Health4Travel Partner Agreement

2.1. Platform Provider: For the purposes of this agreement, "Health4Travel" and "Platform Provider" refers to Health4Travel and its official representatives, subcontractors, agents, subsidiaries, and related companies, including its parent company Health4Travel Enterprises Pte Ltd, Singapore UEN 202341292N domiciled at 160 Robinson Road, #14-04, Singapore 068914 and all its related companies.

2.2. Platform: "Platform" refers to the Health4Travel platform and all its sub-pages and sub-sections, accessible through https://www.health4travel.com, operated by Health4Travel, which provides an online service for the listing, booking, financial transactions, and other solutions for services.

2.3. Partner: "Partner" refers to any individual, group, or entity that agrees to use the Platform for the purpose of listing services, accepting bookings, and conducting financial transactions for business purposes and its official representatives, subcontractors, agents, subsidiaries, and related companies.

2.4. Services: "Services" shall mean any and all services listed, promoted, booked, transacted through, or otherwise processed through the Platform.

2.5. The Agreement: This Agreement.

2.6. End-user: The person or legal entity that books and consumes Services on the Platform or who uses the Platform with the intention of booking and consuming Services.

3.1. The Platform Provider is the provider of an online Platform as a service for the booking of Services.

3.2. The Partner is a service provider that provides medical, wellness, travel-related, and/or healthcare-related services for different end-customer groups. The Partner wishes to use the Platform as a distribution channel for the sale and booking of Services offered by the Partner to individuals or corporations.

3.3. This Agreement sets out how the Parties will work together to allow bookings to be made using the online Platform.

3.4. Third-party introducers and coordinating partners: Where the Partner has been introduced, referred, arranged, or coordinated through a third-party introducer, arranger, assistance company, insurer, TPA, network manager, or other coordinating partner, this Agreement is intended to enable the Partner's operational and technical onboarding to, and use of, the Platform.

3.5. Separate third-party arrangements: The Partner acknowledges that certain commercial, payment, referral, coordination, reporting, service-flow, or other operational arrangements may be governed by a separate agreement between the Platform Provider and the relevant third party. To the extent that any provisions of this Agreement relating to such matters differ from that separate agreement, the separate agreement shall prevail as between the Platform Provider and that third party.

4. Appendices to This Agreement: Acceptance of this Agreement includes the acceptance of (4.1) the Health4Travel Acceptable Use Agreement, appended hereto as Appendix A, and (4.2) the Health4Travel Data Processing Agreement (incorporating processor terms), appended hereto as Appendix B.

5. Agreement to Terms: This Agreement is accepted by the Partner when its authorised representative completes the electronic acceptance form provided by Health4Travel, including confirmation of authority to bind the Partner. Acceptance may also occur by creating an account on, or otherwise utilising, the Platform to list services, accept bookings, and conduct financial transactions. The version of this Agreement accepted, together with the acceptance record (name, designation, e-mail address, and timestamp of the accepting representative), constitutes the agreement between the Parties, together with any additional terms and policies provided by Health4Travel.

5.1. Authority declaration: The person accepting this Agreement declares that they are duly authorised to enter into this Agreement on behalf of the Partner. The Partner shall be bound by such acceptance.

5.2. Versioning: This Agreement is identified by a version number and date. The version accepted by the Partner remains available to the Partner on request and at https://health4travel.com/partner-agreement-version-2-0.

6. Service providers: This Agreement does not form any kind of legal partnership or ownership between the Parties. All Parties will carry out their duties independently and with full responsibility.

6.1. The Partner is fully responsible for all medical and/or wellness services they provide under this Agreement. The Partner confirms that they have, and will continue to maintain, all required qualifications, licences, registrations, and certifications needed to provide these services in line with applicable laws and professional standards. The Partner also confirms that they have appropriate and valid professional liability insurance in place. Health4Travel is not responsible for the quality, safety, legality, or results of any services provided by the Partner.

7. Partner information: Information provided by the Partner to the Platform in connection with registration, service listing, and cooperation is primarily business-related information. To the extent that such information includes personal data relating to identified or identifiable natural persons, it shall be processed solely for business communication and operational purposes, in accordance with applicable data protection laws and this Agreement.

7.1. Clause 7 does not apply to End-User or patient personal data, which is governed by Clause 8 and Appendix B.

8.1. Compliance. Each Party shall comply with Regulation (EU) 2016/679 (the "GDPR") and any other applicable data protection law in respect of personal data processed in connection with this Agreement. Where the Partner processes personal data as the Platform Provider's processor under clause 8.2(b), the Parties shall comply with Article 28(3) GDPR. If a Party is not established in the European Economic Area ("EEA") or is otherwise not directly subject to the GDPR, that Party shall nonetheless comply with the GDPR for all data originating from or related to this Agreement and the use of the Platform.

8.2. Roles of the Parties

(a) The Platform Provider is the controller of the personal data collected through the Platform for the purposes of operating the Platform and facilitating and administering bookings and payments.

(b) In respect of booking-coordination data that the Partner accesses through the Platform solely to receive and fulfil bookings, and only to that extent and for so long as the Partner acts solely on the Platform Provider's documented instructions, the Partner acts as the Platform Provider's processor, and clauses 8.3 to 8.9 and Part 2 of Appendix B apply to that processing.

(c) In respect of the healthcare and wellness Services it provides to End-Users — including any consultation, treatment, diagnosis, medical records, prescriptions and related health data — the Partner acts as an independent controller, determining its own purposes and means and complying with its own legal, regulatory, professional and record-keeping obligations. The Platform Provider is not the controller, processor or custodian of such data.

(d) The Parties are not joint controllers within the meaning of Article 26 GDPR.

8.3. In its capacity as processor under clause 8.2(b), the Partner shall not copy, retain, use, or disclose such data for any purpose not specified in this Agreement and its Appendices, and shall not buy or sell such data. This clause does not apply to personal data that the Partner processes as an independent controller under clause 8.2(c).

8.4. All primary storage of personal data by the Platform Provider shall take place within the European Union. Access to personal data by a Partner outside the EEA shall constitute a restricted transfer under Chapter V of the GDPR and shall be governed by the Standard Contractual Clauses referenced in clause 8.5.

8.5. To the extent personal data is transferred from the EEA to a location outside the EEA, or from outside the EEA into the EEA, the Parties agree that such transfers shall be subject to appropriate safeguards in accordance with Chapter V of the GDPR. In particular, the Parties agree to enter into the European Commission Standard Contractual Clauses adopted in Decision (EU) 2021/914 of 4 June 2021, using Module One (controller-to-controller) for transfers between the Parties acting as independent controllers and Module Two (controller-to-processor) for transfers of data processed under clause 8.2(b). The Parties acknowledge the SCCs constitute appropriate safeguards under Article 46 GDPR and that no additional data localisation obligation is imposed beyond compliance with applicable local law. Where the Partner is established outside the EEA, the Parties shall execute the applicable Standard Contractual Clauses as a separate signed document prior to or promptly following acceptance of this Agreement, and account activation may be conditional on such execution.

8.6. The Parties will only access the data for the period within which it is needed to fulfil their obligations under this contract.

8.7. On termination, the Partner shall return to the Platform Provider, and then delete, the booking-coordination data it processes as processor under clause 8.2(b), except to the extent retention is required by applicable law or the data relates to personal data the Partner holds as an independent controller under clause 8.2(c), including medical records.

8.8. The Parties agree to submit to any legally necessary audits and inspections, to provide the Platform Provider with whatever information is needed to demonstrate compliance with data protection obligations, and to notify the other Parties immediately if asked to do anything infringing applicable data protection law.

8.9. In case of any personal data breach affecting personal data shared under this Agreement, the affected Party shall, without undue delay after becoming aware of it and in any event within 72 hours where feasible, notify the other Parties, providing available detail. Each Party remains responsible for its own notifications to supervisory authorities and data subjects.

8.10. The Platform Provider does not collect health data on the Platform and does not require any Party to provide the health data of any End-User or patient of the Platform. Where clinical health data, medical records or prescriptions arise from a Service, they are created and held by the Partner as an independent controller and handled outside the Platform; the Platform Provider is not their controller, processor or custodian.

9. Professional indemnity: The Parties will maintain professional indemnity insurance cover in respect of The Parties' business and provision of Services with and on standard terms offered by reputable insurers. This insurance cover must be maintained whether or not it is required by any relevant authorities.

10.1. Health4Travel's Right To Manage Listings: The Partner hereby grants The Platform provider permission to list, edit, and manage services based on The Partner's written instructions, including any necessary integrations including but not limited to APIs, on the Platform. The Platform Provider also reserves the right to correct, limit access to, or to remove from view any service listing or information that is incorrect, duplicate, or otherwise affecting the ethical use or optimal functioning of the Platform.

10.2. Partner's Right To Manage Listings: The Partner retains the right to list, edit, and manage their services, locations, available times, prices or any other information. If the Partner requires the Platform Provider to execute any of these changes, the request has to come from an email address registered with the required level of authorisation in the Platform's database.

10.3. The Partner understands that they must use the Platform to manage bookings for Services that come through the Platform.

10.4. Until a time slot becomes booked on the Platform, The Partner has the right to book it for other purposes or otherwise make the time slot unavailable for booking through the Platform.

10.5. Calendar Integrations: The Partner agrees to use the Platform's booking calendar system for the management of bookings generated through the Platform. Where the Partner elects to integrate its own systems, such integration shall be subject to mutual agreement and limited to the extent necessary to enable booking coordination. The Partner shall not be required to provide unrestricted or direct access to its internal systems unless separately agreed under defined technical, security, and data protection terms.

10.6. The Partner agrees to manage their service availability and bookings effectively so that reasonable and legitimate bookings made through the Platform can be fulfilled by The Partner.

11.1. Financial Transactions: All financial transactions conducted through the Platform, including but not limited to fees for Services, charges and fees related to bookings, and payments, shall be governed by the prevailing national and international laws, treaties, and regulations. The Partner agrees to bear the costs of any required compliance.

11.2. Payment Settlements: The Partner agrees to a 30-calendar day payment settlement schedule for all bookings fulfilled through the Platform unless agreed otherwise in writing. Payments will be made from The Platform Provider to The Partner within 30 calendar days of the booking being marked as completed on the Platform. The Partner agrees to be paid through self-billing invoices, which Health4Travel will send to The Partner. The settlement will be calculated in Euros and settled either by bank transfer or by any mutually agreed method of transfer, including but not limited to payments automation services. Bank and currency exchange fees are shared unless otherwise arranged by mutual agreement. The Parties acknowledge that the Partner provides medical Services directly to the End-User, and that the Platform Provider acts as a payment collection and settlement intermediary for technical and commercial convenience only.

11.3. Fee Authorization: The Parties agree that The Platform Provider, at its sole discretion, has the right to charge the End-User a fee in addition to The Partner's listed Services price for the Platform and technology services, as well as additional fees to cover card and payment gateway transaction costs. We may also, at our sole discretion, make changes to the displayed nomenclature, structure, amount, and other aspects of this fee with or without prior notice to other Parties.

11.4. Payments are conditional upon the Partner completing onboarding to the Platform Provider's designated payment system, including the provision and verification of a valid bank account or payment method, and maintaining such payment details in an accurate, active, and fully functional state at all times. Any failure, delay, or interruption attributable to the Partner in completing or maintaining such onboarding or functionality, including invalid, outdated, or non-operational payment details, shall temporarily suspend the Platform Provider's payment obligations. No default interest shall accrue during any such period.

11.5. Settlement Timing and Regulatory Cooperation: The Platform Provider shall use reasonable efforts to complete settlements within the agreed timeframe. Where local currency control or regulatory requirements impose mandatory deadlines on the Partner, the Partner shall notify the Platform Provider in writing, and the Parties shall cooperate in good faith to minimise regulatory risk.

11.6. Third-party coordinated payment arrangements: Where the Partner has been referred to Health4Travel as part of an arrangement where payment flows through a coordinating third party, Clauses 11.1 to 11.5 shall be subject to the arrangement between the Partner and that third party.

12.1. The Provider agrees to accept bookings through the Platform, and to list its services, its prices, and its availability accurately and in such a way that best serves the End-users of the Platform and that no operational, reputational, or other kind of harm is done to Health4Travel, their customers, or other users of the Platform.

13. Re-scheduling of Bookings: End-users who have made bookings may request for re-scheduling of those bookings via the Platform. The Provider agrees to accept and facilitate reasonable requests for such re-scheduling. Where necessary The Partner also agrees to delegate such rescheduling to Health4Travel based on The Partner's listed availability on the Platform.

14. Cancellations: The Partner accepts that cancellations of booked appointments can be made on the Platform up to 24 hours in advance of the booking time and that no payments will be due to The Partner in the event of such a cancellation. If a customer does not show up for their appointment and does not inform the Partner, the appointment is considered to have been paid for and the Partner is not obliged to refund the customer or offer a new booking time.

15. Non-fulfilment of Bookings: If the Partner is unable to deliver a Service that has been booked on the platform, they must inform Health4Travel customer support by email at least 24 hours before the start of the booked appointment so that Health4Travel can rebook the End-user. There will be no liability for the Partner in such a situation.

15.1. Emergencies and force majeure causing non-fulfilment of Bookings: In cases where the Partner does not inform Health4Travel customer support by email at least 24 hours before the start of the booked appointment due to an unforeseeable, unavoidable, force majeure event, Health4Travel will waive the liability for the Partner.

15.2. Should the Partner fail to deliver their service and fail to inform Health4Travel customer support by email in time, they will be liable for any difference in cost between the original appointment and the new appointment per non-fulfilled booking.

16. Intellectual Property Rights: The Platform and its entire contents, features, and functionality (including but not limited to all information, software, models, text, displays, images, video, and audio, and the design, selection, and arrangement thereof) are owned by the Platform Provider, its licensors, or other providers of such material and are protected by Dutch and international copyright, trademark, patent, trade secret, and other intellectual property or proprietary rights laws.

16.1. The Partner, their employees, and related entities that have access to the Platform must not reproduce, distribute, modify, create derivative works of, display, republish, download, store, or transmit any of the material on Health4Travel's Website, except for the purpose of fulfilling the terms of this contract and providing Services to End-users.

16.2. No right, title, or interest in or to the Platform or any content on the Platform is transferred to The Partner, and all rights not expressly granted are reserved by the Platform Provider.

17.1. Each Party grants the other Party a non-exclusive, royalty-free, revocable licence to use its company name, registered trademarks, and logos (collectively, the "Marks") solely for the purpose of identifying the other Party as a commercial partner in marketing materials, press releases, case studies, website content, and other public communications.

17.2. Each Party shall notify the other Party in writing at least five (5) business days prior to any public use of the other Party's Marks. The owning Party may provide brand usage guidelines, with which the other Party shall comply.

17.3. Neither Party shall use the other Party's Marks in a manner that is misleading, defamatory, or likely to damage the reputation of the owning Party, or in any way that implies an endorsement, investment relationship, or affiliation beyond the scope of this Agreement.

17.4. Either Party may revoke the licence granted under this Article at any time by providing written notice to the other Party. Upon receipt of such notice, the other Party shall promptly cease all use of the revoking Party's Marks in new materials and shall remove such Marks from existing publicly accessible materials within thirty (30) days.

17.5. Nothing in this Article shall be construed as transferring ownership of either Party's Marks to the other Party.

18. Acceptable Use: All Parties agree to use the Platform in a manner consistent with its intended purpose and in compliance with all applicable laws and regulations. Each Party is responsible for ensuring that all services listed and transacted through the Platform are lawful, accurately described, and ultimately fulfilled in accordance with the terms of the booking. All Parties agree to comply with the terms and conditions of the Health4Travel Acceptable Use Agreement (https://health4travel.com/h4t-partner-acceptable-use-agreement/), attached hereto and incorporated by reference.

19. Liability Disclaimer: All Parties acknowledge that Health4Travel is not responsible or liable for the provision of health or wellness services. Health4Travel acts solely as a platform and technology provider facilitating the booking and payment process. The Partner is solely responsible for the quality, safety, and legality of the Services provided.

19.1. Platform Operational Responsibilities:

19.1.1. The Platform Provider shall use commercially reasonable efforts to ensure that: (a) service listings, pricing, availability, and booking information displayed on the Platform reflect the information provided by the Partner; (b) bookings confirmed via the Platform are accurately transmitted to the Partner without undue delay; and (c) the Platform's booking and payment systems operate in accordance with generally accepted industry standards.

19.1.2. The Platform Provider shall not be responsible for the medical outcome or clinical quality of the Services, but shall remain responsible for errors, inaccuracies, or technical failures attributable solely to the Platform's systems or actions.

19.1.3. Nothing in this Agreement obliges the Platform Provider to obtain or document medical informed consent. The Partner remains solely responsible for obtaining all legally required patient consents prior to provision of medical Services.

19.2. Reputational Harm: Where the Partner suffers demonstrable reputational damage directly caused by inaccurate information, unauthorised content changes, or technical malfunctions attributable to the Platform Provider, the Parties shall cooperate in good faith to mitigate such damage, including prompt correction of information and reasonable public clarification where appropriate.

19.3. Except in cases of gross negligence, wilful misconduct, fraud, breach of confidentiality, breach of data-processing obligations, or IP infringement, each Party's total aggregate liability arising out of or in connection with this Agreement shall be limited to the total amount of fees paid or payable to the Partner under this Agreement in the preceding 6 months. Neither Party shall be liable for indirect, incidental, or consequential damages.

20. Modifications: Health4Travel reserves the right to modify these terms at any time by informing all Parties of such changes. Any change in these terms will be delivered to the email address listed in this contract. Continued use of the Platform after a notice period of 14 days following any such notification of modifications constitutes acceptance of the new terms. For material changes — including changes to fees, payment terms, liability, or data processing — Health4Travel may require active re-acceptance through a new electronic acceptance form, and continued use pending re-acceptance shall not constitute acceptance of such material changes beyond any period stated in the notice.

21. Limited Non-Compete: During the term of this Agreement, the Partner shall not use confidential technical or commercial information obtained from the Platform Provider to develop or offer a directly competing platform that is substantially similar in functionality and business model to the Platform. This restriction shall: (a) apply only during the term of the Agreement; (b) not prevent the Partner from cooperating with other healthcare platforms, insurers, or assistance companies; (c) not restrict the Partner from developing or using its own internal booking or patient management systems.

22. Validity And Termination: The terms of the Health4Travel Partner Agreement are considered to be in force for three (3) years from the date of acceptance by the Partner. At the end of these three (3) years, continued use of the Platform will constitute a renewed acceptance of this Agreement for one (1) month from the date of last use. Either party may terminate this Agreement for any reason with one (1) months' written notice to the other party. Termination will not affect the rights and obligations that have already accrued.

23. Assignment Consent Generally Required: Subject to the following Clause on Permitted Assignment Disposals by Health4Travel, neither party is permitted to assign, transfer, novate or subcontract the benefit of this Agreement, or to subcontract its obligations under it, without the other party's prior written consent (which shall not be unreasonably withheld or denied).

24. Permitted Assignment Disposals by Health4Travel: Health4Travel may, without the Partner's consent, assign, transfer, novate or subcontract its rights and obligations under this Agreement to: (a) any Subsidiary of Health4Travel from time to time, or (b) to any corporate owner of the business undertaking of Health4Travel to which this Agreement relates. At the request of Health4Travel, the Partner will promptly execute all documents required to give effect to such a transaction. Any assignment shall not affect the rights and protections of the Partner. The Partner should be notified in advance prior to any such assignment.

25. Severability: If any Clause (or part of a Clause) in this Agreement is unenforceable, invalid, or illegal for any reason, the other Clauses of this Agreement will remain in force as if they had been executed without the offending text appearing in this Agreement (and the offending text will be deemed to be substituted with drafting that has the closest effect and is enforceable).

26. Force Majeure: Neither party will be liable for inadequate performance to the extent caused by a condition (for example, natural disaster, act of war or terrorism, riot, labor condition, governmental action, and Internet disturbance) that was beyond the party's reasonable control.

27. No Partnership or Agency: Neither party has the authority or power to bind, create a liability for, or enter any commitments for or on behalf of, the other party.

28. E-Signatures and Electronic Acceptance: Unless Applicable Law requires otherwise, this Agreement may be agreed and/or executed using electronic signatures or indicated acceptance through online processes, including completion of an electronic acceptance form. The Parties agree that Health4Travel's electronic records of acceptance constitute valid evidence of the conclusion and content of this Agreement. If an effective date has not been stated within this Agreement, it will come into effect on the date of acceptance by the Partner.

29. Jurisdiction: All disputes or claims arising in connection with this Agreement will be subject to the exclusive jurisdiction of the Amsterdam District Court, with proceedings conducted in English before the Netherlands Commercial Court ("NCC"). If a dispute or claim is held not to fall within the competence of the NCC, the parties agree that it will exclusively be resolved by the Court of Amsterdam, the Netherlands.

30. Governing Law: This Agreement shall be governed by and construed in accordance with the laws of The Netherlands, and any disputes arising from it shall be resolved in accordance with the laws of this jurisdiction.

31. Contact Information: For questions or concerns regarding this Agreement, please contact Health4Travel at info@health4travel.com.

32. Entire Agreement: This Agreement constitutes the entire agreement between the parties and supersedes all prior agreements and understandings, whether written or oral, relating to the subject matter herein.

By completing the electronic acceptance form, the Partner accepts the Health4Travel Partner Agreement version 2.0 dated 8 July 2026, including Appendix A (Acceptable Use Agreement) and Appendix B (Data Processing Agreement).

Offered by Health4Travel B.V., represented by Marko Kauppinen, CEO.

For the Partner — provided at acceptance: Business Name, Business ID, Address, Name of representative, Designation, E-mail, confirmation of authority, signature and date.

This Health4Travel Acceptable Use Agreement ("Agreement") is entered into by and between Health4Travel B.V. ("Health4Travel") and all users of the Health4Travel platform ("User").

A.1. Purpose. This Agreement sets forth the terms and conditions under which Users may access and use the Health4Travel platform ("Platform"). By accessing or using the Platform, you agree to be bound by the terms of this Agreement.

A.2. User Conduct. A.2.1 Users must use the Platform in a lawful and ethical manner. A.2.2 Prohibited activities include, but are not limited to: (a) Fraudulent or misleading practices; (b) Harassment, hate speech, or threats; (c) Unauthorised access to other users' accounts or data; (d) Violation of intellectual property rights.

A.3. Content Guidelines. A.3.1 Users must adhere to the following content guidelines: (a) Post accurate and non-deceptive content; (b) Prohibit content that is offensive, harmful, or illegal; (c) Respect intellectual property rights; do not use copyrighted materials without permission.

A.4. Prohibited Items or Services. A.4.1 Users may not offer, list, or promote: (a) Products or services that are illegal, counterfeit, or infringe on intellectual property rights; (b) Controlled substances, illegal drugs, or drug paraphernalia; (c) Items or services that are prohibited by applicable laws or regulations.

A.5. Privacy and Data Handling. A.5.1 Users must comply with the Health4Travel Privacy Policy, available at https://health4travel.com/wp-content/uploads/2023/09/T2T-privacy-policy.pdf, when handling personal data on the Platform.

A.6. Intellectual Property. A.6.1 Users are responsible for ensuring they have the necessary rights and permissions to use intellectual property on the Platform. A.6.2 Health4Travel respects intellectual property rights and will respond to valid infringement claims promptly.

A.7. User Accounts. A.7.1 Users are responsible for maintaining the security and accuracy of their accounts. A.7.2 Do not share login credentials or allow unauthorised access to your account.

A.8. Termination of Accounts. A.8.1 Health4Travel reserves the right to suspend or terminate a User's access to the Platform for violations of this Agreement or for any other reason, in its sole discretion.

A.9. Dispute Resolution. A.9.1 Users agree to resolve disputes with other Users through peaceful means, including negotiation and mediation if necessary.

A.10. Reporting Violations. A.10.1 Users can report violations of this Agreement or other misconduct on the Platform through the designated reporting mechanism.

A.11. Liability Disclaimer. A.11.1 Health4Travel is a platform and technology provider and is not responsible or liable for the quality, safety, or legality of products or services offered by Users on the Platform.

A.12. Governing Law. A.12.1 This Agreement shall be governed by and construed in accordance with the laws of The Netherlands.

A.13. Updates to the Agreement. A.13.1 Health4Travel reserves the right to modify this Agreement and will provide notice of any changes via email and on the platform. Continued use of the Platform after a notice period of 14 days following any such notification of modifications constitutes acceptance of the revised Agreement.

A.14. Contact Information. A.14.1 For questions or concerns regarding this Agreement, please contact Health4Travel at info@health4travel.com.

A.15. Acceptance. By using the Health4Travel Platform, you acknowledge that you have read, understood, and agree to abide by the terms and conditions of this Acceptable Use Agreement.

Controller-to-controller, with processor terms. This Appendix governs the sharing of personal data between the Platform Provider and the Partner in connection with the Platform and forms part of the Agreement. The terms "controller", "processor", "personal data", "processing", "data subject", "special categories of personal data" and "personal data breach" have the meanings given to them in the GDPR.

Part 1 — Roles and controller-to-controller terms

B.1.1. Roles. As set out in clause 8.2: the Platform Provider is the controller of personal data collected through the Platform for platform operation and booking and payment facilitation; the Partner is an independent controller in respect of the healthcare and wellness Services it provides to End-Users (including medical records and health data); and the Partner acts as the Platform Provider's processor only in respect of booking-coordination data accessed through the Platform strictly to fulfil bookings on the Platform Provider's documented instructions. The Parties are not joint controllers within the meaning of Article 26 GDPR.

B.1.2. Purposes and lawful basis. Each Party shall process the shared personal data only for the purposes set out in Schedule 1 and any compatible purpose permitted by law, and shall maintain a lawful basis. Each Party, as controller, is responsible for providing its own transparency information to data subjects under Articles 13 and 14 GDPR.

B.1.3. Clinical health data outside the Platform. Medical records, prescriptions, diagnostic and treatment information and other clinical health data are created and held by the Partner as independent controller, outside the Platform. The Platform Provider does not require, collect or process such clinical health data through the Platform and is not the controller, processor or custodian of any medical record. Only administrative and booking information is exchanged through the Platform.

B.1.4. Special categories. The Parties acknowledge that the fact a data subject books a medical or wellness Service may itself reveal data concerning health (Article 9 GDPR). Each Party shall ensure it has a valid Article 9 condition for its own processing (for example, explicit consent under Article 9(2)(a) or, for the Partner's provision of healthcare, Article 9(2)(h)).

B.1.5. Data subject rights. Each Party shall handle requests it receives in respect of personal data it controls and shall provide the other Party with reasonable and timely cooperation.

B.1.6. Security. Each Party shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including as appropriate: access controls; authentication measures; encryption in transit; regular backups; logging and monitoring; and staff training and confidentiality procedures.

B.1.7. Personal data breach. Each Party shall notify the other without undue delay, and within 72 hours where feasible, of a personal data breach affecting personal data shared under the Agreement, with available detail. Each Party remains responsible for its own notifications to supervisory authorities and data subjects.

B.1.8. International transfers. International transfers of personal data are addressed in clauses 8.4 and 8.5 of the Agreement.

B.1.9. Retention. Each Party shall retain shared personal data only for as long as necessary for the purposes in Schedule 1 or as required by applicable law, and shall then delete or anonymise it.

Part 2 — Processor terms (apply only to clause 8.2(b) booking-coordination data)

B.2.1. The Partner shall process such personal data only on the Platform Provider's documented instructions, unless required by law (in which case it shall, where lawful, inform the Platform Provider).

B.2.2. The Partner shall ensure that persons authorised to process such data are subject to appropriate confidentiality obligations.

B.2.3. The Partner shall implement the security measures described in Part 1, clause B.1.6.

B.2.4. The Partner shall not engage a subprocessor for such data without the Platform Provider's prior written authorisation, and shall bind any authorised subprocessor to data protection obligations substantially equivalent to these terms, remaining liable for its performance.

B.2.5. Taking into account the nature of the processing, the Partner shall assist the Platform Provider, so far as possible, with data subject requests and with compliance with Articles 32 to 36 GDPR.

B.2.6. The Partner shall notify the Platform Provider without undue delay of any personal data breach affecting such data.

B.2.7. On termination, the Partner shall return and delete such data in accordance with clause 8.7, save where retention is required by law or the data is held by the Partner as an independent controller.

B.2.8. The Partner shall make available information necessary to demonstrate compliance with Article 28 GDPR and shall allow for and contribute to audits in accordance with clause 8.8.

Schedule 1 — Description of data sharing

Parties and roles: Platform Provider — controller (platform and booking data). Partner — independent controller (healthcare Services and medical records) and processor (booking-coordination data under clause 8.2(b)).

Categories of data subjects: End-Users / patients, and where applicable the representatives of any organisation nominating them.

Categories of personal data and purposes: Name, telephone number, e-mail address, insurer, insurance policy number, and case number — each transferred for the coordination of Service delivery.

Special categories: The Platform Provider does not require or intentionally collect medical records or clinical health information through the Platform; clinical data is handled by the Partner outside the Platform as an independent controller. Booking data may nonetheless reveal data concerning health.

Retention period: the duration of the Agreement plus any period required by applicable law.