iNuba CLINIC TERMS AND CONDITIONS

Version 1.7 · In force from: 20 July 2026 · Version history

Preliminary

By accessing the iNuba Clinic platform (hereinafter, the "Platform"), the Professional accepts, in its own name and in the name of the Customer on whose behalf it acts, these Terms and Conditions ("Terms and Conditions") and undertakes to use the services offered and the contents hosted therein in accordance with these Terms and Conditions and under its sole and exclusive responsibility.

The Terms and Conditions shall apply irrespective of the general and specific terms and conditions which may, where applicable, be binding when contracting any of the services offered by iNuba through the Platform.

These Terms and Conditions, together with their Annex 1 (Data Processing Agreement) and, for Customers contracting that mode, their Annex B (White Label Specific Conditions), shall be permanently available through the Platform and at inuba.com/legal/clinic. They have been drafted in Spanish, and therefore, in the event of any contradiction with any of their translations, the Spanish version shall always prevail.

The electronic acceptance of this document (registration checkboxes, re-acceptance screen or contracting from the website) is recorded in a verifiable and immutable manner, stating the date, the version and digital fingerprint of the document, the IP address and the device, and is binding on the Customer and on the accepting Professional. When iNuba publishes a new version, its re-acceptance will be requested by means of a mandatory screen after a courtesy period (by default, seven (7) days); once that period has elapsed, access will be conditional upon acceptance of the version in force.

iNuba reserves the right to deny or withdraw access to the Platform, at any time, to Professionals or Customers who breach the Terms and Conditions applicable at any given time.

1. Definitions

iNuba: owner of the Platform, with corporate name 3DHealthAI, S.L., NIF B-40644445, registered office at Polígono Industrial Los Vientos, C/ Levante, 1, 46119 Náquera (Valencia), Spain, and contact email address info@inuba.com, registered with the Registro Mercantil de Valencia.

Platform: digital environment based on a web platform, provided by iNuba so that the Customer and its Professionals may provide their health monitoring, follow-up and management services to their End Users.

Customer (or Company): the healthcare professional or health sector entity that contracts the Platform and under whose company account the use of the Platform is organised.

Account Holder (or Owner): the Professional holding the owner role of the Customer's company account, solely entitled to contracting, plan changes, pausing and cancelling the account.

Professional: any natural person who, on behalf of the Customer, uses the Platform to work (irrespective of their role: administration, management, secretarial or care roles). The Professional is not the Customer, without prejudice to the Account Holder meeting both conditions.

End User: natural person using the iNuba App who is linked to the Customer, irrespective of the means of access. Any reference in this document to "patient" or "App user" shall be understood as a reference to the End User.

Contact: End User registered by the Customer in respect of whom the Professionals have no access to clinical data or private chat, in accordance with clause 7.2.

Service: all the services carried out through the Platform by iNuba.

iNubaShop: shop module of the Platform through which the Customer sells products and services to its End Users and through which iNuba may distribute its own products.

White Label Mode: contracting mode whereby the Customer distributes the iNuba App under its own brand among its clients, in accordance with the specific conditions of Annex B.

White Label App: the iNuba App customised with the Customer's brand, the ownership, infrastructure, database and provision of the service of which correspond exclusively to iNuba.

Access API: technical interface provided by iNuba through which the White Label Mode Customer communicates the registrations of its clients and their access status.

Parties: iNuba and the Customer (including its Account Holder and its Professionals).

2. Ownership of the Platform

The Platform belongs to 3DHealthAI, S.L., with NIF B-40644445 and registered office at Polígono Industrial Los Vientos, C/ Levante, 1, 46119 Náquera (Valencia), Spain, registered with the Registro Mercantil de Valencia (hereinafter, "iNuba"), as a provider of information society services within the meaning of Ley 34/2002, of 11 July, on information society services and electronic commerce. Contact: info@inuba.com.

3. Identification of the Parties

The Terms and Conditions are entered into, on the one hand, by iNuba and, on the other hand, by the Customer. The Customer's Professionals who register on the Platform may also be a Party. Hereinafter, jointly, the "Parties".

4. Purpose and scope of application

These Terms and Conditions govern access to, browsing of and use of the Platform and access to the Services offered through it. Access to certain Services may be subject to specific conditions which shall replace, supplement and/or amend these Terms and Conditions.

The Platform is a management tool: it does not provide healthcare services nor does it replace the clinical judgement of the Customer, who declares that it holds the legal authorisation required for its activity.

The Customer may additionally contract the White Label Mode (distribution of the iNuba App under its own brand), which is governed by the specific conditions of Annex B, registration on the Platform and acceptance of this document being the sole and standardised channel for contracting that mode, irrespective of the extent to which the Customer uses the other functionalities of the Platform.

5. Roles

There are different types of participants according to their relationship with the Platform, in accordance with the terminology used in the software itself:

In any event, the Account Holder and each Professional undertake to: (i) acknowledge that they are of legal age and hold the necessary legal capacity; (ii) provide only truthful, accurate and complete data regarding their identity and legitimacy; and (iii) accept the responsibility incumbent upon them as to the authenticity and validity of such data. iNuba does not verify the professional status (professional association membership) of the Professionals. Where false, inaccurate or incomplete data are provided, or where there are well-founded reasons to doubt their truthfulness, present or future access to the Platform may be denied.

6. Registration process and access to the Platform

6.1. Direct registration

Registration requires a name, email address and password (a minimum of eight (8) characters with a lower-case letter, an upper-case letter and a number or symbol), as well as acceptance, by means of specific checkboxes, of these Terms and Conditions, of the Privacy Policy and of the data processing regime of Annex 1. The email address is verified by means of a six (6) digit code; without verification it is not possible to log in. Upon registration, the Customer's company account is created automatically. The tax details (corporate name, NIF/CIF, address and billing email address) are completed under User → Billing before contracting the subscription.

6.2. Contracting from the website (guest checkout)

The Platform may be contracted from the public website by providing an email address and a name and expressly accepting the conditions; the account is created when payment is confirmed and the acceptance is recorded.

6.3. Registration through an authorised distributor

Registration may originate through an authorised distributor, which communicates the Account Holder's contact details to iNuba; in such a case the plan and the trial period limits may differ from the standard ones.

These processes may be modified over time, the above instructions being indicative. Queries: support@inuba.com.

7. Platform functionalities

In general terms, the Platform has different functionalities aimed at offering the Customer and its Professionals a comprehensive service for the management, monitoring and control of the health of their End Users. These functionalities may vary over time, so they are merely illustrative and not limiting, and their availability may depend on the plan contracted and on the Professional's role.

7.1. Home dashboard and statistics

Home dashboard with the relevant activity of the account and aggregated statistics dashboards referring exclusively to the End Users of the Customer's own company (distribution, alerts, plans, most frequent treatments, among others).

7.2. End Users and Contacts

The Professional may invite End Users (who accept the linking by means of a link sent to their email address), import and invite Contacts by email, consult their record and history, edit them, reassign them within the company or unlink them. The Platform distinguishes between clinic clients (Professional's access to the full set of clinical data) and Contacts (without access to clinical data or private chat until their conversion into a client). The Customer warrants that it has a legal basis for providing the contact details of the persons it invites or imports.

The Professional may upload files to the End User's profile, with a title, category and tags, warranting that they have authorisation from the data subject and that the content complies with the applicable regulations; iNuba is not liable for the truthfulness or content of the documents uploaded. It is prohibited to upload files unrelated to the Services, files that infringe third-party rights or that contain illegal or offensive material. When an End User ceases to be assigned to the Professional, the latter shall no longer have access to their information, which shall remain blocked and shall only be accessible in the event of a request from a competent authority, upon prior notice to iNuba by means of audited access.

7.3. Clinical record and history of the End User

Structured clinical record (medical background, allergies, medication, observations and source), health monitor with the End User's metrics and biomarkers, iNubaBox/Totem booth data, 3D avatar and thermography (in read-only mode), synchronisation of wearable data, and activity history of the End User indicating what was done, who did it (the End User, a Professional or the system) and the origin of the data (App, wearable, booth or clinic).

7.4. Questionnaires and forms

Creation, editing and assignment of questionnaires and forms to End Users, with consultation of their status (pending, in progress, completed or cancelled), of the individual responses and of the aggregated statistics.

7.5. Parameters, alerts and scheduled measurements

Recording and display of the End User's health parameters, configuration of alerts for out-of-range parameters (based on rules by age and configurable ranges, without automated decisions producing legal effects) and scheduling of periodic measurements that the End User must complete.

7.6. Treatments

Prescription and follow-up of treatments (dosage, frequency, dates) with assessment of the End User's adherence (doses taken, missed or taken late) and associated reminders.

7.7. Programmes and plans

Creation and assignment of personalised programmes and plans (nutrition, training, wellness), with content nodes, questionnaires and parameters, progress monitoring and synchronisation with the End User's App. The number of active programmes may be limited by plan.

7.8. Segments

Creation of segments of End Users by means of filters, for the organisation of the care activity of the Customer's own company.

7.9. Educational content

Assignment of educational content to End Users with monitoring of their progress.

7.10. Follow-up tasks

Creation of follow-up tasks linked to End Users, indicating the intended follow-up channel.

7.11. Reports

Consultation of the End User's reports (general, thermography and symmetry alarms) on the Platform.

7.12. Calendar, appointments, classes and session passes

Calendar management with configurable booking and cancellation policies (minimum notice, limit on active class bookings, auto-confirmation, confirmation by the End User themselves and reminders), in-person or online appointments with clinical notes and session reports, prerequisites per appointment (questionnaires, measurements, photographs and signature of informed consent with a digitised handwritten signature), classes with attendance control, session passes with redemption control, penalties for non-attendance (consumption of the pass and temporary blocking of bookings in accordance with the policy defined by the Customer, which must be lawful, proportionate and notified to the End User before booking) and waiting lists (name and telephone number).

Library of the clinic's consent templates (general, surgical, aesthetic, for minors and GDPR), with system templates and own templates, the signature of which may be required before each appointment, the signed document being archived and dated. These tools do not replace the Customer's responsibility to obtain the consents required by its activity.

7.14. Chat

Real-time messaging between the Customer/its Professionals and the End User, with attachments, the messages of which are stored on the Platform and classified according to the sender (automatic messages from the clinic, a specific Professional or the End User themselves). Contacts have only the general channel of the clinic available. The chat must not be used for emergencies; its clinical content forms part of the End User's documentation.

7.15. Video calls (Google Meet)

If the Customer connects its Google account, the Platform automatically creates the calendar event with a Meet link for online appointments and classes; alternatively, the Professional may provide their own link. The title of the service and the schedule are communicated to Google, under the Customer's Google account; the Platform does not currently communicate the End User's name or email address, nor does it record the video calls. The use of Meet is governed by Google's terms.

7.16. Notifications to the End User

The Platform sends to the End User's App operational and care notifications arising from the Customer's activity (chat, reports, files, clinical notices, questionnaires, appointments, payments, session passes, treatment reminders and shop promotions, the latter being subject to the End User's marketing consent).

7.17. iNubaShop

Shop module governed by clause 9.

7.18. Team, roles and licences

Role-based access control with differentiated permissions: the administration and management roles access the End Users of the entire company; the care roles (nutrition, training, health/clinical) access the End Users of the company or only those assigned to them, according to the configuration established by the Customer itself for each Professional; the secretarial role accesses the company's calendar and appointments without clinical data. The number of registered Professionals is limited in accordance with the plan contracted; where the plan has expired, access to the functionalities is blocked. The Customer shall assign the roles in accordance with the principle of least privilege and shall revoke the access of departed staff; the deregistration of a Professional revokes their access immediately and reassigns their End Users to the Account Holder, the data they entered remaining in the company account.

7.19. WhatsApp support

The Platform incorporates a help button that opens WhatsApp with a predefined message to iNuba support; its use entails the processing of the communication by Meta in accordance with its terms. The Professional shall refrain from including End User data in that channel. There is no WhatsApp messaging integration with End Users; its possible future activation will be notified and documented in advance.

Billing section of the account (plan, seats, tax details, payment portal) and legal centre with the legal documents in force and the history of the Professional's consents and acceptances.

8. Plans

The Platform has three distinct plans: Basic, Pro and Platinum, on a monthly or annual basis (the latter with a discount), with tiered prices according to the number of clients contracted and the limits published during the contracting process (number of professionals, storage, clients, active programmes and shop products).

Trial period: seven (7) days from registration, with no card required, with the configuration indicated at registration. Once the trial period ends without contracting, access to the Platform is blocked, without any automatic charge.

Contacts add-on: optional module with its own independent subscription (contracting, change, cancellation and reactivation separate from the main plan). Contacts do not count towards the client limit of the plan.

The services included in each plan may be modified by giving the Customer thirty (30) days' prior notice. Such modifications shall not give rise to compensation, without prejudice to the Customer's right to cancel with effect at the end of the current period.

9. Prices and fees

9.1. General matters

The Customer shall pay at all times the price of the plans and services that are established and displayed on screen. Prices are shown in euros (€) and excluding VAT; the applicable taxes are calculated automatically during the payment process according to the Customer's tax jurisdiction.

9.2. Subscription payment terms

Payment of the subscription is made through Stripe, with advance charging and automatic renewal for equal periods unless previously cancelled. iNuba does not store card data. Subscription invoices are issued and are available through the Stripe customer portal.

Plan changes: upgrades (more seats or a higher plan) apply immediately with proration; downgrades are scheduled for the end of the current period and may be cancelled before they take effect. Downgrades below the number of active clients or professionals are not permitted.

9.3. Payment terms for the Customer's sales (iNubaShop)

Payments by End Users for the Customer's products and services are processed through Stripe directly into the Customer's Stripe Connect account, the Customer being the seller and the party that invoices the End User. The Customer connects its account via OAuth and may disconnect it; the settlement of funds is governed by the payout schedule of its Stripe account.

9.4. iNuba's commission

iNuba receives a commission of one point five per cent (1.5%) of the net amount (taxable base) of each sale of the Customer, plus the VAT applicable to that commission under the corresponding tax regime (generally, 21% for Customers in Spain and 0% for foreign transactions). The commission is withheld at the time of collection and is invoiced to the Customer transaction by transaction, with the issuance of a proportional corrective invoice in the event of a refund.

9.5. Invoicing of sales and refunds

The Platform generates the Customer's sales invoices (numbering delegated to Stripe), allows their download, reissuance with a NIF and the tax history per order, and flags invoices for amounts exceeding 400 euros issued without a NIF, so that the Customer may reissue them. The Customer's management staff may refund orders from the Platform, with proportional reversal of the commission and issuance of corrective invoices; duplicate charges due to technical error may be refunded from the Platform or requested from iNuba. The Customer is responsible for handling the rights of withdrawal and warranties of its purchasers and for the compliance of its sales with consumer, health and tax regulations.

9.6. iNuba products

iNuba may distribute and sell its own products and programmes to End Users through the shop, charging for them into its own account, without commission for the Customer, acting as the seller.

10. Non-payment of the subscription

If a subscription charge fails, the following staged process shall apply, communicated by email to the Account Holder:

Payment at any time prior to closure reactivates the account with all its data.

11. Termination, cancellation and pause

11.1. Voluntary cancellation

The Account Holder may cancel the subscription at any time from the Platform, with reinforced confirmation. The cancellation takes effect at the end of the period already paid for, with no right to a refund of the amounts paid, the Service being maintained until that date. Thereafter, the account enters a thirty (30) day grace period with full access, intended, among other purposes, for obtaining the necessary information; once that period has elapsed, the account is closed in accordance with clause 12.

11.2. Voluntary pause

The Account Holder may pause the account for between one (1) and six (6) months, free of charge, the Platform remaining blocked on a reversible basis. If the pause expires without reactivation, it shall be converted into a cancellation with its grace period.

11.3. Termination by iNuba

iNuba may suspend access or terminate the contract in the event of a breach by the Customer of its contractual obligations (including failure to pay in accordance with clause 10), fraud, use contrary to these Terms and Conditions or a request from an authority, with reasonable prior notice save in cases of urgency, and may claim the damages arising from the breach.

12. Platform account termination and account closure

Upon closure of the account (voluntary or due to non-payment): (i) the Professionals are deregistered; (ii) the End Users are unlinked, retaining their App as normal and being informed; and (iii) the data are blocked and retained for the legal periods — generally, five (5) years for the data of the End Users, four (4) years for those of the Professionals and six (6) years for those of the Account Holder —, after which the personal data of the End Users and of the Professionals are definitively and irreversibly anonymised.

Recovery: after closure, the account may be restored during the retention period by requesting it from iNuba through the usual contact channel, subject to the re-acceptance of the texts in force. Anonymisation is irreversible.

Closure does not in itself cancel the Customer's ongoing sales: the Customer must settle the paid services pending provision before the account termination, and iNuba may restrict the shop operations of suspended accounts.

13. Availability of the Platform

The Platform is available to Users who have Internet access. iNuba will do everything possible to ensure that the Platform is available at all times (seeking maximum service continuity, excluding planned maintenance). However, access takes place through an Internet connection, so that its quality and availability may be affected by factors beyond iNuba's control, and iNuba shall not be liable for unavailability arising from such factors.

14. Access to and Use of the Platform

The Customer and its Professionals assume responsibility for the correct use of the Platform, providing truthful and lawful data. iNuba shall not be liable for the consequences arising from any breach of these Terms and Conditions, nor for damage caused to the Professional's computer system as a result of: (i) the presence of viruses on the Professional's device; (ii) a malfunction of the Platform; or (iii) the use of non-updated versions.

15. Platform Use Rules

iNuba reserves the right to cancel the access of the Professional or of the Customer in the event of a breach of the obligations undertaken or of use contrary to these Terms and Conditions, to the Privacy Policy or to the good faith practices of the sector. The Customer and each Professional undertake to:

These Terms and Conditions do not apply to the third-party links, applications and services accessible through the Platform (including, among others, Stripe, Google, WhatsApp/Meta). The Customer and its Professionals agree to submit to their respective terms and policies. iNuba is not liable for their content or for their security measures.

17. Exclusion of warranties and liability

iNuba does not warrant the permanent availability of the Platform, although it will use its best efforts to ensure its regularity and proper functioning. iNuba assumes no liability for damages arising from disconnections, interference or interruptions, nor from viruses or other harmful elements, nor in respect of errors or omissions in the contents entered by the Customer or its Professionals, nor for the services and programmes that they implement for their End Users, for which the Customer is solely liable.

iNuba's total liability towards the Customer, save in cases of wilful misconduct or gross negligence, is limited to the amounts actually paid by the Customer in the twelve (12) months preceding the triggering event, and shall in no case cover loss of profit. The Customer shall hold iNuba harmless against claims from End Users or third parties arising from the Customer's breach of its legal or contractual obligations.

18. Force majeure

The Parties shall not be liable for the non-performance of their obligations where this is due to causes reasonably beyond their control, such as, without limitation, fires, floods, epidemics and pandemics, strikes, labour disputes, shortage or unavailability of energy, unavailability of communications networks, accidents, wars, embargoes, blockades, riots or insurrections.

19. Intellectual and industrial property

The Customer and its Professionals acknowledge and accept that all industrial and intellectual property rights over the Platform and the elements inserted by iNuba (including, by way of illustration, the "look and feel", trade marks, logos, texts, images, designs, databases, software, navigation architecture and source code) belong exclusively to iNuba and/or to legitimate third-party assignors. The Customer and its Professionals are granted a non-exclusive and non-transferable licence to use the Platform within the framework of their professional activity for the term of the contract. The Customer retains ownership of the contents and data that it enters, granting iNuba the licences essential to operate the Service and the authorisations set out in Annex 1.

20. Personal data protection

The processing of the personal data of the Account Holder and of the Customer's Professionals is governed by the iNuba Clinic Privacy Policy. The processing of the End Users' data are governed by Annex 1 (Data Processing Agreement), which forms an integral part of these Terms and Conditions, and, in respect of the data for which iNuba is the Data Controller, by the iNuba App Privacy Policy.

21. Communications

Notices between the Parties shall be deemed effective when made through the Platform or the email address designated by each Party. The Customer designates its Account Holder as the point of contact and undertakes to keep its email address operational. Price changes shall be communicated with at least thirty (30) days' notice and shall apply from the following renewal.

22. Amendment of the Terms and Conditions

iNuba may amend these Terms and Conditions and their Annex 1. New versions shall be published with their effective date and digital fingerprint and re-acceptance shall be requested in accordance with the provisions of the "Preliminary" section. The version history shall be available at inuba.com/legal.

23. Applicable law and competent jurisdiction

These Terms and Conditions are governed by Spanish law. The Parties, expressly waiving any other forum to which they might be entitled, submit to the courts and tribunals of Valencia, save where a mandatory rule provides otherwise.

ANNEX 1. DATA PROCESSING AGREEMENT

SECTION I — OVERVIEW

1. Scope and purpose

In order to govern the processing of the personal data covered by this Data Processing Agreement, both Parties agree to enter into it, and it shall be governed by Regulation (EU) 2016/679 of 27 April 2016 ("GDPR"), Ley Orgánica 3/2018, de 5 de diciembre ("LOPDGDD"), its implementing legislation and, in particular, by the following.

2. Definitions

The definitions used in this Agreement shall have the meaning given in Article 4 GDPR. The respective functions, duties and obligations of the Data Controller and of the Data Processor are defined in this Agreement (the "Agreement"). In Annex I the Parties are identified according to the roles assumed.

3. Role architecture of the iNuba ecosystem

(a) iNuba as Data Controller: of the data automatically generated by the End User (App, iNubaBox/Totem, wearables, App questionnaires), which the End User consents to directly with iNuba, as well as of the data of the Account Holder and of the Customer's Professionals.

(b) Customer as Data Controller and iNuba as Data Processor: of the data that the Customer and its team manually enter into the Platform concerning their End Users (clinical record, notes and observations, session reports, prescribed treatments, files, signed consents and messages issued by the Customer). This processing engagement is governed by Sections II and III.

(c) Joint controllership: certain processing operations within the ecosystem are jointly determined by the Parties and are governed by Annex V.

SECTION II — OBLIGATIONS OF THE PARTIES

4. Description of the data processing

The details of the processing operations, in particular the categories of personal data and the purposes for which they are processed on behalf of the Data Controller, are specified in Annex II.

5. Obligations of the Parties

5.1. Instructions

The Data Processor shall process the personal data only on documented instructions from the Data Controller - this Agreement and the configuration of the Platform constituting the principal instruction - unless required to do otherwise by Union or Member State law, in which case it shall inform the Data Controller before processing, unless legally prohibited on important grounds of public interest. The Data Processor shall immediately inform the Data Controller if, in its opinion, an instruction infringes the GDPR or applicable data protection law.

5.2. Purpose limitation

The Data Processor shall process the data solely for the specific purposes of this Agreement, unless it receives further documented instructions from the Data Controller.

5.3. Duration

The processing shall take place for the duration specified in Annex II.

5.4. Security of processing

The Data Processor shall implement, as a minimum, the technical and organisational measures set out in Annex III, in order to protect the data against personal data breaches resulting in destruction, loss, alteration, unauthorised disclosure of, or unlawful access to, the data. The Data Processor shall grant access to the data only to members of its personnel to the extent strictly necessary, ensuring that the authorised persons have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

5.5. Special categories of data

The processing engagement involves the processing of special category data (health data), and the Data Processor shall therefore apply the additional restrictions and safeguards set out in this Agreement and in Annex III.

5.6. Documentation and compliance

The Parties shall be able to demonstrate compliance with these clauses. The Data Processor shall deal promptly and adequately with enquiries from the Data Controller and shall make available to it the information necessary to demonstrate compliance, allowing for and contributing to audits. The Data Controller shall give one (1) month's prior notice of its intention to audit, the audit being carried out during normal business hours, without substantially disrupting the Data Processor's operations and with access exclusively to the data processed on its behalf, up to a maximum of one audit per calendar year save in the event of demonstrable non-compliance. The auditor shall be bound by confidentiality. The results shall be made available to the competent supervisory authority upon request. iNuba further maintains an immutable record of consents and acceptances which can be exported for inspection purposes.

5.7. Use of Sub-processors

The Data Processor may engage ancillary providers without prior specific authorisation, provided that they assume the same data protection obligations set out in this Agreement. The Sub-processors authorised at the time of contracting are listed in Annex IV. The Data Processor shall give at least fifteen (15) days' prior notice of the engagement or replacement of Sub-processors, allowing the Data Controller to object on justified grounds; in such a case, the Parties shall seek a reasonable solution, including not using the affected functionality or terminating the contract without penalty. At the Data Controller's request, the Data Processor shall provide a copy of the contract with its Sub-processors. The Data Processor shall remain fully liable for the performance of its Sub-processors' obligations.

5.8. International transfers

Any transfer to a third country or international organisation by the Data Processor shall be made on the basis of documented instructions from the Data Controller or in order to fulfil a legal requirement, in accordance with Chapter V GDPR. The Data Controller accepts that, where a Sub-processor carries out activities involving an international transfer, compliance may be ensured by means of standard contractual clauses adopted by the Commission (Art. 46(2) GDPR) or another valid mechanism, provided that the conditions thereof are met.

5.9. Assistance to the Data Controller

Given the nature of the processing engagement, where the Data Processor receives a request from a data subject to exercise their rights in relation to data processed on behalf of the Data Controller, it shall forward it to the Data Controller without undue delay and shall assist it in handling the request within a maximum period of one (1) month; the Data Controller shall be the party that responds to requests arising from its own processing operations, with the assistance of the Data Processor. The Data Processor shall further assist the Data Controller with: (i) data protection impact assessments (DPIAs) where processing may entail a high risk; (ii) prior consultations with the supervisory authority; (iii) the accuracy and updating of the data, informing it without delay should it become aware that the data are inaccurate or out of date; and (iv) the obligations of Article 32 GDPR, in accordance with the scope of Annex III.

5.10. Notification of personal data breaches

In the event of a personal data breach affecting personal data processed on behalf of the Data Controller, the Data Processor shall notify it to the Data Controller without undue delay and, in any event, within no more than twenty-four (24) hours of becoming reliably aware of it, cooperating with and assisting it in complying with Articles 33 and 34 GDPR.

6. Authorisation of further uses (anonymisation, improvement and research)

The Customer, as Data Controller of the data described in clause 3(b), expressly authorises iNuba to:

  1. apply pseudonymisation and anonymisation techniques to such data;

  2. use the pseudonymised data for the improvement of the Platform, the development of new functionalities, the compilation of statistics and scientific research, subject to the safeguards of Article 89 GDPR; and

  3. use and transfer to third parties datasets that are irreversibly anonymised (and which therefore cease to be personal data) for research, statistical or health product and service development purposes.

Conditions: (i) uses involving data that allow the End User to be identified shall additionally require the End User's own consent, obtained through the App; (ii) the activation of transfers to third parties is conditional upon a prior impact assessment and upon technical anonymisation controls with a minimum aggregation threshold; (iii) the Customer may revoke this authorisation at any time before the Data Protection Officer (dataprotection@inuba.com), whereupon iNuba shall cease to incorporate its data into new processing operations, with no effect on data already anonymised (irreversible by design); and (iv) minors' data are excluded from transfers to third parties.

7. Access by iNuba personnel (superadministration)

The Customer is informed of and accepts that authorised iNuba personnel, under the superadministration role, have cross-cutting technical capabilities over the whole of the Platform, without the company-level isolation limitation applicable to the Customer's Professionals. Those capabilities comprise support and maintenance; the management of the products distributed by iNuba (including visibility of the orders for such products, identifying the purchasing End User, their identity document, their address and their clinic); the auditing of consents; the handling of data subject rights requests; the administration of the Service; and, technically, read and write access to End Users' data, including clinical data and chat communications. Such access is limited to authorised personnel and is subject to confidentiality, to the measures set out in Annex III and to the Data Controller's instructions, and forms part of the processing engagement.

SECTION III — FINAL PROVISIONS

8. Termination and end of the Service

Without prejudice to the GDPR, if the Data Processor fails to comply with its obligations, the Data Controller may instruct it to suspend the processing until compliance is achieved or terminate the contract; the Data Processor shall inform the Data Controller without delay if it is unable to comply with these clauses. The Data Controller may terminate the contract in so far as the processing is concerned if: (a) the Data Processor is in substantial or persistent breach of these clauses or of its GDPR obligations; or (b) it fails to comply with a binding decision of a court or of a supervisory authority. The Data Processor may terminate it where, having informed the Data Controller that its instructions infringe applicable law, the Data Controller insists on them.

9. Deletion or return of the data

Upon the end of the Service, the Data Processor shall, at the Data Controller's choice, delete or return the personal data processed on its behalf, without prejudice to the blocked retention required by applicable law (clause 12 of the Terms and Conditions). The return shall be effected in a structured, commonly used format within the period agreed by the Parties having regard to the volume and complexity of the data. Once the statutory retention periods have elapsed, the data shall be deleted or irreversibly anonymised.

ANNEX I — IDENTIFICATION OF THE PARTIES AND ROLES

Data Controller: the Customer (the professional or entity holding the company account), in respect of the data that it and its team enter concerning their End Users.

Data Processor: 3DHealthAI, S.L. (iNuba), NIF B-40644445, Polígono Industrial Los Vientos, C/ Levante, 1, 46119 Náquera (Valencia), Spain. DPO: dataprotection@inuba.com.

Independent Data Controller: iNuba, in respect of the data self-generated by the End User and of the data of the Account Holder and of the Customer's Professionals (outside the scope of this processing engagement).

ANNEX II — DESCRIPTION OF THE PROCESSING

Data Subjects: End Users and Contacts of the Customer.

Categories of data: identification and contact data; health data (special category): clinical record (medical history, allergies, medication), notes and observations, session reports, treatments and adherence, measurements, questionnaires; images and photographs provided; digitised handwritten signatures; documents and files; financial data relating to the Customer's sales (orders, invoicing, NIF where applicable); communications (chat and attachments).

Processing operations: collection, recording, structuring, storage, consultation, disclosure to the Data Controller itself and to the End User through the App, backup, blocking, deletion and anonymisation, and the ancillary operations set out in clauses 6 and 7.

Purpose: the provision of the Platform to the Data Controller, as well as the further uses authorised in clause 6.

Duration: the term of the contract, plus the legally required blocked retention periods.

ANNEX III — TECHNICAL AND ORGANISATIONAL MEASURES

Administrative measures: appointment of a DPO; record of processing activities; least-privilege policy and confidentiality of personnel; training; personal data breach management procedure with notification to the Data Controller within 24 hours; immutable record of consents and acceptances, exportable for audit purposes; procedure for handling data subject rights requests.

Platform security measures: encryption of communications (TLS); access control by roles and seats with mandatory email verification; logical isolation by company (multi-tenancy); audit logging of access to blocked records and of lifecycle events; signature verification on payment notifications; pseudonymisation in analytical processes; daily backups on a separate server within the EU; hosting in the European Union (France); blocking and anonymisation upon expiry of the retention periods in accordance with internal procedures.

ANNEX IV — LIST OF AUTHORISED SUB-PROCESSORS

Sub-processor Service Location
Amazon Web Services EMEA SARL Hosting and storage (Paris region) EU (France)
OVHcloud Server infrastructure EU (France)
Stripe Payments Europe, Ltd. Payment processing and invoicing EU (Ireland); transfers subject to safeguards
Amazon SES Transactional email EU
Google Ireland Ltd. - in addition to Calendar/Meet: Firebase Cloud Messaging, for the delivery of notifications to the End User's App (it receives the device identifier and the content of the notification). Default infrastructure service, not conditional upon the Customer connecting its account. Creation of calendar events and video calls (only if the Customer connects their Google account) EU/USA subject to safeguards

The up-to-date list is available at inuba.com/legal.

ANNEX V — JOINT CONTROLLERSHIP IN THE PROCESSING (ART. 26 GDPR)

1. Scope

The Parties jointly determine the means and purposes of the following processing operations within the iNuba ecosystem: (i) the management of the registration and of the linking of the End User with the Customer; (ii) the End User's activity history originating from the App/wearables/booth/clinic; (iii) the End User-Customer chat; and (iv) the synchronisation of data between the App and the Platform.

2. Obligations of the Parties

  1. Information to data subjects: this is provided through the iNuba App Privacy Policy (which describes the essence of this arrangement) and through the Customer's own information; the essence of this arrangement shall be made available to data subjects who so request.

  2. Point of contact: iNuba acts as the single point of contact for data subjects (dataprotection@inuba.com), without prejudice to the data subjects' ability to exercise their rights in respect of each Party.

  3. Handling of rights requests: each Party shall handle the requests relating to the data for which it is Data Controller, providing each other with mutual assistance without delay.

  4. Security and breaches: each Party shall implement appropriate measures within its own sphere and the Parties shall notify each other without delay (and in any event within 24 hours) of any breaches affecting the jointly controlled processing operations, coordinating the notifications to the supervisory authority and to the data subjects.

  5. Cessation: upon cessation of the link, each Party shall retain the data within its own sphere in accordance with the statutory periods, applying the blocking and anonymisation provided for.

ANNEX 2. SPECIFIC CONDITIONS OF THE WHITE LABEL MODE

These specific conditions apply exclusively to Customers that contract the White Label Mode and prevail, as regards that mode, over the general conditions, which continue to apply to all matters not provided for here (including the clauses on availability, liability, force majeure, intellectual property, communications, modification and applicable law).

1. Purpose and operating model

1.1. iNuba grants the Customer the non-exclusive and non-transferable right to distribute the White Label App among its customers under the Customer's brand, for the duration of the mode. Customisation is limited to the agreed branding elements; the White Label App is, for all purposes, the iNuba App.

1.2. The Customer manages the commercial relationship with its customers: acquisition, registration, prices, invoicing, collection and the decision on maintaining or suspending each customer's access right, which it communicates to iNuba through the Access API. The Customer is responsible for its own commercial conditions towards its customers, which it shall obtain and retain through its own channels; iNuba is not a party to that relationship.

1.3. iNuba provides the application service to End Users: it operates the White Label App, its infrastructure and its database, and processes the data generated therein as Data Controller in accordance with clause 5 of this Annex. On first access, each End User accepts the iNuba App Terms and Conditions and Privacy Policy, which inform them that the service is provided by iNuba under the Customer's brand.

1.4. The suspension of the access right communicated through the API entails the suspension of the End User's access to the White Label App; their data remain in their account in accordance with the iNuba App Privacy Policy.

2. Access API, branding and publication

2.1. iNuba provides the Customer with Access API credentials, which are personal and non-transferable and which the Customer shall safeguard, immediately notifying any compromise. Through the API the Customer communicates the identification data necessary for registration (name, email address, identity document and date of birth), the access status and, where it holds them and they are necessary for the provision of the service, the End User's health profile data (sex, ethnic origin, declared conditions, height and weight), warranting their accuracy and that it has a legal basis for communicating them. The Customer shall not use the API for any other purposes nor attempt to access other data within the application.

2.2. The Customer licenses to iNuba, on a non-exclusive and royalty-free basis, the use of its brand solely for the purposes of customising, publishing and promoting the White Label App for the duration of the mode. Publication in the app stores shall comply with the policies of those platforms, and the legal information of the application shall identify 3DHealthAI, S.L. as owner and provider (Ley 34/2002).

2.3. All intellectual and industrial property rights in the application, its code, design, "look and feel" (except for the Customer's brand), databases and content belong exclusively to iNuba.

3. Specific obligations of the White Label Customer

The Customer undertakes to: (a) inform its customers, clearly and prior to contracting, that the application service is provided by iNuba (3DHealthAI, S.L.) under the Customer's brand; (b) maintain its own commercial conditions, which shall be lawful and compliant with the applicable consumer protection legislation; (c) communicate through the API only accurate data of customers with a valid relationship; (d) not request, collect or attempt to access the health data, images or any other data generated by End Users within the application, save for those that iNuba communicates to it in accordance with clause 5.4; (e) not make any statements attributing to itself the ownership of the application or of the processing of the data; and (f) pay the consideration for the mode in accordance with the accepted commercial offer.

4. Financial terms, duration and termination

4.1. The consideration for the White Label Mode (licence, price per active user, revenue share or any other model), its frequency and duration are those of the commercial offer accepted by the Customer at the time of contracting, which is recorded together with the acceptance of this document. In all matters not provided for, the general conditions on prices, non-payment and cancellation apply.

4.2. Effects of termination of the mode: (i) the Customer shall cease distribution and iNuba shall cease using the Customer's brand; (ii) the Access API shall be deactivated; and (iii) End Users shall be informed and may continue to use the standard iNuba application with the same account, or terminate their account in accordance with the iNuba App Terms and Conditions, their data remaining under iNuba's responsibility. Termination does not affect iNuba's relationship with End Users or the processing operations referred to in clause 5 of this Annex.

5. Data protection in the White Label Mode

5.1. Independent Data Controllers. In this mode, each Party is an independent Data Controller for its respective processing operations: the Customer, for the data of its customers within its commercial relationship (acquisition, contracting, invoicing, payment control); iNuba, for the data of End Users within the application (account, health data, images, usage), in accordance with the iNuba App Privacy Policy. The processing engagement regime of Annex 1 applies only if, in addition, the Customer uses the Platform functionalities to enter data concerning its End Users.

5.2. Communication through the API. The communication of the identification data and access status constitutes a communication between Data Controllers, based on the performance of the respective contracts with the data subject (Art. 6(1)(b) GDPR). The Customer shall inform of that communication in its own data protection information.

5.3. Acknowledgement of iNuba's processing operations. The Customer expressly acknowledges and accepts that iNuba, as independent Data Controller, processes the data generated by End Users within the application in accordance with its Privacy Policy, including storage for the service, history and progress tracking; the compilation of statistics using anonymised data; and, subject to the End User's prior consent where this is required, the training and improvement of its technology and the transfer of anonymised datasets. The Customer acquires no right whatsoever over such data or over the datasets, statistics, models or results derived from them, and shall refrain from interfering in the data protection relationship between iNuba and End Users.

5.4. Access limits. As a general rule, the Customer shall not receive health data, images or any other data generated by End Users within the application, and iNuba shall communicate to it only the account status information (effective registration, account termination) necessary for access management. However, where the Customer is also an occupational risk prevention service or a healthcare entity and the scans are carried out in the course of its activity, iNuba shall communicate to it the scan results of its End Users (body metrics, body composition, temperatures and thermographic images), which the Customer shall process as an independent Data Controller and in accordance with the legal basis applicable to it. Any additional flow shall require a specific written agreement and, where appropriate, the End User's consent.

5.5. Assistance and breaches. Each Party shall handle the rights of data subjects relating to its own processing operations, with reasonable mutual assistance, and the Parties shall notify each other, without undue delay (and in any event within twenty-four (24) hours of becoming aware of them), of any personal data breaches affecting the data communicated between them. These obligations survive termination for as long as such data are retained.