Platform Use Agreement and Data Processing Terms — Doctful

1. Parties and subject

This contract is entered into by Dario Sangiovanni (10 Under Tiber Studio), with office at Via Castagnevizza 192, Fiumicino, Rome, 00054 Italy, VAT number IT13120271005, registered with the Rome Companies Register, REA RM-1766019, and the Client identified in the order or account details, for use of the Doctful platform.

This Agreement is a special and supplementary set of terms to the Terms of Service of the platform. The Terms of Service continue to apply to matters not expressly regulated by this Agreement and to the extent compatible with it. For the B2B relationship with the professional Client only, if the documents conflict, this Agreement prevails only for provisions that expressly regulate the same subject, including the professional relationship, processing on behalf of the Client, and service term or termination. For processing where Doctful acts as an independent controller, the Privacy Policy and other relevant privacy documents continue to apply; for processing on behalf of the Client, the processing provisions of this Agreement prevail. Rules applicable to patients and guest users, mandatory law and data-subject rights remain unaffected.

The Client is the individual professional or the practice or company acting for B2B purposes. The accepting person confirms authority to act. The Client uses the platform for its professional activity and remains responsible for its instructions and data.

The plan, price, billing period and applicable taxes are those shown in the Client’s order or account. The Client must provide accurate information and keep its contact details and payment method up to date.

Before conclusion, the applicable order summary identifies the plan, included functions, taxable price, taxes, total, billing period, initial term, renewal, cancellation method, payment method and consequences of non-payment. The order summary and applicable contractual text are retained with their version and hash.

The plan renews for the periods shown in the order or account until cancelled under the applicable process. If payment fails, Doctful may request an updated payment method and apply the stated restrictions after the relevant notice and applicable period.

2. Functions and responsibilities

The platform provides digital tools that support the Client’s professional activity, including management of contacts, appointments, availability, and data and documents entered or configured by the Client, as well as service-related communications. The functions operate on the basis of data, content and instructions supplied or selected by the Client. The Client remains responsible for carrying out its professional activity and related professional and legal obligations, including when using the Service or third-party tools. The Service does not replace the Client in performing those obligations or assume them on the Client’s behalf. Doctful provides technical tools, does not provide healthcare services or represent the Client, and does not act as the Client’s agent, mandatary, healthcare-service intermediary or payment intermediary between the Client and patients.

The Client is responsible for the lawfulness, accuracy, completeness and currency of data, content, materials, settings and instructions it supplies, enters or configures, and for the accuracy and suitability of outputs and documents produced by the Service. Before using, communicating, transmitting or making those outputs or documents available, the Client must review them in full and correct every error or omission. Automated functions do not constitute a review, verification or validation by Doctful. As between the Parties, to the extent permitted by law, the Client assumes sole responsibility for and the risk and consequences of errors, omissions and inconsistencies in data, settings, instructions and outputs or documents produced, including those arising from automated processing, and their use. Doctful does not provide professional or legal advice, independently verify the accuracy, completeness, lawfulness or suitability of data or outputs, or guarantee the conformity of individual outputs or the outcome of the Client’s obligations. To the same extent, Doctful is not liable to the Client for the consequences of such errors, including those arising from automated processing by the Service. Doctful’s responsibilities that cannot legally be excluded or limited remain unaffected.

The Client protects credentials and authorisations, uses the service lawfully and is responsible for its instructions, uploaded content and permissions granted to its users. This does not limit Doctful’s own security, assistance and confidentiality obligations.

3. Processing roles

The Client is Controller for processing connected with care, the professional calendar, contacts, health data, service payments, where entered or processed through the available functions, invoicing and Sistema Tessera Sanitaria. Doctful is Processor for persisted data processed on the Client’s behalf to provide the agreed functions.

Doctful is an independent Controller for accounts, authentication, security, platform management, public profiles and search, technical functions, payments owed to Doctful, consents, legal obligations, diagnostics and other own purposes described in the Privacy Policy. The parties do not become joint Controllers merely by using the platform.

For persisted booking requests, contacts, appointments and data connected with care, the Client is the sole Controller and Doctful acts as Processor, limited to the data and purposes needed for the agreed functions. A booking request is not informed healthcare consent.

Doctful does not collect, hold, transfer or settle payments between patient and Client and does not provide payment services for those relationships. Any payments, refunds, penalties or economic terms concerning healthcare services concern only the direct relationship between Client and patient.

To make booking available, the Client also adopts the standard booking privacy notice that Doctful provides and shows to patients on the Client's behalf. The text is available here: standard booking privacy notice. The template covers only search, availability, appointment requests and the technical management of appointments; it does not replace the Client's notices for healthcare services or other purposes.

4. Processing for the Client

Processing for the Client covers only data needed for the agreed functions, for the term of the relationship and under documented instructions. It may include account, contact, appointment, communications and other data connected with the agreed functions, healthcare, fiscal, invoice and Sistema Tessera Sanitaria data.

Doctful informs the Client without delay if it considers an instruction to breach the GDPR or other applicable law and, except where security or a legal obligation requires otherwise, suspends the instruction until the Client confirms or changes it.

If processing is imposed on Doctful by a provision of European Union or Member State law applicable to it, Doctful informs the Client before processing, unless the law prohibits that information for important reasons of public interest.

The Client’s instructions must be documented, sent through the designated channel and sufficiently specific. Incomplete or ambiguous instructions may be suspended only as needed to request clarification; requests beyond the agreed functions require a written agreement on scope, timing and costs, except for mandatory obligations. Doctful provides confidentiality, appropriate measures, reasonable assistance with rights and incident management. Doctful personnel do not ordinarily access readable healthcare data, conversations, anamnesis, treatments or notes. The Platform may nevertheless technically process such data for the time and to the extent needed to provide requested functions to authorised users. Any human support or security access is subject to the applicable authorisation, confidentiality and recording procedures.

Every person authorised by Doctful to access data processed for the Client is bound by confidentiality or an appropriate statutory duty of secrecy and may access it only under documented instructions and authorisations.

Doctful processes data only on documented instructions and to provide the agreed functions. Categories may include identity and contact data, appointments, communications, healthcare data entered by the professional, fiscal data, invoices and data relating to Sistema Tessera Sanitaria submissions. Data subjects may include patients, caregivers, contacts and users linked to the Client.

Clinical documents, reports, prescriptions, diagnostic images, healthcare attachments and generic archives are not allowed. Public profile content and public domain media are processed only to display them through the service.

5. Providers and transfers

The Client authorises the providers needed for active functions and listed in the updated inventory, subject to this contract and the law. Doctful keeps provider roles and safeguards for transfers outside the European Economic Area up to date, with an objection mechanism under the applicable procedure.

The authorisation for sub-processors is general. Doctful gives written notice of each new sub-processor at least fifteen business days before the change, except for security, continuity or legal urgency; in an urgent case, it will communicate the reason and change as soon as reasonably practicable. The notice identifies the sub-processor, location, processing nature, transfers and applicable safeguards. The Client may object within that period by written notice stating specific and documented data-protection grounds directly related to the change. General commercial preferences, duplicative objections or reasons unrelated to data protection are insufficient. If no timely objection is made, the change is authorised. The parties cooperate in good faith; Doctful may propose reasonable safeguards or an alternative provider and is not required to redesign the platform or maintain an unsustainable function. If no reasonable solution is reached, the affected function may be discontinued or the relationship may be terminated under the applicable process, subject to legal obligations. Doctful remains responsible for sub-processors within the limits of Article 28 GDPR. Transfers outside the EEA use only an adequacy decision, standard contractual clauses or another valid mechanism, with any necessary supplementary measures.

Optional components are enabled only under the applicable preferences. Free-text content and healthcare data are not sent to marketing tools, push notification services or AI services. For operational communications, only the operational data necessary for that communication may be processed and sent to authorised providers, according to the updated inventory and the purposes described in the Privacy Policy.

Doctful does not reuse data processed for the Client for marketing, profiling, training or general product improvement. Assistance with rights, security, breaches and impact assessments is provided as necessary under the Client’s instructions and applicable law.

6. Security, incidents and audits

Doctful applies risk-proportionate technical and organisational measures, access control, data protection, backups, restoration and logging of relevant operations. A standard evidence package for the applicable measures and procedures is available to the Client through restricted channels, normally once per contract year and after material changes. Reasonable requests made necessary by an incident, material change, authority or documented risk remain available. Requests must state their objective, scope and information categories; Doctful may provide attestations, redacted documentation or equivalent evidence when sufficient. Bespoke questionnaires, workshops, dedicated reports and further activities not necessary for applicable obligations require an agreed scope and cost estimate in advance, without prejudice to audits or supervisory-authority requests required by law.

No request for assistance, information or evidence requires Doctful to disclose source code, detailed diagrams or specifications of its internal architecture, configurations, network topology, credentials, keys, secrets, internal logs, other clients’ data or other proprietary information, except to the extent strictly necessary to demonstrate a specific applicable obligation or comply with a supervisory-authority request. Doctful may satisfy the obligation through aggregated or redacted descriptions or other equivalent evidence. Further activities not necessary for applicable obligations will not begin without the Client’s written acceptance of their scope and costs, which remain payable by the Client unless otherwise agreed, without prejudice to audits and supervisory-authority requests required by law.

Doctful assists the Client to a reasonable extent, taking into account the nature of the processing and the information available, with data-subject rights, security, breaches, data-protection impact assessments and prior consultation with the supervisory authority. The Client sends requests through the designated channel and by authorised contacts, stating where possible their scope, urgency, deadline and necessary information; non-urgent requests concerning the same subject must be consolidated. Doctful may request clarification and organise or consolidate overlapping activities. Later additions concerning the same event or subject may be handled in the same workflow and against the same deadline, unless there are new facts or mandatory time limits. The Client remains responsible for legal assessments, decisions and communications to data subjects and authorities; Doctful provides technical and organisational assistance and is not required to draft legal opinions or the Client’s DPIA. Bespoke or repetitive activities that exceed the assistance required under Article 28(3)(e) and (f) require prior agreement on scope and costs, except as necessary to comply immediately with a legal obligation or manage an incident.

Doctful informs the Client without undue delay of a personal data breach. The initial notice contains the information required by law that is available at the time; Doctful provides consolidated updates when material developments occur and, for ongoing incidents, at reasonable intervals based on severity. The Client channels requests through the incident contact; Doctful is not required to provide continuous, duplicative updates or bespoke reports not necessary for applicable obligations. Doctful makes available the information necessary to demonstrate compliance with applicable obligations and allows and contributes to audits, including inspections, conducted by the Client or an auditor it appoints. Ordinary audits may be requested no more than once every twelve months, with at least thirty days’ written notice stating the objectives, scope, requested information categories and auditor. The parties cooperate in good faith to identify proportionate methods, giving priority to documentation, attestations, questionnaires, remote audits or equivalent evidence when adequate for the audit objective. Audits take place during business hours and without unreasonable interruption of the service.

The Client bears the costs of its auditor and reimburses Doctful’s reasonable, documented and necessary incremental costs incurred by Doctful for the audit, determined in relation to the nature, complexity, duration and resources actually required by the audit. Doctful will provide a reasonable advance estimate of additional costs where practicable. These costs do not apply to audits required by an authority or made necessary by a breach attributable to Doctful, unless otherwise required by law. The auditor must be independent, bound by confidentiality and not a Doctful competitor. Duplicative, disproportionate or unreasoned requests are excluded; Doctful may propose a reasonable alternative scope, method or timetable and coordinate overlapping requests. If the Client considers documentation or a remote audit insufficient, it must identify the specific elements and objective requiring a different method; the parties must still use a proportionate method that protects confidentiality, security and third-party data.

The frequency and notice limits do not apply when an audit is required by an authority, necessary to investigate a material breach of data processed for the Client or supported by specific documented evidence of material possible non-compliance directly related to the Client’s processing. Except in an emergency or where required by an authority, the Client must provide the objective and scope as soon as reasonably practicable. An extraordinary audit is limited to the information and period necessary for the event and, absent new material evidence, may not be duplicated for the same event. In all cases, the audit must respect confidentiality, security, other clients’ data and service continuity; it does not include unrestricted access to source code, credentials, keys, secrets, unmasked data of other clients or disruptive technical testing, unless strictly necessary and subject to agreed safeguards. The Client remains responsible for notifications required in its capacity as Controller.

7. Retention and termination

At termination, subject to legal obligations, the Client chooses return/export or deletion by written notice through the designated channel, stating the scope, format, delivery method and contact. The choice may be exercised once for each termination event, except to correct errors or incompleteness attributable to Doctful or as required by law or a supervisory authority. Doctful performs the return or deletion within a reasonable period and under the applicable procedure. For a standard export, Doctful states an estimated operational deadline, normally no longer than thirty business days, and promptly notifies the Client of additional time needed for complex or non-standard requests.

After return or a deletion request, Doctful deletes data processed for the Client and its copies, including backup copies according to the applicable technical cycle, except where retention, security or evidentiary duties are required by law.

Return is made in a commonly usable structured format, with security measures appropriate to the data and delivery method. Any required credentials or keys are communicated through separate channels. Secrets, keys, credentials, proprietary code, other clients’ data and unnecessary internal security logs are excluded.

The standard procedure includes one structured export. A standard export should normally be requested within sixty days after termination; later requests or requests requiring restoration from completed technical cycles are subject to feasibility, reasonable timing and costs notified in advance, without prejudice to legal or supervisory-authority obligations. Additional or repeated exports, transformations, customised formats, migration assistance and non-standard operations require an agreed scope and cost estimate in advance. Deletion requests during the relationship must be specific and documented; Doctful may request confirmation of the scope before an irreversible operation and consolidate overlapping requests, without delaying actions required by law or a supervisory authority.

In case of non-payment, access may become read-only for 30 days. Selective deletion may follow without removing invoices, Sistema Tessera Sanitaria data, records or other data subject to legal, litigation or evidentiary retention.

Payment is due according to the plan and period shown in the order. If payment fails, Doctful may request cure, suspend or limit the service and, after the applicable period, terminate the relationship. Non-use attributable to the Client does not create an automatic right to a refund; law, the plan and written agreements remain applicable.

8. Public content

The Client grants a non-exclusive, limited and non-transferable licence to host and display profile images and public domain media. The Client may revoke the licence for the future under the applicable procedure; revocation does not require retroactive deletion and does not prevent processing and copies necessary to perform the relationship, maintain security, comply with law, manage disputes, preserve evidence, perform backups or produce irreversible anonymisation. The licence does not permit campaigns, blogs, reports or references after removal, except for truly irreversible anonymised data or an independent legal basis.

The Client may not upload clinical documents, reports, prescriptions, diagnostic images or healthcare attachments. Doctful may remove unlawful, reported, harmful or non-compliant public content under applicable procedures.

Publishing a profile and availability does not give Doctful power to negotiate, conclude or guarantee contracts concerning the Client’s healthcare services. The licence granted concerns only the Platform’s technical functions.

Doctful retains ownership of the software, platform, marks and documentation. The Client retains its data and content; licences to Doctful are limited to what is necessary for the service. Non-public information exchanged by the parties must be used only for the relationship and protected with reasonable confidentiality, including after termination.

9. Term, changes and availability

The service is provided on a best-effort basis without a contractual minimum availability guarantee. Material changes are normally notified 30 days in advance, except for legal obligations or urgent security needs. Access to professional functions may be suspended until renewed acceptance.

Current versions and acceptances remain separate for the Terms, Privacy Policy, Cookie Policy and clauses requiring specific approval.

The service depends on technical services, connectivity, external providers and third-party services and may experience maintenance, failures, congestion or events beyond Doctful’s reasonable control. Doctful takes reasonable mitigation, continuity, backup and restoration measures. Operational continuity and restoration targets are not an SLA or contractual guarantee. Email, push and in-app notices do not guarantee delivery, reading or timeliness and are not for emergencies.

Material changes are made for objective organisational, technical, economic or legal reasons. If a material change is not acceptable, the Client may terminate or withdraw by written notice within thirty days of the notice and in any event before the effective date, unless a different period is required by law or the order. Termination or withdrawal takes effect on the renewal date or the change’s effective date under the applicable process and does not create additional charges due solely to the change; the Client remains responsible for accrued amounts and obligations and for the standard return or deletion procedure under this contract.

10. Specific approval

To the extent permitted by law, Doctful is not liable for indirect or consequential damage, loss of profit or loss of opportunity. In B2B relationships only, aggregate liability may be capped at the fees paid or payable in the twelve months preceding the event. The cap does not apply to wilful misconduct, gross negligence, death or personal injury, non-waivable liability, non-waivable GDPR duties or other cases excluded from limitation by law.

To the extent permitted by law, the Client shall indemnify and hold harmless Doctful and its auxiliaries against any third-party claim, loss, damage, cost or amount payable, including reasonable and documented defence costs, arising out of or in connection with: (i) content, data, materials or instructions provided or issued by the Client or anyone acting on its behalf; (ii) use of the Service by the Client or anyone acting on its behalf; or (iii) the Client’s breach of this Agreement or applicable legal obligations. The indemnity includes penalties and amounts imposed by authorities only to the extent their transfer is permitted by law and they are attributable to the Client. It does not apply to the extent a claim arises from Doctful’s liability that cannot legally be excluded or limited. Doctful will promptly notify the Client of a claim, and the Parties will reasonably cooperate in its handling and defence.

Clauses concerning use restrictions, suspension, termination, liability and indemnity, retention, audits, changes, corrections and forum are highlighted in this Agreement and are subject to specific approval where required by Articles 1341 and 1342 of the Italian Civil Code.

11. Governing law and contacts

This contract governs only a B2B relationship with the professional Client. This Agreement is governed by Italian law. To the extent permitted by law, the agreed forum is Rome. Mandatory rules and responsibilities that cannot be excluded remain unaffected.

Contract and privacy contact: privacy@doctful.com.

12. Corrections and safeguards

Doctful may correct manifest typographical, translation, numbering, cross-reference, display or editorial omission errors that have no material effect on the parties’ rights and obligations. The correction is identified by revision, date and hash and becomes effective on publication without requiring renewed acceptance. Until publication of the correction, the published text remains the reference, subject to manifest errors, mandatory rules and supervisory-authority orders.

The Client may report an error through the contract or privacy contact, identifying the relevant passage and reason for the report. Doctful reviews the report within a reasonable period and, where necessary for a mandatory obligation or data-subject rights, acts without undue delay. A report does not in itself require a bespoke report, analysis, meeting or other additional activity, and does not constitute an admission of liability.

An error or omission affecting material rights or obligations, roles, purposes or processing categories, providers or transfers, security, retention, assistance, audits, costs, liability, term, price, forum or mandatory rules is treated as a material change under Section 9 and the applicable legal process. A correction has no retroactive effect, does not cure breaches that have already occurred and does not limit rights, remedies or liabilities that may not be excluded by law. Previous versions remain retained to reconstruct acceptances.