ICARE CLINIC service General Terms and Conditions (“Terms”)

1 SCOPE OF TERMS; PARTIES

1.1 These Terms apply to Agreement(s) (as defined in Section 2) on the provision of the Icare CLINIC Service (as defined in Section 2 below) by Icare Finland Oy, a Finnish company with Business ID 1084502-3 (“Supplier”) to its customer named in the Agreement (“Customer”). The Supplier and the Customer are also hereinafter referred to each as a “Party” and together as the ”Parties”.

2 DEFINITIONS

2.1 The following terms shall have the meanings explained below, unless otherwise explicitly agreed in the Agreement:

Agreement” means an agreement in which the Parties agree on the provision of the Icare CLINIC Service in accordance with these Terms to the Customer, such as (i) a written or electric agreement signed by the Parties, (ii) the Supplier’s offer accepted by the Customer electronically or in writing (iii) the Customer’s order accepted by the Supplier e.g. by commencing the provision of the Icare CLINIC Service to the Customer.

Customer Data” means the data or other content submitted or downloaded by the Customer or by the User into the System through the Icare CLINIC Service’s user interface(s) or by using the Mobile Application. Also a Third Party User may download his/her data into the System only by using the Mobile Application. For the avoidance of doubt it is stated that the Customer Data may contain Personal Data, in which case the Section 7 stipulations apply.

Device” means Icare tonometer devices, as defined by Icare from time to time, supplied to the Customer by a third party (“Device Provider”).

Device Provider” is defined in the definition of “Device” above.

Documentation” means usage manuals and other documents in electronic or other written format that are supplied by the Supplier to the Customer or that are accessible through the Icare CLINIC Service or the Mobile Application, but excluding any marketing materials.

Intellectual Property Rights” means patents, inventions, trademarks, domain names, rights in know-how, trade secrets, copyrights, database rights, rights related to copyrights and any other intellectual property rights, whether registered or not, and including without limitation the right to amend and further develop the objects of those rights and the right to assign the rights to third parties.

Icare CLINIC Service” means the Supplier’s SaaS (software as a service) service delivered via data networks enabling the Customer and the User and the Third Party User to submit and/or upload the Customer Data into the System and to receive the Output Data. The Icare CLINIC Service is defined in its service description in the Documentation as modified by the Supplier from time to time, and it includes the modifications, enhancements, new versions and updates of the Icare CLINIC Service released according to the discretion of the Supplier and by the Supplier for the non-exclusive, commercial and internal use by the Customer.

Mobile Application” means the Supplier’s separate software application called Icare PATIENT Application, which shall be installed on the Third Party Users’ and/or Users’ mobile devices and which can be used by the Third Party Users’ and Users to upload the data provided by the Icare tonometer devices to the System. The Mobile Application is defined in its product description in the Documentation as modified by the Supplier from time to time, and it includes the modifications, enhancements and new versions and updates of the Mobile Application released by the Supplier according to the discretion of the Supplier and by the Supplier for the non-exclusive, commercial and internal use by the Third Party Users and the Users. A separate electronic contract shall be entered into between the Supplier and the Users / the Third Part Users prior to using the Mobile Application.

Output Data” means the Customer Data as processed by the System alone.

Personal Data” is defined in the Section 7 below.

Statistical Information” means the Customer Data, as such or as processed and/or combined with other data, but in a format that no Personal Data is included.

System” means the Supplier and third party systems used by the Supplier to provide the Icare CLINIC Service, and it includes the modifications, enhancements, new versions and updates of the System.

Third Party User” is a third party private person who has a contract in force with the Customer concerning the services of the Customer only for the benefit of himself/herself (such as doctor – patient relationship).

User” means members of the Customer’s or the Customer’s subcontractors’ personnel who are authorized by the Customer in writing or electronically to use the Icare CLINIC Service solely on behalf of and for the benefit of the Customer internally.

3 ESSENTIAL DUTIES OF PARTIES

3.1 The Customer warrants that i) it is an entity (e.g. company, partnership, corporation or a public legal person) and not a private individual and that ii) the Customer has not acquired the usage right to the Icare CLINIC Service as a consumer or otherwise for the purpose of private household.

3.2 The Supplier may make changes to the System, the Icare CLINIC Service, the Mobile Application and the Documentation at any time.

3.3 The Customer shall contribute to the provision of the Icare CLINIC Service with respect to factors under the command or control of the Customer.

3.4 The Customer shall, at its own expense, acquire (i) the Devices from a Device Provider, (ii) mobile devices for the Users, (iii) connections and data traffic subscriptions, (iv) its own hardware and software environment with which the Icare CLINIC Service is used, (v) sufficient rights to the Mobile Application for the Third Party Users’ and Users’ use and (vi) information security related to any of the foregoing in this sub-section, to the extent these are required for the Customer’s use of the Icare CLINIC Service and the Users’ and the Third Party Users’ use of the Mobile Application, each according to the compatibility requirements set by the Supplier from time to time. For example, the Mobile Application is available for limited type(s) of mobile device operating system(s) and its/their version(s) and the Icare CLINIC Service is available for limited type(s) of web browsers and its/their version(s).

4 TERMS OF USE

4.1 Subject to the Customer’s payment of the prices payable under the Agreement, the Customer is granted a non-exclusive and non-transferable right, during the term of the Agreement, to: (i) use the Icare CLINIC Service by the Users in accordance with the Documentation and (ii) allow each User and each Third Party User to download one copy of the Mobile Application on a mobile device owned, rented or leased by the Customer (or the Third Party User in case of the Third Party User using the Icare CLINIC Service). The Customer may not use the Icare CLINIC Service or the Mobile Application to offer services to any third party or otherwise transfer the Icare CLINIC Service or the Mobile Application or allow access to the Icare CLINIC Service or the Mobile Application to any third party. In addition, the terms of use of the Mobile Application to be accepted when downloading the Mobile Application apply to the use of the Mobile Application. THE CUSTOMER AGREES THAT EACH USER IS AUTHORIZED TO CONCLUDE A BINDING AGREEMENT ON BEHALF OF THE CUSTOMER AND THE USER REGARDING THE TERMS OF USE OF THE MOBILE APPLICATION. THE CUSTOMER IS LIABLE FOR ANY BREACH BY THESE TERMS OR THE TERMS OF USE OF THE MOBILE APPLICATION BY THE USERS AND THE THIRD PARTY USERS.

4.2 The Customer may use the Documentation during the term of the Agreement internally to support the granted use of the Icare CLINIC Service.

4.3 The Users and the Third Party Users shall maintain user names and passwords diligently and they may not be disclosed to any third parties. The Customer is responsible for the use of the Users’ and the Third Party Users’ user names and passwords as widely as the law allows.

4.4 The Customer may not repair or otherwise modify the Documentation, the Icare CLINIC Service, the System or the Mobile Application. The Customer may not disassemble, decompile or reverse engineer or otherwise attempt to derive the source code of the software used in the implementation or production of the Icare CLINIC Service or the System or of the Mobile Application.

5 CUSTOMER DATA

5.1 The Customer shall ensure that no Customer Data violates applicable laws or any rights of third parties. The Customer warrants that it and the Users and the Third Party Users have the right to download/upload and submit the Customer Data into the System and that the Supplier and its subcontractors are entitled to process the Customer Data lawfully for the purposes of the Agreement. The Supplier may remove any Customer Data that the Supplier suspects is in violation of these Terms or to satisfy a court or authority request based on mandatory law.

5.2 For the avoidance of doubt it is stated that the Customer may transfer the Customer Data or any part of it to the systems, devices or services of the Customer at the discretion and liability of the Customer.

6 PROVISION OF ICARE CLINIC SERVICE; STATISTICAL INFORMATION

6.1 The Supplier may suspend the provision of or access to the Icare CLINIC Service:

(a) If it is necessary for the purposes of installation, change or maintenance work, or

(b) due to interruption in public networks, repair of errors or equipment, security risks, problems in electricity supply, if required by law or an order by an authority or if the Supplier suspects misuse of the Icare CLINIC Service or breach of the Agreement.

6.2 If the suspension is due to a service break planned by the Supplier, the Supplier informs, where reasonably possible, the Customer of the suspension in advance. The Supplier will inform the Customer of other suspensions, where reasonably possible, without delay after the Supplier has received information about the cause of the suspension. The notifications can be made in the user interface of the Icare CLINIC Service, otherwise electronically or in other appropriate manner.

6.3 The following are not considered as errors of the Icare CLINIC Service or the Mobile Application: (a) errors that are caused by faulty use, (b) errors that are caused by failure to follow these Terms, the terms of the Agreement, the terms of use of the Mobile Application or the usage instructions (c) errors that are caused by a modification or repair performed by anyone else than the Supplier; (d) errors that are caused by malfunction or defects of the Devices or mobile devices; (e) errors that are caused by the Device Provider’s failures or actions, (f) errors that are caused by any system, product or service not provided by the Supplier or (g) errors that are caused by faulty form or content of the Customer Data. The Supplier’s liability for errors of the Icare CLINIC Service or the Mobile Application is limited to the fulfillment of its support duties towards the Device Provider.

6.4 EXCEPT TO THE EXTENT SET OUT HEREIN, THE SUPPLIER DOES NOT MAKE, AND HEREBY DISCLAIMS, ANY AND ALL OTHER EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND ANY WARRANTIES ARISING FROM A COURSE OF DEALING, USAGE, OR TRADE PRACTICE.

6.5 During and after the term of the Agreement, the Supplier has a permanent, non-revocable, transferable, sublicensable and free of charge right to produce the Statistical Information and to use and disclose the Statistical Information for any and all purposes such as for further developing and managing the Icare CLINIC Service and the Supplier’s services.

7 VARIOUS PERSONAL DATA MATTERS

7.1 The Customer acknowledges and agrees that in order to be able to utilize the Icare CLINIC Service, the Users and the Third Party Users will have to provide the Personal Data to be processed by the Supplier and also the Customer. If the Users and the Third Party Users do not provide the Personal Data, the User and the Third Party User are not allowed to utilize the Icare CLINIC Service.

7.2 The Customer shall make sure that the User and the Third Party User shall provide their explicit written or electronic consents for the processing and transfers of the Personal Data as explained here in this Section 7.

7.3 The Supplier acts as a processor of Personal Data and the Customer acts as the controller of Personal Data. The Customer defines the Personal Data it wants to register and control in its business. The Customer is (among other things) liable for the correctness of the Personal Data and the lawfulness of the processing of the Personal Data. Without limiting the generality of the foregoing, the Customer is liable for all duties and liabilities of a Personal Data controller. The User and the Third Party User acknowledge that as the Customer runs its business completely separately from the Supplier, the Customer also is a Personal Data controller. The Customer is itself liable as a Personal Data controller for the processing towards the purposes the Customer has in its business. For the avoidance of doubt it is stated that when the Customer acts as the controller of Personal Data, the Supplier acts as the processor of Personal Data according to the Customer’s needs and decisions and, therefore, the Supplier cannot define those itself.

7.4 Also the Supplier acts as a Personal Data controller in a limited manner as explained below. The Supplier wants to act as a Personal Data controller in the purposes and manner only explained below in this Section 7.

7.5 The types of Personal Data to be processed by the Supplier (in the role of a controller) are as follows. All the below data refers to the User or the Third Party User.

(a) Personal Data including first name; last name; personal ID number; unique patient ID number; date of birth; email address; phone number; full street address; role (doctor/admin/other types of roles); point of time when the User / Third Party User was trained on using the Device; unique serial number and name of the Device; Device’s cheek and forehead support settings; cookie related information (see section 9 below) and

(b) data concerning health including pre-operation or post operation data concerning eye related deceases or conditions; and

(c) location data including geographical location; and

(d) special category of Personal Data relating to ethnic background; and

(e) patient data including intraocular pressure values derived from the Devices and intraocular pressure values’ quality indicators as well as the patient data the User or the Third Party User has provided, such as information relating to glaucoma.

7.6 The purposes for processing of the Personal Data are as follows:

(a) Performance of a contract and in order to take steps prior to entering into a contract regarding the following types of contracts between the Supplier and the Customer: these Terms; terms and conditions between the Supplier and the Users and the Third Party Users relating to the Icare CLINIC Service; contracts related to direct marketing; contracts related to subcontractors; contracts related to group companies.

(b) Compliance with a legal obligation and exercise of rights related to following types of obligations between the Supplier and the Customer: obligations and rights related to customer relationships; obligations and rights related to direct marketing; obligations and rights related to subcontractors.

(c) Consent of the data subject to the processing of Personal Data in certain, following purposes: enabling the use of the Icare CLINIC Service for the Users and the Third Party Users; obligations and rights related to customer relationships; obligations and rights related to direct marketing; obligations and rights related to subcontractors.

(d) Handling of storage, reporting and request obligations based on law and administrative orders and related guidelines regarding patient data matters.

(e) Purposes of direct marketing of the services of the Supplier, within the boundaries set by law.

(f) Handling of customer service and customer relationship, the governing and handling of potential reclamations as well as internal marketing and customer analyses and marketing research purposes.

(g) Further development of the Supplier’s own business.

7.7 The legal basis for the processing of the Personal Data are as follows:

(a) The User or the Third Party User as data subject has given his/her consent to the processing of his/her Personal Data either electrically or in writing for the purposes stated in the Section 7.6 c.

(b) Processing of Personal Data is necessary for the performance of contracts to which the Customer is party or in order to take steps at the request of the Customer relating to such contracts. This relates to the above-mentioned purpose in the Section 7.6 a.

(c) Processing of Personal Data is necessary for compliance with a legal obligation of the data controller. This relates to the above-mentioned purpose in the Section 7.6 b.

(d) Processing of Personal Data is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller. This relates to processing of patient data only.

7.8 When a child is a Third Party User, the guardian of the child shall give his/her explicit consent for the processing of the Personal Data relating to the child.

7.9 The Personal Data may be transferred to the subcontractors of the Supplier. The purposes of the transfers are the same as stated in the Section 7.6.

7.10 The Personal Data may be transferred to the following third countries: USA. The basis of a transfer outside the EU area is the model clauses of the EU Commission and the Privacy Shield arrangement. The contract text is available on the internet at the address http://ec.europa.eu/justice/data-protection/international-transfers/transfer/index_en.htm.

7.11 The Personal Data explained in the Section 7.5 are processed for the time until the debt relationship directly related to the Personal Data becomes time-barred. Main rule according to law for a debt to become time-barred is three years. When mandatory law provides a longer or shorter time for processing, such limitation is applied.

8 SUPPORT

8.1 The Customer shall contract with the Device Provider regarding the provision of support services for the Icare CLINIC Service and the Mobile Application according to the Device Provider’s commercial discretion. The Customer may contact the Supplier in support matters and in such case the Supplier considers itself on how and when to provide support. Also in such specific case(s) when the Customer is entitled to contact the Supplier in support matters, even such support is considered to be provided by the Device Provider under its support contract with the Customer.

9 COOKIES

9.1 The Icare CLINIC Service requires the use of cookies. The cookies are called authTokens. They are session-based cookies. They collect only the data to be able to identify the User or the Third Party User as he/she logs in the Icare CLINIC Service and only for the duration of the session in the Icare CLINIC Service.

9.2 The terms regarding cookies may vary from time to time, as notified by the Supplier.

10 INTELLECTUAL PROPERTY RIGHTS

10.1 Title and any and all Intellectual Property Rights in and to the Icare CLINIC Service, the System, the Mobile Application, the Documentation and the results of the Supplier’s services, and any copies, modifications, translations, amendments and derivatives thereof are and shall belong only to the Supplier and/or its licensors.

11 PRICES AND PAYMENT

11.1 Prices

11.1.1 The prices payable by the Customer for the right to use the Icare CLINIC Service are agreed in the Agreement.

11.1.2 If however some prices are not agreed in the Agreement, those prices are in accordance with the Supplier’s price list as amended by the Supplier from time to time.

11.1.3 The payment methods available are determined by the Supplier from time to time. The Customer agrees that the payment services may be provided by third parties or a third party, whose terms and conditions regarding the payment service might be applicable to the payments and related use of the Customer’s data.

11.1.4 The Supplier may change the agreed prices by notifying the Customer thereof latest two (2) months prior to the change. If a price is increased, the Customer may terminate the Agreement to terminate on the date of increase, by notifying the Supplier thereof in writing latest thirty (30) days before the intended date of increase. However, such termination will become effective only if the Supplier does not cancel the price increase within fourteen (14) days from the receipt of the Customer’s termination notice.

11.1.5 Value added tax, duties, levies and other taxes and governmental charges are borne by the Customer and added to the prices.

11.2 Invoicing and Payment

11.2.1 If not otherwise agreed in the Agreement, the prices are invoiced:

(a) recurring prices, such as monthly, quarterly or annual prices, in advance of the invoicing period;

(b) one time prices upon the order; and

(c) other prices monthly afterwards.

11.2.2 Invoices are payable within fourteen (14) days from the date of the invoice. The Supplier may suspend the Customer’s access to the Icare CLINIC Service in the event that the Customer has delayed in making a payment despite of a payment reminder.

12 CONFIDENTIALITY

12.1 Each Party (i) shall keep in confidence all information of the other Party of confidential nature or marked as confidential (together referred to as “Confidential Information”); (ii) may not disclose the other Party’s Confidential Information to any third party and (ii) may not use the other Party’s Confidential Information for any purpose other than for fulfilling its obligations and using its rights arising out of the Agreement. The structure and user interfaces of the Icare CLINIC Service, the System and the Mobile Application, and their underlying ideas and the Documentation are always the Supplier’s Confidential Information. The Supplier may disclose the Customer’s Confidential Information to its subcontractors for the fulfilment of the purpose of the Agreement if the subcontractors have committed to a confidentiality provision substantially similar as herein. In addition, the Supplier may disclose the Customer’s Confidential Information to the Device Providers to the extent required to cooperate in possible support or delivery issues.

12.2 The foregoing obligations shall not apply to information: (i) which at the time of the disclosure is or later becomes generally available or otherwise public through no fault of the receiving Party; (ii) which was in the possession or knowledge of the receiving Party prior to receipt of the same from the other Party; (iii) which the receiving Party receives from a third party who is not bound by a confidentiality obligation towards the other Party regarding the same Confidential Information; (iv) which the receiving Party has independently developed without using the other Party’s Confidential Information; or (v) which must be disclosed based on law or an order by an authority or court. Unauthorized disclosures of Confidential Information that are caused by security breaches or other similar causes are not regarded as a breach of this confidentiality obligation. The Supplier shall have the right to utilize the general expertize and skills that its and its subcontractors’ personnel have learnt in conjunction with the Agreement.

13 LIABILITY

13.1 Arising out of or related to the Icare CLINIC Service, the System, the Mobile Application, the Documentation, the Supplier’s services or otherwise out of or related to the Agreement, the Supplier shall have no liability for any: (i) indirect damages such as loss of profit, revenue or savings, or for damages payable to third parties, or (ii) loss or alteration of data, information or for any damages incurred as a result thereof, or for cover purchase.

13.2 The Supplier’s aggregate maximum liability arising out of or related to the Icare CLINIC Service, the System, the Mobile Application, the Documentation, the Supplier’s services and otherwise out of or related to the Agreement for any and all causes of action occurred during any calendar month, and including the amounts of possible price returns or reductions, shall not exceed the amount of the prices (without value added tax and other governmental charges) paid by the Customer to the Supplier for the said calendar month.

13.3 The limitations of liability shall not apply to damages caused by gross negligence or intentional act.

14 TERMINATION

14.1 Termination at Will

14.1.1 Either Party may terminate the Agreement by giving the other Party a three (3) months’ prior written notice.

14.2 Termination for Cause

14.2.1 Either Party may terminate the Agreement with immediate effect by giving the other Party a written notice if:

(a) the other Party commits a material breach of the Agreement and fails to remedy the same within thirty (30) days after receipt of a written demand from the other Party to cure the breach; or

(b) the other Party is declared bankrupt, placed into liquidation or its financial situation has otherwise materially deteriorated so that it becomes evident that the other Party will not be able to fulfil its obligations under the Agreement.

14.3 Effects of Termination

14.3.1 Upon termination of the Agreement, each Party shall return to the other Party any tangible property representing Confidential Information of the other Party and erase/delete any other Confidential Information of the other Party held by the first Party in electronic form. However, unless the Parties agree on such service in writing, the Supplier does not return the Customer Data to the Customer. The Supplier is not obliged to store the Customer Data after the termination of the Agreement but the Supplier may continue to store the Customer Data if required by law or regulation.

14.3.2 In any cases of termination or cancellation the Customer is not entitled to receive any compensation for payments of any prices for the period of time the Customer cannot or has not utilized the rights under the Agreement.

14.3.3 The rights to process the Personal Data remain in force as per the Section 7.

15 MISCELLANEOUS

15.1 Assignment and Subcontractors

15.1.1 Either Party may not assign the Agreement to a third party, without the prior written consent of the other Party. However, the Supplier may assign the Agreement without the consent of the Customer to a transferee when assigning the ownership of the Supplier’s business assets or part thereof, or to the Supplier’s affiliate, and, for the avoidance of doubt, in merger or demerger. The Supplier may subcontract its duties. The Supplier shall be liable for the work of its subcontractors as for work of its own.

15.2 Survival

15.2.1 Upon termination of the Agreement, the provisions relating to Intellectual Property Rights, confidentiality, disclaimers of warranty, limitations of liability and this Section “Miscellaneous” shall survive. Also, any other provisions which by their nature or wording contemplate effectiveness beyond the termination of the Agreement, shall survive the termination.

15.3 Entire Agreement

15.3.1 The Agreement constitutes the complete agreement between the Parties with respect to the subject matter hereof and it supersedes all previous proposals, marketing materials and other communications between the Parties with respect to the subject matter hereof.

15.4 Severability

15.4.1 If any provision of the Agreement is found to be contrary to law, the other provisions of the Agreement will remain in force. The invalid provision shall be amended by the Parties, and the Agreement shall be interpreted so as to best accomplish the objectives of the original provision to the fullest extent allowed by law.

15.5 Waiver and Amendment

15.5.1 No change of the Agreement shall be binding unless made in writing and signed by duly authorized representatives of each Party. A failure by a Party to use any of its rights based on the Agreement shall not be construed as a waiver of such right.

15.6 Force Majeure

15.6.1 A Party shall not be liable for delays, defects or damages caused by factors due to an impediment beyond his control, which he cannot reasonably be deemed to have taken into account at the time of the conclusion of the Agreement, and the consequences of which he could not reasonably have avoided or overcome. Such events of force majeure shall include, without being limited to, natural disasters, breakdown of electricity or networks, security attacks, failures in Internet or other public networks or data traffic, strikes and other labor disputes or acts of government. A labor dispute shall be considered a force majeure event also when a Party is the target or a party to such an action. The force majeure events suffered by subcontractors are also be deemed as force majeure events.

15.7 Governing Law and Dispute Settlement

15.7.1 The Agreement shall be construed in accordance with the laws of Finland, excluding its choice of law provisions and the UN Convention on Contracts for the International Sale of Goods.

15.7.2 Any dispute, controversy or claim arising out of or relating to this Agreement, or the breach, termination or validity thereof, shall be finally settled by arbitration in accordance with the Rules of Arbitration of the Finland Chamber of Commerce. The arbitration shall take place in Helsinki, Finland, and shall be conducted in English. The arbitrator shall have at least a master’s degree in law from a Finnish university. Notwithstanding the above, the Supplier shall be entitled to seek equitable and/or injunctive relief to prevent or stop a violation of the terms and conditions in the Agreement and take legal actions concerning overdue payments, in any court of law.