Health4Travel Partner Agreement

2.1. Platform Provider: For the purposes of this Agreement, “Health4Travel” and “Platform Provider” mean Health4Travel (iFlyIT B.V.), the legal entity identified in Clause 1.1 and the contracting party under this Agreement.

2.1.1. Health4Travel Group: “Health4Travel Group” means the Platform Provider, its parent company Health4Travel Enterprises Pte Ltd, Singapore UEN 202341292N, and any entity that from time to time directly or indirectly controls, is controlled by, or is under common control with either of them, including any present or future parent company, subsidiary, affiliated company or successor entity.

2.1.2. Third-Party Suppliers: “Third-Party Suppliers” means contractors, agents, payment service providers, technology providers, professional advisers and other external suppliers engaged by the Platform Provider or another member of the Health4Travel Group in connection with the Platform or the performance of this Agreement.

2.2. Platform: "Platform" refers to the Health4Travel platform and all its sub-pages and sub-sections, accessible through https://www.health4travel.com, operated by Health4Travel, which provides an online service for the listing, booking, financial transactions, and other solutions for services.

2.3. Partner: “Partner” means the individual, group or legal entity identified in Clause 1.2 and in the electronic acceptance record, including for the purposes of the performance of this Agreement its branches, service locations, official representatives, employees, healthcare professionals, contractors, subcontractors and agents, and any subsidiary, affiliate or related entity through which the Partner lists, arranges, supports or provides Services through the Platform (collectively, the “Partner Network”).

The Partner represents that it has the authority or other lawful basis necessary to list, arrange or administer Services provided through its Partner Network and undertakes responsibility to the Platform Provider for compliance with this Agreement by members of the Partner Network to the extent that they participate in Services or activities under this Agreement.

Inclusion within the Partner Network does not by itself make a separate legal entity or individual a contracting party to this Agreement or alter the allocation of clinical, professional or regulatory responsibility imposed by applicable law.

2.4. Services: "Services" shall mean any and all services listed, promoted, booked, transacted through, or otherwise processed through the Platform.

2.4.1. Regulated Services: “Regulated Services” means any Services whose provision is subject to professional licensing, registration, healthcare, patient-safety, professional-conduct or other sector-specific legal or regulatory requirements in the jurisdiction where the Services are provided.

2.5. The Agreement: This Agreement.

2.6. End-User: “End-User” means the natural person who receives, or is intended to receive, a Service booked or administered through the Platform.

2.6.1. Booking Party: “Booking Party” means any person or legal entity that makes, requests, authorises or administers a booking for an End-User, including an insurer, assistance company, third-party administrator, employer or other organisation acting on behalf of or for the benefit of the End-User.

2.6.2. Payer: “Payer” means the person or legal entity responsible for paying all or part of the Partner Price, Platform Fee or other amount arising from a booking. The Payer may be the End-User, the Booking Party or another person or organisation.

2.7. Partner Price: “Partner Price” means the price set or agreed by the Partner for the relevant Service, excluding any separate Platform Fee charged by Health4Travel.

2.8. Platform Fee: “Platform Fee” means any fee charged by Health4Travel for use of, access to or services provided through the Platform, separate from the Partner Price.

2.9. Settlement Amount: “Settlement Amount” means the amount payable by the Platform Provider to the Partner in respect of a Completed Booking, including the applicable Partner Price, less only refunds, chargebacks, taxes required to be withheld by law, or other deductions expressly authorised by this Agreement or agreed with the Partner.

2.10. Completed Booking: “Completed Booking” means a booking for which the Service has been provided and marked as completed on the Platform, or a booking treated as completed for settlement purposes under the late-cancellation or no-show provisions of Clause 14.

3. Background and purpose of the Agreement

3.1. The Platform Provider is the provider of an online Platform as a service for the booking of Services.

3.2. The Partner is a service provider that provides medical, wellness, travel-related, and/or healthcare-related services for different end-customer groups. The Partner wishes to use the Platform as a distribution channel for the sale and booking of Services offered by the Partner to individuals or corporations.

3.3. This Agreement sets out how the Parties will work together to allow bookings to be made using the online Platform.

3.4. Third-party introducers and coordinating partners: Where the Partner has been introduced, referred, arranged, or coordinated through a third-party introducer, arranger, assistance company, insurer, TPA, network manager, or other coordinating partner, this Agreement is intended to enable the Partner’s operational and technical onboarding to, and use of, the Platform.

3.5. Separate third-party arrangements: The Partner acknowledges that certain commercial, payment, referral, coordination, reporting, service-flow, or other operational arrangements may be governed by a separate agreement between the Platform Provider and the relevant third party. To the extent that any provisions of this Agreement relating to such matters differ from that separate agreement, the separate agreement shall prevail as between the Platform Provider and that third party.

4. Appendices to This Agreement: Acceptance of this Agreement includes the acceptance of

4.1. the Health4Travel Acceptable Use Agreement, appended hereto as Appendix A.

4.2. the Health4Travel Data Processing Agreement (incorporating processor terms), appended hereto as Appendix B.

4.3. the European Commission Standard Contractual Clauses for international transfers, incorporated as Appendix C, where and to the extent Appendix C applies under Clause 8.5.

5. Agreement to Terms: This Agreement is accepted by the Partner when its authorised representative completes the electronic acceptance form provided by Health4Travel, including confirmation of authority to bind the Partner. Acceptance may also occur by creating an account on, or otherwise utilising, the Platform to list services, accept bookings, and conduct financial transactions. The version of this Agreement accepted, including Appendix A, Appendix B and, where applicable under Clause 8.5, Appendix C, together with the acceptance record (name, designation, e-mail address, and timestamp of the accepting representative), constitutes the agreement between the Parties. Use of Health4Travel websites and the Platform may also be subject to separately published terms, policies and notices, including website Terms and Conditions and the Privacy Policy, to the extent applicable to that use. Such terms, policies and notices do not amend or override this Agreement unless they are expressly incorporated into it or separately accepted by the Partner in accordance with Clause 20. No separate signature of Appendix B or Appendix C is required where the relevant appendix applies and the information required for its operation is recorded in this Agreement, the acceptance record or an associated Partner onboarding or compliance record incorporated into this Agreement.

5.1. Authority declaration: The person accepting this Agreement declares that they are duly authorised to enter into this Agreement on behalf of the Partner. The Partner shall be bound by such acceptance.

5.2. Versioning: This Agreement is identified by a version number and date. The version accepted by the Partner remains available to the Partner on request and at https://health4travel.com/medical-provider/partner-agreement

6. Service providers: This Agreement does not form any kind of legal partnership or ownership between the Parties. All Parties will carry out their duties independently and with full responsibility.

6.1. The Partner is fully responsible for all medical and/or wellness services they provide under this Agreement. The Partner confirms that they have, and will continue to maintain, all required qualifications, licences, registrations, and certifications needed to provide these services in line with applicable laws and professional standards. The Partner also confirms that they have appropriate and valid professional liability insurance in place. Health4Travel is not responsible for the quality, safety, legality, or results of any services provided by the Partner.

6.2. Use of Health4Travel Group and Third-Party Suppliers: The Platform Provider may perform its obligations and exercise its rights under this Agreement through members of the Health4Travel Group and may engage Third-Party Suppliers in connection with the Platform or the performance of this Agreement. The involvement of any such entity does not by itself make that entity a party to this Agreement. The Platform Provider remains responsible to the Partner for the performance of its contractual obligations where those obligations are performed on its behalf by a member of the Health4Travel Group or a Third-Party Supplier.

6.3. Partner Personnel, Partner Network, and Service Locations: Where permitted by applicable law, the Partner may provide, arrange or support Services through members of its Partner Network, including its employees, healthcare professionals, other personnel, contractors, subcontractors, branches, service locations, subsidiaries, affiliates and related entities, as described in Clause 2.3.

The Partner remains contractually responsible to the Platform Provider for the performance of the Services and for compliance with this Agreement by members of the Partner Network to the extent that they participate in Services or activities under this Agreement. A separate legal entity or individual does not become a Party merely because it provides, arranges or supports Services on behalf of or in cooperation with the Partner.

Nothing in this Agreement transfers clinical or professional responsibility from an individual healthcare professional, healthcare institution or other regulated person where applicable law places that responsibility upon that person.

6.4. Local Regulation of Regulated Services: The provision of Regulated Services remains subject to all mandatory laws, regulations, professional standards and regulatory requirements applicable in the jurisdiction where the Services are provided. The Partner is responsible for ensuring that Regulated Services offered through the Platform are provided by persons and entities holding all licences, registrations, qualifications, authorisations and insurance required by applicable law. Clinical, professional, organisational and regulatory responsibility shall remain with the Partner and/or the relevant individual professional or other member of the Partner Network to the extent allocated to them by applicable law.

Nothing in this Agreement requires the Partner or any professional providing Services to act contrary to an applicable legal, regulatory or professional obligation.

6.5. Professional Independence: The Platform Provider provides technology, booking, administrative and payment-related services. It does not direct or control clinical judgement, diagnosis, treatment, prescribing or other professional decision-making by the Partner or its professionals. Nothing in this Agreement requires the Partner or any professional providing Services to act contrary to an applicable legal, regulatory or professional obligation.

7. Partner information: Information provided by the Partner to the Platform in connection with registration, service listing, and cooperation is primarily business-related information. To the extent that such information includes personal data relating to identified or identifiable natural persons, it shall be processed solely for business communication and operational purposes, in accordance with applicable data protection laws and this Agreement.

7.1. Clause 7 does not apply to End-User or patient personal data, which is governed by Clause 8 and Appendix B.

8.1. Each Party shall comply with the GDPR and other applicable Data Protection Law in respect of personal data processed in connection with this Agreement. The detailed data-protection terms are set out in Appendix B.

8.2. Roles of the Parties. For the standard booking workflow, the Platform Provider and the Partner act as independent controllers for their respective purposes as described in Appendix B. The Parties are not joint controllers. The standard booking workflow does not create a processor relationship between them.

8.3. The Partner acts as independent controller for appointment acceptance and scheduling, clinical assessment and treatment, informed consent, patient and medical records, prescriptions, clinical follow-up, professional oversight and its healthcare, regulatory and legal obligations. Clinical records and other clinical health data are created and held by the Partner outside the Platform unless otherwise expressly documented.

8.4. A Party shall act as processor for the other Party only where a future processing activity is expressly documented in advance under Clause 7 of Appendix B. Any such processor activity shall be subject to the Article 28 terms in Appendix B.

8.5. International transfers. Where a transfer of personal data in connection with this Agreement is subject to Chapter V GDPR, the Parties shall ensure that it is covered by a valid transfer mechanism. Where an adequacy decision under Article 45 applies, or another valid Chapter V mechanism lawfully covers the transfer, Appendix C does not apply unless the Parties expressly agree otherwise. Where the European Commission Standard Contractual Clauses adopted under Commission Implementing Decision (EU) 2021/914 are the applicable transfer mechanism, Appendix C applies automatically as part of this Agreement. Module One applies where the exporter and importer act as independent controllers. Module Two applies only where the exporter acts as controller and the importer acts as processor for a future activity documented under Clause 7 of Appendix B. Only the module applicable to the actual transfer applies.

8.6. Acceptance of this Agreement constitutes acceptance of Appendix B and, where applicable under Clause 8.5, the applicable provisions of Appendix C without a separate signature step. Partner- and transfer-specific factual information recorded through the electronic acceptance process and the associated onboarding or compliance record forms part of the relevant SCC annex information.

8.7. Each Party shall retain personal data only for as long as necessary for its own purposes or as required by applicable law and shall then securely delete or anonymise it, subject to the more specific terms in Appendix B.

8.8. Each Party remains responsible for its own compliance, security, data-subject rights handling, breach notifications, records and supervisory-authority obligations, subject to the cooperation requirements in Appendix B.

8.9. The Platform Provider does not require medical records, diagnoses, treatment notes, prescriptions, images or test results to be entered into the Platform as part of the standard workflow. Such clinical data remains under the Partner’s control in its clinical systems.

9. Insurance: The Partner shall maintain appropriate and valid professional indemnity, medical malpractice or equivalent liability insurance appropriate to the Regulated Services it provides and as required by applicable law or professional regulation. The Platform Provider shall maintain appropriate corporate liability insurance for its business and operations, including directors’ and officers’ liability insurance (D&O) and such other liability cover as is reasonably appropriate to its activities and risk profile. Each Party shall maintain the insurance applicable to it during the term of this Agreement.

10. Service Listing and Management:

10.1. Health4Travel’s Right To Manage Listings: The Partner hereby grants the Platform Provider permission to list, edit and manage Services based on the Partner’s written instructions, including through necessary integrations such as APIs. The Platform Provider shall not materially change the Partner’s prices, Service descriptions, availability or other material Service information without the Partner’s prior written instruction or approval, except where reasonably necessary to correct an obvious error, comply with applicable law, address a patient-safety, security or Platform-integrity issue, or temporarily restrict or remove inaccurate, duplicate or otherwise problematic content. The Platform Provider also reserves the right to correct, limit access to, or remove from view any Service listing or information falling within those exceptions.

10.2. Partner’s Right To Manage Listings: The Partner retains the right to list, edit, and manage their services, locations, available times, prices or any other information. If the Partner requires the Platform Provider to execute any of these changes, the request has to come from an email address registered with the required level of authorisation in the Platform’s database.

10.3. The Partner understands that they must use the Platform to manage bookings for Services that come through the Platform.

10.4. Until a time slot becomes booked on the Platform, The Partner has the right to book it for other purposes or otherwise make the time slot unavailable for booking through the Platform.

10.5. Calendar Integrations: The Partner agrees to use the Platform’s booking calendar system for the management of bookings generated through the Platform. Where the Partner elects to integrate its own systems, such integration shall be subject to mutual agreement and limited to the extent necessary to enable booking coordination. The Partner shall not be required to provide unrestricted or direct access to its internal systems unless separately agreed under defined technical, security, and data protection terms.

10.6. The Partner agrees to manage their service availability and bookings effectively so that reasonable and legitimate bookings made through the Platform can be fulfilled by The Partner.

11.1. Financial and Regulatory Compliance: Each Party shall comply with the laws, tax requirements, payment regulations and other financial obligations applicable to its own activities under this Agreement and shall ordinarily bear its own costs of such compliance. The Partner remains responsible for taxes arising from the Services it provides, and the Platform Provider remains responsible for taxes arising from its own Platform Fees and services. Where the Platform Provider is required by law to deduct or withhold an amount from a payment to the Partner, it may do so and shall provide reasonable information concerning the deduction or withholding.

11.2. Payment Settlements: The Platform Provider shall pay the Settlement Amount for each Completed Booking to the Partner within thirty (30) calendar days after the booking becomes a Completed Booking, subject only to the circumstances described in Clause 11.4.

11.2.1. Self-Billing: The Partner expressly agrees that the Platform Provider may prepare and issue self-billed invoices in the Partner’s name and on its behalf for amounts payable under this Agreement. Each self-billed invoice shall be provided to the Partner electronically. The Partner shall notify the Platform Provider of any specific objection to an invoice within ten (10) business days after receipt. In the absence of such an objection, the invoice shall be treated as accepted to the extent permitted by applicable law.

Where applicable law requires an express invoice-acceptance procedure, supplier-issued invoices or other additional formalities, the Parties shall use the legally compliant procedure required in that jurisdiction without altering the underlying payment obligation under this Agreement.

11.2.2. Settlement Currency: Unless otherwise agreed, Settlement Amounts shall be calculated and paid in Euros.

11.2.3. Bank and Currency Costs: The Platform Provider shall bear charges imposed by its own bank or payment provider for initiating the settlement payment. The Partner shall bear charges imposed by its receiving bank or intermediary banks after the payment has been initiated, together with currency-conversion costs arising because the Partner elects to receive or maintain an account in a currency other than Euros, unless otherwise agreed in writing.

11.2.4. Payment Role: The Parties acknowledge that the Partner provides the underlying Service directly to the End-User and that the Platform Provider facilitates the collection and settlement of payment for technical and commercial convenience. Collection of the Partner Price by the Platform Provider does not make the Platform Provider the provider of the underlying Service.

11.3. Platform Fees and Partner Charges: The Platform Provider may charge an End-User, Booking Party or Payer a Platform Fee in addition to the Partner Price and may determine or change the amount, description and structure of that Platform Fee. Health4Travel shall not deduct any commission, booking fee, Platform Fee or other charge imposed by Health4Travel from the Partner Price or Settlement Amount unless the Partner has separately agreed to that charge in writing. This does not prevent refunds, chargebacks, taxes required to be withheld by law or other deductions expressly authorised by this Agreement from being reflected in the Settlement Amount.

11.4. Payment Onboarding and Permitted Suspension: Payment is conditional upon the Partner completing and maintaining any reasonably required payment, identity, business, beneficial-ownership, sanctions or bank-account verification process. The Platform Provider may suspend payment of an affected Settlement Amount only to the extent reasonably necessary because of:

• a) incomplete, inaccurate, expired or non-functional payment or onboarding information provided by the Partner;
• b) a genuine and specific dispute concerning settlement of a late cancellation or no-show under Clause 14.4, or a material error or anomaly affecting the relevant booking or Settlement Amount;
• c) a refund, suspected fraud or chargeback affecting the relevant booking;
• d) a legal, regulatory, sanctions, court or payment-provider restriction that prevents the payment; or
• e) a payment-system failure or force majeure event beyond the Platform Provider’s reasonable control.

Where legally permitted, the Platform Provider shall inform the Partner of the reason for the suspension and shall release the payment promptly after the relevant issue has been resolved. No default interest shall accrue during a delay caused by the Partner or by a legal or regulatory prohibition on payment.

11.5. Regulatory Cooperation: Where currency-control, banking or other mandatory regulatory requirements affect a settlement, the affected Party shall notify the other Party as soon as reasonably practicable and the Parties shall cooperate in good faith to complete the settlement lawfully. This Clause does not convert the payment obligation in Clause 11.2 into a reasonable-efforts obligation.

11.6. Third-party coordinated payment arrangements: Where the Partner has been referred to Health4Travel as part of an arrangement where payment flows through a coordinating third party, and the Partner has been informed of that arrangement, Clauses 11.1 to 11.5 shall be subject to the arrangement between the Partner and that third party, which shall identify whether the Platform Provider or the third party is responsible for payment to the Partner.

11.7. Payment to Partner: Unless the Platform Provider expressly agrees otherwise in writing, all Settlement Amounts shall be paid solely to the Partner identified in the electronic acceptance record. Payment of a Settlement Amount to the Partner fully discharges the Platform Provider from its payment obligation in respect of that amount, including where the underlying Service was provided by a member of the Partner Network. The Partner is solely responsible for allocating or paying any amounts due to its employees, healthcare professionals, contractors, agents, affiliates or other members of the Partner Network.

12. Bookings

12.1. The Partner shall maintain accurate information concerning its Services, Partner Prices and availability and shall use reasonable efforts to fulfil bookings confirmed through the Platform.

12.2. The Partner shall manage bookings received through the Platform using the Platform or another booking process agreed with Health4Travel.

13. Rescheduling

13.1. An End-User or Booking Party may request that a booking be rescheduled. Where the request is made at least twenty-four (24) hours before the scheduled start time, the Partner shall use reasonable efforts to accommodate the request, subject to availability.

13.2. A request made less than twenty-four (24) hours before the scheduled start time may be accommodated at the Partner’s discretion. Where it cannot reasonably be accommodated, it may be treated as a late cancellation under Clause 14.2.

14. Cancellations and No-Shows

14.1. Timely Cancellation: A booking cancelled at least twenty-four (24) hours before its scheduled start time is a timely cancellation. No Partner Price is payable to the Partner for a timely cancellation, and any Partner Price already collected for that booking shall be refunded to the applicable End-User, Booking Party or Payer.

14.2. Late Cancellation: A booking cancelled less than twenty-four (24) hours before its scheduled start time is a late cancellation. Unless mandatory applicable law requires a different outcome, the Partner shall be entitled to receive the Partner Price for a late cancellation unless the Partner waives that entitlement. Subject to Clause 14.4, the booking shall be treated as a Completed Booking for settlement purposes.

14.3. No-Show: Where the End-User does not attend a confirmed booking and the booking has not been timely cancelled, the Partner shall be entitled to receive the Partner Price unless the Partner waives that entitlement, provided that the Partner was ready and able to provide the Service at the agreed time. Subject to Clause 14.4, the booking shall be treated as a Completed Booking for settlement purposes.

14.4. Settlement Eligibility for Late Cancellations and No-Shows: A late cancellation or no-show shall not become eligible for settlement until seven (7) calendar days after the scheduled appointment time.

During that period, the End-User, Booking Party, Payer, Partner or Platform Provider may raise a genuine dispute concerning the booking.

Subject to applicable law and the remaining provisions of this Clause, an undisputed late cancellation or no-show shall become eligible for settlement upon expiry of the seven-day period and, unless the Partner has waived payment, shall at that time be treated as a Completed Booking for settlement purposes.

The Platform Provider may decline or suspend settlement where:

• a) applicable law prohibits or restricts the relevant cancellation or no-show payment;
• b) there is a genuine dispute as to whether the booking was a valid late cancellation or no-show;
• c) fraud, duplicate booking or material error is reasonably suspected;
• d) the Partner was not ready and able to provide the booked Service at the agreed time; or
• e) the Partner has waived payment.

14.5. Mandatory Rights: Cancellation charges, refund rights and other patient or consumer rights remain subject to any mandatory law applicable to the relevant booking or Service.

15. Partner Non-Fulfilment

15.1. If the Partner becomes unable to provide a confirmed Service, it shall notify Health4Travel as soon as reasonably practicable so that the End-User, Booking Party or Payer may be informed and, where possible, offered an alternative booking.

15.2. Where the Partner gives Health4Travel at least twenty-four (24) hours’ notice, the Partner shall not be responsible for the cost of arranging a replacement booking solely because of that cancellation.

15.3. Where the Partner cancels less than twenty-four (24) hours before the scheduled start time for reasons within its reasonable control, the Partner shall be responsible for any reasonable and documented incremental cost actually incurred by Health4Travel in arranging a substantially equivalent replacement Service.

15.4. Clause 15.3 does not apply where the Partner’s inability to provide the Service results from a Force Majeure event under Clause 26 or another unforeseeable circumstance outside the Partner’s reasonable control, including a sudden serious illness, injury, accident or comparable emergency affecting the Partner or the professional due to provide the Service.

15.5. Where a Service is not provided by the Partner, the applicable End-User, Booking Party or Payer shall be entitled to a refund of the Partner Price paid for that Service unless an alternative booking is accepted instead.

16. Intellectual Property Rights: The Platform and its entire contents, features, and functionality (including but not limited to all information, software, models, text, displays, images, video, and audio, and the design, selection, and arrangement thereof) are owned by the Platform Provider, its licensors, or other providers of such material and are protected by Dutch and international copyright, trademark, patent, trade secret, and other intellectual property or proprietary rights laws.

16.1. The Partner, their employees, and related entities that have access to the Platform must not reproduce, distribute, modify, create derivative works of, display, republish, download, store, or transmit any of the material on Health4Travel’s Website, except for the purpose of fulfilling the terms of this contract and providing Services to End-users.

16.2. No right, title, or interest in or to the Platform or any content on the Platform is transferred to The Partner, and all rights not expressly granted are reserved by the Platform Provider.

17. Use of Names and Marks

17.1. Operational Use: The Partner grants the Platform Provider a non-exclusive, royalty-free licence during the term of this Agreement to use the Partner’s business name, trading names, trademarks and logos (“Marks”) to the extent reasonably necessary to identify the Partner and its Services on the Platform, display Service listings, process bookings and communicate with End-Users, Booking Parties and Payers in connection with the Partner’s Services.

17.2. Health4Travel Marks: The Platform Provider grants the Partner a non-exclusive, royalty-free licence during the term of this Agreement to use Health4Travel’s name and Marks solely to identify Health4Travel as a booking, technology or commercial partner where reasonably necessary in connection with the Services.

17.3. Promotional Use Requiring Approval: Neither Party may use the other Party’s Marks in a case study, testimonial, press release, paid advertising campaign, prominent promotional campaign or other public promotional material outside the operational uses permitted above without the owning Party’s prior written approval.

17.4. Brand Protection: Each Party shall comply with reasonable brand guidelines provided by the other Party and shall not use the other Party’s Marks in a misleading, defamatory or unlawful manner, or in a manner that implies an endorsement, investment relationship or affiliation beyond the actual relationship between the Parties.

17.5. End of Use: On termination of this Agreement, each Party shall cease new use of the other Party’s Marks and shall remove them from publicly accessible materials within thirty (30) days, except where continued use is reasonably necessary for archival, legal, regulatory or record-keeping purposes.

17.6. Ownership: Nothing in this Agreement transfers ownership of either Party’s Marks to the other Party.

18. Acceptable Use: All Parties agree to use the Platform in a manner consistent with its intended purpose and in compliance with all applicable laws and regulations. Each Party is responsible for ensuring that all services listed and transacted through the Platform are lawful, accurately described, and ultimately fulfilled in accordance with the terms of the booking. All Parties agree to comply with the terms and conditions of the Health4Travel Acceptable Use Agreement (https://health4travel.com/h4t-partner-acceptable-use-agreement/), attached hereto and incorporated by reference.

19. Liability Disclaimer: All Parties acknowledge that Health4Travel is not responsible or liable for the provision of health or wellness services. Health4Travel acts solely as a platform and technology provider facilitating the booking and payment process. The Partner is solely responsible for the quality, safety, and legality of the Services provided.

19.1. Platform Operational Responsibilities:

19.1.1. The Platform Provider shall use commercially reasonable efforts to ensure that:

• a) service listings, pricing, availability, and booking information displayed on the Platform reflect the information provided by the Partner;
• b) bookings confirmed via the Platform are accurately transmitted to the Partner without undue delay; and
• c) the Platform’s booking and payment systems operate in accordance with generally accepted industry standards.

19.1.2. The Platform Provider shall not be responsible for the medical outcome or clinical quality of the Services, but shall remain responsible for errors, inaccuracies, or technical failures attributable solely to the Platform’s systems or actions.

19.1.3. Nothing in this Agreement obliges the Platform Provider to obtain or document medical informed consent. The Partner remains solely responsible for obtaining all legally required patient consents prior to provision of medical Services.

19.2. Mitigation: Where an error, inaccurate information, unauthorised content change or technical malfunction attributable to either Party causes or is reasonably likely to cause material harm to the other Party, the Parties shall cooperate reasonably and in good faith to mitigate that harm, including by correcting inaccurate information where appropriate. This Clause does not create any category of damages or liability beyond that otherwise recoverable under this Agreement.

19.3. Limitation of Liability: Except in cases of gross negligence, wilful misconduct, fraud, breach of confidentiality, breach of data protection obligations or infringement of intellectual property rights, each Party’s total aggregate liability arising out of or in connection with this Agreement shall not exceed the greater of:

• a) EUR 25,000; or
• b) the total Platform Fees paid or payable to Health4Travel in connection with the Partner during the twelve (12) months preceding the event giving rise to the claim.

Where the Agreement has been in force for less than twelve (12) months, paragraph (b) shall apply to the period since the Agreement took effect.

Neither Party shall be liable for indirect, incidental, special or consequential damages, including loss of anticipated profit or opportunity, except to the extent that such liability cannot lawfully be excluded.

19.4. Payment Obligations: The limitations in Clause 19.3 do not reduce or limit an obligation to pay an undisputed Settlement Amount or other sum properly due from one Party to the other under this Agreement. Such amounts constitute payment obligations rather than damages for the purposes of the liability cap.

20. Modifications: Health4Travel reserves the right to modify these terms by informing the Partner of the proposed changes at the e-mail address recorded for the Partner. Continued use of the Platform after a notice period of fifteen (15) days following notification constitutes acceptance of non-material changes. Any modification that materially reduces amounts payable to the Partner, introduces or increases fees payable by the Partner, or otherwise materially changes the Partner’s commercial terms shall require the Partner’s explicit prior acceptance and shall not take effect through continued use of the Platform alone. Other material changes, including material changes to payment terms, liability or data processing, may require active re-acceptance through a new electronic acceptance form as stated in the applicable notice. Until such required acceptance is given, the existing agreed terms continue to apply unless the Agreement is terminated in accordance with Clause 22.

21. Confidentiality

21.1. Confidential Information: “Confidential Information” means any non-public commercial, financial, operational, technical, security, product, pricing, business or strategic information disclosed by or obtained from one Party by the other Party in connection with this Agreement where the information is identified as confidential or would reasonably be understood to be confidential from its nature or the circumstances of disclosure.

21.2. Permitted Use: Each Party shall use the other Party’s Confidential Information only to perform, receive or administer the Services and obligations contemplated by this Agreement and shall protect it using reasonable organisational and technical measures.

21.3. Permitted Disclosure: A Party may disclose Confidential Information to its employees, professional advisers, members of its corporate group, contractors and Third-Party Suppliers who reasonably need the information for purposes connected with this Agreement, provided that such persons are subject to confidentiality obligations appropriate to the information concerned.

21.4. Exclusions: Confidential Information does not include information that the receiving Party can demonstrate:

• a) is or becomes publicly available other than through breach of this Agreement;
• b) was lawfully known to it without an obligation of confidentiality before disclosure;
• c) was lawfully received from a third party without an obligation of confidentiality; or
• d) was independently developed without use of the other Party’s Confidential Information.

21.5. Required Disclosure: A Party may disclose Confidential Information where required by law, regulation, court order or competent authority, provided that, where legally permitted, it gives the other Party reasonable notice and discloses only the information required.

21.6. Competing Activities: Neither Party may use the other Party’s Confidential Information to develop, improve or assist the development of a product or service that competes with the other Party. This restriction does not prevent either Party from competing lawfully using information that is public, independently developed or otherwise lawfully available to it.

21.7. Data and Professional Confidentiality: This Clause supplements and does not limit the Parties’ obligations under Clause 8, Appendix B, applicable data protection law, medical confidentiality requirements or other professional confidentiality obligations.

21.8. Survival: The obligations in this Clause survive termination of the Agreement for five (5) years. Obligations relating to trade secrets or information that remains legally protected as confidential shall continue for so long as that protection applies.

22. Validity And Termination: The terms of the Health4Travel Partner Agreement are considered to be in force for three (3) years from the date of acceptance by the Partner. At the end of these three (3) years, continued use of the Platform will constitute a renewed acceptance of this Agreement for one (1) month from the date of last use. Either party may terminate this Agreement for any reason with one (1) month’s written notice to the other party. Termination will not affect the rights and obligations that have already accrued.

23. Assignment and Subcontracting: Except as permitted under Clause 24, neither Party may assign, transfer or novate this Agreement as a whole without the prior written consent of the other Party, such consent not to be unreasonably withheld or delayed. Nothing in this Clause prevents the Platform Provider from using members of the Health4Travel Group or Third-Party Suppliers in accordance with Clause 6.2, or the Partner from using its personnel or contractors in accordance with Clause 6.3.

24. Permitted Health4Travel Group and Business Transfers: The Platform Provider may transfer, assign or novate this Agreement, in whole or in part, to another member of the Health4Travel Group or to a successor to all or substantially all of the Health4Travel business to which this Agreement relates, including as part of a corporate reorganisation, merger, acquisition or transfer of business. The Partner gives its advance consent to such transfer, provided that the transferee assumes the relevant obligations of the Platform Provider under this Agreement and the transfer does not materially reduce the Partner’s contractual rights. The Platform Provider shall notify the Partner of such transfer. The Partner shall provide any further reasonable cooperation required to give effect to the transfer.

25. Severability: If any Clause (or part of a Clause) in this Agreement is unenforceable, invalid, or illegal for any reason, the other Clauses of this Agreement will remain in force as if they had been executed without the offending text appearing in this Agreement (and the offending text will be deemed to be substituted with drafting that has the closest effect and is enforceable).

26. Force Majeure: Neither party will be liable for inadequate performance to the extent caused by a condition (for example, natural disaster, act of war or terrorism, riot, labor condition, governmental action, and Internet disturbance) that was beyond the party’s reasonable control.

27. No Partnership or Agency: Neither party has the authority or power to bind, create a liability for, or enter any commitments for or on behalf of, the other party.

28. E-Signatures and Electronic Acceptance: Unless Applicable Law requires otherwise, this Agreement may be agreed and/or executed using electronic signatures or indicated acceptance through online processes, including completion of an electronic acceptance form. The Parties agree that Health4Travel's electronic records of acceptance constitute valid evidence of the conclusion and content of this Agreement. If an effective date has not been stated within this Agreement, it will come into effect on the date of acceptance by the Partner.

29. Jurisdiction: All disputes arising out of or in connection with this Agreement shall be subject to the exclusive jurisdiction of the competent court in Amsterdam, the Netherlands, to the exclusion of the jurisdiction of any other courts, except that this choice of court shall not exclude the jurisdiction of a competent court in the jurisdiction where a Regulated Service is provided in respect of a dispute concerning the clinical, professional, licensing, patient-safety or other mandatory regulatory requirements applicable to that Regulated Service.

Where a dispute falls within the competence of the Netherlands Commercial Court (“NCC”), the Parties may agree in writing, after the dispute has arisen, that the particular dispute will instead be resolved in English before the NCC. Where the Parties make such an agreement, proceedings, interim measures and any appeal shall be governed by the applicable NCC rules and procedures.

For the avoidance of doubt, the exception in the first paragraph applies only to the extent that the dispute concerns matters governed by mandatory local laws, regulations or professional requirements applicable to the provision of Regulated Services. All other disputes remain subject to the exclusive jurisdiction of the competent court in Amsterdam unless the Parties make a written agreement under the preceding paragraph to submit the particular dispute to the NCC. Nothing in this Clause limits the jurisdiction or powers of any competent healthcare, professional, data-protection or other regulatory authority.

30. Governing Law: This Agreement and the commercial relationship between the Parties shall be governed by and construed in accordance with the laws of the Netherlands. This choice of law does not displace any mandatory law, regulation or professional requirement applicable to the provision of Regulated Services in the jurisdiction where those Services are provided, as set out in Clause 6.4.

31. Contact Information: For questions or concerns regarding this Agreement, please contact Health4Travel at info@health4travel.com .

32. Entire Agreement: This Agreement constitutes the entire agreement between the parties and supersedes all prior agreements and understandings, whether written or oral, relating to the subject matter herein.

By completing this form, the Partner accepts the Health4Travel Partner Agreement version 2.2 dated 18 September 2026, including Appendix A (Acceptable Use Agreement), Appendix B (Data Processing Agreement) and Appendix C (European Commission Standard Contractual Clauses) where Appendix C applies under Clause 8.5. Where Appendix C applies, this acceptance is intended to constitute the Partner’s agreement to and execution of the applicable SCC module and completed SCC annex information as part of the same contracting step.

Offered by Health4Travel (iFlyIT B.V.), represented by Marko Kauppinen, CEO.

For the Partner

• Business Name:
• Business ID:
• Address:
• Name of representative:
• Designation:
• E-mail:

⃞I confirm that I am duly authorised to enter into this Agreement on behalf of the Partner.

• Signature:
• Date:

This Health4Travel Acceptable Use Agreement ("Agreement") is entered into by and between Health4Travel (iFlyIT B.V.) ("Health4Travel") and all users of the Health4Travel platform ("User").

A.1. Purpose

This Agreement sets forth the terms and conditions under which Users may access and use the Health4Travel platform ("Platform"). By accessing or using the Platform, you agree to be bound by the terms of this Agreement.

A.2. User Conduct

A.2.1 Users must use the Platform in a lawful and ethical manner.

A.2.2 Prohibited activities include, but are not limited to:

• a. Fraudulent or misleading practices.
• b. Harassment, hate speech, or threats.
• c. Unauthorised access to other users' accounts or data.
• d. Violation of intellectual property rights.

A.3. Content Guidelines

A.3.1 Users must adhere to the following content guidelines:

• a. Post accurate and non-deceptive content.
• b. Prohibit content that is offensive, harmful, or illegal.
• c. Respect intellectual property rights; do not use copyrighted materials without permission.

A.4. Prohibited Items or Services

A.4.1 Users may not offer, list, or promote:

• a. Products or services that are illegal, counterfeit, or infringe on intellectual property rights.
• b. Controlled substances, illegal drugs, or drug paraphernalia.
• c. Items or services that are prohibited by applicable laws or regulations.

A.5. Privacy and Data Handling

A.5.1 Users must comply with the Health4Travel Privacy Policy, available at https://health4travel.com/privacy-policy, when handling personal data on the Platform.

A.6. Intellectual Property

A.6.1 Users are responsible for ensuring they have the necessary rights and permissions to use intellectual property on the Platform.

A.6.2 Health4Travel respects intellectual property rights and will respond to valid infringement claims promptly.

A.7. User Accounts

A.7.1 Users are responsible for maintaining the security and accuracy of their accounts.

A.7.2 Do not share login credentials or allow unauthorised access to your account.

A.8. Termination of Accounts

A.8.1 Health4Travel may immediately suspend or restrict a User’s access to the Platform where reasonably necessary because of a violation of this Agreement, suspected fraud or misuse, security concerns, legal or regulatory requirements, patient-safety concerns, or a material risk to the Platform or its users. Where the User is a Partner under the Health4Travel Partner Agreement, termination of the Partner relationship otherwise remains subject to Clause 22 of that Agreement.

A.9. Dispute Resolution

A.9.1 Users agree to resolve disputes with other Users through peaceful means, including negotiation and mediation if necessary.

A.10. Reporting Violations

A.10.1 Users can report violations of this Agreement or other misconduct on the Platform through the designated reporting mechanism.

A.11. Liability Disclaimer

A.11.1 Health4Travel is a platform and technology provider and is not responsible or liable for the quality, safety, or legality of products or services offered by Users on the Platform.

A.12. Governing Law

A.12.1 This Agreement shall be governed by and construed in accordance with the laws of The Netherlands.

A.13. Updates to the Agreement

A.13.1 Where the User is a Partner under the Health4Travel Partner Agreement, changes to this Agreement are governed by Clause 20 of the Partner Agreement. Accordingly, continued use of the Platform after fifteen (15) days’ notice may constitute acceptance only of non-material changes. Any material change is subject to the acceptance requirements set out in Clause 20. For Users who are not Partners under the Partner Agreement, Health4Travel may modify this Agreement by providing notice by e-mail or through the Platform, and continued use after a notice period of fifteen (15) days constitutes acceptance of the revised Agreement.

A.14. Contact Information

A.14.1 For questions or concerns regarding this Agreement, please contact Health4Travel at info@health4travel.com

A.15. Acceptance

By using the Health4Travel Platform, you acknowledge that you have read, understood, and agree to abide by the terms and conditions of this Acceptable Use Agreement.

Clinic partner version | 18 September 2026

Platform Provider

Health4Travel (iFlyIT B.V.), KvK 67335829, Burgemeester Burgerhof 29, 3481 CX Harmelen, the Netherlands

Partner

The clinic or healthcare provider identified as the Partner in the Main Agreement

Effective date

The date on which the Main Agreement takes effect

Status and incorporation. This Agreement forms part of the Health4Travel Partner Agreement between the Parties (the “Main Agreement”) and constitutes Appendix B to it. Acceptance of the Main Agreement includes acceptance of this Agreement, so no separate signature page is required.

For this Appendix, “Data Protection Law” means the GDPR and any other applicable law governing the processing of personal data in connection with the Main Agreement.

1. Scope and roles

1.1. This Agreement governs personal data processed in connection with listing, booking, administering, paying for and providing services through the Health4Travel Platform. GDPR terms have their GDPR meanings; other capitalised terms have the meanings in the Main Agreement.

1.2. Health4Travel is an independent controller for Platform operation and security, accounts, bookings and booking communications, payment and settlement administration, support, fraud prevention, audit, compliance and its own legal obligations.

1.3. The Partner is an independent controller for appointment acceptance and scheduling, clinical assessment and treatment, informed consent, patient and medical records, prescriptions, clinical follow-up, professional oversight and its healthcare, regulatory and legal obligations.

1.4. The Parties are not joint controllers. The standard booking workflow does not create a processor relationship between them. A Party acts as processor only for a future activity expressly documented under Clause 7 before that activity begins.

2. Data and purposes

2.1. The standard booking dataset may include name, telephone number, email address, booking ID, selected service and provider, appointment date, time and location, payment and booking status, insurer, insurance policy number or case identifiers where relevant, and limited booking or accessibility notes. This information may reveal data concerning health and must be protected accordingly.

2.2. Health4Travel uses booking data to create, transmit and administer bookings, process payments and refunds, support users and Partners, prevent fraud, secure the Platform and meet legal obligations. The Partner uses it to accept and schedule appointments, identify and communicate with patients, provide care, maintain required records, handle billing and meet professional and legal obligations.

2.3. Clinical records, diagnoses, treatment notes, prescriptions, images and test results are controlled by the Partner and kept in the Partner’s clinical systems. They must not be entered into Platform free-text fields unless the Parties first document a necessary purpose, lawful basis, Article 9 condition, access restriction and retention period.

3. Independent-controller obligations

3.1. Each Party shall comply with applicable Data Protection Law for its own processing, including establishing an Article 6 lawful basis and, where health data is involved, an Article 9(2) condition; providing required privacy information; respecting data-subject rights; maintaining appropriate records; and applying data protection by design and default.

3.2. Each Party shall use only data necessary for its stated purposes, keep data reasonably accurate, restrict access to authorised persons bound by confidentiality and not use shared booking data for unrelated marketing without its own lawful basis and required notice.

4. Security, rights and incidents

4.1. Each Party shall maintain security appropriate to risk, including access control, strong authentication, encryption in transit, appropriate encryption at rest, logging and monitoring, backups and recovery, vulnerability management, incident response, personnel training, supplier controls and secure deletion.

4.2. Each controller handles requests concerning its own processing. A request mainly concerning the other Party shall be forwarded without undue delay where lawful. The Parties shall reasonably assist each other with complaints, investigations and supervisory-authority enquiries relating to shared processing.

4.3. A Party becoming aware of a personal data breach affecting data received from the other Party shall notify the other without undue delay and provide available information about the breach, affected people and data, likely consequences and mitigation. Each controller remains responsible for its own regulatory and data-subject notifications.

5. Retention, providers and international transfers

5.1. Each controller shall retain data only as long as necessary for its purposes or required by law, then securely delete or anonymise it. The Partner may retain patient and clinical records for periods required by applicable healthcare, professional, tax or other law; Health4Travel shall not direct deletion of records the Partner controls independently.

5.2. Each Party is responsible for its service providers and processing locations. A restricted transfer may occur only in compliance with Chapter V GDPR, including an adequacy decision or the applicable 2021 European Commission Standard Contractual Clauses with required assessments and supplementary measures.

5.3. The H4T-specific hosting, retention, backup and transfer facts are recorded in Schedule 2.

6. Term, precedence and liability

6.1. This Agreement takes effect and ends with the Main Agreement, except that it continues for as long as either Party processes personal data arising from the relationship.

6.2. This Agreement prevails over the Main Agreement on data-protection matters. Applicable Standard Contractual Clauses prevail for a relevant restricted transfer. Liability, governing law and jurisdiction are otherwise governed by the Main Agreement, subject to mandatory Data Protection Law and data-subject rights.

6.3. Changes to this Agreement require written acceptance by both Parties. Each Party may change the service providers it uses for its own processing, subject to its responsibilities under Data Protection Law. Where a change relates to processor activity under Clause 7, any applicable notice, authorisation or objection rights under that Clause shall apply.

7. Article 28 terms for any future processor activity

7.1. No routine processor activity between the Parties has been identified for the standard workflow. Before one Party processes personal data solely on behalf of the other, the Parties must document the subject matter, duration, nature, purpose, data, data subjects, controller rights and instructions. For that activity, the processor shall:

• process only on documented instructions, including for transfers, unless required by law;
• ensure authorised personnel are bound by confidentiality;
• apply Article 32 security measures;
• use subprocessors only with specific or general written authorisation, give reasonable notice of changes, impose equivalent terms and remain responsible for them;
• assist with data-subject requests and Articles 32-36 compliance, taking account of the processing;
• notify the controller of a relevant breach without undue delay and, where practicable, within 24 hours;
• at the controller’s choice, return or delete the processor-held data when the activity ends unless law requires storage;
• provide information reasonably necessary to demonstrate compliance and permit proportionate audits, normally no more than once annually unless justified by a breach, regulator or evidence of material non-compliance; and
• immediately identify an instruction it considers unlawful and suspend it while the Parties resolve the issue.

Contacts and acceptance

A. Health4Travel privacy contact: info@health4travel.com. Partner privacy contact: the Partner contact identified in the Main Agreement, or any replacement contact notified in writing.

B. The competent supervisory authority is determined under applicable Data Protection Law.

C. This Agreement is accepted and becomes binding through acceptance of the Main Agreement. No separate signature or duplicate Party-information fields are required.

C.1. Incorporation and scope

Where Clause 8.5 provides that the Standard Contractual Clauses are the applicable transfer mechanism, the standard contractual clauses set out in the Annex to Commission Implementing Decision (EU) 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 (the “SCCs”) are incorporated into this Agreement by reference in their official, unmodified form and form this Appendix C.

Official text: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32021D0914

The operative clauses of the SCCs are not rewritten by this Appendix. The selections and Annex information below are intended to complete the SCCs for the transfer concerned. If there is any conflict between a provision of this Agreement and the SCCs in relation to a transfer governed by the SCCs, the SCCs prevail to the extent required by Clause 5 of the SCCs.

Appendix C applies only to a transfer that is subject to Chapter V GDPR and for which the SCCs under Decision (EU) 2021/914 are the applicable transfer mechanism. It does not apply where an adequacy decision under Article 45 GDPR or another valid transfer mechanism applies, or where Decision (EU) 2021/914 is not legally available for the relevant transfer.

C.2. Module selection and one-step acceptance

Only the SCC module relevant to the actual transfer applies.

(a) Module One (controller to controller) applies where the data exporter and data importer act as independent controllers in relation to the relevant transfer.

(b) Module Two (controller to processor) applies only where a future processor activity has been expressly documented under Clause 7 of Appendix B and the relevant data exporter acts as controller while the data importer acts as processor for that activity.

Acceptance of the Partner Agreement constitutes acceptance and execution of the applicable SCC module as part of the same contracting step. No separate signature of the SCCs is required. The Partner details and acceptance timestamp recorded through the electronic acceptance process form part of Annex I.A below.

Partner- and transfer-specific factual information recorded in the electronic acceptance record and the associated Partner onboarding or compliance record forms part of the SCC annexes for the relevant transfer. Such information may include the Partner’s identity and contact details, destination country, transfer circumstances and other factual particulars required by the applicable SCC module. Recording or updating those factual particulars within the agreed onboarding or compliance process does not require the Main Agreement or the SCCs to be re-signed unless applicable law requires otherwise.

C.3. SCC selections

C.3.1. Clause 7 (Docking clause): The optional docking clause is not selected for this Agreement.

C.3.2. Clause 9(a), Module Two (Use of sub-processors): Option 1, specific prior authorisation, is selected where Module Two applies, consistently with Clause 7 of Appendix B. Any authorised subprocessor must be identified in Annex III before it processes the transferred personal data.

C.3.3. Clause 11 (Redress): The optional independent dispute-resolution body wording is not selected.

C.3.4. Clause 17 (Governing law of the SCCs): The law of the Netherlands is selected, subject to the requirements of the applicable wording of Clause 17 and the rights of data subjects under the SCCs.

C.3.5. Clause 18 (Choice of forum and jurisdiction under the SCCs): The courts of the Netherlands are selected for the purposes of Clause 18. This SCC selection is without prejudice to any mandatory jurisdiction conferred by the SCCs or applicable data protection law.

C.4. ANNEX I TO THE SCCs

A. LIST OF PARTIES

Data exporter

• Name: Health4Travel (iFlyIT B.V.)
• Address: Burgemeester Burgerhof 29, 3481CX Harmelen, the Netherlands
• Business ID: 67335829 (Netherlands KvK number)
• Contact person: Marko Kauppinen, CEO
• E-mail: marko@health4travel.com

Activities relevant to the transfer: operation of the Health4Travel Platform and facilitation and administration of bookings and payments as described in Clauses 3, 8 and Appendix B.

Role: Controller.

Signature and date: the Platform Provider offers this Agreement through the electronic contracting process. The effective acceptance date is recorded in the Partner acceptance record.

Data importer

• Name: the Partner identified in the electronic acceptance record under Clause 1.2.
• Address: as stated in the electronic acceptance record.
• Business ID: as stated in the electronic acceptance record.
• Contact person, position and e-mail: as stated in the electronic acceptance record.

Data-protection contact details: the Partner contact person and e-mail stated in the electronic acceptance record shall also serve as the Partner’s contact for SCC and data-protection matters unless the Partner notifies Health4Travel in writing of a different privacy or data-protection contact.

Activities relevant to the transfer: receipt and handling of booking and administrative information in connection with Services booked or administered through the Platform, as described in Clause 8 and Appendix B.

Role under Module One: Controller, but only where the Partner acts as an independent controller in relation to the relevant transfer.

Role under Module Two: Processor, but only where the Partner/data importer acts as processor for a future activity expressly documented under Clause 7 of Appendix B.

Signature and date: satisfied through the Partner’s electronic acceptance of this Agreement; the representative, authority confirmation and acceptance timestamp are recorded in the acceptance record.

B. DESCRIPTION OF TRANSFER

Categories of data subjects

End-Users / patients and, where applicable, natural persons acting for or representing a Booking Party or Payer.

Categories of personal data transferred

Name; telephone number; e-mail address; booking ID; selected service and provider; appointment date, time and location; payment and booking status; insurer, insurance policy number or case identifiers where relevant; and limited booking or accessibility notes.

Sensitive data / special categories

The Platform Provider does not require or intentionally collect medical records, prescriptions, diagnostic information, treatment information or other clinical health data through the Platform. Such clinical data is created and held by the Partner outside the Platform as an independent controller. Booking data may nevertheless reveal data concerning health because it shows that a data subject has booked or is receiving a medical or wellness Service.

Frequency of the transfer

As required in connection with individual bookings and their administration during the term of the Agreement.

Nature and purpose of the processing / transfer

Module One: where applicable, transfer of the administrative and booking data listed above to the Partner in circumstances where the Partner processes that data as an independent controller in connection with the provision and administration of its Services and its own applicable legal, regulatory, professional or record-keeping obligations. This does not include transfer by Health4Travel of clinical medical records or treatment data through the Platform.

Module Two: where applicable, processing of the personal data identified for a future processor activity expressly documented under Clause 7 of Appendix B, solely on the relevant controller’s documented instructions and for the documented purpose of that activity.

Purpose under Appendix B Schedule 1: creation, transmission, administration and fulfilment of bookings, together with the applicable controller purposes described in Appendix B.

Period for which the personal data will be retained, or criteria used to determine that period

Module One: only for as long as necessary for the applicable purposes described above or as required by applicable law, consistently with Clause 5.1 of Appendix B.

Module Two: only for the period documented for the relevant future processor activity under Clause 7 of Appendix B. When that processor activity ends, the processor shall return or delete the processor-held data at the controller’s choice unless applicable law requires storage.

For transfers to (sub-)processors, subject matter, nature and duration of the processing

For Module Two, the subject matter, nature, purpose and duration are those expressly documented for the relevant future processor activity under Clause 7 of Appendix B and the applicable SCC annex information. The processor may act only on the controller’s documented instructions, subject to the return/deletion requirements applicable to that activity.

C. COMPETENT SUPERVISORY AUTHORITY

Where Health4Travel (iFlyIT B.V.) is the data exporter, the competent supervisory authority under Clause 13 of the SCCs is the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), as the supervisory authority of the Member State in which the data exporter is established. If mandatory Data Protection Law requires another supervisory authority for a particular transfer, that authority shall apply instead.

C.5. ANNEX II TO THE SCCs — TECHNICAL AND ORGANISATIONAL MEASURES

The Partner/data importer shall implement and maintain, before accessing transferred personal data and for as long as it processes that data, technical and organisational measures appropriate to the risk. For the transferred personal data covered by this Appendix, those measures shall include at least: (a) access controls restricting data to authorised personnel who require access for permitted purposes; (b) individual user accounts or equivalent controls allowing access to be attributed to an authorised person, together with strong authentication appropriate to the system and risk; (c) encryption in transit over public or external networks and appropriate encryption at rest or equivalent technical protection where data is stored on systems under the Partner’s control; (d) reasonable logging, monitoring and review of access and security-relevant events where supported by the systems used; (e) reasonable vulnerability and security-update management for systems and devices used to access or store transferred data, including malware protection where appropriate; (f) backup, availability and recovery measures appropriate to any transferred personal data stored by the Partner; (g) documented incident-response procedures and procedures for notifying Health4Travel of relevant personal data breaches without undue delay in accordance with Appendix B; (h) confidentiality obligations and appropriate data-protection and security instructions or training for personnel authorised to process the transferred data; (i) procedures to review and remove access when no longer required; (j) supplier and subprocessor controls designed to ensure that any third party permitted to process transferred data is bound by appropriate confidentiality, security and data-protection obligations; (k) procedures for secure deletion, anonymisation or return of transferred personal data when retention is no longer permitted or required; and (l) measures designed to prevent transferred personal data from being copied, exported, disclosed or retained outside the systems, locations and purposes reasonably necessary for the processing authorised by this Agreement, except where required by applicable law.

These measures constitute the minimum safeguards agreed for the transferred personal data. The Partner remains responsible for implementing any additional measures appropriate to its systems, processing activities and risk profile.

The Partner shall notify Health4Travel without undue delay if it can no longer comply with these measures or if a material change in its systems or processing requires different or additional safeguards.

Where Module Two applies, the processor shall also maintain procedures reasonably capable of assisting the controller with data-subject requests and with the controller’s obligations under Articles 32 to 36 GDPR, taking account of the nature of the processing and the information available to the processor, consistently with Clause 7 of Appendix B.

C.6. ANNEX III TO THE SCCs — LIST OF SUB-PROCESSORS (MODULE TWO ONLY)

No subprocessors are authorised at the time of acceptance for processing covered by Module Two. The Partner may not appoint a subprocessor for such processing without the controller’s prior written authorisation in accordance with Clause 7 of Appendix B and Clause 9 of the applicable SCC module.

Any authorised subprocessor shall be recorded in writing before it begins processing, including its name, address, contact details and description of processing. That written authorisation and record shall form part of this Annex III without requiring the Main Agreement or the SCCs to be re-signed.

C.7. CLAUSE 14 TRANSFER ASSESSMENT

Before the first transfer to a Partner that relies on Appendix C, Health4Travel shall record the destination country and relevant transfer circumstances in the Partner onboarding or compliance record and shall document the assessment required by Clause 14 of the SCCs. The assessment shall take due account of the circumstances of the transfer, the laws and practices of the destination country relevant to the transfer, the nature and categories of the personal data, the purposes and duration of processing, the method of transfer and any relevant contractual, technical or organisational safeguards.

By accepting this Agreement, the Partner agrees to provide information reasonably required for that assessment, confirms that it has no reason to believe that laws or practices applicable to it prevent it from fulfilling its obligations under the SCCs, and undertakes to notify Health4Travel without undue delay if that position changes, subject to the notification restrictions and obligations contained in the SCCs. Health4Travel shall not rely on Appendix C for the relevant transfer until the Clause 14 assessment has been documented and any supplementary measures identified as necessary have been implemented. The Partner onboarding or compliance record containing the assessment, together with any documented supplementary measures, is incorporated by reference into this Appendix for the relevant transfer.