iCenna Cloud Hosting Policy
Hosting, availability, support and delivery of the iCenna Services
Version: 1.0
Last Updated: 23-08-2026
This Cloud Hosting Policy (the “Policy”) describes how iCenna hosts, delivers and supports its cloud Services. It forms part of the Service Specifications under the iCenna Cloud Services Agreement (the “Agreement”). iCenna may update this Policy from time to time, provided updates do not materially reduce the level of performance, security or availability of the Services during an active Services Period.
1. Hosting and Data Residency
The Services, including the iCenna AI Features, are hosted within iCenna’s dedicated cloud tenancy in data centres located in the Kingdom of Saudi Arabia, on a multi-tenant architecture with logical tenant isolation. Customer Content, including patient health data, is stored and processed within the Kingdom; any processing by service providers is described in the iCenna Data Processing Agreement and the Sub-processor List at iCenna.com/sub-processors
2. Service Availability
2.1. iCenna targets a Monthly Uptime Percentage of at least 99.5% for the production Services, measured per calendar month, excluding: (a) scheduled maintenance notified under Section 3; (b) emergency maintenance; (c) unavailability caused by the Customer’s systems, content, connectivity or third-party services; (d) force majeure; and (e) suspension permitted under the Agreement.
2.2. If the Monthly Uptime Percentage falls below the target, the Customer may claim a service credit against future fees: below 99.5% – 5% of the monthly fee; below 99.0% – 10%; below 97.0% – 20%. Claims must be submitted within thirty (30) days of the end of the affected month. Service credits are the Customer’s sole and exclusive remedy for availability shortfalls, capped at 30% of the monthly fee for the affected month.
3. Maintenance
Scheduled maintenance is performed during low-usage windows (typically Friday 00:00–06:00 Arabia Standard Time) with at least seventy-two (24) hours’ notice via the Services portal or email; most maintenance is performed without downtime. Emergency maintenance to address security or stability risks may be performed at any time, with as much notice as reasonably practicable.
4. Support
4.1. Support is available in Arabic and English through email at support@iCenna.com , Sunday to Thursday, 09:00–18:00 Arabia Standard Time, with 24/7 intake for Severity 1 incidents.
4.2. Severity levels and target response times:
- Severity 1 — Critical: production Service down or unusable for all Users. Target response: one (1) hour, 24/7; continuous effort until resolution or workaround.
- Severity 2 — High: major functionality significantly impaired; no reasonable workaround. Target response: four (4) business hours.
- Severity 3 — Medium: partial, non-critical loss of functionality; workaround available. Target response: one (1) business day.
- Severity 4 — Low: general questions, cosmetic issues, feature requests. Target response: two (2) business days.
4.3. Response-time targets are objectives, not guarantees, and do not commit to resolution times.
5. Security
iCenna maintains an information security programme aligned with applicable cybersecurity regulations of the Kingdom of Saudi Arabia, governed by iCenna’s internal Cybersecurity Policy and including: encryption of data in transit and at rest; role-based access control with multi-factor authentication for administrative access; logical tenant isolation; continuous logging and monitoring; vulnerability management with at least annual independent penetration testing; and documented, tested incident response. The contractual security and data protection commitments applicable to Customer Content are set out in the iCenna Data Processing Agreement. Customers may not conduct penetration or vulnerability testing of the Services without iCenna’s prior written approval.
6. Backup and Disaster Recovery
Customer Content is backed up at least daily; backups are encrypted and stored in a geographically separate location within the Kingdom of Saudi Arabia, retained for thirty-five (35) days on a rolling basis, with restore procedures tested periodically. iCenna maintains a documented disaster recovery plan with a Recovery Point Objective (RPO) of no more than twenty-four (24) hours and a Recovery Time Objective (RTO) of no more than eight (8) hours for the production Services, tested at least annually. Backups protect against platform-level failure and are not a substitute for the Customer’s own records-retention obligations.
7. Data Retrieval and Deletion
During the Services Period, the Customer can export its Content through the Services’ standard export functionality in commonly used, machine-readable formats. For sixty (60) days after the end of the Services Period, iCenna will make Customer Content available for retrieval on request. Following the retrieval period, Customer Content is deleted from production systems within thirty (30) days and from backups upon their scheduled expiry, except where retention is required by applicable law. Written confirmation of deletion is available on request.
8. Customer Responsibilities
The Customer is responsible for: managing User accounts, roles and permissions, and promptly de-provisioning departing personnel; maintaining the confidentiality of credentials and enforcing strong authentication for its Users; ensuring its devices, networks and connectivity meet the documented minimum requirements; configuring the Services consistently with its own legal and clinical obligations; and exporting and retaining records as required by applicable health-records retention rules before deletion under Section 7.
This Policy is part of the Service Specifications. In the event of conflict, the order of precedence in the Agreement applies.
