Juridisch centrum

1. Recitals

These General Terms and Conditions apply to the following companies, each referred to as “iCure” when it is the contracting entity named in the Sales Order:

iCure SA, a Swiss company limited by shares (société anonyme) with its registered office at Route de la Corniche 2, 1066 Epalinges, Switzerland, registered in the commercial register of the canton of Vaud under IDE CHE-270.492.477 (VAT CHE-270.492.477 TVA); and

iCure Belgium SRL, a Belgian private limited company (société à responsabilité limitée) with its registered office at Avenue des Eaux Vives 4, 1332 Genval, Belgium, registered with the Crossroads Bank for Enterprises under number 1017.767.847 (VAT BE 1017.767.847).

Each iCure entity is solely responsible for the Sales Orders it signs. iCure SA and iCure Belgium SRL are not jointly liable, and a Sales Order signed by one of them creates no obligation for the other.

Where no Sales Order has been signed, the contracting entity is determined by the hosting region selected by the Client when the Account is created: iCure SA where the Client selects hosting in Switzerland, and iCure Belgium SRL where the Client selects hosting in the European Union. The entity so determined is shown in the Client’s Account and on every invoice, and sets the billing currency, the governing law and the jurisdiction under Sections 8 and 17.6.

These General Terms and Conditions (Terms and Conditions) provide a legal framework for the use of the iCure Products and Services.

It governs all use of our Services (as defined below) and App/interface (or product) (as defined below) and all content available on or through the iCure GitHub repositories and the iCure Cockpit (collectively, “iCure Services”). iCure Services does not contain our additional consulting services (please refer to Support and Maintenance Agreement).

The Cardinal SDK (previously named iCure MedTech SDK) is a set of software created for Medical Data Storage and Management Solution in the cloud. It is accessible either by using Cardinal SDK, iCure Medtech SDK, and iCure Core SDKs, and through the Cardinal Cockpit. Client can learn more about the technology behind it here (https://cardinalsdk.com and https://docs.icure.com/sdks/intro).

The Cardinal Cockpit is a web application that can be used to access some of the iCure product functionalities. The Cockpit is used to create an account, manage applications and organise their Databases, as well as managing and assigning Administrators and users. Through the Cockpit, an overview of all the data generated, the devices connected, and the information about people who have access to that data, is available. Client can learn more about the technology behind it here (https://docs.icure.com/cockpit/intro).

The Client aims to develop or operate their digital health application and wishes to use for that purpose the solution offered by iCure Services.

iCure SA and iCure Belgium SRL are both certified under ISO/IEC 27001:2022 for information security, HDS v2 Activities 3 to 5 of the French Health Data Hosting, valid from 28/04/2025 to 27/04/2028. iCure has conducted all necessary validations, including external audits and penetration tests, to ensure the robustness of our systems. iCure Services for medical devices comply with ISO 13485:2016 and adhere to the requirements as defined under the Medical Device Regulation (MDR) (EU) 2017/745.

When the Client accepts, these Terms and Conditions form a legally binding contract between Client and iCure. If Client is entering into these Terms and Conditions on behalf of an entity, such as his/her employer or the company the Client works for, the Client represents that he/she has the legal authority to bind that entity.

PLEASE READ THESE TERMS AND CONDITIONS CAREFULLY. BY REGISTERING FOR, ACCESSING, BROWSING, AND/OR OTHERWISE USING THE iCURE SERVICES, THE CLIENT ACKNOWLEDGES THAT HE/SHE HAS READ, UNDERSTOOD, AND AGREE TO BE BOUND BY THESE TERMS AND CONDITIONS. IF THE CLIENT DOES NOT AGREE TO BE BOUND BY THESE TERMS AND CONDITIONS, HE/SHE SHALL NOT ACCESS, BROWSE OR OTHERWISE USE THE iCURE SERVICES.

iCure may, in its sole discretion, elect to suspend or terminate access to, or use of the iCure Services to anyone who violates these Terms and Conditions.

If the Client registers for a free trial period of iCure Services, the applicable provisions of these Terms and Conditions will govern that free trial period.

The original language of these Terms and Conditions is English. In case of other translations provided by iCure, the English version shall prevail.

2. Definitions

Account The primary means for accessing and using the iCure Services, subject to payment of a Fee designated in the selected Plan.

Account Owner An employee working at a Client company. For example, a developer at a medical device company has created an account through iCure’s Cockpit (Account Owner is referred as Administrator in Cockpit).

Client Application (App in the Cockpit) A top hierarchy management structure for managing Databases, Users, connected devices, and Administrators. Each Database, User, Connected Device and Administrator belong to an App (the opposite does not apply).

A Database can only belong to one App while Users, Connected Devices and Administrators can connect to several. An App is always connected to one cluster, which is defined when creating an App. An App also has a name and one or several Administrators.

Authorization The set of rights and privileges on Cockpit interface and App assigned to an Administrator (all administrators defined in these Terms and Conditions) by the Client.

Business Days Shall mean Monday to Friday, excluding legal holidays at the registered office of the contracting iCure entity.


Business Hour Shall mean 9:00 a.m. to 5:00 p.m. (Central European Time) on Business Days.

Charges Means the rates, fees, charges and prices for the Services.

Client A natural or legal person who has accepted these Terms and Conditions with iCure (in most cases it is a Medical Device company) and can have access to iCure Services from the Subscription plan purchased.

Client Data Any data that has been created by the Client in a Database. iCure provides facilities to streamline the end-to-end encryption of the Client Data but it is the responsibility of the Client to trigger the encryption on the Client Data.

Consultancy Refers to the Consultancy Packages in the Maintenance and Support services which is available to the Client for additional extra fees (please refer to the Maintenance & Support Agreement).

Content Any electronic data contained within iCure Medtech or accessible through iCure Cockpit. Inclusive of but not limited to articles, documents, brochures, presentations, pictures, images, audiovisual works, other informational materials, and any comments.

Database (DB) A database is an organised collection of structured information. Databases are contained within an App. An application can have a limitless number of Databases. These Databases contain users, healthcare parties, Medical Devices, patients, and data generated from devices or any application the Client developed. The properties of a Database can be customized by the Client.

Encrypted Data Data that has been rendered unintelligible to any person not authorized to access it through technological protection measures, even for iCure. Encryption occurs by means of asymmetric cryptographic algorithms. In order to decrypt the data, private keys (Private Key) are needed that are never available to iCure, solely to the Client. The Client has the responsibility and discretion to choose which data are encrypted.

Feature A function or set of functions providing a particular capability within iCure Services as determined by iCure.

Fee Regular payment for using iCure license subscription.

Free Trial Period Temporary access for trying out the iCure Services per any selected Plan without paying a Fee.

Healthcare Organization An organization within the healthcare sector. It is typically a hospital or clinic.

Healthcare Professional (HCP) A professional person working within the healthcare sector, as doctor, nurse or similar. It is typically a Client of iCure’s Clients.

iCure Refers to iCure SA or iCure Belgium SRL, whichever is named as the contracting entity in the Sales Order or, absent a Sales Order, determined by the hosting region selected in the Account, which provides the iCure Products and Services. iCure provides also support for additional fees (please refer to the Maintenance and Support Agreement.

iCure Intellectual Property (IP) Rights Means any patent, copyright, trade secret, trademark, know-how, invention, or other intellectual property right embodied in or related to the iCure Medtech Services and technology.

iCure Marks Means the iCure name and logo, the iCure.com domain name, and any other product and service names, logos, trademarks and domain names used by iCure® in connection with the Services.

iCure Services Means any function provided by iCure through its solutions and applications to their Clients. Please, it does not include the consulting services.

iCure Product (also referred to as Product) includes iCure's backend (“Cardinal”) application of all published and supported versions, iCure's software development kits (“Cardinal SDKs”), the iCure Cockpit (“Cardinal Cockpit”), and Interoperability Tools in the form of a subscription as explained herein in these Terms and Conditions.

iCure Technology Means iCure Backend, iCure Cockpit, iCure Medtech and other iCure Products, all documents, software, hardware, products, processes, algorithms, user interfaces, know-how, trade secrets, techniques, designs, inventions and other tangible or intangible technical material or information used, all software, technology or other works developed or created by or for the Client with respect to its use of the iCure.

iCure Web Site The compilation of all web documents (including images, PHP and HTML files) made available via www.icure.com.­

Pre-existing Know-How Refers to any knowledge, information, or expertise possessed by the Client before entering into these Terms and Conditions with iCure, including but not limited to technical know-how, methodologies, processes, and proprietary information.

Independent Know-How Refers to any knowledge, information, or expertise developed independently by the Client during the term of these Terms and Conditions with iCure, without the use of iCure's confidential information or resources, including but not limited to technical know-how, methodologies, processes, and proprietary information.

Licenses The lawful grant of permission stated by iCure to do something that would otherwise not be legal or allowed.

Medical device Means any instrument, apparatus, software, material, or other article intended for human use, alone or in combination, for medical purposes such as diagnosis, prevention, treatment, monitoring, or alleviation of disease, injury, or disability, or for investigation, replacement, or modification of the anatomy or physiological processes, and not primarily functioning through pharmacological, immunological, or metabolic means as defined under the Medical Device Regulation (MDR) (EU) 2017/745.

Notice Means a written notification sent by the Client to iCure by email, indicating the Client's request to terminate the use of iCure Services. The Notice must include the effective date of termination and any other relevant details required by iCure.

Order (or Sales Order) Means the iCure approved form or online subscription process by which Client agrees to subscribe to the iCure Services and/or Maintenance and Support Agreement and/or Consultancy Package, and which identifies the contracting iCure entity.

Outage Means a period of time during which the iCure Services are not available to the Client or End Customers due to a system failure or technical issue that is not within iCure's control.

Downtime Means any period during which the iCure Services are not available to the End Customers due to scheduled maintenance or unexpected Outages.

Patient Data Means name, mailing address, telephone number, email address, social security numbers, and any other non-public, identifying information processed by iCure Medtech as a result of acceptance of current Terms and Conditions by the Client.

Subscription Means an enrollment for iCure Services and/or Maintenance and Support Agreement and/or Consultancy Package for a defined Plan as established in our Services.

Subscription Plan Various criteria related to the use and functionality of the iCure Services and/or Maintenance and Support Agreement and/or Consultancy Package and on which the Fee is based.

Taxes Means any and all present or future taxes, levies, imposts, duties, deductions, charges or withholdings imposed by any Governmental Authority.

Third Parties Means third-party providers of services and products, some of which may be listed on the iCure website or Cockpit.

User A DB concept that is created within a DB that is part of an App. User refers to a Doctor or other Healthcare Professional, a Patient, a Medical Device, or Healthcare Organization (HCP). These different types of Users have received access through the Client's Permission.

Warrants Means the warrants of the Client issued and presently authorized and for the time being outstanding.

3. Authority to enter into terms and conditions with iCure services

The use of the iCure Services is subject to acceptance of these Terms and Conditions. To accept these Terms and Conditions for itself or on behalf of a Client, a person must have the legal capacity to do so. In the case of an individual, the individual must be at least 18 years of age or have valid authorization from his/her legal representative or custodian. Warrants to the other they have the right and lawful authority to enter into these Terms and Conditions for the purposes herein and that them are no other outstanding Terms and Conditions or obligations inconsistent with the Terms and Conditions and provisions hereof. In the case of a legal entity, the entity must be duly incorporated and in good standing.

The Terms and Conditions are accepted as soon as the person has received the confirmation of the creation of the Account and necessary credentials from iCure Services in order to log in to his Account.

Once accepted, these Terms and Conditions remain effective until the termination as provided for herein.

4. Modifications of these Terms and Conditions

iCure reserves the right to modify these General Terms and Conditions at any time, at its sole discretion. Any modifications will be effective immediately upon posting on iCure's website.

If any modifications have a significant impact on a Client's use of the Services (this may include changes to fees or payment terms, changes to the scope or functionality of the iCure Services, changes related to compliance to GDPR or HDS requirements), iCure may, at its discretion, notify the Client of the changes via email and provide thirty (30) days notice prior to the modifications taking effect.

If a Client continues to use the Services after the modified General Terms and Conditions are posted, it will be deemed acceptance of the modifications. If a Client objects to the modifications, they may terminate the Services as stipulated in Section 16.

5. iCure Purpose & Responsibilities

1. iCure is responsible for providing the Product that the client has subscribed.

2. For Client Data storage, iCure provides storage of Client Data within the limits of the Client’s Subscription Plan, including the free Subscription Plan, whose Databases are deleted after twelve (12) months without activity (Section 7.3).

3. iCure implements Encryption and/or pseudonymization measures to ensure compliance with GDPR requirements for the protection of personal data and with HDS requirements for the protection of personal health data. As such, iCure has no acces to medical data (decrypted Client Data).

4. The Client will be allowed to manage and access their data through Cockpit.

5. Implement and maintain security and business continuity measures and other technical and organizational measures, per best industry practices, to maintain the security and integrity of the iCure Services.

6. Protect against accidental, unauthorized, or unlawful alteration, loss, or destruction of data within its control, including the data stored on behalf of the Client according to the limitation of the availability of iCure Services as stipulated in Section 17.11).

7. Use commercially reasonable efforts to make the iCure Services available 24 hours a day, 7 days a week, except for any unavailability caused by circumstances beyond our reasonable control or Force Majeure (see Section 15.1, Limitation of Liability and 17.9, Force Majeure and Service Availability 17.11).

8. Only authorized employees or contractors of iCure under confidentiality and data protection and privacy clauses will be permitted to access and work on the products and associated systems operated by or for the Client in accordance with but not limited to HDS certification.

9. Continuously improve and develop iCure Services, including new features, within the discretion of iCure, and make these new features available to existing Clients of iCure Services (see section 17.2, New Releases).

10. iCure will conduct necessary investigations and perform thorough root cause analysis in case of incidents affecting Client’s end customers. iCure will collaborate closely with the Client to resolve these incidents and ensure continuity and quality of services.

11. iCure acts as a subcontractor in accordance with the provisions of the General Data Protection Regulation (GDPR) and the regulations applicable to health data and undertakes to comply with the obligations associated with HDS certification for the European Union hosting region.

12. iCure guarantees that all services provided in the European Union hosting region comply with HDS certification requirements, including the implementation of organizational, technical and physical measures to ensure the security, integrity and confidentiality of health data.

13. In case of termination, end of contract or any deficiencies as defined in the French Public Health Code iCure commits to return all health data to the customer in a structured and interoperable format within 20 working days, in accordance with HDS requirements. Health data subject to the French Public Health Code must be hosted in the European Union hosting region, the only region covered by iCure’s HDS certification (DPA, Section 8.3).

14. iCure remains fully responsible for the actions of its subsequent processors, as set out in the DPA; in the European Union hosting region, these processors must also comply with the obligations arising from HDS certification.

6. Client Responsibilities

1. Follow the process in the technical documentation for the best use of the product.

2. The Client will provide reasonable access to and use of all correct information and facilities determined necessary for the supply of the iCure Services and as reasonably requested by iCure and cooperate with iCure. In any case iCure shall not be responsible for the accuracy, quality, legality, reliability, and appropriateness of all Client Data and Patient Data.

3. The Client will clearly define responsibilities regarding data protection, access control, backup and disaster recovery and auditability, including a technical contact, a Data Security incident contact and a Business Continuity contact to be stipulated in the Sales Order (see Annex I).

4. The Client shall obtain and maintain all computer hardware, software, and communications equipment needed to access the iCure Services.

5. The Clients shall permit access to the iCure Services only to its authorized Users.

6. iCure shall provide security standards and procedures to the Client. The Client is responsible for the enforcement of these procedures by its Users, including but not limited to personal health data as defined in the HDS (Hébergement de données de santé) v2.0 certification framework

7. The Client shall use reasonable efforts to prevent unauthorized control, malicious software, or tampering or any other unauthorized access to, or use of, the iCure Services or the systems operated by or on behalf of Client that capture, store or transmit Client Data and Patient Data, including personal health data as defined in the HDS (Hébergement de données de santé) v2.0 certification framework and notify iCure immediately of any unauthorized use or security breach.

8. The Client shall comply with all applicable laws and regulations (including laws regarding privacy and protection of personal data including personal health data) in using iCure Services.

9. If the Client needs iCure to access its decrypted data, it will notify iCure by written with a precise description of the request, provide iCure with his Private Key and explicitly authorize iCure to access the required data.

10. The Client may, at its own expense, carry out audits or have them carried out to verify the compliance of the hosting provider's services in the European Union hosting region with HDS requirements, subject to 20 working days' notice by sending its request to privacy@icure.com and without disrupting the operation of the services. Other audits are governed by Section 11 of the DPA.

11. The Client may request iCure to provide an executive summary of a technical audit report on the resources shared such as the Pentest as part of the service. The full HDS audit report is also available on demand. These audits will have been carried out by independent auditors and be less than three years old by sending its request to privacy@icure.com

7. Using iCure Services

7.1 Access

The Clients will have access to iCure Services depending on the selected Subscription Plan that Client agreed with the Sales Order during the Subscription term or the Free Trial Period.

The Client must ensure that all access, use, and receipt by the Client’s Users are subject to and in compliance with these Terms and Conditions.

The hosting region, Switzerland or the European Union, is selected when the Client Application is created and determines the contracting entity under Section 1. A change of hosting region changes the contracting entity, the billing currency, the governing law and the jurisdiction, and therefore forms a new contract: it is implemented as an assignment under Section 17.5, by written agreement stating the effective date, and cannot be made unilaterally through the Cockpit.

7.2 Client Support

Annex I sets out the default support and maintenance levels, Client Priority and response times. A specific Maintenance and Support Agreement may be agreed with the Client; in that case it prevails over Annex I for the matters it covers. Additional Consulting Services are ordered through a Sales Order.

7.3 Free Trial Period and Free Plan

During Free Trial Period, the Client will be able to use iCure Services free of charge, until the earlier of (a) the end of the free trial period (if not terminated earlier) or (b) the start date of paid Subscription.

Unless the Client purchases a subscription to the applicable iCure Services before the end of the free trial, all the Client Data in the iCure Services may be permanently deleted at the end of the trial, and iCure will not recover it. If iCure includes additional Terms and Conditions on the trial registration web page, those will apply as well.

Where the Client uses a free Subscription Plan, the Client’s entire Database, including all Client Data, is deleted after twelve (12) months without activity, meaning without any authenticated access to that Database through the iCure Services or their APIs. iCure informs the Account Owner by email at least one (1) month before deletion, so that the Client can export its data (DPA, Section 13.5). The free Subscription Plan is intended for development and evaluation; it is not designed to serve as the system of record for medical files subject to legal retention periods.

7.4 Termination of the Account

Please refer to section 16 of these Terms and Conditions.

8. Payment and Fees

The fees for iCure Services are payable on a monthly or annually or per-package basis, as set forth in the Subscription Plan. The subscription for iCure Services shall be renewed monthly unless terminated by the Client.

All payments shall be made in the currency stated in the Sales Order (as a rule CHF for iCure SA and EUR for iCure Belgium SRL) by wire bank transfer to the bank account designated by iCure. The fees do not include any applicable taxes, duties, or fees, which shall be the responsibility of the Client.

Invoices for the fees shall be issued by iCure to the Client on a monthly basis for the iCure Services. The Client shall pay the invoice prior to accessing the iCure Services.

If the Client fails to make payment for any invoice by the due date, iCure may suspend or terminate the use and access to iCure Services without further notice.

9. Data Processing Agreement (DPA)

The Data Processing Agreement (DPA), version 2.0 of 22 October 2026, and its annexes, including the list of sub-processors, are published with these Terms and Conditions at https://icure4.odoo.com/general-terms-conditions. The DPA forms an integral part of these Terms and Conditions and of every Sales Order, for the purposes of Article 28 of Regulation (EU) 2016/679 (GDPR) and Article 9 of the Swiss Federal Act on Data Protection of 25 September 2020 (FADP). In case of conflict on data protection matters, the DPA prevails over these Terms and Conditions and any Sales Order.

10. Privacy

The Privacy Policy of iCure Services can be found at www.icure.com it is incorporated into these Terms and Conditions by reference. Please read the Privacy Policy carefully as it governs iCure Services collection, use, and disclosure of Client’s or User’s personal information.

11. Proprietary Rights

11.1 Reservation of Rights

By accessing or using our software, the Client acknowledges and agrees that iCure retains all proprietary rights in the software and any related documentation, as well as any patents, trademarks, copyrights, and trade secrets associated with the software. The Client is granted a limited, non-exclusive, non-transferable license to use the software in accordance with these Terms and Conditions, but the Client does not acquire any ownership rights in the software or any other intellectual property rights. The Client may not modify, reverse engineer, or distribute the software in any way. iCure reserves the right to terminate the Client’s access to the software as listed below (Section 11.2 Restrictions), and to modify or update the software at its discretion.
Any new features developed for the iCure Product and Services shall remain the sole property of iCure.

The Client retains ownership of its Pre-existing Know-How, and Independent Know-How. Accordingly, the Client remains the owner of the intellectual property rights on the software, Client Data, files, and documents covered by such rights, transmitted or made available to iCure in the performance of these Terms and Conditions. These Terms and Conditions do not transfer any intellectual property rights to iCure, other than those necessary for iCure to fulfill its obligations under these Terms and Conditions.

11.2 Restrictions

Except as expressly permitted by these Terms and Conditions or otherwise as required by law, Clients shall not:

1. Use, make, have made, sell, offer to sell, reproduce, modify, copy, or create derivative works based on the iCure Services, or iCure Technology.

2. Disassemble, reverse engineer, or decompile the iCure Services, or iCure Technology.

3. Use the Services for the delivery of advertising content that causes the generation of a user session (e.g., use of the Services as an ad server),

4. Create links to or from the iCure Services or use any Content forming part of the iCure Services in such a manner as to circumvent the checkout process of the iCure Services.

5. Provide, maintain access, or use the iCure Services, Client Services, or iCure Technology in any manner inconsistent with these Terms and Conditions.

11.4 Client Data

iCure respects Client’s right to the exclusive ownership of Client Data. Unless specifically permitted by the Client, Client’s use of the iCure Services does not grant iCure to use, reproduce, adapt, modify, publish, or distribute the Client Data created by the Client or stored in Client’s Account for commercial, marketing, or any similar purpose.

Client expressly grants iCure Services the right to use and analyze aggregate system activity data associated with the use of the iCure Services by Client and its Users for the purposes of optimizing, improving, or enhancing the way the iCure Services operate, and to create new Features and functionality in connection with the iCure Services.

11.5 Suggestions (Feedback)

Client and his/her Users may, from time to time, make known to iCure suggestions, enhancement requests, techniques, know-how, comments, feedback, or other input to iCure Services with respect to the Client Services, or iCure Technology (collectively, “Suggestions”; Suggestions shall exclude any Client intellectual property).

12. Confidentiality

12.1 Definition of Confidential Information

As used herein, “Confidential Information” means all confidential and proprietary information of a party (“Disclosing Party”) disclosed to the other party (“Receiving Party”), whether orally or in writing, that is either marked or designated as confidential or is identified in writing as confidential or proprietary within fifteen (15) days of disclosure to the Receiving Party or that a reasonable person would deem confidential or proprietary given the nature of the information and the circumstances under which it is disclosed.

Confidential Information shall include, but not be limited to Client Data, Patient Data, iCure Technology, Technology, and the Disclosing Party’s business and marketing plans, technology and technical information, product designs, and business processes.

Confidential Information shall not include any information that a Receiving Party can show: (i) is or becomes generally known to the public without breach of any obligation owed to the Disclosing Party; (ii) was known to the Receiving Party prior to its disclosure by the Disclosing Party; (iii) was independently developed by the Receiving Party without breach of any obligation owed to the Disclosing Party; or (iv) is received from a third party without breach of any obligation owed to the Disclosing Party.

12.2 Confidentiality and Non-Use

During the term of Subscription, and for a period of three (3) years thereafter for Confidential Information that does not constitute a trade secret or know-how and for so long as such Confidential Information is not in the public domain for Confidential Information that constitutes a trade secret or know-how, each party agrees to protect the confidentiality of the Confidential Information of the other party in the same manner that it protects the confidentiality of its own proprietary and confidential information of like kind, but in no event shall either party exercise less than reasonable care in protecting such Confidential Information; provided that a Receiving Party may disclose Confidential Information of the Disclosing Party to its employees, agents and/or representatives who have a need to know such Confidential Information for purposes of these Terms and Conditions and who are bound to a written agreement protecting such Confidential Information as required hereby. In addition, without the Disclosing Party’s written permission, the Receiving Party shall not use any Confidential Information of the Disclosing Party other than in connection with the Receiving Party’s performance hereunder.

Neither party may engage in any purchasing or selling of securities based on any Confidential Information or any material, non-public information and may not communicate any such information to any person or entity when it is reasonably foreseeable that such person is likely to purchase or sell securities based on such information.

12.3 Compelled Disclosure

If the Receiving Party is compelled by law to disclose Confidential Information of the Disclosing Party, it shall provide the Disclosing Party with prior Notice of such compelled disclosure (to the extent legally permitted) and reasonable assistance, at Disclosing Party's expense, if the Disclosing Party wishes to contest the disclosure.

12.4 Remedies

If the Receiving Party discloses or uses (or threatens to disclose or use) any Confidential Information in breach of this Section 12, the Disclosing Party shall have the right, in addition to any other remedies available to it, to seek injunctive relief to enjoin such acts, it being specifically acknowledged by the parties that any other available remedies are inadequate. The Client agrees to pay iCure any damages that iCure may incur as a result of the Client breach, including any legal fees or costs that iCure may incur in enforcing our rights under this Section. The Client acknowledges that the damages that iCure may suffer as a result of a breach of confidentiality may be difficult or impossible to quantify, and the Client agrees that the remedies set out in this Section are reasonable and appropriate in the circumstances.

13. Warranties & Disclaimers

13.1 Warranties

Unless otherwise expressly stated by the iCure Terms and Conditions, any Content, services, or features made available in conjunction with or through the iCure services are provided “as is” and “as available” without warranties of any kind either express or implied. To the fullest extent permissible pursuant to applicable law, Clients and its affiliates disclaim all warranties, statutory, express or implied, including, but not limited to, implied warranties of merchantability, fitness for a particular purpose, non-infringement of proprietary rights, correctness, accuracy, and reliability.

Unless otherwise expressly stated by iCure, iCure does not warrant or make any representations regarding the use or the results of the use of the Cockpit, the iCure Medtech services, or any linked sites, in terms of correctness, accuracy, reliability, or otherwise.

13.2 Disclaimer

iCure will not be responsible for: (a) the loss of a Private Key of Data that is not due to a breach of these Terms and Conditions by (b) the inability of Client to access or interact with any other service provider through the internet, other networks or users that comprise the internet or the informational or computing resources available through the internet; or (c) service provided by other service providers. Please note that iCure provides the necessary tools and infrastructure to help ensure the security of the Client Data. However, it is ultimately the responsibility of the Client to decide which data should be encrypted, and how best to protect that data from unauthorized access or disclosure. iCure is not responsible for any breaches of security or loss of data resulting from the Client's failure to properly encrypt or protect their data. The Client acknowledges that software reuse carries certain risks, including the risk of introducing errors or vulnerabilities into their software. iCure takes reasonable steps to minimize these risks, including conducting code reviews and maintaining thorough documentation of all software components being reused. However, the Client agrees to take all necessary precautions to minimize these risks on their end, including testing their software thoroughly before deploying it. By agreeing to these terms and conditions, the Client accepts responsibility for any risks associated with the reuse of software components provided by iCure. iCure shall not be liable for any damages or losses resulting from the use of iCure Services, including loss of use, consequential damages, commercial losses, or loss of profit. iCure’s liability is limited as set out in Section 15 and, for data protection matters, in Section 14 of the DPA. The warranty for iCure Services shall automatically terminate if the software has been mishandled, altered, or repaired by third parties, or if the instructions provided by our company for the use of the iCure Services have not been followed. In such cases, iCure shall not be liable for any damages or losses resulting from the termination of the warranty.

14. Indemnification

Client shall defend, indemnify and hold iCure its affiliates, employees, directors and shareholders harmless against any loss or damage (including reasonable attorneys' fees) incurred in connection with claims (i) made or brought against iCure by a third party alleging that the Client Technology or Client Data infringes the intellectual property rights of, or has otherwise harmed, a third party, (ii) based on the offer, marketing, sale design, construction, assembly, production, packaging, labeling, advertising, instructions or warnings (or lack thereof) of any products or services through the Client Web Application(s), including Claims based upon infringement, product liability, personal injury or death relating to any products or services offered through the Client Web Application(s), (iii) based upon any Client use of the iCure Services not in accordance with the terms hereof (iv) based on a breach of Sections (Client Responsibilities) or (Data Protection) of these Terms and Conditions, or (v) based on any failure or alleged failure of the Client to comply with any applicable law, rule or regulation in connection with its Client Web Application(s), including, without limitation, all national and/or foreign Patient protection laws and data protection and privacy laws as long as this failure is not attributable to an action or omission of iCure.

15. Limitation of Liability

15.1 Limitation of Liability

Subject to the application of public order rules, and except for amounts due hereunder and liability arising from the indemnification obligations set forth in this section, in no event shall either party's aggregate liability arising out of or related to these terms and conditions exceed the total amount paid by client for the icure services giving rise to the liability in the 12 months preceding the first incident out of which the liability arose.

This limitation on liability will apply whether an action is in contract or tort and regardless of the theory of liability but will not limit the client's payment obligations.

Nothing in these terms and conditions will limit a party's liability:

(i) for any losses that cannot be limited under applicable laws;

(ii) for death or personal injury caused by that party's negligence;

(iii) for breach of Section 12 (Confidentiality) or any related indemnity, except for breaches concerning Client Data, Patient Data or other personal data.

Liability arising out of or in connection with the DPA or data protection laws, including in respect of personal data breaches, is subject to the specific limitation set out in Section 14 of the DPA, which applies to such claims instead of the limitation above.

The foregoing limitation will apply whether an action is in contract or tort and regardless of the theory of liability but will not limit the client’s payment obligations

In the event of a dispute arising out of or related to these terms and conditions, iCure shall be entitled to recover its reasonable legal fees and costs from the Client.

In the event of a breach of these terms and conditions by one party, the parties will negotiate in good faith to allocate liability for the breach between them. If the parties are unable to reach an agreement within a reasonable period of time, the allocation of liability will be determined by a court of competent jurisdiction.

15.2 Exclusion of Economic and Financial Damages

Subject to the application of public order rules, in no event shall either party have any liability to the other party or to any third party for any economic or financial losses, whether they are direct or indirect, such as loss of actual or anticipated profits, loss of business, loss of, damage to, or corruption of data, loss of use, costs of procurement of substitute goods or services, however, caused and whether or not the party has been advised of the possibility of such damage or whether such damage was foreseeable or in the contemplation of the parties. This Section does not exclude the costs that Section 14.2 of the DPA treats as direct damages.

16. Termination

16.1 Start and end of the Subscriptions

These General Terms and Conditions will commence on the Client’s first payment, or free trial subscription that allows the Client to access to iCure Services and continue until the end of iCure Services subscriptions and free trial plan entered into hereunder have terminated or expired unless earlier terminated as provided below in this Section 16.2.

16.2 Termination

Following these situations, these Terms and Conditions may be terminated:

1. By mutual agreement by both Parties.

2. To terminate the Services, the Client must provide written Notice of termination to iCure by email at least fourteen (14) days before the end of the current Subscription.

3. By iCure upon a decision to end the provision of the iCure Services. iCure must provide written Notice of termination to the Client by email at least fourteen (14) days before the end of the current Subscription.

4. Immediately by either party, if proceedings are initiated for the other party’s liquidation or insolvency or a negotiated settlement with the other party’s creditors is concluded or an assignment is made on behalf of the other party for the benefit of creditors.

5. By iCure automatically, if the Client fails to timely make any payment due hereunder and fails to cure such default within fourteen (14) days of receiving Notice in writing from iCure of such failure (whether or not iCure avails itself of its right to suspend Services pursuant to Section 8 hereof).

6. By either party, automatically, in the event, the other party materially breaches any of its duties, obligations, or responsibilities under these Terms and Conditions and fails to cure such breach or provide the other party with an acceptable plan for curing such breach within thirty (30) days after receipt by the breaching party of written Notice specifying the breach.

7. immediately by either party if the other party breaches its obligations, as applicable under Sections 11 (Proprietary Rights) and 14 (Indemnification) of these Terms and Conditions.

8. by either party, subject to mandatory applicable rules, in the event (i) a receiver, trustee, administrator, or administrative receiver is appointed for the other party or its property; (ii) the other party makes an assignment for the benefit of creditors; (iii) any proceedings should be commenced against the other party under any bankruptcy, insolvency, or debtor’s relief law; or (iv) the other party is bankrupt, insolvent, liquidated or dissolved.

9. By either party, in case of adjustment fees such as described in section 8 of these Terms and Conditions. The Client may send a Notice by contacting iCure at client@icure.com.

16.3 Effect of Termination

Upon termination of these Terms and Conditions,

1. Regarding the Data of the Client being processed by iCure, please refer to the Data Processing Agreement for further clarification.

2. Client must stop using and prevent the further usage of the iCure Services, and pay any amounts owed to iCure under these Terms and Conditions, and discharge any liability incurred by iCure under these Terms and Conditions before their termination.

16.4 Outstanding Fees

Termination shall not relieve Client of the obligation to pay any fees accrued or payable to iCure prior to the effective date of termination.

iCure won’t provide any refunds of prepaid fees or unused Subscription Fees for early cancellation, except as provided in Section 7.5 of the DPA.

16.5 Surviving Provisions

The following provisions shall survive until perpetuity the termination or expiration of these Terms and Conditions for any reason and shall remain in effect after any such termination or expiration: Sections 1 (definitions), 12.3 (compelled disclosure), 11 (proprietary rights), 13 (warranty and disclaimers), 14 (Indemnification), 15 (limitation of liability), and 17 (general provisions).

17. General Provisions

17.1 Relationship of the Parties

These Terms and Conditions do not create a partnership, franchise, joint venture, agency, fiduciary, or employment relationship between the Client and iCure.

17.2 Notices

All Notices required or permitted to be given under these Terms and Conditions shall be sent by email: to iCure at client@icure.com, or at privacy@icure.com for notices relating to data protection or the DPA; and to the Client at the email address of its Account Owner, or to such other address as a party has notified in writing.

Notices sent by email shall be deemed given when sent, provided that no error message or other notification of non-delivery is received.

17.3 Waiver and Cumulative Remedies

Failure of either Party to exercise or enforce any provision of or any of its rights under these Terms and Conditions shall not be deemed a waiver of future enforcement of that or any other provision or right. Other than as expressly stated herein, the remedies provided herein are in addition to, and not exclusive of, any other remedies of a party.

17.4 Severability

If any provision of these Terms and Conditions is held by a court of competent jurisdiction to be contrary to law, the provision shall be modified by the court and interpreted so as best to accomplish the objectives of the original provision to the fullest extent permitted by law, and the remaining provisions of these Terms and Conditions shall remain in full force and effect.

17.5 Assignment

Neither party may assign any of its rights or obligations hereunder, whether by operation of law or otherwise, without the prior express written consent of the other party; provided, however, that iCure may assign these Terms and Conditions to an affiliate, including from iCure SA to iCure Belgium SRL or the reverse, by written notice to the Client. Notwithstanding the foregoing, either party may assign these Terms and Conditions together with all rights and obligations hereunder, without consent of the other party, in connection with a merger, acquisition, corporate reorganization, or sale of all or substantially all of its assets related to these Terms and Conditions not involving a direct competitor of the other party. Any attempt by a party to assign its rights or obligations under these Terms and Conditions in breach of this section shall be void and of no effect. Subject to the foregoing, these Terms and Conditions shall bind and inure to the benefit of the parties, their respective successors, and permitted assigns.

17.6 Governing Law

These Terms and Conditions and each Sales Order are governed by the law of the country of the contracting iCure entity, without regard to its conflict of law provisions: Swiss law where iCure SA is the contracting entity, and Belgian law where iCure Belgium SRL is the contracting entity. The United Nations Convention on Contracts for the International Sale of Goods (Vienna Convention of 1980) is specifically excluded from application to these Terms and Conditions.

The parties shall attempt to solve the matter amicably in mutual negotiations.

Failing an amicable settlement, the courts of Lausanne have exclusive jurisdiction where iCure SA is the contracting entity, and the French speaking courts of Brussels where iCure Belgium SRL is the contracting entity.

17.7 Compliance with Laws

Each party shall comply with all laws or regulations applicable to its performance under these Terms and Conditions. Client acknowledges and agrees that it has not received or been offered any illegal bribe, kickback, payment, gift, or thing of value from any iCure employees, agent, or representative in connection with these Terms and Conditions, other than reasonable gifts and entertainment provided in the ordinary course of business. Client will promptly notify iCure if it offers or receives any such improper payment or transfer in connection with these Terms and Conditions.

17.8 Collection Fees

Client shall pay on demand the lump-sum indemnity for collection fees provided for by the law applicable under Section 17.6, as well as all of iCure’s reasonable attorney fees and other costs incurred by iCure in addition thereto to collect any fees or charges due iCure under these Terms and Conditions following Client’s breach of Section 8.

17.9 Force Majeure

Except for the obligation to make payments, nonperformance of either party shall be excused to the extent that performance is rendered impossible by strikes or other labor problems, fire, flood, civil unrest, acts of terror, war, governmental acts or orders or restrictions, failure of suppliers, or any other reason where failure to perform is beyond the reasonable control of the non-performing party.

17.10 Entire Terms and Conditions

These Terms are the entire Terms and Conditions between Client and iCure with respect to the subject matter hereof and supersedes all prior and contemporaneous agreements, proposals or representations, written or oral, concerning its subject matter. Except as otherwise provided herein, no modification, amendment, or waiver of any provision of these Terms will be effective unless in writing and signed by the party against whom the modification, amendment or waiver is to be asserted.

17.11 Service Availability & Objectives (SLA & SLO)

The service levels, service level objectives, support Client Priority and service credits are set out in Annex I, which forms an integral part of these Terms and Conditions. In case of conflict between these Terms and Conditions and Annex I on those matters, Annex I prevails.

17.12 New Releases

iCure is committed to continuously improving its Products and will therefore provide regular releases. iCure offers two main release channels to accommodate Client’s needs:

“Fixed Schedule” Release Channel - iCure provides regular releases every 6 months through the designated “Fixed Schedule” release channel

(YYYYMM.api.icure.cloud). These scheduled releases are carefully planned and tested to ensure stability and reliability. iCure guarantees that endpoints within each release of this channel will remain backward compatible, allowing for seamless integration and minimal disruption to Client’s operations.

Continuous Development Channel - Additionally, iCure offers a continuous development channel (api.icure.cloud) that provides access to the latest version of the API. Updates within this channel are deployed without prior warning and at the discretion of iCure. While iCure endeavors to maintain backward compatibility at all times, no explicit guarantee is provided regarding the compatibility of endpoints within this channel. The Client acknowledges and accepts the inherent risks associated with utilizing the continuous development channel and agrees to exercise caution when integrating updates from this channel into its systems.

For detailed information regarding iCure's SLDC and Software Release policy, the Client may refer to the relevant documentation available on iCure's website or through designated access portals.

17.13 Construction

The titles of the sections of these Terms and Conditions are for convenience of reference only and are not to be considered in construing these Terms and Conditions. Unless the context of these Terms and Conditions clearly requires otherwise: (i) references to the plural include the singular, the singular the plural, and the part the whole, (ii) ”or” has the inclusive meaning frequently identified with the phrase “and/or,” (iii) ”including” has the inclusive meaning frequently identified with the phrase “including but not limited to” or “including without limitation,” and (iv) references to “hereunder”, “herein” or “hereof” relate to these Terms and Conditions as a whole. Any reference in these Terms and Conditions to any statute, rule, regulation or agreement, including these Terms and Conditions, shall be deemed to include such statute, rule, regulation or agreement as it may be modified, varied, amended or supplemented from time to time. The parties agree that these Terms and Conditions shall be fairly interpreted in accordance with its terms without any strict construction in favor of or against either party and that ambiguities shall not be interpreted against the drafting party.

iCure Belgium SRL and iCure SA | Version: 12 October 2026

1. Scope and parties

This Annex I to the iCure General Terms & Conditions (GT&C) sets the availability objectives (SLOs), support commitments and service credits that iCure gives on its hosted Cardinal services. It forms an integral part of the GT&C and of any Sales Order that references it.

Contracting entity. This Annex is identical for iCure Belgium SRL and iCure SA (Switzerland). The entity bound is the one named on the Sales Order or, absent a Sales Order, the one determined by the hosting region selected in the Account; governing law and jurisdiction follow the GT&C.

Precedence. A negotiated agreement with its own service levels (for example a bespoke hosting convention) prevails over this Annex for the matters it covers.

What applies to each iCure activity

Activity	Availability SLO (section 3)	Support Client Priority (section 4)	Service credits (section 5)
Cloud infrastructure run by iCure (hosted Cardinal backend, application server, databases)	Yes	Yes	Yes
Software licenses, self hosted by the client (Cardinal SDK, server, DB components)	No; the client operates the infrastructure	Yes, for defects in iCure software	No
Support services (standalone or bundled)	No	Yes	No
Software development services (projects under a Sales Order)	No; governed by the Sales Order milestones and acceptance	Yes, during the warranty period stated in the Sales Order (3 months after acceptance if none is stated)	No

The SLO covers the production environment only. Test, staging, sandbox and preview environments, and features marked beta, are excluded.

2. Definitions

• Sales Order: the order document signed by the client that sets the services, prices, Resource Throttling limits and, for development services, the scope, deliverables, milestones, acceptance terms and warranty period.

• Service: the hosted Cardinal API endpoints operated by iCure for the client's production tenant.

• Request: an authenticated API call to the Service that is within the client's Resource Throttling limits.

• Error: a Request answered with an HTTP 5xx status, or not answered within 30 seconds. HTTP 4xx responses, including 429 (throttled), are not Errors.

• Total Outage: a period of at least 1 minute during which the Service is unreachable from iCure's external monitoring probes, or 95% or more of Requests end in Error.

• Partial Outage: a period during which, for more than 10 consecutive minutes, either (a) the Service does not meet the Ideal Objectives, or (b) more than 5% of Requests end in Error. Once the 10 minute threshold is passed, the whole period counts, including the first 10 minutes.

• Ideal Objectives: the performance targets below, measured server side on Requests, over rolling 5 minute windows.

• Resource Throttling: the per tenant limits configured by iCure on the Service (request rate, concurrency, payload size and storage quotas) that stop one client or workload from saturating shared resources. Limits are set in the Sales Order or in Cockpit.

• Month: a calendar month, measured 24 hours a day, 7 days a week, in Europe/Zurich time.

• Business Hours: 9:00 to 17:00, Monday to Friday, excluding public holidays of the contracting entity's seat.

Ideal Objectives

Indicator	Target
Read Requests (get, search by id), p95 latency	500 ms
Write Requests (create, modify, delete), p95 latency	1,000 ms
Filter and bulk queries, p95 latency	3,000 ms
Authentication and token refresh, p95 latency	800 ms
Error rate	below 1%

Latency excludes time spent in client side encryption and in the client's network.

3. Service Level Objectives (SLO): availability

iCure targets 99.5% monthly availability against Total Outage and 99% monthly availability against Partial Outage, provided Resource Throttling is enabled on the client's tenant for the whole Month.

SLO	Monthly target	Allowed budget, 30 day Month	Allowed budget, 31 day Month
Availability (no Total Outage)	99.5%	216 min (3 h 36)	223 min (3 h 43)
Service quality (no Total or Partial Outage)	99%	432 min (7 h 12)	446 min (7 h 26)

Calculation

• Availability % = (minutes in Month − Excluded minutes − Total Outage minutes) ÷ (minutes in Month − Excluded minutes) × 100.

• Service quality % uses the same formula, counting Total Outage minutes and Partial Outage minutes together (a minute counts once).

• Measurement comes from iCure's external probes (at least every 60 seconds, from two locations) and from server side request logs. iCure's records prevail unless the client shows a manifest error.

Condition: Resource Throttling enabled

• The SLO applies only for Months in which Resource Throttling was enabled on the tenant at all times.

• If the client asks iCure to disable or raise limits beyond the Sales Order values, the SLO is suspended from that moment until the end of the Month in which throttling is restored.

• Requests rejected by throttling (HTTP 429) are not Errors and are excluded from the Error rate.

4. Service Level Agreement (SLA): support and Client Priority

Scope of support. The Client Priority commitments below cover only:

• iCure products and services (Cardinal SDK, application server, databases and hosted services) used in accordance with iCure's technical specifications and documentation, on supported versions and within the Resource Throttling limits of the Sales Order;

• code developed by iCure for the client under a Sales Order that uses iCure services, provided the client has not modified it, during the warranty period stated in the Sales Order (3 months after acceptance if none is stated).

All other requests, including the client's own applications, code or integrations, third party software or services not supplied by iCure, iCure components or iCure developed code modified by the client, and use outside the documented specifications, are supported on a best effort basis only, without response or resolution commitments.

Tickets are opened through the iCure support portal or support@icure.com; the client sets the Client Priority when opening the ticket, and iCure may adjust it at first response if it does not match the definitions below. Response and update times run during Business Hours unless stated otherwise.

Client Priority	Definition	First response	Updates	Target to workaround or fix
Urgent-Business Critical	Total Outage, data loss or corruption, a confirmed security incident on production, or the client's business operations stopped	1 hour, 7 days a week for hosted services; 1 Business Hour otherwise	Every 2 hours until workaround	Workaround 4 hours; fix 2 business days
High	Partial Outage, or a core function (authentication, read or write of health data, sync) unusable for many users, no workaround	4 Business Hours	Every business day	Workaround 2 business days; fix in next patch release
Standard	A function degraded with a workaround, a non production environment issue, a question, documentation, a cosmetic issue or a feature request	1 business day	Weekly	Fix in a scheduled release; feature requests on the roadmap, no commitment

• Response and update times are commitments; resolution times are targets, not guarantees.

• Resolution clocks pause while iCure waits for information or access from the client.

• Urgent-Business Critical tickets must be raised through the portal or phone line, not email alone, to trigger the 7 day coverage.

• Development work, integration help and training beyond reasonable guidance are billable services, not support.

5. Service credits, exclusions and client obligations

If iCure misses an SLO in a Month, the client may be entitled to a credit on future invoices, determined at iCure's sole discretion. No refund or cash payment is due in any case.

Claiming credits

• Written claim within 30 days after the end of the Month, with tenant id and affected periods.

• Credits are deducted from a future invoice; they are not paid in cash and are forfeited if the client has overdue invoices.

• Credits are the client's sole and exclusive remedy for missed SLOs, within the liability cap of the GT&C. In no event is iCure liable for any indirect, incidental, consequential or special damages arising out of any downtime or unavailability of the Services.

Excluded minutes

• Scheduled maintenance, which iCure may perform on the Services at its discretion; iCure uses reasonable efforts to notify clients of planned downtime in advance.

• Emergency security patches, announced as soon as practical.

• Causes on the client side: client application or SDK misuse, unsupported SDK versions, client network, or credentials.

• Traffic above Resource Throttling limits, load tests not agreed in advance, or any period where throttling was disabled at the client's request.

• Any unavailability caused by circumstances beyond iCure's reasonable control, including but not limited to Force Majeure events, network or telecommunication outages outside iCure's systems, and the actions or omissions of third party service providers.

• Suspension of the Service under the GT&C (for example for unpaid invoices).

Client obligations

• Use a supported Cardinal SDK version (current major and the previous one).

• Keep Resource Throttling enabled and size limits with iCure before significant load increases.

• Designate a technical contact, a Data Security incident contact and a Business Continuity contact, and keep them current.

• Report incidents promptly with the information needed to reproduce them.

6. Reporting and changes

• Notice of any Total Outage or Urgent-Business Critical incident within 1 hour of detection, by email to the client's technical contact, Data Security incident contact and Business Continuity contact.

• Post incident report within 5 business days for every Total Outage or Urgent-Business Critical incident: timeline, root cause, corrective actions.

• Monthly SLO report on request, with both percentages and the list of excluded minutes.

• iCure may update this Annex with 30 days notice; changes cannot lower the SLO targets during a committed term.

Version 2.0, effective 22 October 2026 for new Clients and, for Clients with an active subscription on that date, thirty (30) days after the notice sent to them. Replaces the Data Processing Agreement dated 30 June 2026.

How this DPA applies

This Data Processing Agreement (the "DPA") forms part of the iCure General Terms and Conditions (the "GT&C") and of every Sales Order concluded under them (together, the "Agreement"). It sets out the obligations of the parties under Article 28 of Regulation (EU) 2016/679 (the "GDPR") and Article 9 of the Swiss Federal Act on Data Protection of 25 September 2020 (the "FADP") when iCure processes Personal Data on behalf of the Client.

Acceptance. The Client accepts this DPA when it accepts the GT&C, by registering for, accessing or using the iCure Services (including any free subscription plan of Cardinal), or when it signs or accepts a Sales Order. No separate signature is required. A Client that needs a countersigned copy may request one at privacy@icure.com; the countersigned copy has the same content as the published version.

Contracting iCure entity. Each subscription covers one Hosting Region and is concluded with the iCure entity of that region, which is also the entity named in the Sales Order. "iCure" means that entity:

• EU Hosting Region: iCure Belgium SRL, Avenue des Eaux Vives 4, 1332 Genval, Belgium, company number BE 1017.767.847;
• Swiss Hosting Region: iCure SA, Route de la Corniche 2, 1066 Epalinges, Switzerland, IDE CHE-270.492.477.

Each iCure entity is solely responsible for the processing it performs under its own subscriptions and Sales Orders. A Client hosted in both Hosting Regions has a separate contractual relationship with each entity. The Client and iCure are each a "party".

Negotiated DPA. Where the Client and iCure have signed a data processing agreement that expressly replaces this DPA, the signed agreement prevails.

Language. This DPA is drafted in English. Any translation is provided for convenience only; the English version prevails.

1. Definitions

1.1  Capitalised terms not defined in this DPA have the meaning given to them in the GT&C. The terms "controller", "processor", "Data Subject", "processing", "Personal Data", "Personal Data Breach" and "Supervisory Authority" have the meaning given to them in the Applicable Data Protection Law; where the FADP applies, they include the corresponding FADP notions, in particular "breach of data security" and the Federal Data Protection and Information Commissioner.

1.2  In this DPA:

"Account Data" means Personal Data of the Client's Account Owners, billing contacts and other representatives that iCure processes to manage the Client's account, billing, security and support.

"Account Owner" means a person, typically a developer or administrator of the Client, who has created or manages an account of the Client in the Cardinal Cockpit or any other iCure interface.

"Applicable Data Protection Law" means the GDPR, the Belgian Law of 30 July 2018 on the protection of natural persons with regard to the processing of personal data, the FADP and the Swiss Data Protection Ordinance of 31 August 2022 (the "FDPO"), and any other data protection law applicable to the processing under this DPA.

"Client Personal Data" means the Personal Data contained in Client Data, or otherwise processed by iCure on behalf of the Client under the Agreement, as described in Annex 3.

"Encrypted Data" means Client Data encrypted end-to-end with the encryption features of the iCure Services, so that it can only be decrypted with the corresponding Encryption Keys.

"Encryption Keys" means the private keys needed to decrypt Encrypted Data, held by the Client, its End Users or devices under their control.

"End User" means any person who uses an application or service of the Client built on the iCure Services, including healthcare professionals, members of care teams and patients.

"Hosting Region" means the region, EU or Switzerland, in which the Client's databases are hosted, as selected by the Client when subscribing or as stated in the Sales Order.

"Sub-processor" means any processor engaged by iCure, or by another Sub-processor, that processes Client Personal Data or has access to systems storing it, including infrastructure providers that only have physical access to those systems.

2. Roles and scope

2.1  iCure as processor. For Client Personal Data, the Client acts as controller and iCure acts as processor.

2.2  Client acting as processor. Where the Client processes Client Personal Data on behalf of one or more third-party controllers (for example as a software vendor serving hospitals, practices or healthcare professionals), iCure acts as a sub-processor of the Client. In that case the Client:

(a) warrants that its instructions to iCure, including the engagement of iCure and of the Sub-processors listed in Annex 1, are authorised by those controllers;

(b) remains iCure's sole point of contact and relays any communication between iCure and those controllers; and

(c) is not required to disclose the identity of those controllers to iCure, but discloses it to iCure or to a Supervisory Authority where the law requires it.

References in this DPA to the Client as controller then apply to the Client acting on the instructions of those controllers.

2.3  Account Data. iCure processes Account Data as a controller, in accordance with its Privacy Policy published at www.icure.com. This DPA does not apply to Account Data.

2.4  Services covered. This DPA applies to all iCure Services, whatever the subscription plan, and to any support, maintenance or professional services in the course of which iCure processes Client Personal Data.

2.5  Compliance. Each party complies with the Applicable Data Protection Law. The Client is responsible for the lawfulness of the processing it instructs, including the legal basis and, for health data, the applicable condition under Article 9 GDPR or the FADP, for informing Data Subjects, and for the accuracy of Client Personal Data. The Client informs iCure without undue delay at privacy@icure.com if it becomes aware that the processing under this DPA does not comply with the Applicable Data Protection Law.

2.6  Details of the processing. The subject matter, duration, nature and purpose of the processing, the categories of Personal Data and the categories of Data Subjects are described in Annex 3.

3. Instructions

3.1  iCure processes Client Personal Data only on documented instructions from the Client, including with regard to transfers outside the Hosting Region. The Agreement, this DPA, and the Client's configuration and use of the iCure Services (including the API calls made by its applications) are the Client's complete instructions at the date of acceptance. Further instructions must be given in writing; where they require work outside the standard iCure Services, they may be subject to a Sales Order.

3.2  iCure may process Client Personal Data otherwise only where required to do so by the law of the European Union, of an EU Member State or of Switzerland to which iCure is subject. In that case iCure informs the Client of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.

3.3  iCure informs the Client without delay if, in its opinion, an instruction infringes the Applicable Data Protection Law, with a reasonably detailed explanation. iCure may suspend the execution of that instruction until the Client confirms or modifies it.

3.4  iCure does not process Client Personal Data for its own purposes, does not sell it and does not use it for commercial or marketing purposes. This does not prevent iCure from using technical telemetry on the use and performance of the iCure Services (such as request volumes, error rates and storage usage), which does not include the content of Client Data and does not identify Data Subjects, to operate, secure and improve the iCure Services.

4. End-to-end encryption

4.1  The iCure Services provide end-to-end encryption. The Client decides, through its configuration and use of the iCure Services, which Client Data is encrypted end-to-end.

4.2  Encryption Keys are generated and kept on the side of the Client and its End Users. The iCure Services are designed so that neither iCure nor its Sub-processors hold Encryption Keys or can decrypt Encrypted Data. iCure accesses decrypted Client Data only if the Client gives it explicit written authorisation and the means to do so; such access is then an instruction under Section 3.

4.3  Client Data that is not encrypted end-to-end, such as identification data needed to authenticate users, technical metadata needed to operate the iCure Services and fields that the Client chooses to leave unencrypted, is protected by encryption in transit and at rest and by the other measures described in Annex 2.

4.4  The Client is responsible for the custody of Encryption Keys and for using the key recovery mechanisms offered by the iCure Services. iCure cannot restore Encrypted Data whose Encryption Keys have been lost.

4.5  Client Personal Data is protected under this DPA whether or not it is encrypted. Encryption is a security measure; it does not reduce the obligations of either party under this DPA.

5. Confidentiality and professional secrecy

5.1  iCure ensures that every person acting under its authority who may access Client Personal Data (a) is bound by a written confidentiality undertaking or by an appropriate statutory obligation of confidentiality, (b) has been informed of the sanctions applicable to a breach of confidentiality, and (c) processes Client Personal Data only on iCure's instructions, unless required otherwise by law.

5.2  Where Client Personal Data is covered by a professional secrecy obligation of the Client or of the controllers on whose behalf it acts, in particular medical secrecy under Article 321 of the Swiss Criminal Code or the corresponding rules of Belgian or other applicable law, iCure:

(a) keeps that data secret and does not seek to obtain knowledge of it;

(b) invokes, to the extent available to it, the rights of auxiliaries of persons bound by professional secrecy to refuse to testify and to oppose the seizure of documents (in Switzerland, Articles 171 and 264 of the Swiss Criminal Procedure Code); and

(c) binds its Sub-processors to confidentiality obligations appropriate to that secrecy.

6. Security of processing

6.1  iCure implements and maintains technical and organisational measures ensuring a level of security appropriate to the risk, as required by Article 32 GDPR and by Article 8 FADP together with Articles 1 to 5 FDPO, in particular against accidental or unlawful destruction, loss, alteration, unauthorised disclosure of or access to Client Personal Data. These measures are described in Annex 2.

6.2  iCure operates an information security management system certified to ISO/IEC 27001 and holds the other certifications listed in Annex 2. iCure informs the Client without undue delay if a certification listed in Annex 2 is suspended or withdrawn.

6.3  iCure may update the measures described in Annex 2 to follow technical and regulatory developments, provided that the overall level of protection of Client Personal Data is not reduced.

7. Sub-processors

7.1  General authorisation. The Client gives iCure a general written authorisation to engage Sub-processors, within the meaning of Article 28(2) GDPR and Article 9(3) FADP with Article 7 FDPO. The Sub-processors engaged at the effective date of this DPA are listed in Annex 1, by Hosting Region; the current list is also published at https://icure4.odoo.com/general-terms-conditions. Only the Sub-processors listed for the Client's Hosting Region, and those listed as common to all Hosting Regions, process the Client's Personal Data.

7.2  Flow-down. iCure engages a Sub-processor only under a written contract imposing the data protection obligations required by Article 28(4) GDPR and Article 9 FADP, with sufficient guarantees as regards security measures, confidentiality, notification of Personal Data Breaches and audits. Where iCure negotiates the contract, these obligations are at least as protective as those of this DPA. A Sub-processor engaged by another Sub-processor requires iCure's prior authorisation and is listed in Annex 1; for infrastructure providers contracting on standard terms, Annex 1 refers to the lists of sub-processors they publish.

7.3  Responsibility. iCure remains fully responsible towards the Client for the performance by its Sub-processors of their data protection obligations.

7.4  Changes. iCure informs the Client of any intended addition or replacement of a Sub-processor at least thirty (30) days before the change, by email to the Account Owner and by updating the published list. Where the change concerns a Sub-processor engaged by another Sub-processor and iCure is informed of it with shorter notice, iCure informs the Client as soon as it is itself informed. Where an emergency affecting the security or continuity of the iCure Services requires it, iCure may replace a Sub-processor immediately, within the same Hosting Region and with equivalent safeguards, and informs the Client without undue delay afterwards.

7.5  Objection. The Client may object to a change on reasonable data protection grounds by writing to privacy@icure.com within thirty (30) days of the notice. The parties then seek a solution in good faith. If no solution is found within thirty (30) days of the objection, the Client may terminate the affected iCure Services without penalty by written notice, and iCure refunds any prepaid fees for the period after termination. Where the notice is given after the change under Section 7.4, the objection period runs from that notice. In the absence of objection within the notice period, the change is deemed accepted.

8. Location of processing and international transfers

8.1  Hosting Region. iCure stores Client Personal Data in the Hosting Region selected by the Client:

(a) for the EU Hosting Region, in the European Union;

(b) for the Swiss Hosting Region, in Switzerland, including replicated copies of the databases.

iCure does not move Client Personal Data to another Hosting Region without the Client's instruction. A change of Hosting Region requires a new Sales Order with the iCure entity of the new Hosting Region.

8.2  Transfers. Any transfer of Client Personal Data outside the Hosting Region, including remote access from another country by personnel of iCure or of a Sub-processor, takes place only (a) to a country recognised as providing an adequate level of data protection under Article 45 GDPR or Article 16(1) FADP, or (b) under appropriate safeguards, such as the standard contractual clauses adopted by the European Commission, with the adaptations required by the FADP where Swiss law applies. The European Union recognises Switzerland, and Switzerland recognises the Member States of the European Union, as providing an adequate level of protection. Annex 4 describes the safeguards relied upon.

8.3  French health data. Where the Client stores health data covered by Article L.1111-8 of the French Public Health Code, the Client must select the EU Hosting Region; the Swiss Hosting Region is outside the scope of iCure's HDS certification. The information on transfers, remote access and exposure to non-European laws that certified health data hosts must publish is set out in Annex 4 and kept up to date.

9. Assistance to the Client

9.1  Data Subject requests. The iCure Services provide technical means, through their APIs and features, to access, rectify, export, restrict and erase Client Personal Data, including Encrypted Data in its encrypted form. If iCure receives a request from a Data Subject relating to Client Personal Data, it forwards the request to the Client without undue delay and does not respond to it unless the Client authorises it to do so. As iCure cannot decrypt Encrypted Data, its assistance in respect of Encrypted Data is limited to those technical means. Erased data remains in backup copies until they expire under the backup cycle described in Annex 2.

9.2  Other obligations. Taking into account the nature of the processing and the information available to it, iCure assists the Client in ensuring compliance with Articles 32 to 36 GDPR and Articles 8 and 22 to 24 FADP, in particular by providing information on its security measures, its certifications and its Sub-processors (including their own certifications) for data protection impact assessments and prior consultations of Supervisory Authorities.

9.3  Costs. Assistance going beyond the documentation and self-service features of the iCure Services may be charged at iCure's standard rates, unless it is needed because of a breach of this DPA by iCure.

10. Personal Data Breach

10.1  iCure notifies the Client without undue delay, and in any event within seventy-two (72) hours, after becoming aware of a Personal Data Breach affecting Client Personal Data, including a Personal Data Breach occurring at a Sub-processor.

10.2  The notification is sent to the Account Owner and to the privacy contact designated by the Client in the Cardinal Cockpit. The Client keeps these contact details up to date.

10.3  The notification describes, as far as the information is available, the nature of the Personal Data Breach, the categories and approximate number of Data Subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact point. Information not available at first is provided in phases without undue delay. iCure states whether the data concerned was Encrypted Data and whether Encryption Keys may have been compromised, so that the Client can assess its own notification obligations.

10.4  iCure takes reasonable measures to contain the Personal Data Breach, mitigate its possible adverse effects and prevent recurrence, and cooperates with the Client in its investigation. iCure documents every Personal Data Breach, including the facts, its effects and the remedial action taken, and provides that documentation to the Client on request. A notification is not an acknowledgement of fault or liability.

10.5  The Client remains responsible for notifying Supervisory Authorities and Data Subjects where required. iCure does not notify them on the Client's behalf unless the Client instructs it to do so or the law requires it.

11. Records and audits

11.1  Records. iCure keeps a record of the processing activities it carries out on behalf of its clients, as required by Article 30(2) GDPR and Article 12 FADP, and makes the relevant information available to the Client on request.

11.2  Documentation. iCure makes available to the Client the information necessary to demonstrate compliance with this DPA, in particular its certificates, a summary of its most recent external audit and penetration test, Annex 2 and, for Sub-processors, their certifications and, where the Sub-processor permits it, their audit reports or summaries of them (for example the Tier IV certification and ISAE 3402 Type 2 report of the Swiss Hosting Region datacenter). This information is Confidential Information of iCure.

11.3  On-site audits. Where the information under Section 11.2 is not sufficient to demonstrate compliance, where a Supervisory Authority requires it, or after a Personal Data Breach, the Client may audit iCure, itself or through an independent auditor bound by confidentiality who is not a competitor of iCure. The Client sends its request, with a proposed scope, at least twenty (20) working days in advance to privacy@icure.com. Audits take place during business hours, without disrupting the iCure Services, at most once per calendar year except after a Personal Data Breach or at the request of a Supervisory Authority, and are limited to the processing of Client Personal Data. The Client keeps all information obtained during the audit confidential and shares the audit report with iCure.

11.4  Sub-processors. Sub-processors are audited by iCure under its contracts with them or through their certifications and audit reports. Where the information under Section 11.2 is not sufficient, the Client may request an audit of a Sub-processor with the same notice; iCure organises it to the extent its contract with the Sub-processor allows, at the Client's cost, with an auditor who is not a competitor of iCure or of the Sub-processor.

11.5  Costs. Each party bears its own audit costs. iCure's time beyond one working day per audit is charged at CHF 1,000 (iCure SA) or EUR 1,000 (iCure Belgium SRL) per day or part of a day, unless the audit reveals a material breach of this DPA by iCure.

12. Requests from authorities and third-party measures

12.1  If iCure receives a request or order from an authority or any other third party to disclose Client Personal Data, iCure (a) redirects the requester to the Client where possible, (b) informs the Client without delay unless legally prohibited from doing so, and (c) discloses only what it is legally required to disclose, after assessing the lawfulness of the request and using the available remedies where reasonable. As iCure does not hold Encryption Keys, it can only disclose Encrypted Data in encrypted form.

12.2  If Client Personal Data held by iCure or by a Sub-processor is endangered by a seizure, an attachment, insolvency or composition proceedings or any other third-party measure, iCure informs the Client without delay and informs the authorities and persons concerned that the Client, or the controllers on whose behalf it acts, alone control that data.

13. Return and deletion of data

13.1  During the Agreement, the Client can export Client Data at any time through the APIs of the iCure Services.

13.2  On termination or expiry of the Agreement for any reason, iCure stops processing Client Personal Data other than as provided in this Section 13, and:

(a) keeps Client Data for sixty (60) days after the end of the iCure Services (the "Retrieval Period"), during which the Client may request its return by email to privacy@icure.com;

(b) on such request, returns Client Data in a structured, commonly used, machine-readable and interoperable format within twenty (20) working days, and keeps it until the return is completed; Encrypted Data is returned in encrypted form;

(c) at the end of the Retrieval Period, or earlier on the Client's written request, deletes Client Personal Data and all copies. Copies held in backups are deleted at the end of the backup cycle described in Annex 2, and in any event within twelve (12) months, and remain protected under this DPA until then.

13.3  iCure may keep Client Personal Data where the law of the European Union, of an EU Member State or of Switzerland requires it, only for the purpose and duration required and subject to this DPA.

13.4  On request, iCure confirms the deletion in writing.

13.5  For free subscription plans, iCure deletes the Client's entire database, including all Client Data, after twelve (12) months without activity. Activity means any authenticated access to that database through the iCure Services or their APIs. iCure informs the Account Owner by email at least one (1) month before deletion, so that the Client can export its data under Section 13.1; backup copies follow Section 13.2(c). For trial periods, the GT&C apply.

14. Liability

14.1  Each party is liable for damage caused by the processing attributable to it, in accordance with the Applicable Data Protection Law. iCure is liable for damage caused by the processing only where it has not complied with the obligations of the Applicable Data Protection Law specifically directed to processors or with this DPA, or where it has acted outside or contrary to lawful instructions of the Client.

14.2  The aggregate liability of each party arising out of or in connection with this DPA and the Applicable Data Protection Law, including in respect of Personal Data Breaches, is limited to the greater of (a) three (3) times the fees paid or payable by the Client for the hosting and processing of Client Data by the affected iCure Services in the twelve (12) months preceding the first event giving rise to liability, as identified in the Sales Order or the applicable price list, excluding fees for support packages, maintenance and support agreements, professional services, non-recurring engineering (NRE) and other additional services, and (b) CHF 1,000 (iCure SA) or EUR 1,000 (iCure Belgium SRL). For such claims, this cap replaces the general cap of the Agreement, and amounts paid under it do not count towards the general cap. The other limitations and exclusions of liability of the Agreement (Section 15 of the GT&C) continue to apply; however, the reasonable costs of investigating a Personal Data Breach caused by a breach of this DPA by iCure, and of notifying it to Supervisory Authorities and Data Subjects, are direct damages recoverable within this cap. Nothing in this DPA limits liability that cannot be limited under applicable law.

14.3  Where a party has paid full compensation to a Data Subject for damage for which the other party is responsible in whole or in part, it may claim back from the other party the part of the compensation corresponding to that party's responsibility.

15. Term, precedence and amendments

15.1  Term. This DPA applies for as long as iCure processes Client Personal Data, including during the Retrieval Period and until deletion.

15.2  Precedence. In case of conflict on data protection matters, this DPA prevails over the GT&C and any Sales Order, unless a Sales Order signed by both parties expressly derogates from a specific Section of this DPA. Standard contractual clauses entered into under Section 8.2 prevail over this DPA.

15.3  Amendments. iCure may amend this DPA to reflect changes in the Applicable Data Protection Law, in the iCure Services or in its Sub-processors (Section 7 then applies). iCure informs the Client of material amendments by email at least thirty (30) days before they take effect. No amendment may reduce the overall level of protection of Client Personal Data during a committed subscription term. A Client that objects may terminate the affected iCure Services without penalty before the amendment takes effect; continued use after that date is acceptance. Each published version is dated, and earlier versions are available on request.

15.4  Notices. Notices to iCure under this DPA are sent to privacy@icure.com. Notices to the Client are sent to the email address of the Account Owner.

15.5  Severability. If a provision of this DPA is or becomes invalid, it is replaced by a valid provision whose effect is as close as possible to the invalid one; the other provisions remain in force.

16. Governing law and jurisdiction

16.1  This DPA is governed by the law that governs the GT&C for the contracting iCure entity: Swiss law where iCure SA is the contracting entity, and Belgian law where iCure Belgium SRL is the contracting entity.

16.2  The parties first attempt to settle any dispute amicably. Failing that, the courts of Lausanne have exclusive jurisdiction where iCure SA is the contracting entity, and the French-speaking courts of Brussels have exclusive jurisdiction where iCure Belgium SRL is the contracting entity.

16.3  This Section does not affect the rights of Data Subjects or the competence of Supervisory Authorities under the Applicable Data Protection Law.

Annex 1: Sub-processors

Sub-processors are listed by Hosting Region. A Client only has its Personal Data processed by the Sub-processors of its own Hosting Region and by those listed under A. Infrastructure providers contracting on standard terms (OVHcloud, Google Cloud) use their own sub-processors, listed on their published sub-processor pages. The current list is also published at https://icure4.odoo.com/general-terms-conditions.

A. All Hosting Regions

Sub-processor	Purpose	Access to Client Personal Data	Location
iCure SA or iCure Belgium SRL, whichever is not the contracting entity	Intra-group operation, administration and support of the platform	Administrative access to production systems; no access to Encryption Keys	Switzerland / Belgium

B. EU Hosting Region (contracting entity: iCure Belgium SRL)

Sub-processor	Purpose	Access to Client Personal Data	Location
OVH SAS (OVHcloud), 2 rue Kellermann, 59100 Roubaix, France (RCS Lille Métropole 424 761 419)	Hosting and infrastructure	Data hosting on mirrored servers	Strasbourg (France) and Limburg (Germany), EU
Google Cloud EMEA Limited (Ireland), Google Cloud Platform; contracted through the reseller Devoteam G Cloud BeLux, Diegem, which has no access to Client Personal Data	Application servers (computing)	Transient processing of requests; no storage of Client Data; no Encryption Keys	Belgium (EU); safeguards in Annex 4
Passmann Benelux (formerly Taktik), Avenue Reine Astrid 92, 1310 La Hulpe, Belgium	Backup storage	Storage of encrypted backups	Belgium (EU)

C. Swiss Hosting Region (contracting entity: iCure SA)

Sub-processor	Purpose	Access to Client Personal Data	Location
Edificom SA, Route de la Corniche 1, 1066 Epalinges (CHE-111.720.820)	Provision and maintenance of physical servers and network connectivity	Physical access to servers only; no logical access; no access to Encryption Keys	Switzerland
BrainServe SA, Rue de la Vernie 12, 1023 Crissier (sub-processor of Edificom SA)	Datacenter colocation: physical hosting of servers and network connectivity	Physical access to the datacenter only; no logical access; no access to Encryption Keys	Crissier (VD), Switzerland
synaforce Schweiz AG (formerly ServerBase AG), Bachenbülach (ZH) (CHE-115.419.029)	Database storage and replication	Encrypted replication, on two separate physical sites	Winterthur (ZH) and Lupfig (AG), Switzerland

Edificom SA is contractually responsible towards iCure SA for the compliance of BrainServe SA with the physical security obligations of their data processing agreement. The BrainServe datacenter is certified Tier IV by the Uptime Institute and audited annually under ISAE 3402 Type 2 and FINMA Circular 2018/3.

Annex 2: Technical and organisational measures

This Annex describes the main measures iCure implements to protect the iCure Services and the data stored through them against malicious or accidental unauthorised access, loss or alteration. iCure reviews and improves these measures continuously.

A2.1 Certifications and governance

• ISO/IEC 27001:2022. iCure SA and iCure Belgium SRL operate a certified information security management system, audited by TÜV AUSTRIA Hellas. Internal audits and staff training take place between external audits.
• HDS. Certification as a French health data host (hébergeur de données de santé), activities 3 to 5, for the EU Hosting Region, issued by CertiTrust.
• ISO 13485:2016. Certified quality management system for the design and development of the iCure Services.
• Test data. No production data is used in test environments.
• Zero trust. A single security standard applies to every connected device, whether used by iCure personnel and contractors or by Clients accessing their own data.

A2.2 Encryption and access control

• End-to-end encryption. The iCure Services offer asymmetric end-to-end encryption by default. Users select the data to encrypt within a database, so that sensitive data stays encrypted while the unencrypted part can still be processed automatically.
• Design objectives of the encryption model: each data owner has a public and private key pair; a data owner can decrypt the data it created or that was shared with it, starting from its private key only; a data owner cannot decrypt data that was not shared with it; third parties cannot access sensitive data, nor infer relationships between entities that would reveal sensitive information (for example the frequency of a patient's visits); a data owner who loses its private key can regain access to data it had shared with other data owners.
• No access by iCure. The iCure Services are designed so that iCure does not hold Encryption Keys. Unless the Client provides the means under Section 4.2, Encrypted Data is not available in decrypted form to iCure personnel or to any Sub-processor.
• Data not encrypted end-to-end is encrypted in transit (TLS) and at rest, in both Hosting Regions.
• Granular permissions. The data model applies a cascade of permissions to every item of data within a Client database, so that each user only accesses the data appropriate to its role.
• Administrative access to production systems is limited to authorised personnel and protected by multi-factor authentication.
• Logging and processing regulation. End-to-end encryption is the primary preventive measure. In addition, access to and changes of personal data are logged in accordance with Article 4 FDPO, and iCure's ISO/IEC 27001 documentation, which covers iCure SA and iCure Belgium SRL, serves as the processing regulation required by Article 5 FDPO.

A2.3 Infrastructure of the EU Hosting Region

• OVHcloud. Data is stored on mirrored servers in the OVHcloud datacenters of Strasbourg (France) and Limburg (Germany); backups are kept separately by Passmann Benelux in Belgium.
• Google Cloud Platform (Google Cloud EMEA Limited), contracted through Devoteam G Cloud BeLux, runs the application servers in Belgium. No Client Data is stored and no Encryption Keys are kept on Google Cloud.
• Passmann Benelux (formerly Taktik). Backup storage in Belgium.
• OVHcloud and Google Cloud are certified ISO/IEC 27001 and HDS; Passmann Benelux is certified ISO 9001 and ISO/IEC 27001.

A2.4 Infrastructure of the Swiss Hosting Region

iCure SA runs the Swiss Hosting Region on physical servers provided and maintained by Edificom SA in the BrainServe SA datacenter in Crissier (VD). Edificom SA has physical access to the servers only; it has no logical access to operating systems, databases or data and never holds Encryption Keys. All data stored on these servers is encrypted, end-to-end or at rest, with keys that are not accessible to Edificom SA. The databases of the Swiss Hosting Region are stored and replicated, encrypted, by synaforce Schweiz AG (formerly ServerBase AG) on two separate physical sites in Winterthur (ZH) and Lupfig (AG). The measures of Edificom SA and BrainServe SA include:

• Datacenter: Tier IV certification by the Uptime Institute; annual ISAE 3402 Type 2 audit; compliance with FINMA Circular 2018/3; operations based on ISO 20000 and ITIL; on-site monitoring 24 hours a day, 365 days a year; location outside identified natural and industrial risk zones; proprietary fibre network around Lausanne connected to the main interconnection points.
• Physical access: strict access control to premises and server rooms, limited to expressly authorised persons; CCTV and access logs; identification and authentication of technicians; mandatory escort of third parties in sensitive areas; locked rooms and racks; register of physical access available to iCure SA.
• Continuity: redundant power supply (dual feed, UPS, generators) and cooling; documented backup and restoration of hardware configurations; business continuity and disaster recovery plan; physical intrusion tests at least once a year.
• Personnel of Edificom SA and BrainServe SA are bound by confidentiality and professional secrecy obligations equivalent to Section 5 of this DPA.

A2.5 Availability and resilience

• Service levels are set out in Annex I of the GT&C or, where applicable, in the Client's Maintenance and Support Agreement.
• Data is stored on mirrored servers, with an extensive backup policy in the hosting infrastructure. Data reconciliation and conflict resolution are built into the iCure Services.
• Backup cycle: a daily backup kept for one week, a weekly backup kept for one month, a monthly backup kept for three months and a quarterly backup kept for one year. Backups are not modified after creation; they expire at the end of this cycle.
• Restoration from backup is tested at least once a year, with documented results.

A2.6 Supplier management

• All suppliers are vetted before engagement and bound by a security policy proportionate to their access. Sub-processors are bound by the obligations described in Section 7, and their certifications are monitored.

Annex 3: Description of the processing

A3.1 Subject matter, nature and purposes

iCure processes Client Personal Data to provide, operate, secure and support the iCure Services subscribed by the Client, as further instructed by the Client through its use of the iCure Services. The processing consists of:

• hosting, storage, backup and restoration of Client Data;
• support for the encryption of Client Data, and synchronisation and transmission of Client Data between the Client's applications and End Users;
• technical operations needed to run and secure the iCure Services, including monitoring, maintenance and support;
• disclosure where required by law, under Section 12.

A3.2 Duration

The term of the Agreement, followed by the Retrieval Period and deletion under Section 13.

A3.3 Categories of Data Subjects

• End Users of the Client's applications: healthcare professionals, members of care teams, patients and their representatives;
• staff and users of the Client and of the controllers on whose behalf it acts;
• Account Owners and administrators of the Client's databases, insofar as their data is part of Client Data.

A3.4 Categories of Personal Data

• identification and contact data: name, email address, telephone number, postal address;
• national identification numbers, where the Client is authorised by law to process them (for example the Belgian national register number, NISS; in Switzerland, the AHV number only where its systematic use is authorised by law);
• authentication and technical data: user identifiers, credentials in protected form, IP addresses, device identifiers, logs and timestamps;
• any other data the Client or its End Users enter or upload, which may be Encrypted Data.

A3.5 Special categories of data

Health data and other special categories of Personal Data within Article 9 GDPR, and sensitive personal data within Article 5(c) FADP, as determined by the Client. The Client is expected to encrypt such data end-to-end. Because iCure cannot see Encrypted Data, it relies on the Client to determine the categories of data processed; the Client informs iCure if it processes data requiring specific measures, such as genetic data or data of minors on a large scale.

A3.6 Frequency and Sub-processors

Continuous processing for the duration of the iCure Services. Sub-processors are listed in Annex 1.

Annex 4: Transfers and exposure to non-European laws

A4.1 Transfer safeguards

• Between the European Union and Switzerland: adequacy decisions of the European Commission for Switzerland and of the Swiss Federal Council for the Member States of the European Union (Annex 1 FDPO).
• Google Cloud Platform: Google Cloud EMEA Limited (Ireland) runs the application servers in the EU and stores no Client Data. EU standard contractual clauses, Module 3 (processor to processor), incorporated in Google Cloud's terms and available at https://cloud.google.com/terms/sccs/eu-p2p, apply to any transfer outside the European Union by Google group entities.
• Remote administration: the platform is administered from Belgium. Administration of the Swiss Hosting Region from Belgium relies on the recognition of the EU Member States by the Swiss Federal Council. The EU Hosting Region is not administered from outside the European Union.
• Swiss Hosting Region database replication: stored in Switzerland (Winterthur and Lupfig); no transfer abroad.

A4.2 Information required from certified health data hosts (EU Hosting Region)

This section sets out, for the EU Hosting Region covered by iCure's HDS certification, the information on transfers, remote access and exposure to non-European laws that French law requires certified health data hosts to publish.

• Storage: health data is stored exclusively in the European Union: OVHcloud in Strasbourg (France) and Limburg (Germany), and Passmann Benelux (backups) in Belgium. Google Cloud Platform runs the application servers in Belgium and stores no data.
• Remote access from outside the European Union: none. The EU Hosting Region is administered from the European Union only.
• Exposure to non-European laws: Google Cloud EMEA Limited belongs to a group whose parent company, Google LLC, is established in the United States. United States laws, such as the CLOUD Act and Section 702 of the Foreign Intelligence Surveillance Act, may allow United States authorities to request data from the group. OVH SAS and Passmann Benelux (Passmann group, France) are European companies.
• Residual risk and measures: no Client Data and no Encryption Keys are stored on Google Cloud. Encrypted Data stays encrypted on the application servers, since it is decrypted only on the side of the Client and its End Users. Data not encrypted end-to-end is processed there only transiently, in memory, while requests are handled, and travels encrypted (TLS). Requests received by iCure itself are handled under Section 12.