Clinic software contract terms to read before you sign Term, exit, data return, price changes, sub-processors and the DPDP contract, clause by clause.

Before signing up for clinic software, read the terms for six things: the term and how it renews, how you cancel and what you owe, how and when your data comes back and is deleted, how much notice you get of a price change, which other companies process your patients' data, and the clauses that make the vendor your Data Processor under the DPDP Act. Most terms pages answer some of these; the gaps are where the cost of leaving hides.

This is a reading guide, not legal advice. For an agreement that covers patient records, a lawyer's hour is cheap against the years the records must survive. Our post on switching clinic software shows what these clauses mean on the day you leave.

How long are you bound, and how does it renew?

• Term: monthly, yearly or longer. A yearly term paid upfront is a year of lock-in if the software does not suit the desk.
• Auto-renewal: does it renew without a fresh yes, and how many days before renewal must you cancel? Put that date in the clinic calendar.
• Trial: does the trial need a card or a mandate, and does it convert to a paid plan on its own?
• Refunds: if you cancel mid-term, is the unused period refunded? If the terms are silent, assume not.

How do you leave, and what do you owe?

Find the cancellation clause and read it as a procedure: who sends what, to which address, with how much notice, and what happens on the day it takes effect. Then find the words read-only, grace period and deletion. A fair agreement gives the clinic a stated period after cancellation to read and export its records, then deletes them on a stated date. A silent agreement may delete on the day, or keep the data for as long as the vendor likes, and neither suits a clinic.

How does your data come back?

The clause should say three things: that the clinic can export its data, in what format, and at what cost. The useful format is one you can open without the vendor, such as CSV. The useful cost is none. The useful trigger is the clinic admin, not a support ticket. Section 8(7)(b) of the DPDP Act adds a duty on the clinic as fiduciary: when retention is no longer needed, it must "cause its Data Processor to erase any personal data that was made available by the Data Fiduciary for processing". That means the clinic needs a contractual right to make the vendor delete, and a written confirmation when it has. Our page on clinic data ownership lists what to expect.

How can the price change?

• Notice period for a price change, and whether you can cancel without penalty when one is announced.
• Whether a price is fixed for the term you have paid, or can change mid-term.
• Whether limits (doctors, users, patients, messages) can be tightened on an existing plan.
• Whether GST is extra and at what rate the invoice will show it. Our post on free versus paid clinic software explains why a clinic usually cannot claim it back.

Who else processes your patients' data?

A cloud vendor runs on other companies' servers and uses other companies to send messages, store files and take payments. Each of those is a further processor of your patients' data. The terms or a linked page should list them, say what each does, and say how you will be told when the list changes. Section 8(1) of the DPDP Act keeps the clinic responsible for processing "undertaken by it or on its behalf by a Data Processor", so the clinic has an interest in knowing who those processors are.

What does the DPDP Act require the contract to say?

The Digital Personal Data Protection Act, 2023 defines a Data Fiduciary as the person who "determines the purpose and means of processing of personal data" and a Data Processor as "any person who processes personal data on behalf of a Data Fiduciary". The clinic is the fiduciary; the software company is its processor. Section 8(2) then says the fiduciary "may engage, appoint, use or otherwise involve a Data Processor to process personal data on its behalf for any activity related to offering of goods or services to Data Principals only under a valid contract".

The DPDP Rules, 2025 say what the contract should cover. Rule 6(1)(f) lists, among the minimum security safeguards, an "appropriate provision in the contract entered into between such Data Fiduciary and such a Data Processor, wherever applicable, for taking reasonable security safeguards". Rule 8(3) requires the fiduciary to keep personal data and processing logs for at least one year, and its illustration is a company that engages a cloud provider and must ensure the provider keeps the data and logs for that period. So the contract should at least say:

1. That the vendor processes patient data only on the clinic's instructions and for the clinic's service.
2. What security safeguards the vendor takes, in terms that match rule 6(1): encryption or similar, access control, logs and monitoring, backups, one-year log retention.
3. How and how fast the vendor tells the clinic of a breach, so the clinic can meet rule 7's duty to tell affected patients and the Board, with the detailed report to the Board within 72 hours.
4. That the vendor will erase data on the clinic's instruction and confirm it, meeting section 8(7)(b).
5. Who the sub-processors are and how changes are notified.
6. That data and logs are retained for the periods the Rules require, and where.

The rules on security, breach and retention come into force eighteen months after the Rules' publication on 13 November 2025, but a contract signed today will still be running then. Our DPDP guide for clinics and our list of security questions for a vendor cover the rest.

Is a clinic a consumer when it buys software?

Often not, and it matters for where a dispute can go. Section 2(7) of the Consumer Protection Act, 2019 defines a consumer as a person who buys goods or hires a service for consideration, but says the term "does not include a person who avails of such service for any commercial purpose". The Explanation then carves out use "exclusively for the purpose of earning his livelihood, by means of self-employment". A single doctor running her own clinic may sit inside that carve-out; a company-owned clinic with employed doctors may not. Which side your clinic is on decides whether a consumer commission is open to you or only the civil courts and whatever dispute clause the terms contain. Ask your lawyer; do not assume.

That makes the dispute clause worth reading too: which court or arbitration, in which city, under which law. A clause that puts every dispute in a city you cannot travel to is a cost of leaving.

The clause checklist