Terms of Use

Platform: NABHDesk  â€¢  Version: [1.1]  â€¢  Effective: 01/04/2026

These Terms govern use of NABHDesk (the "Platform"), supplied by Caresoft Systems Private Limited, CIN [U72900MH2022PTC387875], GSTIN [GSTIN], registered office 311, Mahesh Industrial Estate , Silver Park, Mira Road East , Thane -401107 ("Caresoft", "we"), to the hospital or healthcare organisation identified in the Order ("Hospital", "you").

These Terms incorporate the Independence, Trademark & Content Notice, Privacy Policy, Disclaimer, Refund Policy and Data Processing Addendum. On any question of our relationship with NABH, or of what our content is, the Independence Notice prevails.

1. Definitions

• "Hospital Data" — everything you create or import: assessments, scores, documents, committee records, indicators, incidents, audits, staff records, equipment records, patient feedback and grievances.
• "Library" — our element library, including codes, tiers, structure and our own requirement wording.
• "Readiness Score" — a self-assessment figure calculated from what your team recorded.
• "Order" — the agreement specifying plan, users, programme scope, validity and fees.

2. Our role

• Caresoft supplies quality management and compliance workflow software, with a structured element library.
• We are not NABH, not connected to NABH, and not able to influence any assessment (Independence Notice §2).
• We are not assessors and produce no assessment findings.
• We do not provide accreditation consultancy under this licence. Where consultancy is purchased separately, it is our own advice with no NABH standing.
• We are not your quality department. The work is yours; the software organises it.

3. Licence and access levels

Subject to these Terms and payment, we grant you a non-exclusive, non-transferable, non-sublicensable right, during the validity period in your Order, to use the Platform for the hospital named in your Order, within the user limits stated.

4. Consultants and multi-hospital use

• Each hospital's data is a separate organisation's confidential information, and often contains patient and employee data. The licensing and data protection position differs materially from single-hospital use.
• A consultant must not move data, documents or templates between client tenants without each hospital's written consent.
• A hospital's incidents, RCAs and grievances must never be shared with another hospital, including as an anonymised example, without its written consent.
• Where a consultant's engagement ends, access must be revoked by the hospital immediately, and the consultant must retain nothing.

5. Accounts and users

• Accounts are personal. Do not share credentials — the record of who scored an element, approved a document or closed a CAPA is the audit trail an assessor may ask about.
• Revoke access within [24] hours of a person leaving or changing role, and immediately when a consultant's engagement ends.
• You are responsible for all activity under your accounts.
• Grant module permissions on need. Not everyone should see incidents, grievances or staff credentialing records.

6. Scope declaration

• You declare your scope in the Platform, and must record a reason where an element is marked not applicable.
• Applicability is your clinical and administrative judgement, not ours. We do not verify it.
• Review scope whenever your services, bed count or programme changes.
• An assessor may disagree with an applicability decision, and theirs governs.

7. Our content and your verification

The Library contains our own requirement wording, written by us. It is an interpretation of what each element asks for, not the published standard, and not a substitute for it (Independence Notice §7).

• Where an element's wording has not completed our own verification, the Platform indicates it. Do not score against it as though it were settled.
• Your hospital should hold its own copy of the current published standards.
We correct promptly and notify clients where a correction changes a score.
• Do not paste published standard text into any field (Independence Notice §6).
• Standards change without notice to us. Knowing which edition applies to your assessment is your responsibility.

8. Readiness scores

• A Readiness Score reflects what your own team recorded — their judgement, their evidence, their honesty about gaps.
• It is not an accreditation score, not a prediction, and not evidence to anyone outside your hospital.
• The Platform cannot detect generous self-scoring, and generous self-scoring is the normal failure mode of every quality system.
• Do not present a Readiness Score to a board, insurer, empanelment body or customer as evidence of accreditation status.
• Only one assessment may be open at a time. Reporting is against the open assessment.

9. Incidents, RCA and legal exposure

• Storing them in NABHDesk does not create the exposure — the exposure exists wherever an incident register is kept, including on paper. The software does not increase it, and does not reduce it either.
• Take your own advice on how your hospital records incidents, what language is used, and who has access.
• Restrict access to incidents, RCAs and grievances to those who need them.
• Where a matter is or may become contentious, place the records on hold and tell us — we will preserve rather than delete them on schedule.
• Caresoft will produce records and access logs on lawful request or your instruction, and will notify you unless legally prohibited (Privacy Policy).
• We will not edit, backdate or remove a record to improve its appearance, and no member of our team may be asked to. Audit trails are immutable by design.

10. Document control

• Documents you upload — policies, SOPs, minutes, licences — are yours and are confidential to your hospital.
• The Platform enforces versioning, approval and automatic obsoleting of superseded versions. An obsoleted version is retained, not deleted, because the question "what did the policy say at the time" is one that gets asked.
• Read acknowledgement records who confirmed reading a document. An acknowledgement is a record that someone clicked, not evidence that they understood or complied.
• You are responsible for the content, accuracy and clinical soundness of every document. We do not review them.
• Do not upload published standard text, or third-party copyright material you are not licensed to hold.

11. Records and retention

• Quality records, incident records, minutes and staff records carry retention obligations under professional regulation, employment law, tax law and the standards themselves.
• You set retention in the Platform and are responsible for setting it lawfully. We do not set it and cannot advise on it.
• The record destruction register requires a named witness. Destruction is refused without one, deliberately — an unwitnessed destruction record is worth nothing if questioned.
• Records under investigation, complaint or legal hold must not be destroyed on schedule.
• Export regularly. The Platform is not your only copy of your quality records.

12. HIS integration

• Where you connect a hospital information system, data flows on your instruction using credentials you control.
• Values pushed from a HIS are badged as such so your team can see what was entered by hand and what arrived automatically.
• We do not verify HIS-sourced values. An indicator calculated from wrong source data is wrong, and looks exactly as authoritative as a right one.
• You are responsible for the mapping, for your HIS credentials, and for changes made at the HIS end that break the integration.
• API keys are secrets. Rotate them on personnel change.

13. Excel imports

• Imports must match our published format. Malformed files are rejected rather than partially loaded.
• Verify imported data before relying on it. An import can succeed technically and be wrong substantively — wrong column mapped, wrong period, stale extract.
• Import only what you need. A staff or equipment extract often carries more personal data than the module requires (Privacy Policy).
• You warrant you are entitled to import the data you upload.

14. Assessor access

• The role is read-only and enforced server-side — write attempts are refused, not merely hidden.
• Granting it is your decision. Revoke it when the engagement ends.
• Granting assessor access does not make anyone a NABH assessor, and NABH has no access to your tenant.
• Consider what the account can see. It reads incidents, grievances and staff records unless you restrict it.

15. Your responsibilities

• Verify our wording against the published standards (§7).
• Declare scope accurately, and review it when services change.
• Score honestly. A generous score is a lie you tell yourself.
• Hold your own copy of the current published standards.
• Set retention lawfully and place records on hold when needed.
• Control access to incidents, grievances and staff records.
• Export regularly and keep your own copy.
• Maintain your own registrations and statutory compliance, which sit above accreditation (Independence Notice §14).

16. Acceptable use

You must not: use one licence for more than the hospital named in your Order; share accounts; use the Platform across multiple client hospitals without a consultant arrangement; upload published standard text or unlicensed third-party material; extract or redistribute our Library, wording, checklists or templates; use our content to build a competing product or consultancy offering; falsify records or ask us to; scrape or automate beyond the documented API; probe security without authorisation; or use the Platform unlawfully.

We may suspend immediately where we reasonably believe use breaches this Section.

17. Your data and ownership

• You own all Hospital Data. We claim no ownership.
• You grant us a limited licence to host, store, process and display it solely to provide, secure and support the Platform for you.
• We do not use Hospital Data for our own purposes, do not sell it, do not share it between hospitals, do not aggregate it into identifiable benchmarks, and do not use it to train artificial intelligence models.
• Export in a documented, machine-readable format is available throughout the term and on exit (§28).

18. Data protection

Hospital Data includes patient data (feedback, grievances, incidents) and employee data (credentialing, training). You are the Data Fiduciary; Caresoft is a Data Processor, under the DPA. Data is stored and processed within India. You are responsible for the lawful basis, notices and consents.

19. Security

We maintain the measures in the DPA, including encryption in transit and at rest, uploaded files stored outside the web root, role-based access with server-side enforcement, multi-factor authentication for administrative access, tenant isolation, immutable audit logging, forced password reset on provisioning with no password ever emailed, no production data in non-production environments, and periodic penetration testing.

You are responsible for your devices, network, user access hygiene and API keys. Each party notifies the other of a suspected incident immediately, and within [24] hours at the latest.

20. Availability and support

The Platform is provided on an "as available" basis. Unless a written SLA applies, we give no uptime commitment and no service credits. Support is per your plan via support@caresoft.co.in.

21. Changes to the Platform

We may add, modify, deprecate or remove features, and will update the Library as standards change. Where a Library change alters how an element is worded or scored, we notify you and indicate it in the Platform, so you are not comparing periods computed on different bases without knowing. We give at least [30] days' notice before removing a feature material to your paid plan.

22. Fees and validity

• Fees, users, programme scope and validity are as stated in your Order, in Indian rupees, exclusive of GST.
• Access ends when the validity period expires unless renewed. Subscriptions renew automatically unless cancelled before renewal; price revisions require [30] days' notice.
• Invoices payable within [15] days; overdue amounts attract interest at [1.5]% per month or the maximum permitted by law, whichever is lower.
• We may suspend after [7] days of non-payment following notice, and terminate after [30] days.

23. Intellectual property

Caresoft retains all rights in the Platform, the Library, our requirement wording, how-to notes, evidence hints, checklists and templates, and the marks "NABHDesk" and "Caresoft". You retain all rights in Hospital Data, including documents you upload and records you create. Our content is licensed for use within the Platform for your own hospital only (Independence Notice §16). Third-party rights are addressed in that Notice.

24. Confidentiality

Each party protects the other's confidential information with at least reasonable care. Your incidents, grievances, RCAs, staff records and internal policies are confidential without qualification, and are never disclosed to another hospital, used as an example, or shared in any form. Obligations survive for [5] years, and indefinitely for patient data, employee data and source code.

25. Warranties

We warrant that we have the right to grant the licence, that the Platform will perform materially in accordance with its documentation, and that we will provide the services with reasonable skill and care.

You warrant that you are entitled to the data you upload and that your use complies with applicable law.

26. Limitation of liability

27. Indemnities

• By us: against third-party claims that the Platform as supplied infringes intellectual property rights, subject to prompt notice, control of defence and cooperation. This includes a claim that our own requirement wording infringes copyright in the published standards, since that wording is ours.
• By you: against claims, penalties, losses and costs arising from Hospital Data and how it was obtained; published standard text or unlicensed material you uploaded; patient and employee data you process; your records, their retention or destruction; representations you made about accreditation status; and your breach of these Terms or applicable law.

28. Term, termination and exit

• Term and validity as stated in your Order, renewing automatically unless cancelled before renewal.
• Either party may terminate for material breach not cured within [15] days, or immediately on insolvency.
• We may suspend or terminate immediately for breach of §16.
• Exit. On termination we make Hospital Data available for export — records, documents, minutes, incidents and audit trails — for [60] days, because these are records you are obliged to retain.
• Export before you leave. After the window, data is deleted and unrecoverable, and your retention obligation continues regardless.
• Our Library and wording are not exportable and remain our property (§23).
• Sections 17, 23, 24, 26, 27 and 29 survive termination.

29. Governing law and disputes

Governed by the laws of India. The parties will escalate in good faith for [30] days. Failing resolution, disputes are finally settled by arbitration under the Arbitration and Conciliation Act, 1996 by a sole arbitrator appointed by agreement, seated at [Mumbai, Maharashtra], in English. Subject to arbitration, the courts at [Mumbai, Maharashtra] have exclusive jurisdiction.

30. Grievance and general

Grievance Officer (Information Technology Act, 2000; Digital Personal Data Protection Act, 2023):
Name: Rajeev Pillai  |  Email: legal@caresoft.co.in
Address: 311, Mahesh Industrial Estate , Silver Park, Mira Road East , Thane -401107 — acknowledgement within 24 hours, resolution within 15 days.

• Entire agreement — the Order, these Terms and the incorporated documents.
• Assignment — not without our consent, save to a successor of your hospital on notice. We may assign to an affiliate or in a merger or sale of assets.
• Subcontracting — permitted; we remain responsible. S
• Notices — to your registered email or in-product; to us at legal@caresoft.co.in.
• Publicity — we may name you as a client only with your prior written consent, and will never state or imply your accreditation status.
• Severability, waiver — standard. These Terms constitute an electronic record under the Information Technology Act, 2000.
• Amendment — material changes on [30] days' notice.