Data Processing Agreement

Version 1.0 – effective from 18 August 2026 Classification: Public

between

Medibrix AS, with registered address at Sjøgata 5, 9405 Harstad, Norway, and organization number 912 540 863 ("Medibrix" or "Data Processor")

and

The customer ("Data Controller")

each referred to as a "Party" and together the "Parties"

1. Introduction

1. This Agreement sets out the rights and obligations of the Data Controller and the Data Processor when the Data Processor processes Personal Data on behalf of the Data Controller.

2. This Agreement is designed to ensure both Parties comply with the European Parliament and Council Regulation (EU) 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC ("GDPR").

3. In connection with the delivery of services agreed under the main agreement called the Terms and Conditions for the TIMIT platform (the "Terms and Conditions"), the Data Processor shall process Personal Data on behalf of the Data Controller in accordance with this Agreement. This Agreement applies exclusively to processing activities for which Medibrix acts as a Data Processor.

4. In the event of a conflict between this Agreement and any other agreement between the Parties relating to data processing, this Agreement shall prevail.

5. There are three appendices to this Agreement which form an integral part hereof:

   • Appendix A: Detailed information on the processing activities, including purpose, nature and types of Personal Data, categories of Data Subjects, and duration of processing.
   • Appendix B: Conditions for the use of Sub-Processors and the list of approved Sub-Processors.
   • Appendix C: The Data Controller's instructions for processing, minimum security measures to be implemented by the Data Processor, and procedures for audits.

6. This Agreement does not exempt the Data Processor from obligation imposed by the GDPR or other applicable data protection legislation.

2. Rights and obligations of the Data Controller

1. The Data Controller is responsible for ensuring that the processing of Personal Data complies with the GDPR principles of accountability and data protection, applicable data protection legislation and this Agreement.

2. The Data Controller shall determine the purposes of the processing and the means by which such processing is to be carried out.

3. The Data Controller is responsible for ensuring that there is a valid legal basis for the processing of Personal Data by the Data Processor in accordance with the Data Controller's instructions.

3. The Data Processor´s Obligation to Act on Instructions

1. The Data Processor shall only process Personal Data according to documented instructions from the Data Controller, unless otherwise required by applicable law. If the law requires the Data Processor to process data beyond these instructions, the Data Processor must inform the Data Controller, unless prohibited by law. The Data Controller may issue additional documented instructions at any time during processing.

2. If the Data Processor believes any instruction violates data protection laws or the GDPR, it must immediately notify the Data Controller.

4. Confidentiality

1. The Data Processor may only allow access to Personal Data to individuals under its authority who are required to follow instructions and are bound by confidentiality, either by contract or by law. Access must be limited to what is strictly necessary.

2. The data processor must be able to demonstrate, upon request, that all authorized individuals are subject to the required confidentiality obligation.

5. Security of Processing

1. Both the Data Controller and the Data Processor must implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk. This includes considering available technology, implementation costs, processing nature, and potential harm to individuals' rights and freedoms.

   Depending on relevance, such measures may include:

   a. Pseudonymisation and Encryption b. Maintaining confidentiality, integrity, availability and resilience of systems c. Restoring data access quickly in case of incidents d. Regular testing and evaluation of security measures.

2. The Data Processor must also independently assess the risks to individuals' rights and freedoms and implement relevant safeguards. The Data Controller must provide necessary information for this assessment.

3. The Data Processor must support the Data Controller´s compliance with its security obligations by providing details on existing safeguards and any other necessary information.

6. Use of Sub-Processors

1. The Data Processor may only engage another processor if certain conditions are met, including a written agreement ensuring equivalent data protection responsibilities.

2. Sub-Processors must be approved in writing by the Data Controller. General approval is given for those listed in Appendix B. Written agreements must be in place with sub-processors, ensuring they follow the same obligations as in this Agreement. The Data Processor remains fully responsible for Sub-Processors´ compliance.

3. If the Data Processor intends to appoint a new sub-processor, the Data Controller must be notified at least one month in advance. The Data Controller can object to the change within 15 days. If the Data Controller objects to the change, either party may terminate the agreement with 15 days' notice, within 5 days after the objection. If the Data Controller does not terminate the agreement, the new sub-processor is considered accepted.

4. A copy of the sub-processor agreement must be shared with the Data Controller upon request, excluding commercial terms not relevant to data protection.

5. If a Sub-Processor fails to meet its obligations, the Data Processor remains fully liable to the Data Controller in terms of fulfilling the Sub-Processor's obligations.

7. Transfers to Third Countries or International Organisations

1. The Data Processor may only transfer Personal Data to outside the EU/EEA with the controller's prior approval and in accordance with applicable safeguards, such as the EU's standard contractual clauses ("SCCs").

2. The Data Controller has approved transfers listed in Appendix B. SCCs have been entered into with relevant third-countries and updated in line with new EU rules.

3. The Sub-Processors who are domiciled in the USA are all registered under the Data Privacy Framework subject to an adequacy decision.

8. Assistance to the Data Controller

1. The Data Processor must assist the Data Controller, where possible, in responding to requests from individuals exercising their rights (such as access, rectification, deletion, etc.). This includes helping the Data Controller meet its information obligations, as well as honoring individual rights including objection, data portability, and protection against automated decision-making.

2. The data processor must also assist with:

   a. Reporting data breaches to the relevant data protection authority b. Notifying affected individuals of serious breaches c. Conducting data protection impact assessments d. Consulting authorities where high-risk processing cannot be mitigated.

3. The scope of technical and organizational measures for this assistance is detailed in Appendix C, including the level and type of support the Data Processor must provide.

9. Notification of Personal Data Breach

1. If a personal data breach occurs, the Data Processor must notify the Data Controller without undue delay after becoming aware of it.

2. This notification must be provided promptly so that the Data Controller can meet its obligation to report the breach to the data protection authority within the legally required timeframe.

3. The Data Processor must assist the Data Controller in preparing this report. This includes helping collect and provide the following information:

   a. A description of the nature of the breach, including, when possible, the categories and approximate number of individuals and records affected. b. Likely consequences of the breach c. Measures taken or proposed to address the breach and, if relevant, mitigate its harmful effects.

10. Audit and Inspection

1. The Data Controller may carry out an audit once per year to assess how the Data Processor handles Personal Data. The Data Processor must support the audit. The Data Controller may also request a third party security audit. A report of that audit will be shared with the Data Controller upon request. The Data Processor may charge for audit-related work at the applicable hourly rates according to the Terms and Conditions.

2. The Data Processor will conduct internal security audits for relevant systems, and reports documenting these audits must be made available to the Data Controller upon request.

11. Liability

The liability terms set out in the Terms and Conditions also apply to any breaches of this Agreement.

12. Commencements and Termination

This Agreement enters into force at the same time as the Terms and Conditions and remains valid for as long as the Terms and Conditions is active.

13. Governing Law and Dispute Resolution

1. This Agreement shall be governed by and construed in accordance with the laws of Norway, without regard to its conflict of law principles.

2. Any dispute arising out of or in connection with this Agreement, including any question regarding its existence, validity or termination, shall be finally settled under the Rules of Arbitration of the International Chamber of Commerce (ICC) by one arbitrator appointed in accordance with said Rules. The seat of arbitration shall be London, England. The language of the arbitration shall be English.

Appendix A – Information about the processing

A.1. The purpose of the data processor's processing of personal data on behalf of the data controller is:

To provide the relevant and agreed services that the data controller has chosen in the Terms and Conditions. The data processor must not carry out any other processing than is necessary to fulfill these purposes.

A.2. The data processor's processing of personal data on behalf of the data controller shall mainly pertain to (the nature of the processing):

Providing the SaaS services, as described in the Terms and Conditions, including:

• collection (regarding appointment booking/registration, and when this is confirmed, a copy goes into the customer's journal in TIMIT platform),
• registration,
• storage (Interim storage of incomplete forms. Storage in the customer's record in TIMIT platform follows the patient record regulations)
• structuring
• organization in a database,
• adaptation or change
• retrieval,
• compilation,
• deletion or destruction (Registrants must have their data deleted within 30 days in Medibrix.app in accordance with the GDPR. Deletion in the customer's record in TIMIT platform follows the patient record regulations.)
• forwarding,
• analysis and dissemination,
• handover by transfer (According to consent or with authority in law or regulations
• exchange of information with authorities.

A.3. The processing includes the following types of personal data about data subjects:

The SaaS service includes a range of personal data such as:

• personal contact information - name, telephone number, e-mail address, physical address, etc.
• identification number, gender and GP
• work-related information – position/role, organisation, company, telephone number/e-mail/physical address for work
• payment information – credit card number, expiry date, CVV number, other cardholder information, financial transactions, recipient, account number, amount, date/time/place of purchase, etc.
• device information – brand and model, IP address, MAC address, serial number, location data (only anonymised personal data)
• profiling data – analyzes and reports on registered persons (only anonymised health and personal data)
• health information (special categories of personal information) as the service can also be linked to services that are subject to health legislation. This will depend on which services have been chosen by the data controller. For example for the Contact Lens Subscription service specifically, this includes contact lens prescription data such as sphere (SPH), cylinder (CYL), axis, base curve (BC), lens prescription, date of eye examination, and recommended lens types
• content of messages the user sends to/from the TIMIT platform.

A.4. The processing includes the following categories of data subject:

The service typically includes an individual who is an end customer or user of the data controller, typically patients, but may also include children/pupils, guardians/legal representatives and healthcare personnel and employees, former healthcare personnel/employees and relatives.

Appendix B – Authorised sub-processors

B.1. Approved sub-processors and geographical location

On commencement of the Clauses, the data controller authorises the engagement of the following sub-processors:

Service-specific data processors:

On commencement of the Clauses, the controller has approved the use of the above-mentioned sub-processors for the processing activity described above.

Appendix C – Instructions pertaining to the use of personal data

C.1. The subject of instruction

The processing as agreed in Appendices A and B.

C.2. Information security

The Data processor has the right and duty to make decisions about which technical and organizational security measures are to be implemented in order to establish the necessary (and agreed) security level. Safety measures are described below.

Technical measures

Organisational measures

Compliance and framework

Sub-processors and transfer basis