General Terms and Conditions for the Medevio Application (Healthcare Providers Section)

1 Introductory Provisions
‍
1.1 The company Medevio s.r.o., ID: 09675400, VAT ID: CZ09675400, registered at Sudoměřská 1413/2, Žižkov, 130 00 Prague 3, listed in the Commercial Register maintained by the Municipal Court in Prague, file no. C 340224 (hereinafter "Medevio"), operates the Medevio web and mobile application (hereinafter the "Application"), which enables healthcare providers (hereinafter "Healthcare Providers" or "Providers") to communicate digitally with patients.

1.2 These General Terms and Conditions (hereinafter the "GTC") define the rights and obligations of the parties arising from a contract regarding the use of the Application, which may be concluded between the Provider and Medevio as the Application’s operator (hereinafter the "Contract"). These GTC constitute an integral part of the Contract. For the purposes of these GTC, any Provider that has concluded a Contract with Medevio under these GTC will be referred to as the customer (hereinafter the "Customer").

1.3 Medevio is solely a provider of a technical solution in the form of the Application, with the Customer remaining solely responsible for providing healthcare services. The Customer acknowledges that the Application is intended to facilitate and enhance the security of remote communication with patients and that its use does not replace the management of medical records.
‍
2. Conclusion of the Contract
‍
2.1 The Customer may only be a person authorized to provide healthcare services under Act No. 372/2011 Coll., on Health Services and Conditions of Their Provision (Health Services Act), as amended. By registering and proposing to conclude the Contract, the Customer expressly declares and confirms that they hold all authorizations required for providing healthcare services.

2.2 To initiate the Contract conclusion process under these GTC, the Provider, or a person authorized to act on behalf of the Provider (hereinafter the "Authorized Person"), must complete registration at https://my.medevio.e or have an account created upon their request by Medevio. The Contract between Medevio and the Provider is concluded upon completion of registration. During registration, the Customer is required to provide accurate and truthful information. The chosen login credentials will be used post-contract as the Customer’s means of accessing the Application’s interface for Providers, which allows for the management of healthcare facilities (hereinafter the "Customer Account"). Medevio reserves the right to refuse to activate and conclude the Contract with the Provider for any reason.

3. Rights and Obligations of Medevio

3.1 Under the Contract, Medevio commits to maintaining the Customer Account for the Customer, enabling the use of the Application with functionalities specified in the Customer’s order. The specific functionalities of the Application are defined on the webpage: https://www.medevio.eu/for-doctors.

3.2 Medevio also commits to providing the Customer with user support services as necessary, with Customer requests being processed within timelines appropriate to the nature of the request.

3.3 Medevio will make reasonable efforts to ensure the Application remains continuously accessible, secure, and error-free. However, as a complex IT system partly dependent on third-party infrastructure, Medevio cannot guarantee, nor does it guarantee, that the Application and its functionalities will always operate without error, be continuously available, or be secure from breaches, particularly in cases of force majeure, cyber-attacks, technical issues, or routine maintenance. Medevio frequently updates the Application, which may result in temporary unavailability due to scheduled or unscheduled maintenance by Medevio or third-party providers, or for other reasons beyond Medevio’s reasonable control.

3.4 The Customer declares they have thoroughly reviewed the Application’s features and assessed its suitability for their needs. Medevio is only liable to the Customer for damages intentionally or grossly negligently caused by Medevio. Otherwise, to the extent permitted by law, Medevio excludes liability for damages incurred by the Customer from using or in connection with the Application, and the Customer waives any right to compensation for such damages. Should Medevio be obligated to compensate the Customer for damages, the compensation amount shall not exceed the total of payments made by the Customer to Medevio under the Contract in the last 12 calendar months.

3.5 Medevio reserves the right to modify or terminate the operation of the Application at any time. Medevio bears no responsibility for any damages that may arise for the Customer as a result of such action. Medevio will inform the Customer of any significant changes to or termination of the Application’s operation in advance, at least 10 days prior to such action.

3.6 In the event of any breach of these GTC by the Customer, Medevio reserves the right, without prior notice or compensation, to temporarily restrict the Customer's access to the Application or immediately terminate the Contract and cancel the Customer’s account, at its sole discretion. Medevio is not responsible for any damage the Customer may incur as a result of restricted access to the Application or account cancellation. Such restriction or cancellation does not release the Customer from obligations towards Medevio concerning any fees due prior to the restriction or cancellation. The Customer is liable to Medevio for any damage caused or arising from the use of the Application in violation of these GTC or relevant legal regulations.

3.7 The Application is not a medical device within the meaning of Act No. 268/2014 Coll., on Medical Devices and Amendments to Act No. 634/2004 Coll., on Administrative Fees, as amended.

3.8 Medevio’s questionnaires and their evaluations serve as an indicative assessment of symptoms associated with specific diseases, and neither a positive nor a negative result excludes other diseases. Results calculated by the Medevio platform do not replace the professional clinical judgment of a physician.

3.9 By concluding the Contract, the Customer agrees that Medevio may disclose (including outside the Application) the fact that the Customer uses the Application, including the option to display their logo in Medevio’s marketing campaigns at its discretion, for example on the website, social media, or other service presentations.

4. Rights and Obligations of the Customer

4.1 The Customer declares that they have thoroughly reviewed and agree to comply with these GTC unconditionally.

4.2 The Customer guarantees they are authorized to provide healthcare services per Act No. 372/2011 Coll. and commits to using the Application only for healthcare services specified in their authorization.

4.3 As an Application user, the Customer assumes sole responsibility for communications with patients and the consequences of these communications. Medevio does not interfere with the legal relationship between the Customer and patients. The Customer provides healthcare services independently under their name and on their account, independently managing the Customer Account and related settings. The Customer assumes all responsibility for providing healthcare and using the Application, including handling patient requests (e.g., appointment cancellations, provision of incorrect information), agreeing to indemnify Medevio for any third-party claims or fines arising from such use. The Application does not replace healthcare documentation and cannot be used to fulfill obligations for record-keeping.

4.4 The Customer agrees to use the Application solely in accordance with its intended purpose and not to harm Medevio’s reputation or interests. When using the Application, the Customer commits to adhering to all relevant legal and ethical standards, as well as performing services with due diligence and in accordance with best practices.

4.5 The Customer agrees to fulfill all legal information and instruction obligations regarding healthcare services, especially towards patients (also as consumers and data subjects).

4.6 The Customer agrees that all information provided in the Application’s patient section or otherwise communicated via the Application will be lawful, accurate, truthful, complete, non-misleading, and current, and they commit to maintaining these qualities continuously.

4.7 If the Customer uploads content (e.g., information, personal data, attributes of third parties, copyrighted works) (hereinafter "Customer Content"), they guarantee having the rights to do so (e.g., appropriate licenses, permissions). Medevio is granted a free, non-exclusive, global license to use Customer Content necessary for providing Application services, with Medevio not monitoring compliance with legal standards. If Medevio discovers that Customer Content violates laws, Medevio may make it inaccessible or remove it.

4.8 The Customer agrees not to use the Application to spread unsolicited messages, computer viruses, or other illegal or harmful data.

4.9 Medevio holds no responsibility for the actions of users with a patient account towards the Customer (e.g., failing to attend appointments). Although Medevio verifies patient identity, it does not guarantee that the person using a patient account is who they claim to be. The Customer must independently secure patient consent for any patient-related documentation or data conveyed via the Application.

4.10 The Customer may permit necessary individuals to access their Customer Account, provided each person has their own user account (shared login details are prohibited). Customer Account use by other individuals is considered Customer use, with the Customer assuming responsibility for any GTC violations resulting from such use.

4.11 The Customer agrees not to misuse the Application or employ methods, tools, or scripts that could impair its operation, functionality, or burden it unreasonably.

4.12 The Application and its content may be protected by intellectual property rights. Under these GTC, the Customer is authorized to use the Application only in a standard manner through the Customer Account for intended purposes. No other rights to the Application or its content are granted.

4.13 The Customer is not permitted to use the Application or its components (e.g., source codes, logos, graphic elements) to develop a competing application or engage in other actions infringing Medevio’s rights, including functional analysis or reverse engineering.

5. Ordering, Pricing, and Free Access

5.1. The Customer agrees to pay Medevio a fee for the ability to use the Application in accordance with the order and the current price list, available at https://www.medevio.eu/for-doctors. The Customer acknowledges that Medevio is entitled to unilaterally change the price list; Medevio will notify the Customer of any such change well in advance, at least 30 days before it becomes effective, by publishing the updated price list on its website, www.medevio.eu, or within the Application interface. For more substantial changes, a notification will also be sent to the Customer’s registered email address. The Customer consents to receiving invoices (tax documents) electronically with a 14-day payment term.

If the Customer is not using the freemium version as per clause 5.2, the amount of the fee will be specified on the electronic invoice sent to the Customer. By paying the invoice, the Customer agrees to the fee amount stated on it.

The Customer may also arrange to use the Stripe payment gateway. The invoice amount is final and includes third-party fees. Medevio facilitates access to the payment gateway by establishing an affiliated account, and its use is subject to Stripe’s terms and conditions.

If the Customer offers users the option to pay for selected services online, the user pays through Stripe as the intermediary, and under Stripe’s payment terms.

The Customer can configure the method and frequency of payouts from Stripe in their affiliated Medevio account.

5.2. Freemium. Medevio offers the Customer a trial period for free use of the Application, as specified in the price list, during which the Agreement can be terminated by the Customer immediately and without notice, simply by sending a notice to info@medevio.eu. The length of the trial period can be extended by agreement between Medevio and the Customer or as part of a special offer defined by Medevio.

5.3. In the event of the Customer's delay in payment of the fee, Medevio has the right to terminate the Agreement with immediate effect and to charge interest on the overdue payment at the statutory rate. Payment is considered completed on the date it is credited to Medevio's bank account.

5.4. If Medevio, by agreement with the Customer, allows the Customer to use the Application at a price different from the standard price list, the Customer is obligated to maintain confidentiality regarding this non-standard price. In the event of a breach of this confidentiality obligation, the Customer is required to pay Medevio a contractual penalty equal to the payments made to Medevio by the Customer based on the Agreement in the 12 calendar months preceding this breach.

6. Data Protection

6.1. Given that the Application is a cloud-based tool designed in part to handle personal data, Medevio, when fulfilling the Agreement for the Customer, processes personal data entered into the Application by the Customer or collected through it, including data about the Customer’s patients (hereinafter referred to as "Customer Data"). This processing is governed by the Data Processing Agreement, attached as Annex 1 to these Terms and Conditions, and thus becomes an integral part of every Agreement (hereinafter referred to as the "Agreement"). Medevio may collect and process Customer Data through patient registrations into the Medevio application at the Customer's request. The Customer acknowledges and agrees that Medevio, in such cases, may also establish a direct relationship with the registering patients, who will become users of the application. Following registration, Medevio will process patients’ personal data as a data controller, particularly to provide the Medevio application, and may also ask patients for consent to further processing of their personal data.

6.2. With regard to Customer Data, Medevio is bound by a confidentiality obligation and commits to implementing technical and organizational measures in accordance with the Agreement.

6.3. Information on the processing of personal data of Authorized Persons and other users of the Customer Account is available in a separate document at www.medevio.eu/personal-data-processing.

6.4. Medevio also uses cookies to a limited extent for the operation of the Application. Our cookie policy is included in a separate document available at www.medevio.eu/personal-data-processing.

7. Final Provisions

7.1. The Agreement based on these Terms and Conditions is concluded for an indefinite period. Both the Customer and Medevio have the right to terminate the Agreement without stating a reason, by giving written notice with a one-month notice period, which begins on the first day of the calendar month following delivery of the written notice to the other party.

7.2. Upon termination of the Agreement, the Customer Account will be canceled, and all Customer Content, including Customer Data, will be deleted.

7.3. The Customer is not entitled to assign or transfer their rights and obligations under the Agreement to a third party. However, the Customer agrees that all rights and obligations of Medevio under the Agreement may be assigned to a third party by Medevio without further consent.

7.4. Due to the nature of the Application and its planned development, changes to these Terms and Conditions may be necessary. Medevio may make reasonable unilateral changes to these Terms and Conditions. Reasonable changes include corrections of inaccuracies, modifications related to changes in the Application’s functionalities or their pricing, changes in fees, changes in the Privacy Policy, the Cookie Policy, and the Data Processing Agreement, as well as changes mandated by legal requirements. Medevio will inform the Customer of any changes to the Terms and Conditions at least 30 days before they take effect, either by publishing the updated Terms on www.medevio.eu or within the Application interface. For substantial changes, a notification will also be sent to the Customer's registered email address. The Customer has the right to reject the changes and terminate the Agreement in writing, no later than 15 days after Medevio notifies them of the changes. The notice period will be 15 days from receipt of the written notice by Medevio. If the Customer does not terminate the Agreement within the specified period, the changes will be deemed accepted, and the new Terms and Conditions will replace the original terms as part of the Agreement. The current version of the Terms and Conditions is always available on www.medevio.eu and within the Application, and the Customer is obligated to review it periodically.

7.5. All legal relationships between the Customer and Medevio arising from or in connection with the Agreement are governed by the laws of the Czech Republic. Any disputes arising from or related to the Agreement will be resolved exclusively under Czech law, in the District Court for Prague 1 or the Municipal Court in Prague.

7.6. The invalidity of any provision of these Terms and Conditions does not affect the validity of the remaining provisions.

7.7. Medevio and the Customer are both entitled to terminate the Agreement without notice if either party becomes insolvent within the meaning of Act No. 182/2006 Coll., the Insolvency Act.

7.8. For any questions, requests, or complaints, you can contact Medevio at info@medevio.eu.

Annex 1 to the Terms and Conditions
‍
DATA PROCESSING AGREEMENT

1. Introductory Provisions

1.1. This Agreement, in accordance with Article 28, Section 3 of the GDPR, is part of the Contract between Medevio and the Healthcare Provider (HCP) based on the General Terms and Conditions (hereinafter the “Agreement”). All terms defined in the General Terms and Conditions apply to this Agreement. The Agreement concerns the processing of Customer Data (as further specified in Section A of this Agreement) (hereinafter “Processing”), for which the Customer acts as the data controller and Medevio as the data processor.

2. Obligations

2.1. The Customer, as the data controller of Customer Data, agrees to maintain a valid legal basis for processing Customer Data in the Application throughout the processing period and to fulfill all legal obligations toward data subjects, particularly the duty to inform. The Customer further agrees to promptly remove from the Application any Customer Data for which it lacks a valid legal basis for processing.

2.2. Medevio agrees to process Customer Data solely based on the Customer's instructions under this Agreement, including instructions provided through the Customer Account or customer support services. Instructions are limited to Medevio’s contractual obligations under the Contract. Medevio will inform the Customer if it believes any instructions violate legal regulations.

2.3. Customer Data will not be transferred to countries outside the EU (i.e., third countries).

2.4. Medevio agrees to maintain confidentiality regarding all Customer Data and ensures that all persons authorized to process personal data on behalf of Medevio are bound by contractual or statutory confidentiality obligations, including other processors engaged by Medevio in the Processing. Confidentiality obligations persist even after the Contract ends.

2.5. Medevio is authorized to grant access to patient personal data to contractually appointed processors who directly participate in managing and operating the Application.

2.6. The Customer, as the controller, grants Medevio general authorization to modify the engagement of processors.

2.7. Medevio agrees to implement technical and organizational measures as described in Section B of this Agreement.

2.8. Medevio will assist the Customer to a reasonable extent in fulfilling its obligations to respond to data subjects’ requests for rights exercise through customer support services if requests cannot be addressed directly via the Customer Account. If Medevio receives a request intended for the Customer, it will forward it to the Customer without undue delay.

2.9. Medevio will assist the Customer to a reasonable extent in ensuring compliance with obligations regarding the security of Customer Data, breach notification, data protection impact assessment, and consultation with the supervisory authority, taking into account the nature of Processing and available information. Medevio will notify the Customer without undue delay of any security breach involving Customer Data.

2.10. Upon termination of the Contract, Medevio will delete Customer Data and its copies unless laws require their retention. Since Customer Data is processed exclusively electronically and is accessible to the Customer, Medevio is not required to return Customer Data on a data carrier.

2.11. Medevio will provide the Customer with all necessary information to demonstrate compliance with Article 28 of the GDPR and will allow audits, including inspections conducted directly by the Customer or an auditor appointed by the Customer, within reasonable timeframes and assist with these audits.

3. Section A – Systematic Description of Processing

3.1. Medevio will act as a processor for the Customer by performing the following specified Processing of Customer Data (in terms of securing the technical solution through the Application):

‍
4. Section B – Technical and Organizational Measures

4.1. Medevio agrees to implement and maintain technical and organizational measures related to the Processing to at least the following extent:

• Secure data center certified to ISO 27001, located within the EU, with logical (firewall, passwords, roles and permissions) and physical access controls (doors, locks, reception/security, electronic security, CCTV);
• Encryption of Customer Data during transmission;
• Strong password policy in the Application, with passwords encrypted;
• Data processing agreements under Article 28 of the GDPR with all processors;
• Internal data protection policy, including access control management to Customer Data;
• Regular automatic backups;
• Periodic review of security policy.