewal, cancellation, and refunds

The service renews automatically for each agreed cycle unless cancelled.

You may cancel at any time by writing to sawasdee@flowclinic.tech from the account administrator's email address. Cancellation takes effect as a stop on the next renewal. You keep normal access until the end of the cycle you have already paid for.

We do not refund fees pro rata for a cycle that has already begun, whether you cancel mid-cycle or do not use the full period. This does not affect rights you have under law that cannot be excluded, and does not apply where we have billed you in error — in that case we will refund or credit the next cycle once verified.

If we terminate while you are not in breach — because we discontinue the service, for example — we will refund the fees paid for the period not yet used.

6. Acceptable use

You agree not to do the following, and to hold your users to the same:

• Use the service for unlawful purposes, or to store and distribute content that is unlawful, infringing, or false.
• Send marketing messages to people who have not consented, or otherwise breach data protection law or the rules governing healthcare advertising.
• Use bots, scripts, scrapers, or other automated means to access the service, other than through an interface or API we have expressly made available.
• Circumvent security controls, rate limits, permission scopes, or the data boundary between clinics, or attempt to reach another clinic's account or data.
• Reverse-engineer, decompile, or copy any part of the service, or sublicense, resell, or operate it for third parties as a service bureau.
• Upload malware, or place an unreasonable load on the system in a way that affects other customers.
• Impersonate anyone, or register using false identifying information.

If we detect or reasonably suspect any of the above, we may suspend access immediately under clause 13, to limit harm to the system and to other customers.

7. Chat channels and third-party services

The service can connect to third-party platforms such as LINE, Meta (Facebook Messenger and Instagram), Google Calendar, and payment providers. Connecting is the clinic's choice, and begins with the clinic authorising us to access only the data a given feature needs.

Accounts on those platforms belong to the clinic, not to us. The clinic is therefore responsible for its own compliance with each platform's terms and policies, in particular:

• Messaging only people who gave their contact details and consented to receive messages, and stopping immediately when a recipient opts out or blocks.
• Respecting the messaging windows and message types each platform defines, including the limits on messages sent outside the reply window.
• Presenting sender information truthfully, without impersonating another person or business.
• Providing a human who can take over from automated replies within a reasonable time when a matter needs one.
• Maintaining the privacy notice and consents the clinic's own customers require.

We do not guarantee the availability or continuity of any external platform. A platform may change its terms, reduce permissions, rate-limit, suspend, or close a clinic's account on its own, without going through us and without notice to us. None of that is a breach of these terms by us, none of it gives rise to a claim for damages, and none of it entitles you to a refund or fee reduction.

If a platform requires us to act, or a clinic's connection puts our standing as a provider or other customers at risk, we may suspend or disconnect that channel, giving you notice where circumstances allow. Disconnecting a channel does not end your Flow Clinic account and does not relieve you of payment obligations.

Turning a channel off inside Flow Clinic stops new messages from being sent or received, but is not a deletion of existing history and is not confirmation that permissions on the platform side have been revoked. See /data-deletion for how to request deletion and revoke access.

8. Clinic data and ownership

Clinic data belongs to the clinic. We claim no ownership of it, and we do not sell, rent, or use a clinic's customer data for our own advertising or anyone else's.

You grant us only the rights we need to store, process, copy, transmit, and back up clinic data solely to provide the service, keep it secure, resolve problems, and meet legal obligations. Those rights end when the relationship ends and the period in clause 12 has passed.

We may use aggregated or de-identified statistics to improve and measure the service, provided they cannot be linked back to any clinic or person. We do not use clinics' medical records or customer conversation content to train commercial models.

You confirm that you have the legal right to put the data you import into the service, and that doing so infringes no one else's rights.

9. Data protection and PDPA roles

For the personal data of a clinic's customers, and the staff data the clinic records such as names, roles, and permissions, the clinic is the data controller and we are the data processor under the Personal Data Protection Act B.E. 2562 (2019). We process on the clinic's instructions and only as needed to provide the service.

For account credentials and security logs, billing, system security, and our own business-contact data, we act as controller. The detail is in the Privacy Policy at /privacy.

As controller, the clinic is responsible for informing data subjects of the purposes, having a valid lawful basis, obtaining consent where required — particularly for health data, which is sensitive personal data — and for responding to data subject requests. We will provide reasonable assistance when asked.

We maintain security measures appropriate to the risk, engage sub-processors only as needed, and will notify the clinic without undue delay once we become aware of a personal data breach affecting its data, so the clinic can meet its own notification deadline.

Where the law requires a separate data processing agreement, the parties agree to put one in place as needed.

10. Intellectual property

The software, interfaces, system databases, documentation, trade marks, trade names, and all design work in Flow Clinic are the intellectual property of us or our licensors. These terms grant a right of use under clause 3 only; they transfer nothing.

If you send us feedback or suggestions, we may use them to improve the service with no obligation to pay for them, and without affecting your ownership of clinic data under clause 8.

11. Availability, maintenance, and changes to the service

We aim for availability of at least 99.95% per month. That figure is a service target, not a contractual warranty, and does not give rise to service credits or damages unless separately agreed in writing.

The service is provided as is and as available. Although we intend to perform fully, we do not warrant that it will be free of defects, delays, interruptions, or processing errors, because communications, computer, and internet systems are inherently uncertain.

We may take the system down for planned maintenance, giving reasonable notice and choosing the least disruptive window we can. Emergency maintenance for security reasons may happen immediately without notice.

We may add, change, or retire features. If we retire a significant feature in a way that materially affects your use, we will give reasonable notice and you may cancel under clause 5.

12. Backups, export, and deletion at the end of the agreement

We back data up regularly and keep multiple copies, and will restore from the most recent backup as far as reasonably possible after an incident. Even so, we cannot guarantee that data will never be lost or damaged, so you should export important data and keep your own copies on a cycle suited to your clinic's risk.

When the agreement ends, by cancellation or termination, you have 90 days from the end date to request an export of clinic data in a format the system supports. We may require the request to come from the account administrator, and may charge reasonably for exports in unusual formats.

After those 90 days we delete clinic data from primary systems or render it non-identifying, and let backup copies expire on their normal rotation, unless the law requires us to keep it — in which case we restrict access to what is necessary.

Statutory retention of medical records and accounting documents is the clinic's duty as controller and as the party bound by professional and tax law. Exporting data before the 90 days expire is therefore the clinic's responsibility.

13. Suspension and termination

We may suspend access to a clinic account in whole or in part, or terminate, if:

1. fees are overdue and remain unpaid after the reminder period we give;
2. you breach clause 6 or clause 7, or applicable law;
3. the use puts system security, another clinic's data, or our standing with an external provider at risk; or
4. a court, a competent authority, or the law requires it.

Where a breach is remediable, we will give notice and a reasonable chance to fix it first. Where it is serious, not remediable, or where waiting would create risk to the system or to others, we may suspend immediately and notify afterwards. Suspension for your breach does not entitle you to a refund or fee reduction.

You may terminate under clause 5. When the agreement ends, the right to use the service ends, but clauses 8, 9, 12, 14, 15, and 17 survive to the extent their nature requires.

14. Limitation of liability

Flow Clinic is a record-keeping and management tool. It is not a medical device, and it does not provide diagnoses, medical advice, or legal or tax advice. Decisions about examination, diagnosis, treatment, prescribing, issuing medical documents, and issuing tax documents rest with the clinic and its licensed professionals. You must always check that data and documents are correct before relying on them.

To the extent the law allows, we are not liable for indirect or consequential loss, lost profits, lost revenue or business opportunity, damage to reputation, or loss of data arising from causes beyond our reasonable control.

In any event, our total liability arising out of or in connection with the service will not exceed the fees you actually paid us in the 12 months before the event giving rise to the claim, to the extent the law permits liability to be limited.

The limits in this clause do not apply to liability arising from our fraud, wilful misconduct, or gross negligence, nor to liability the law does not permit to be excluded or limited.

If any part of this clause is held void or unenforceable, the rest remains in force and liability is limited to the maximum extent the law allows.

15. Indemnity

You agree to indemnify and defend us against claims, damages, fines, and reasonable costs including legal fees arising from (a) content or data you or your users put into the service; (b) your failure to comply with data protection law, healthcare-establishment law, professional regulation, or tax law; (c) your breach of clause 6 or clause 7; or (d) a dispute between you and your own customers or staff.

We will notify you without undue delay of any such claim and cooperate reasonably in the defence.

16. Force majeure

We are not liable for delay or non-performance caused by events beyond our reasonable control, such as natural disaster, widespread power or network failure, cyber-attack, government order, war, epidemic, or an outage at an infrastructure provider or external platform.

17. Governing law, changes, and contact

These terms are governed by Thai law, and the courts with jurisdiction in Bangkok have jurisdiction. The parties will attempt to resolve any dispute in good faith before starting proceedings.

You may not assign your rights or obligations under these terms without our written consent. We may assign to an affiliate or to a successor of the business, without reducing your rights under these terms.

We may amend these terms and will show the last-updated date above. If an amendment materially affects your rights, we will give at least 30 days' notice by email to the account administrator or by in-product notification. If you do not accept the change, you may cancel under clause 5 before it takes effect. Continuing to use the service after the effective date counts as acceptance.

Contact KENGTECH Co., Ltd. at sawasdee@flowclinic.tech. For data protection rights requests see /privacy, and for deletion requests see /data-deletion. Please do not email passwords, tokens, OTP codes, or health data that is not needed.