Clinic Subscription Terms (B2B)

NACRT / DRAFT — pending legal review by qualified Croatian counsel. This is not a published, binding version.

Courtesy translation. The Croatian version of this document is the sole authentic and binding version; this translation is provided for convenience only.

1. Parties and application of these Terms

1.1. These Clinic Subscription Terms (the "Terms") are applied by [ legal entity name and form], with its registered seat at [ registered address], registered with [ court of registration and MBS number], OIB [ OIB], VAT ID [ VAT ID / VAT payer status], represented by [ representative name] ("Medkit"), in respect of the platform service available at medkit.ltd (the "Platform").

1.2. The "Clinic" is a healthcare institution, a company performing healthcare activity, a private practice, or another healthcare provider that concludes a subscription contract with Medkit under these Terms. The Clinic contracts exclusively within its registered or professional activity and does not act as a consumer; consumer-protection legislation (the Croatian Consumer Protection Act) does not apply to this contract.

1.3. The contract between Medkit and the Clinic (the "Contract") is concluded when the Clinic registers an account (Section 4.1), or when its claim of a Directory listing is approved (Section 4.3), and begins using the service; use of the service constitutes acceptance of these Terms. The registration and claim flows currently include no separate terms-acceptance confirmation (checkbox). [ counsel to confirm acceptance mechanics; consider adding an acceptance checkbox at registration] Annex 1 — the Data Processing Agreement under Art. 28 of the General Data Protection Regulation ("GDPR") forms an integral part of the Contract.

2. Definitions

• "Directory" — the public catalogue of healthcare providers on the Platform, including unclaimed listings imported from the public registry (Section 4.2).
• "Profile" — the public page of the Clinic or of a healthcare practitioner on the Platform.
• "Agenda Module" — the part of the Platform used by the Clinic to manage appointments (confirmations, cancellations, no-show records), availability rules, and the internal on-call duty roster.
• "Patient Data" — patients' personal data collected through the Platform: name, email address, phone number (optional), reason for visit (optional), appointment details (time, chosen practitioner, location), and related records.
• "Active Practitioner" — a healthcare practitioner with a profile activated on the Clinic's account.
• "Trial Period" — the period defined in Section 5.1.

3. Description of the service

3.1. Medkit is an online intermediation service within the meaning of Regulation (EU) 2019/1150 (the "P2B Regulation"): it enables patients to browse the Directory and book appointments with Clinics online, and enables Clinics to manage their Profile, appointments, and the Agenda Module.

3.2. Medkit is not a healthcare provider, provides no medical advice, diagnosis, or treatment, and is not a party to the relationship between the patient and the Clinic. The healthcare contract is concluded exclusively between the patient and the Clinic.

3.3. The service is free of charge for patients. Medkit never processes or intermediates patient payments — no charges, advances, deposits, or per-appointment commissions. Any patient payments are strictly a matter between the patient and the Clinic.

3.4. The subscription includes an unlimited number of online bookings; the fee is never metered per appointment or booking.

3.5. Patients have no user accounts on the Platform; they access their appointment via a confirmation email. The Platform currently sends the following transactional emails: (a) to the patient — a booking confirmation with a calendar file (.ics attachment) and a link to cancel the appointment; (b) to a patient on the waitlist — a notification that a slot has become available, with a booking link; (c) to the person who submitted a claim request — a notification of the decision on the request (approval with a sign-in link, or a rejection notice). No other emails are sent. Transactional emails are sent from a no-reply sending address.

4. Registration and claiming a Directory listing

4.1. An account is created by registering with an email address, password, practice name, and city; the account is active immediately upon registration.

4.2. The Directory also contains unclaimed listings (approximately 3,700) imported from the publicly available registry of healthcare providers (National Registry of Healthcare Providers, HZJZ): name, address, city, postal code, activity category, and the data snapshot date. Medkit does not add invented contact details (phone, email, website) to these listings.

4.3. Claim process: an authorised person of the Clinic submits a request via the form (requester's name, email, phone, and an explanation or evidence of their connection to the Clinic). Medkit reviews requests manually. Upon approval, a Clinic administrator account is provisioned and a sign-in link is emailed to the stated address.

4.4. Removal requests: removal of a listing from the Directory (e.g. closed practice, incorrect data, objection) may be requested via the publicly available form. Honoured requests are entered on a suppression list that prevents the removed listing from being re-imported in future registry updates. Review and processing of requests is currently performed manually.

4.5. The Clinic is responsible for the accuracy of the data submitted in the claim process, and the requester warrants that they are authorised to represent the Clinic.

5. Trial Period

5.1. New accounts are granted a free trial period of 90 days from registration, with full Platform functionality.

5.2. After the Trial Period expires, continued use of the service is subject to the paid subscription under Section 6.

5.3. Billing is currently not activated; until it is activated, no subscription is charged to anyone. Medkit will notify the Clinic in writing at least 30 days before the first charge; until that time the Clinic may terminate the Contract at no cost.

6. Price and payment terms

6.1. The monthly subscription is EUR 39 (net, excluding VAT) per Clinic and includes up to 2 Active Practitioners.

6.2. Each additional Active Practitioner is charged at EUR 20 per month (net).

6.3. VAT is applied to the above amounts in accordance with applicable law: [ VAT treatment].

6.4. Invoicing, payment method, and payment deadlines: [ invoicing mechanics and payment terms].

6.5. Price changes: Medkit will notify the Clinic of price changes in writing (durable medium) at least [ price-change notice period — proposed 30 days] before they apply. The new price applies from the start of the next billing period following expiry of the notice period; until then the Clinic may terminate the Contract at no cost.

6.6. The fee never depends on the number of bookings and contains no per-appointment commission of any kind.

7. Term, termination, and consequences of termination

7.1. The Contract is concluded for an indefinite term with monthly billing periods.

7.2. Termination by the Clinic: the Clinic may terminate the Contract at any time, effective at the end of the current billing period; during the Trial Period and before billing activation, termination takes immediate effect and is free of charge.

7.3. Termination by Medkit: Medkit may terminate the Contract in the ordinary course with 30 days' notice and a statement of reasons on a durable medium (Art. 4 of the P2B Regulation). Extraordinary termination without notice, or with shortened notice, is possible only in the cases set out in Section 11.3.

7.4. Consequences of termination: access to the Agenda Module and Profile management ceases. A listing originating from the public registry may remain in the Directory as an unclaimed listing after termination; the removal process under Section 4.4 applies to it.

7.5. Data after termination: upon the Clinic's written request submitted within [ data return/deletion window in days — proposed 30] days of termination of the Contract, Medkit will hand over to the Clinic a copy of the Patient Data it processed as processor and thereafter delete it, all in accordance with Annex 1. Handover and deletion are currently performed manually; automated self-service export is not available.

7.6. Provisions which by their nature survive termination of the Contract (in particular confidentiality, liability, and data protection) remain in force.

8. Clinic obligations and warranties

8.1. Status: the Clinic warrants that it is an authorised healthcare provider under Croatian law (including the Healthcare Act, Zakon o zdravstvenoj zaštiti), that it holds all approvals required for its activity, and that the practitioners shown on its Profile are authorised to perform the stated activity.

8.2. Data accuracy: Profile data (activities, descriptions, locations, availability) must be accurate and up to date; the Clinic updates it without delay.

8.3. Appointment management: the Clinic must regularly review booking requests (including "pending" ones), maintain an accurate availability calendar, diligently record confirmations, cancellations, and no-shows, and honour duly booked appointments or cancel them in good time.

8.4. Data protection on the Clinic's side: the Clinic is an independent controller for healthcare purposes (Section 13) and warrants that it: (a) has a valid legal basis for processing its patients' data, including a basis under Art. 9(2) GDPR for health data; (b) provides its own processing information to patients; (c) maintains professional secrecy in accordance with healthcare legislation; (d) uses Patient Data received via the Platform exclusively for arranging appointments and providing healthcare.

8.5. Staff accounts: the Clinic keeps credentials confidential, is responsible for actions taken through its staff accounts, and promptly removes access for persons no longer authorised.

8.6. The following are prohibited: publishing untrue or unlawful content, submitting or soliciting fake reviews, misusing the Platform, and actions endangering its security or integrity.

8.7. The Clinic is responsible for the content it publishes on its Profile.

9. Medkit's obligations; security; availability

9.1. Medkit provides the service with the diligence of a prudent businessperson and keeps the Platform in working order.

9.2. Security measures (as implemented): data storage in the European Union (Supabase, AWS region eu-west-1, Ireland); encrypted transport (TLS with HSTS); multi-tenant isolation enforced at the database level (forced row-level security policies covered by automated tests); database-enforced integrity constraints (double-booking prevention, tenant-consistency checks); patient access exclusively via unguessable capability tokens; staff-action audit logging; strict security headers and a Content Security Policy with no third-party scripts; server-side-only service keys. Data is stored and processed in the EU: the Supabase database (AWS region eu-west-1, Ireland), the subprocessor Vercel's serverless functions in EU region fra1 (Frankfurt, Germany), and email sending via Resend (AWS region eu-west-1). Vercel's CDN/edge network for content delivery is global, and certain providers are US-headquartered companies; details and transfer safeguards are governed by Annex 1.

9.3. Availability: Medkit uses reasonable efforts to keep the service available but does not guarantee uninterrupted or error-free availability; no contractual service level (SLA) exists. Medkit may perform maintenance while endeavouring to minimise disruption.

9.4. Clinic support is available at: [ clinic support contact email].

10. Ranking in search and the Directory (Art. 5 P2B Regulation)

10.1. Practitioner search (results with online booking). The search criteria set by the patient — specialty, city or map area, language, patient age group (adults/children), free-text query, and the optional "available today" filter — act as filters: they determine which results appear at all. The main parameter ordering the displayed results is availability of bookable slots: results are ordered ascending by the first available slot (soonest first). Practitioners without any bookable online slot in the searched period are omitted from search results (they are not shown, i.e. they are not shown "last"). Where the first available slot is the same, results are ordered alphabetically by name.

10.2. Clinic Directory (listings without active online booking, primarily from the public registry). The query (name, city, specialty) acts as a filter. Displayed listings are ordered: first by listing status (activated, then claimed, then unclaimed listings), then by an internal listing category assigned at import from the public registry, then alphabetically by name.

10.3. Ratings and reviews are displayed alongside results but do not affect ranking.

10.4. Paid placement does not exist; the fee paid by the Clinic has no direct or indirect influence on ranking, and Medkit applies no differentiated treatment in favour of its own or related providers (there are none). If paid placement is ever introduced, it will be clearly labelled and these Terms amended with prior notice under Section 18.

10.5. Practical note: for its practitioners to be visible in search results with appointment slots, the Clinic must have published availability rules (see Section 10.1).

11. Restriction, suspension, and delisting (Art. 4 P2B Regulation)

11.1. Medkit may restrict or suspend a Profile, specific content, or functionality in the event of: a material breach of these Terms, unlawful content, a serious security risk, or where required by law or a decision of a competent authority.

11.2. In the event of restriction or suspension, Medkit will provide the Clinic with a statement of reasons on a durable medium before, or at the latest at the time, the measure takes effect. Full delisting (termination) is subject to 30 days' notice with reasons.

11.3. The notice period and prior notification do not apply where: (a) Medkit is subject to a legal or regulatory obligation requiring it; (b) the Clinic repeatedly infringes the Terms; or (c) it is necessary to avert imminent harm, a security risk, or legal liability.

11.4. The Clinic may lodge a complaint against measures under this Section pursuant to Section 19.

12. Patient reviews and content moderation

12.1. Reviews can be submitted only via a link tied to an actually booked appointment (the access token from the confirmation email); reviews are thereby limited to persons who booked through the Platform.

12.2. Reviews are publicly visible on the Profile. The Clinic cannot edit or delete them.

12.3. Reporting illegal content (including defamatory reviews): to [ clinic support contact email]. Reports are currently processed manually; no automated moderation tools exist. Medkit may remove unlawful content and provides the affected party with a statement of reasons in accordance with Art. 17 of Regulation (EU) 2022/2065 (DSA).

12.4. Reviews express patients' subjective opinions; Medkit is not their author and is liable for them only within the limits applicable to hosting providers under applicable law.

13. Data protection — allocation of roles

13.1. (a) Public booking flow (marketplace): Medkit and the Clinic act as separate, independent controllers, each for its own purposes. Medkit is the controller for: collecting data via the booking form, transmitting it to the Clinic, transactional emails to patients, Platform security, abuse prevention, and audit logging. The Clinic is the controller for: arranging and providing healthcare, its own medical records and retention periods, and patient rights relating to treatment.

13.2. Should a competent supervisory authority or court find that the flow under Section 13.1 involves joint controllership (Art. 26 GDPR), the provisions of Section 13.1 serve as the arrangement allocating responsibilities between the parties, and the essence of that arrangement is made available to data subjects in Medkit's privacy notice.

13.3. (b) Agenda Module: for data the Clinic processes in the Agenda Module, the Clinic is the controller and Medkit its processor — exclusively on documented instructions and under the terms of Annex 1.

13.4. (c) Unclaimed Directory listings: Medkit is the sole controller; the legal basis is legitimate interest (Art. 6(1)(f) GDPR — public availability of official healthcare-provider information), with a right to object and the removal process under Section 4.4.

13.5. The parties cooperate in fulfilling data-subject rights and forward received requests to each other without undue delay; Medkit's data-protection contact: privacy@medkit.ltd.

13.6. Subprocessors used by Medkit: Supabase (database and authentication; AWS eu-west-1, Ireland), Vercel (hosting; serverless functions in EU region fra1, Frankfurt; global CDN/edge network), Resend (transactional email; sending from AWS region eu-west-1). The full list, engagement conditions, and third-country transfer mechanisms are governed by Annex 1.

14. Data Processing Agreement (Annex 1)

14.1. The parties conclude a Data Processing Agreement under Art. 28 GDPR, which constitutes Annex 1 and forms an integral part of the Contract.

14.2. In the event of conflict between these Terms and Annex 1 on data-protection matters, Annex 1 prevails.

15. Intellectual property

15.1. The Platform, its software, design, and trademarks belong to Medkit or its licensors. Through the subscription the Clinic acquires a non-exclusive, non-transferable right to use the Platform for its own business needs for the duration of the Contract.

15.2. The Clinic retains all rights in the content it provides (names, descriptions, photographs, price lists). The Clinic grants Medkit a non-exclusive, royalty-free, territorially unlimited licence to display that content on the Platform (including the Directory and search results) for the purpose of providing the service, for the duration of the Contract.

15.3. The Clinic warrants that its content does not infringe third-party rights.

16. Confidentiality

16.1. Each party will use the other party's confidential information solely to perform the Contract and will not disclose it to third parties, except where required by law or by a decision of a competent authority.

16.2. The confidentiality obligation does not apply to information that is publicly available without breach of the Contract, that the party lawfully held before receipt, or that it developed independently.

16.3. The confidentiality obligation survives termination of the Contract. Personal data is governed by Annex 1.

17. Liability

17.1. Medkit is not liable for the provision, quality, availability, or outcome of healthcare services, nor for disputes between the Clinic and patients.

17.2. Medkit's total liability under or in connection with the Contract is limited to the fees paid by the Clinic to Medkit in the 12 months preceding the event giving rise to liability; if no fees were paid in that period (Trial Period, billing not activated), liability is limited to EUR 39.

17.3. The limitations in this Section do not apply to damage caused intentionally or by gross negligence (Art. 345 of the Croatian Obligations Act, ZOO) or in other cases where liability cannot be excluded or limited under mandatory law.

17.4. To the extent permitted by mandatory law, liability for indirect damage and lost profit is excluded.

17.5. The Clinic will indemnify and hold Medkit harmless against third-party claims (including patients and competent authorities) arising from the Clinic's breach of its warranties and obligations under Section 8, including the absence of a valid legal basis for the Clinic's processing of patient data.

18. Changes to the Terms

18.1. Medkit may amend these Terms with notice to the Clinic on a durable medium at least 15 days before the amendments take effect (Art. 3(2) of the P2B Regulation), or with a longer period where the amendments require technical or business adaptations by the Clinic.

18.2. A Clinic that does not agree with the amendments may terminate the Contract at no cost before they take effect. Continued use of the service after the amendments take effect constitutes acceptance.

18.3. The notice period does not apply where an amendment is necessary to comply with a legal or regulatory obligation or to avert imminent danger. Amendments do not apply retroactively.

19. Clinic complaints

19.1. The Clinic may submit complaints regarding the service, measures under Section 11, or ranking under Section 10 to [ clinic support contact email]. Medkit considers complaints diligently and without undue delay and responds in writing.

20. Governing law, jurisdiction, and language

20.1. The Contract is governed by Croatian law. Disputes are subject to the jurisdiction of [ competent court venue].

20.2. The Croatian version of these Terms is the sole authentic and binding version; the English translation is provided for convenience only.

21. Final provisions

21.1. The invalidity or unenforceability of any provision does not affect the validity of the remaining provisions; an invalid provision shall be replaced by a valid one that most closely achieves its purpose.

21.2. These Terms, together with Annex 1 and the price list displayed in the application, constitute the entire agreement between the parties and supersede all prior arrangements on the same subject matter.

21.3. The Clinic may not assign the Contract without Medkit's prior written consent; Medkit may assign it to an affiliated company with notice to the Clinic.

21.4. Communication between the parties takes place electronically, to the email addresses associated with the Clinic's account.

---

Last updated: [ date]