Data Processing Agreement

Version 1.1 – effective from 26 August 2026 Classification: Public

Medibrix AS, with registered address at Sjøgata 5, 9405 Harstad, Norway, and organization number 912 540 863 ("Medibrix" or "Data Processor") processes personal data on behalf of the Customer as specified in the Terms and Conditions or the TIMIT platform ("Data Controller").

Medibrix and the Data Controller are individually referred to as a "Party" and collectively as the "Parties".

1. Introduction

1. This Agreement sets out the rights and obligations of the Data Controller and the Data Processor when the Data Processor processes Personal Data on behalf of the Data Controller.

2. This Agreement is designed to ensure both Parties comply with the European Parliament and Council Regulation (EU) 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC ("GDPR").

3. In connection with the delivery of services agreed under the main agreement called the Terms and Conditions for the TIMIT platform (the "Terms and Conditions"), the Data Processor shall process Personal Data on behalf of the Data Controller in accordance with this Agreement. This Agreement applies exclusively to processing activities for which Medibrix acts as a Data Processor.

4. In the event of a conflict between this Agreement and any other agreement between the Parties relating to data processing, this Agreement shall prevail.

5. There are three appendices to this Agreement which form an integral part hereof:

   • Appendix A: Detailed information on the processing activities, including purpose, nature and types of Personal Data, categories of Data Subjects, and duration of processing.
   • Appendix B: Conditions for the use of Sub-Processors and the list of approved Sub-Processors.
   • Appendix C: The Data Controller's instructions for processing, minimum security measures to be implemented by the Data Processor, and procedures for audits.

6. This Agreement does not exempt the Data Processor from obligation imposed by the GDPR or other applicable data protection legislation.

2. Rights and obligations of the Data Controller

1. The Data Controller is responsible for ensuring that the processing of Personal Data complies with the GDPR principles of accountability and data protection, applicable data protection legislation and this Agreement.

2. The Data Controller shall determine the purposes of the processing and the means by which such processing is to be carried out.

3. The Data Controller is responsible for ensuring that there is a valid legal basis for the processing of Personal Data by the Data Processor in accordance with the Data Controller's instructions.

3. The Data Processor´s Obligation to Act on Instructions

1. The Data Processor shall only process Personal Data according to documented instructions from the Data Controller, unless otherwise required by applicable law. If the law requires the Data Processor to process data beyond these instructions, the Data Processor must inform the Data Controller, unless prohibited by law. The Data Controller may issue additional documented instructions at any time during processing.

2. If the Data Processor believes any instruction violates data protection laws or the GDPR, it must immediately notify the Data Controller.

4. Confidentiality

1. The Data Processor may only allow access to Personal Data to individuals under its authority who are required to follow instructions and are bound by confidentiality, either by contract or by law. Access must be limited to what is strictly necessary.

2. The data processor must be able to demonstrate, upon request, that all authorized individuals are subject to the required confidentiality obligation.

5. Security of Processing

1. Both the Data Controller and the Data Processor must implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk. This includes considering available technology, implementation costs, processing nature, and potential harm to individuals' rights and freedoms.

   Depending on relevance, such measures may include:

   a. Pseudonymisation and Encryption b. Maintaining confidentiality, integrity, availability and resilience of systems c. Restoring data access quickly in case of incidents d. Regular testing and evaluation of security measures.

2. The Data Processor must also independently assess the risks to individuals' rights and freedoms and implement relevant safeguards. The Data Controller must provide necessary information for this assessment.

3. The Data Processor must support the Data Controller´s compliance with its security obligations by providing details on existing safeguards and any other necessary information.

6. Use of Sub-Processors

1. The Data Processor may only engage another processor if certain conditions are met, including a written agreement ensuring equivalent data protection responsibilities.

2. Sub-Processors must be approved in writing by the Data Controller. General approval is given for those listed in Appendix B. Written agreements must be in place with sub-processors, ensuring they follow the same obligations as in this Agreement. The Data Processor remains fully responsible for Sub-Processors´ compliance.

3. If the Data Processor intends to appoint a new sub-processor, the Data Controller must be notified at least one month in advance. The Data Controller can object to the change within 15 days. If the Data Controller objects to the change, either party may terminate the agreement with 15 days' notice, within 5 days after the objection. If the Data Controller does not terminate the agreement, the new sub-processor is considered accepted.

4. A copy of the sub-processor agreement must be shared with the Data Controller upon request, excluding commercial terms not relevant to data protection.

5. If a Sub-Processor fails to meet its obligations, the Data Processor remains fully liable to the Data Controller in terms of fulfilling the Sub-Processor's obligations.

7. Transfers to Third Countries or International Organisations

1. The Data Processor may only transfer Personal Data to outside the EU/EEA with the controller's prior approval and in accordance with applicable safeguards, such as the EU's standard contractual clauses ("SCCs").

2. The Data Controller has approved transfers listed in Appendix B. SCCs have been entered into with relevant third-countries and updated in line with new EU rules.

3. The Sub-Processors who are domiciled in the USA are all registered under the Data Privacy Framework subject to an adequacy decision.

8. Assistance to the Data Controller

1. The Data Processor must assist the Data Controller, where possible, in responding to requests from individuals exercising their rights (such as access, rectification, deletion, etc.). This includes helping the Data Controller meet its information obligations, as well as honoring individual rights including objection, data portability, and protection against automated decision-making.

2. The data processor must also assist with:

   a. Reporting data breaches to the relevant data protection authority b. Notifying affected individuals of serious breaches c. Conducting data protection impact assessments d. Consulting authorities where high-risk processing cannot be mitigated.

3. The scope of technical and organizational measures for this assistance is detailed in Appendix C, including the level and type of support the Data Processor must provide.

9. Notification of Personal Data Breach

1. If a personal data breach occurs, the Data Processor must notify the Data Controller without undue delay after becoming aware of it.

2. This notification must be provided promptly so that the Data Controller can meet its obligation to report the breach to the data protection authority within the legally required timeframe.

3. The Data Processor must assist the Data Controller in preparing this report. This includes helping collect and provide the following information:

   a. A description of the nature of the breach, including, when possible, the categories and approximate number of individuals and records affected. b. Likely consequences of the breach c. Measures taken or proposed to address the breach and, if relevant, mitigate its harmful effects.

10. Erasure and Return of Data

1. Upon termination of the data processing services, the Data Processor will notify the Data Controller of the upcoming deletion of Personal Data at least 30 days in advance, in accordance with the Terms and Conditions. The Data Controller is solely responsible for exporting, or confirming retention of, any Personal Data it is required to retain under applicable law - including statutory requirements for retention of patient journal records - before deletion.

2. Upon expiry of the notice period, the Data Processor must delete or destroy all personal data in its possession or control - whether on computers, devices, or in other formats - unless required to retain it by law or unless it exists in system backups retained under standard IT procedures, in which case such backup copies shall be deleted or destroyed in accordance with the Data Processor's standard backup rotation and remain subject to the security measures and confidentiality obligations of this Agreement until then.

3. The Data Controller may request to transfer their data in Medibrix's standard electronic format. Data Processor's work in this connection can be invoiced at the Medibrix´s applicable hourly rates. Alternatively, if agreed in writing, Medibrix may store the data on behalf of the Data Controller for a fee. In that case, this Agreement's terms will continue to apply.

11. Audit and Inspection

1. The Data Controller may carry out an audit once per year to assess how the Data Processor handles Personal Data. The Data Processor must support the audit. The Data Controller may also request a third party security audit. A report of that audit will be shared with the Data Controller upon request. The Data Processor may charge for audit-related work at the applicable hourly rates according to the Terms and Conditions.

2. The Data Processor will conduct internal security audits for relevant systems, and reports documenting these audits must be made available to the Data Controller upon request.

12. Liability

The liability terms set out in the Terms and Conditions also apply to any breaches of this Agreement.

13. Commencements and Termination

This Agreement enters into force at the same time as the Terms and Conditions and remains valid for as long as the Terms and Conditions is active.

14. Governing Law and Dispute Resolution

1. This Agreement is governed by the laws of Norway, without regard to its conflict of law principles.

2. Any dispute arising out of or in connection with this Agreement shall be attempted resolved through negotiations between the Parties. If not resolved within thirty (30) days, either Party may bring the dispute before the ordinary courts, with Oslo District Court as agreed venue.

Appendix A – Information about the processing

A.1. The purpose of the data processor's processing of personal data on behalf of the data controller is:

To provide the relevant and agreed services that the data controller has chosen in the Terms and Conditions. The data processor must not carry out any other processing than is necessary to fulfill these purposes.

A.2. The data processor's processing of personal data on behalf of the data controller shall mainly pertain to (the nature of the processing):

Providing the SaaS services, as described in the Terms and Conditions, including:

• collection (regarding appointment booking/registration, and when this is confirmed, a copy goes into the customer's journal in TIMIT platform),
• registration,
• storage (Interim storage of incomplete forms. Storage in the customer's record in TIMIT platform follows the patient record regulations)
• structuring
• organization in a database,
• adaptation or change
• retrieval,
• compilation,
• deletion or destruction (Registrants must have their data deleted within 30 days in Medibrix.app in accordance with the GDPR. Deletion in the customer's record in TIMIT platform follows the patient record regulations.)
• forwarding (including forwarding of images, consents, and self-declarations between professional users for treatment approval, and related SMS notifications),
• analysis and dissemination,
• handover by transfer (According to consent or with authority in law or regulations
• exchange of information with authorities.

A.3. The processing includes the following types of personal data about data subjects:

The SaaS service includes a range of personal data such as:

• personal contact information - name, telephone number, e-mail address, physical address, etc.
• identification number, gender and GP
• work-related information – position/role, organisation, company, telephone number/e-mail/physical address for work
• payment information – credit card number, expiry date, CVV number, other cardholder information, financial transactions, recipient, account number, amount, date/time/place of purchase, etc.
• device information – brand and model, IP address, MAC address, serial number, location data (only anonymised personal data)
• profiling data – analyzes and reports on registered persons (only anonymised health and personal data)
• health information (special categories of personal information) as the service can also be linked to services that are subject to health legislation. This will depend on which services have been chosen by the data controller. For example for the Contact Lens Subscription service specifically, this includes contact lens prescription data such as sphere (SPH), cylinder (CYL), axis, base curve (BC), lens prescription, date of eye examination, and recommended lens types
• content of messages the user sends to/from the TIMIT platform.

A.4. The processing includes the following categories of data subject:

The service typically includes an individual who is an end customer or user of the data controller, typically patients, but may also include children/pupils, guardians/legal representatives and healthcare personnel and employees, former healthcare personnel/employees and relatives.

Appendix B – Authorised sub-processors

B.1. Approved sub-processors and geographical location

On commencement of the Clauses, the data controller authorises the engagement of the following sub-processors:

Service-specific data processors:

On commencement of the Clauses, the controller has approved the use of the above-mentioned sub-processors for the processing activity described above.

Appendix C – Instructions pertaining to the use of personal data

C.1. The subject of instruction

The processing as agreed in Appendices A and B.

C.2. Information security

The Data processor has the right and duty to make decisions about which technical and organizational security measures are to be implemented in order to establish the necessary (and agreed) security level. Safety measures are described below.

Technical measures

Organisational measures

Compliance and framework

Sub-processors and transfer basis

Terms and Conditions for the TIMIT Platform

Version 1.1 – effective from 26 August 2026 Classification: Public

I. Formation and Subscription

1. Introduction

Medibrix AS, with registered address at Sjøgata 5, 9405 Harstad, Norway, and organization number 912 540 863 ("Medibrix"), owns and operates TIMIT platform, an information and communication platform dedicated to the aesthetic treatment sector ("TIMIT platform"). The Customer gains access to the Platform on a subscription basis, in accordance with this Agreement.

TIMIT platform provides professional users (typically healthcare personnel) with access to the Platform through a common framework and user interface, developed and continuously evolved by Medibrix to facilitate efficient communication and information flow between professional users and end-users (patients/customers).

TIMIT platform is delivered as "Software as a Service" (SaaS) based on the Microsoft Azure platform and services. This means that TIMIT platform is web-based and operated and maintained by Medibrix.

2. Registration and Acceptance of Terms

The Customer registers for TIMIT platform by logging in via BankID and completing the registration process on the Website, providing the Customer's company name, organisation number, and contact e-mail address. Upon registration, the Customer confirms acceptance of this Agreement, including the Data Processing Agreement referred to and made available as a separate document, and the Price List, by clicking "I accept the terms of use of TIMIT platform and subscribe now" ("Acceptance").

By Acceptance, the Customer confirms that: (a) the person completing the registration has the authority to bind the Customer; (b) the information provided is correct; and (c) the Customer had the opportunity to review the Agreement, the Data Processing Agreement, and the Price List applicable at the time of registration.

Where the Customer continues as a paying Subscription, whether by clicking "Start subscription" or upon expiry of the Trial Period, the Customer shall additionally provide billing address, billing e-mail address (if different), and any invoice reference. This is a registration of additional information and does not require a new Acceptance.

The Agreement, including the Data Processing Agreement, comes into effect upon Acceptance - including for any Customer data the Customer registers in TIMIT platform during the Trial Period. No physical or digital signature is required, and no countersignature or confirmation from Medibrix is required for the Agreement to be binding.

The Customer and Medibrix are individually referred to as "Party" and collectively as "Parties".

3. TIMIT Platform and Services

Access to TIMIT platform is provided via the Website and can be accessed through a web browser. TIMIT is web-based and requires no installations at the Customer's end other than updated browsers of the types approved by Medibrix.

The Subscription gives the Customer's professional users access to the TIMIT platform's functionality for booking, treatment documentation, communication with end-users, and related administrative tools.

The Customer may activate digital forms ("Forms") as an additional service, enabling the Customer's professional users to collect structured information from end-users in connection with bookings or treatment. Forms are activated by the Customer in TIMIT platform and are invoiced in accordance with Invoicing.

The Customer may connect an unlimited number of Locations to its account in TIMIT platform. A Professional User may be granted access to more than one Location under the same Customer and switch between them within TIMIT platform. Where a Professional User also performs services for a different legal entity, that entity must separately register as a Customer and give its own Acceptance; such use falls outside this Agreement.

Support for the Customer's professional users is included in the Subscription; support for end-users is not included.

The Subscription Fee applicable to the Customer's number of professional users is set out in the Price List published on the Website, as updated from time to time in accordance with this Agreement. A Responsible Doctor is not counted as a professional user for purposes of the Subscription Fee, unless the Responsible Doctor also delivers or documents treatment services to End Users through TIMIT platform.

4. Trial Period

Upon Acceptance, the Customer is granted a fourteen (14)-day trial period, during which the Customer has free access to TIMIT platform ("Trial Period"). The Trial Period commences on the date of Acceptance. The remaining Trial Period is shown to the Customer at all times in the TIMIT platform dashboard.

If the Customer cancels before expiry of the Trial Period, access to TIMIT platform terminates at the end of the Trial Period, and no Subscription Fee is charged. Cancellation during the Trial Period does not require any notice period.

If the Customer does not cancel before expiry of the Trial Period, the Subscription automatically continues as a paid Subscription, and the first invoicing period begins on the day following expiry of the Trial Period, with the Subscription Fee for that period invoiced in arrears in accordance with Invoicing.

If the Customer has registered Customer data in TIMIT platform during the Trial Period and does not continue as a paying Subscription upon its expiry, the process set out in the Parties' Obligations upon Termination applies as if the Subscription had been terminated, with the expiry of the Trial Period as the starting point for the notice and deletion timeline.

II. Pricing and Payment

5. Invoicing

The Subscription Fee is invoiced to the Customer monthly in arrears, based on the number of active billable professional users during the preceding month and the applicable pricing tier set out in this Agreement ("Subscription Fee").

If the number of paying professional users changes during a month so that the Customer moves to a different pricing tier, the Subscription Fee for that month is calculated based on the number of professional users active during each part of the month.

The fee for Active Forms is invoiced monthly in arrears, based on the number of Forms that were in active use during the preceding month, at the price set out in the Price List.

All amounts set out in this Agreement are exclusive of value added tax (VAT), which shall be added in accordance with Applicable Law. The Customer shall pay each invoice within thirty (30) days of receipt.

Upon termination of the Agreement, the Customer shall pay the Subscription Fee for the period up to and including the effective date of termination.

6. Transaction Costs

Use of TIMIT platform entails transaction costs associated with communication and login, invoiced monthly in arrears.

Communication with end-users primarily takes place via SMS, but other communication methods (such as e-mail or push notifications) may also be used. Communication is billed regardless of which method is used.

The TIMIT platform includes standard notification functionality that generates communication, such as booking confirmations and cancellation/rebooking notices in connection with appointments. These notifications result in transactions incurring costs as described below.

The TIMIT platform uses a standard SMS setup provided by a third party, which has conditions related to SMS length and the use of special characters. A message text typically consists of predefined text along with text added by the professional user. If long message texts or special characters (e.g., symbols and emojis) are used, it may be necessary to send the message as multiple message segments. Each message segment is billed according to the Price List. For e-mail or push notifications, there are no restrictions on the number of characters, and each message is considered a single message segment.

The Customer must always use messages with login invitations, as the entry point to TIMIT platform for end-users. An end-user is defined as a patient or customer using Customers services.

Medibrix may update the Price List for transaction costs when Medibrix's own costs from third-party providers (e.g. SMS or BankID providers) change, with at least one (1) month's written notice to the Customer before the adjusted price takes effect. Notice is given to the Customer through the invoice preceding the effective date of the update, showing the Customer's applicable transaction costs under the updated Price List. Such invoice notice constitutes the written notice required.

7. Price Adjustment

The Subscription Fee is fixed for the first twelve (12) months from the date of Acceptace. After the expiry of this period, Medibrix may update the Price List, thereby adjusting the Subscription Fee, by giving the Customer at least one (1) month's written notice before the adjusted price takes effect. Notice is given to the Customer through the invoice preceding the effective date of the update, showing the Customer's applicable Subscription Fee under the updated Price List. Such invoice notice constitutes the written notice required.

If the Customer does not accept the adjusted Subscription Fee, the Customer may terminate the Subscription before the adjusted price takes effect.

8. Payment Default and Late Payment Interest

If the Customer fails to pay by the due date, Medibrix is entitled to interest on the overdue amount from the first day of delayed payment, in accordance with Applicable Law on payment of debts. If the overdue amount, plus late payment interest, is not paid within forty-five (45) calendar days after the due date of Medibrix's invoice, Medibrix may send the Customer written notice that the Agreement may be terminated in whole or in part due to the Customer's default, unless payment is made within thirty (30) calendar days after receiving the notice. Termination for payment default shall not occur if the Customer pays the overdue amount, plus late payment interest, before the deadline expires.

III. Use of the TIMIT Platform

9. Account Administration and Communication Channels

The Customer is provided with access to an admin console for managing access to the TIMIT platform.

The Customer is responsible for safeguarding the password and other credentials used to access the TIMIT platform. Usernames, passwords, or other credentials shall not be shared with third parties.

The Customer is responsible for any activity on the account and for any use of the Customer's username, password, or other credentials.

Medibrix may communicate with the Customer through TIMIT platform, via the Customer's registered contact e-mail address, or via other electronic channels communicated by Medibrix. All information and notifications communicated through such channels shall be considered known to the Customer; however, in the case of termination of the Agreement or notice of breach, Medibrix shall use e-mail.

10. Usage Rights and Limitations

The Customer is granted a non-exclusive, payable, non-sublicensable, non-transferable right to use TIMIT platform during the Subscription period, in accordance with this Agreement.

The Customer's use of TIMIT platform is limited to the Customer's ordinary business activities in the country where the Customer is established, and to the Customer's own use. This does not include commercializing as TIMIT platform.

The Customer shall not sublicense or transfer the rights granted under this Agreement, and gains no rights to any intellectual property held by Medibrix or its licensors beyond what is expressly stated herein. The Customer has no right to access executable code or source code for TIMIT platform, and only gains access to TIMIT platform as a software-as-a-service through designated interfaces.

The Customer shall not, and shall not allow others to:

a) modify, adapt, translate, reverse engineer, decompile, or disassemble TIMIT platform, or attempt to discover its source code, underlying ideas, algorithms, or file formats; or

b) create derivative works of, reproduce, distribute, sell, or resell TIMIT platform or other Medibrix technology; or

c) use information received from Medibrix regarding TIMIT platform to develop, integrate, market, license, distribute, or host a competing product or service.

11. Functionality and Availability (SLA)

TIMIT platform is available for use 24/7 throughout the year. However, Medibrix cannot guarantee continuous availability and reserves the right to perform necessary maintenance and upgrades, as well as temporarily take down the platform if required. Planned changes/upgrades and maintenance will be notified via the Website and/or via email to the Customer's contact person in case of significant changes. The Customer cannot object to service interruptions as a result of planned upgrades.

12. Acceptable Use

The Customer is responsible for its use of TIMIT platform, its Customer Data, and its communication with others through the platform. The Customer shall: (a) use TIMIT platform only in accordance with Applicable Law; (b) not disrupt normal use of TIMIT platform or attempt to access it other than through the designated interfaces; (c) not circumvent or attempt to circumvent any limitations Medibrix applies to the Customer's account; (d) not investigate, scan, or test the vulnerability of TIMIT platform or systems used to deliver it, without Medibrix´s prior written consent; and (e) not contribute to undue or excessive use of TIMIT platform that negatively affects its speed, response, stability, availability, or functionality for other users. Medibrix will endeavor to notify the Customer of such use before taking further action.

13. Customer Responsibility for Treatment and Regulatory Compliance

Medibrix is not responsible for the Customer's use of TIMIT platform, the Customer's underlying services delivered to end-users, or the Customer's marketing of such services. The Customer is fully responsible for these matters.

Medibrix is not responsible for the accuracy or completeness of information submitted by an End User through TIMIT platform, or for documentation generated on the basis of such information. The Customer is responsible for ensuring that these are conducted in accordance with Applicable Law.

Medibrix does not verify that the Customer's professional users hold the professional qualifications, authorizations, or approvals required under Applicable Law to perform the treatments they offer through TIMIT platform, including any required prior approval of a treatment by another qualified person. The Customer is solely responsible for ensuring that its professional users are duly qualified and authorized, and that all regulatory approvals required for a given treatment have been obtained before the treatment is performed or documented in TIMIT platform.

14. Open Source and Third-Party License Term

The TIMIT platform may be based on open source or third-party licensed software. Relevant open-source licenses and other third-party licenses are published in the TIMIT platform. The Customer shall comply with the terms of any applicable third-party licenses.

15. Changes to the Platform and SLA

Medibrix has the right to make commercially reasonable changes to the TIMIT platform and SLA from time to time. TIMIT platform is developed dynamically, and new features will always be available to the Customer as part of the Subscription. New services may also be developed; these are not included in the Subscription but can be activated as additional services under the Subscription.

Medibrix shall provide written notice if Medibrix intends to (a) terminate or (b) make backward incompatible changes to the functionality of TIMIT platform. Such changes will be notified through TIMIT platform.

Medibrix shall reasonably endeavor to continue the functionality of TIMIT platform without such changes for at least three (3) months after the notice, unless: (a) the change is required due to Applicable Law and cannot be postponed without violating the law; (b) continued operation of the TIMIT platform poses a security risk; or (c) Customer-specific features are replaced by functionally equivalent standard features.

16. Changes to Agreement Terms

Medibrix reserves the right to unilaterally adopt changes to this Agreement. Significant changes unfavorable to the Customer and not resulting from Applicable Law require the Customer's acceptance through a renewed click-to-accept upon the Customer's next login, and take effect from the date of such acceptance.

If the Customer does not accept such a change within thirty (30) days of Medibrix's notice, or considers the change to be a significant change unfavorable to the Customer, the Customer may terminate the Subscription in accordance with this Agreement before the change takes effect.

If the Customer neither accepts nor terminates the Subscription within the notice period referred to above, the Customer's continued use of TIMIT platform after expiry of that period constitutes acceptance of the change. Medibrix may, in addition, require the Customer to actively accept or decline the change upon next login before further use of TIMIT platform.

Other changes to this Agreement are communicated through TIMIT platform and take effect as stated in the notice.

IV. Liability and Risk

17. Delivery Responsibility

Medibrix shall deliver TIMIT platform in accordance with generally accepted professional standards. The Customer accepts that the TIMIT platform may have errors, and unless otherwise agreed in a writing, TIMIT platform and associated services are provided "as is." Medibrix does not warrant that the TIMIT platform is error-free.

Medibrix notes that telecommunications operators assume that approx. 0.5% of SMS may never reach their destination. Medibrix is not responsible for this or other errors in the telecommunication services of its subcontractors.

If the TIMIT platform is not delivered in accordance with the above, and Medibrix does not remedy the breach, the Customer may terminate the Agreement in accordance with Termination for Cause, but only if the breach is material.

18. IPR

Medibrix, or the relevant third-party licensor, is and shall remain the owner of TIMIT platform and all technology used to make it available to the Customer.

Each Party is and remains the owner of its own Background IPR, and this Agreement does not affect such ownership. No rights to the other Party's Background IPR are acquired under the Agreement unless expressly agreed in writing.

Medibrix, or the relevant third-party licensor, shall be and remain the sole owner of all Improvements and all IPR related to TIMIT platform, regardless of any contributions from the Customer. Medibrix has the right to use and commercialize any Improvements at its discretion and without any restrictions.

19. Customer Data

Unless otherwise agreed, the Customer retains ownership of Customer Data. Except as stated in this Section, Medibrix shall not use Customer Data for any purpose other than fulfilling Medibrix's obligations to the Customer and/or Applicable Law.

Medibrix is responsible for an ongoing assessment of information security and shall treat all information in accordance with Applicable Law, including applicable requirements for information security in connection with the processing of health data.

To allow Medibrix to continue developing the TIMIT platform, the Customer grants Medibrix a gratuitous, royalty-free, sublicensable license to use anonymized Customer Data during the Subscription period for product development purposes, including training algorithms on anonymized Customer Data.

Medibrix is the data processor for patient and personal information registered by the Customer in TIMIT platform. Medibrix is the data controller for personal data processed through functionality delivered directly to End Users and for processing based on the End User's explicit consent. The Data Processing Agreement applies to Medibrix's processing as data processor, and Medibrix's privacy notice applies to Medibrix's processing as data controller.

Medibrix' privacy notice is available on the Website and describes Medibrix's processing of personal information as data controller. The Customer is responsible for reviewing the privacy notice and informing Medibrix if it needs to be expanded or changed as a result of the Customer's processing of personal information.

20. IPR Indemnification

Medibrix shall indemnify the Customer against any third-party claim that the Customer's use of the TIMIT platform in accordance with this Agreement infringes such third-party Intellectual Property Rights (IPR), provided that Medibrix is promptly given full control over the defense of the claim and the Customer does not prejudice that defense. The Customer shall reasonably assist Medibrix in handling the claim. Indemnification does not apply if the claim arises from the Customer's use of TIMIT platform other than in accordance with this Agreement.

To avoid or remedy an infringement, Medibrix may, at its discretion, replace or modify TIMIT platform, provide an equivalent non-infringing solution, or make TIMIT platform unavailable to the Customer, including by suspending the Customer's access.

If Medibrix does not resolve the infringement or provide an equally effective solution within a reasonable time, the Customer may terminate the Agreement in accordance with Termination for Cause and claim compensation within the limits of Limitation of Liability. Beyond this, Medibrix has no liability to the Customer for infringement of third-party IPR.

21. Handling of Indemnified Claims

A Party shall promptly notify the other Party of any claim covered by the other Party's duty to indemnify. Where possible, the indemnifying Party shall take over the defense of the claim, and the Parties shall provide each other with the information and assistance reasonably necessary. The indemnified Party shall not settle or otherwise dispose of the claim without the indemnifying Party's written consent.

22. Limitation of Liability

Neither Party is liable to the other for indirect loss or consequential loss, including but not limited to loss of production, revenue, income, expected cost savings, loss or destruction of Customer Data, third-party claims, or loss of profit.

Each Party's total liability arising from or in connection with this Agreement shall not exceed an amount equal to twelve (12) months' Subscription Fee paid by the Customer, excluding transaction costs and VAT. This cap is cumulative per 12-month period, not per event.

The limitations in this Section do not apply to (a) the Customer's payment obligations, (b) a Party's indemnification obligations under this Section or under Parties' Obligations upon Termination, or (c) loss caused by gross negligence or willful misconduct.

23. Confidentiality

Each Party shall keep confidential all information received from the other Party that is marked as confidential or that, by its nature, should reasonably be understood to be confidential ("Confidential Information"), and shall not disclose it to third parties or use it for any purpose other than to fulfil this Agreement.

The confidentiality obligation does not apply to information that: (a) was already lawfully known by the receiving Party without a confidentiality obligation; (b) is or becomes publicly available other than through breach of this Section; (c) is received from a third party without breach of any confidentiality obligation; or (d) must be disclosed pursuant to Applicable Law, in which case only the portion required shall be disclosed.

Medibrix may disclose Confidential Information to subcontractors and third parties to the extent necessary to fulfil this Agreement, provided such third party is bound by confidentiality obligation at least as strict as those in this Section.

Each Party shall ensure that Confidential Information is handled securely, including that electronically stored information is inaccessible to unauthorized individuals.

The confidentiality obligation survives termination of this Agreement for ten (10) years, and indefinitely for Confidential Information constituting personal data or trade secrets.

24. Compliance with Applicable Law

Each Party shall comply with Applicable Law and any decisions from competent authorities, both generally and in connection with this Agreement.

Each Party shall ensure that taxes and fees are paid in accordance with Applicable Law and shall not, directly or indirectly, for its own part or on behalf of others: (a) provide, offer, request, or accept any undue advantage in connection with the performance of an office, position, or assignment; or (b) provide, offer, request, or accept any undue advantage with the purpose of influencing such performance.

V. Termination

25. Subscription Period and Termination

Following expiry of the Trial Period, the Subscription continues automatically as a paid Subscription for an indefinite period, with no minimum term.

The Customer may terminate the Subscription at any time, with three (3) months' notice, either through the cancellation function in TIMIT platform or by written notice to Medibrix sent by e-mail to contact@medibrix.com. Medibrix may terminate the Subscription by written notice to the Customer on the same notice period.

The notice period runs from the end of the calendar month in which notice is given, and the Subscription terminates at the end of the third subsequent calendar month, consistent with the monthly invoicing of the Subscription Fee.

The Customer remains liable for the Subscription Fee and any transaction costs incurred up to and including the last calendar month of the Subscription. Upon termination, the deletion and export process set out in Parties' Obligations upon Termination applies.

26. Termination for Cause

Either Party may terminate the Agreement by written notice if the other Party materially breaches the Agreement and fails to remedy the breach within thirty (30) calendar days after written notice describing the breach and stating that termination may follow.

The following shall always be deemed a material breach by the Customer, without limiting what else may constitute a material breach: (a) a failure to pay any due and undisputed amount within thirty (30) calendar days after written notice that payment is overdue, in accordance with Payment Default and Late Payment Interest; (b) breach of the Acceptable Use provisions of this Agreement; (c) the Customer shares, or through gross negligence allows unauthorized third parties to obtain, BankID credentials, login details, or platform access; (d) breach of the Data Processing Agreement; or (e) providing materially false information at registration or Acceptance.

A breach by Medibrix is material if it substantially deprives the Customer of the benefit the Customer was entitled to expect under the Agreement, such as an uncured failure to deliver TIMIT platform in accordance with Delivery Responsibility.

If a material breach by the Customer cannot be remedied, Medibrix may terminate with immediate effect. Either Party may also terminate with immediate effect if debt negotiations, composition, bankruptcy, or other creditor control proceedings are initiated against the other Party, provided this is not contrary to mandatory law.

Termination is ex nunc; he Customer shall only be liable for the Subscription Fee and transaction costs for the period up to and including the effective date of termination. This limitation of liability for the period after termination is the Customer's sole remedy for the breach giving rise to termination, without prejudice to Limitation of Liability; no liability arises for transaction costs, set-up fees, or other one-time charges.

27. Parties' Obligations upon Termination

Upon termination of the Subscription - including where the Customer does not continue as a paying Subscription upon expiry of the Trial Period after having registered Customer data in TIMIT platform - Medibrix will notify the Customer that Customer Data will be deleted from TIMIT platform.

The Customer is solely responsible for ensuring that any statutory retention requirements applicable to the Customer's business - including, but not limited to, requirements under the Applicable Law regarding retention of patient journal records, including data relating to approval of treatment - are complied with before Customer Data is deleted.

Before deletion, the Customer may, in TIMIT platform: (a) export the Customer Data the Customer is required to retain; or (b) confirm that the relevant patient data is already documented in the Customer's primary patient journal system outside TIMIT platform, and that export is therefore not required.

Medibrix will notify the Customer of the upcoming deletion at least 30 days in advance through TIMIT platform and/or by e-mail to the Customer's registered contact address. If the Customer takes no action in accordance with (a) or (b) above before the notified deletion date, Customer Data is deleted automatically.

Medibrix reserves the right to delete Customer Data at any time after the notice period referred to above has expired, but is not obliged to delete Customer Data on a specific date.

Medibrix has no obligation to retain, export, or otherwise preserve Customer Data after deletion in accordance with this Section. Medibrix's deletion of Customer Data does not relieve the Customer of any statutory obligation to retain such data, and the Customer shall hold Medibrix harmless from any claim arising from the Customer's failure to export or retain data as required by applicable law.

VI. Final Provisions

28. Governing Law and Dispute Resolution

This Agreement is governed by the laws of Norway, without regard to its conflict of law principles.

Any dispute arising out of or in connection with this Agreement shall be attempted resolved through negotiations between the Parties. If not resolved within thirty (30) days, either Party may bring the dispute before the ordinary courts, with Oslo District Court as agreed venue.

29. Assignment and Subcontractors

Neither Party may transfer this Agreement without the other Party's written consent, which shall not be unreasonably withheld or delayed. Medibrix may transfer this Agreement to any company that directly or indirectly controls, is controlled by, or is under common control with Medibrix, without the Customer's consent.

Medibrix has the right to use subcontractors and is responsible for their performance as for its own.

30. Reference Rights

Medibrix may refer to the Customer as a user of TIMIT platform in its marketing, including using the Customer's company name and logo for this purpose, unless the Customer objects in writing.

31. Force Majeure

If an extraordinary situation beyond a Party's control makes it impossible to fulfil its obligations under this Agreement — including war, strike, lockout, riot, epidemic, pandemic, or natural disaster — the affected Party shall notify the other Party as soon as reasonably possible, and its obligations are suspended for the duration of the event. The Customer cannot invoke force majeure as a basis for not paying amounts due, except where the force majeure affects payment systems.

Each Party shall keep the other Party informed of the actual and potential effects of the event, steps taken to mitigate it, and its expected duration.

Either Party may terminate the Agreement if the force majeure event lasts, or is expected to last, more than ninety (90) calendar days, with fifteen (15) calendar days' written notice. Each Party bears its own costs of such termination, and neither Party may claim compensation from the other as a result.

32. Integration Clause

The Agreement, together with the Data Processing Agreement, constitutes the entire agreement between Medibrix and the Customer regarding the Subscription, and supersedes any prior or contemporaneous agreements or understandings, written or oral, on the same subject. Although the Data Processing Agreement is made available as a separate document, it forms an integral and binding part of this Agreement.

VII. Definitions

"Acceptance" means the Customer's electronic acceptance of this Agreement and the Data Processing Agreement, given by logging in via BankID and clicking the button confirming acceptance of the terms of use of TIMIT and subscription to the Subscription.

"Active Form" means a Form that has been used at least once by the Customer's professional users during a given calendar month.

"Agreement" means these Terms and Conditions together with the Data Processing Agreement and the Price List referred to herein.

"Applicable Law" means all current laws, regulations, requirements, or ordinances issued by a public authority with legal authority to exercise legislative, judicial, regulatory, or administrative functions, as amended, supplemented, or replaced from time to time.

"Background IPR" means any IPR that a Party has created or otherwise acquired prior to or independently of the Agreement.

"Confidential Information" means all information exchanged between the Parties that can reasonably be considered proprietary or confidential, whether marked as such or not, including but not limited to procedures, documentation, technical data, software, source code, and pricing information.

"Customer" means the legal entity that completes registration and gives Acceptance, as identified by the company name and organisation number provided during registration.

"Customer Data" means all data provided to or registered in TIMIT platform by or on behalf of the Customer, including personal data and health data.

"Data Controller" and "Data Processor" have the meaning set out in Applicable Law on the protection of personal data.

"Data Processing Agreement" means the agreement between Medibrix, as data processor, and the Customer, as data controller, governing Medibrix's processing of personal and health data on behalf of the Customer in connection with the Subscription. The Data Processing Agreement is made available as a separate document and forms an integral and binding part of the Agreement, entered into together with, and on the same terms as, the Customer's Acceptance.

"End User" means a patient or customer receiving treatment services from the Customer's professional users.

"Improvements" means any modifications, enhancements, or further development of TIMIT platform or other services provided under this Agreement.

"IPR" means intellectual property rights of any kind that exist now or in the future anywhere in the world, whether registered or not, and all applications, renewals, and extensions thereof, including but not limited to patents, trademarks, design rights, copyright, database rights, logos, business names, domain names, goodwill, know-how, trade secrets, and other protected material in any form, including rights in inventions, technology, data, algorithms, and computer programs.

"Location" means a clinic or physical/organizational unit operated by the Customer and connected to the Customer's account in TIMIT platform. All Locations connected to the same Customer are covered by the same Subscription and this Agreement.

"Price List" means the price list for the Subscription Fee and transaction costs, published ont the Website, as updated by Medibrix from time to time.

"Professional User" means an individual authorized by the Customer to use TIMIT platform to deliver or document treatment services to End Users.

"Responsible Doctor" means a Professional User whose use of TIMIT platform is limited to reviewing and approving treatments on referral from another Professional User, without independently delivering or documenting treatment services to End Users.

"SLA" means Medibrix's service level commitment regarding the availability of TIMIT platform.

"Subscription" means the right to access and use TIMIT platform in accordance with this Agreement.

"Subscription Fee" means the recurring monthly fee for the Subscription, as set out in the Price List.

"Trial Period" means the fourteen (14) day period of free access to TIMIT platform granted to the Customer immediately following Acceptance, during which no Subscription Fee is charged and no notice period applies for cancellation.

"Website" means the domain through which the Customer accesses TIMIT platform and related information, currently https://timit.com, as updated by Medibrix from time to time.