Terms & Conditions.

The Issuer

This document (the " Terms", the " Contract" or the " T&C") is issued by:

Name SC NOSTRABIOME SRL

Registered office Str. Nicolae Bălcescu nr. 11, Arad, Arad County, Romania

Unique registration code (CUI) RO48131957

Trade Register number J02/731/2023

Administrator / Legal Călin-Laurențiu Popescu representative

EUDAMED registration number RO-MF-000044337 (SRN)

ANMDMR authorisation / RO_I_105_298 of 10.12.2024 registration

Contact e-mail contact@nostrabiome.com

Data protection e-mail dpo@nostrabiome.com

Website / Application The NostraBiome application and platform

hereinafter referred to as " NostraBiome", the " Company", the " Controller", " we" or the " provider".

The User

" User", " Client", " Subscriber" or " you" means any natural or legal person who creates an account, accesses, installs, uses or purchases any product, service, sampling kit, report, subscription or content made available through the NostraBiome Application.

Legal nature of the document

This document constitutes, cumulatively and indivisibly:

a) a distance contract within the meaning of Government Emergency Ordinance No. 34/2014 on consumer rights in contracts concluded with professionals (transposing Directive 2011/83/EU);

b) an agreement on the processing of personal data, including special categories of personal data (health data, genetic data and biometric data), within the meaning of Regulation (EU) 2016/679 (" GDPR");

c) a software licence agreement of a limited, non-exclusive and revocable nature;

d) where the User opts for a recurring-payment plan, a subscription contract with a minimum fixed term of 6 (six) months, carrying a firm payment obligation, under the terms of Article 16;

e) an agreement on the use of medical device software, within the meaning of Regulation (EU) 2017/745 on medical devices (" MDR").

Acceptance — electronic signature

BY TICKING THE BOX "I HAVE READ AND ACCEPT THE TERMS AND CONDITIONS", BY CREATING AN ACCOUNT, BY ACTIVATING A SAMPLING KIT, BY MAKING A PAYMENT OR BY ANY OTHER USE OF THE APPLICATION, THE USER:

1. declares that they have read, understood and accept this Contract in full and unconditionally; 2. signs this Contract by electronic signature within the meaning of Regulation (EU) No 910/2014 (eIDAS) and of Law No. 455/2001 on electronic signatures, the act of ticking/confirming having the value of an expression of will producing full legal effects; 3. gives their explicit consent, within the meaning of Article 9(2)(a) GDPR, to the processing of the special categories of personal data described in Articles 8--14; 4. undertakes, if they select a subscription plan, the firm payment commitment for a minimum term of 6 months, under the terms of Article 16.

IF YOU DO NOT AGREE WITH ANY OF THE PROVISIONS OF THIS CONTRACT, DO NOT CREATE AN ACCOUNT AND DO NOT USE THE APPLICATION.

Essential warning

> NostraBiome does not establish medical diagnoses and does not > replace the consultation, assessment, diagnosis or treatment provided > by a physician or another qualified healthcare professional. > NostraBiome products are intended exclusively for use as a COMPLEMENT > to standard therapies. Do not discontinue, alter or initiate any > treatment on the basis of the information supplied by the Application > without the approval of your treating physician. In a medical > emergency, call 112.

For the purposes of this Contract, the terms below have the following meaning:

1.1. The Application — the NostraBiome software application, in any form of distribution (iOS/Android mobile application, web application, portal, API), together with all related modules, algorithms, interpretation engines, databases and interfaces.

1.2. Account — the individual, credential-protected space through which the User accesses the Services.

1.3. Biological Sample — any human biological material collected from the User or from the Data Subject, including without limitation: faecal samples, saliva, oral swabs, skin swabs, vaginal swabs, urine samples, capillary blood samples or other biological materials expressly accepted by NostraBiome.

1.4. Sampling Kit — the device and materials made available for the collection, stabilisation and transport of the Biological Sample.

1.5. Genetic data — personal data relating to the inherited or acquired genetic characteristics of a natural person which give unique information about the physiology or the health of that person, as defined in Article 4(13) GDPR, as well as, for the operational purposes of this Contract, the nucleic acid sequences (DNA/RNA) derived from the microorganisms identified in the Biological Sample and the fractions of residual human genetic material.

1.6. Biometric data — personal data resulting from specific technical processing relating to the physical, physiological or behavioural characteristics of a natural person, as defined in Article 4(14) GDPR.

1.7. Health data — personal data related to the physical or mental health of a natural person, including the provision of health care services, which reveal information about that person's health status (Article 4(15) GDPR).

1.8. Bio-signalling — the set of biological, physiological and molecular signals collected continuously or discretely (for example: heart rate variability, body temperature, interstitial glucose, sleep quality, activity level, inflammatory markers, metabolomic signals), used to build an extended biological profile.

1.9. Static functional report — the interpretation report generated on the basis of a single Biological Sample, at a given point in time, reflecting the compositional and functional state of the microbiome at that moment.

1.10. Dynamic functional report — the interpretation report generated on the basis of two or more successive measurement points and/or through the continuous integration of Bio-signalling data, data declared by the User and adherence data, reflecting the evolution of the biological profile over time.

1.11. The Services — all functionalities, analyses, reports, recommendations, educational content, monitoring modules and support made available through the Application.

1.12. One-Time Access product — the product purchased through a single payment, granting access to a determined set of analyses and reports, without automatic renewal.

1.13. Subscription product — the product with a recurring monthly payment, granting continuous access to the Paid Space of the Application and subject to the Minimum Commitment provided for in Article 16.

1.14. Minimum Commitment — the firm and irrevocable contractual period of 6 (six) consecutive months, with the corresponding obligation to pay 6 (six) monthly instalments, undertaken by the User upon activation of a Subscription product.

1.15. Paid Space — the sections, modules and functionalities of the Application accessible exclusively against payment.

1.16. Access code / Voucher — the alphanumeric code issued or funded by a Third-Party Payer, granting access to the Paid Space without a direct payment obligation on the part of the User.

1.17. Third-Party Payer — any entity (clinic, hospital, partner physician, insurer, employer, sponsor, distributor, research programme) that bears the cost of the User's access to the Paid Space.

1.18. Data Subject — the natural person whose personal data are processed; this may be the User themselves or a minor / a person lacking full legal capacity, legally represented by the User.

1.19. Anonymisation — the irreversible process by which data are stripped of any identifying element, so that the Data Subject can no longer be identified, directly or indirectly, by reasonable means; anonymised data no longer fall within the scope of the GDPR (Recital 26 GDPR).

1.20. Pseudonymisation — the processing of data in such a manner that they can no longer be attributed to a Data Subject without the use of additional information kept separately and subject to technical and organisational measures (Article 4(5) GDPR).

1.21. GDPR — Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016.

1.22. MDR — Regulation (EU) 2017/745 on medical devices.

1.23. ANSPDCP — the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP).

1.24. ANMDMR — the Romanian National Agency for Medicines and Medical Devices (ANMDMR).

1.25. ANPC — the Romanian National Authority for Consumer Protection (ANPC).

1.26. Force Majeure — the event defined in Article 27.

2.1. The subject matter of this Contract consists of:

a) granting the User a limited right to use the NostraBiome Application; b) the provision of Biological Sample analysis services, including the extraction of genetic information and the functional profiling of the microbiome; c) the generation and provision of Static and Dynamic Functional Reports; d) the formulation of nutritional, supplementation and lifestyle recommendations, in the nature of complementary informational and decision support; e) the processing of the Data Subject's personal data for the purposes and under the conditions described in Articles 8--15; f) where applicable, the provision of access to the Paid Space on a subscription basis, subject to the Minimum Commitment.

2.2. NostraBiome reserves the right to modify, extend, restrict or discontinue any functionality of the Application, subject to Article 26.

2.3. The Services are addressed exclusively to persons who have reached the age of 18. Use for minors is permitted exclusively through a legal representative, under the terms of Article 7.

3.1. Software as a medical device. The components of the Application which perform the interpretation of biological data for the purpose of health information support are developed, documented and maintained within a quality management system built in accordance with the requirements applicable to medical devices, in particular:

a) Regulation (EU) 2017/745 on medical devices (MDR); b) SR EN ISO 13485 — Quality management systems for medical devices; c) SR EN ISO 14971 — Application of risk management to medical devices; d) SR EN IEC 62304 — Medical device software. Software life cycle processes; e) SR EN IEC 62366-1 — Application of usability engineering to medical devices; f) ISO/IEC 27001 and ISO/IEC 27701 — information security management and privacy information management; g) ISO 20387 / good biobanking practice, where applicable to sample storage activities.

3.2. Registrations. NostraBiome is registered as an economic operator in the European EUDAMED database under single registration number RO-MF-000044337 and holds registration with ANMDMR under number RO_I_105_298/10.12.2024.

3.3. Declared intended use. The NostraBiome Application is intended to provide functional information regarding the composition and activity of the microbiome and the associated biological profile, for the purpose of supporting lifestyle, nutritional and supplementation decisions, as a complement to — and never as a substitute for — medical care. The Application is not intended for:

a) establishing, confirming or excluding a medical diagnosis; b) monitoring physiological parameters on which the patient's immediate vital safety directly depends; c) prescribing, adjusting or discontinuing medicinal treatment; d) use in medical emergency situations.

3.4. Limits of conformity. The User understands and accepts that certain modules, experimental functionalities, or functionalities marked as "beta", "research use" or "wellness" may fall outside the scope of the medical device certification and are made available for informational purposes only. NostraBiome flags the nature of such modules within the Application.

3.5. Vigilance. The User is under an obligation to report to contact@nostrabiome.com any incident, malfunction, manifestly erroneous result or deterioration in their state of health which they consider to be associated with the use of the Application. NostraBiome operates a vigilance system and, where the legal framework so requires, reports serious incidents to ANMDMR and, as the case may be, to other competent authorities, in accordance with Article 87 MDR.

4.1. The results, scores, indices, classifications, probabilities, reports and recommendations generated by the Application do not constitute a medical diagnosis, do not represent an individualised medical opinion and do not create a physician--patient relationship between NostraBiome and the User.

4.2. NostraBiome products are designed to complement standard therapies in fields including, without limitation:

a) digestive diseases (inflammatory bowel disease, irritable bowel syndrome, dysbiosis, SIBO, coeliac disease, hepatobiliary pathology); b) oncology (nutritional and modulatory support during and after standard oncological therapies); c) metabolic diseases (obesity, metabolic syndrome, insulin resistance, type 2 diabetes mellitus, dyslipidaemia, hepatic steatosis); d) fertility and reproductive health (including preconception preparation and support within assisted human reproduction procedures); e) general health, longevity and prevention; f) paediatric health, under the terms of Article 7; g) immunity, dermatological health, neurocognitive health and other fields for which NostraBiome develops dedicated modules.

4.3. Any therapeutic decision rests exclusively with the treating physician. The User undertakes to discuss with their treating physician any recommendation provided by the Application before putting it into practice, in particular in the case of: pregnancy and breastfeeding, active oncological pathology, immunosuppression, renal or hepatic insufficiency, severe food allergies, eating disorders, as well as in the case of minors.

4.4. NostraBiome does not guarantee the achievement of any particular clinical outcome, symptomatic improvement or therapeutic response. NostraBiome's obligations are obligations of means (best efforts), not obligations of result.

4.5. The User understands that microbiome science is a rapidly evolving field, that interpretations are based on the current state of scientific knowledge and on reference databases undergoing continuous updating, and that re-analysis of the same data at different times may lead to updated or different interpretations.

5.1. In order to use the Services, the User must: (i) be at least 18 years of age; (ii) have full legal capacity; (iii) provide true, accurate and complete identification data; (iv) not have previously been excluded from the Application for breach of the Terms.

5.2. The User is solely responsible for the confidentiality of their credentials and for all activities carried out through their Account. Any suspected unauthorised use must be notified immediately to contact@nostrabiome.com.

5.3. NostraBiome may request identity verification where this is necessary for the protection of health data, for the exercise of the rights provided for in Article 13 or for the prevention of fraud.

5.4. An Account is strictly personal and non-transferable. It is prohibited to share the Account, access reports or activation codes with third parties, save in the cases expressly provided for in Articles 6 and 7.

6.1. Where the User accesses the Services through a clinic, a medical practice, a partner physician or another Third-Party Payer, the User may expressly consent to their results and reports being shared with the designated healthcare professional.

6.2. The sharing referred to in Article 6.1 takes place exclusively on the basis of the Data Subject's explicit and separate consent, which is revocable at any time from the Account settings, without affecting the lawfulness of sharing carried out prior to withdrawal.

6.3. In relation to the data received, the healthcare professional acts as an independent controller and is liable for their own processing operations. NostraBiome is not liable for the interpretation, use or subsequent disclosure of the data by that professional.

6.4. The fact that access was facilitated by a Third-Party Payer does not confer on that party any right of access to the User's raw data, genetic sequences or individual reports, in the absence of the User's explicit consent.

7.1. The Services may be used for the benefit of a minor exclusively by that minor's legal representative (parent or guardian), who creates and administers the Account.

7.2. By activating a paediatric profile, the legal representative declares and warrants that: (i) they hold parental authority or legal guardianship; (ii) they are entitled to consent, on behalf of the minor, to the processing of health data, genetic data and, where applicable, biometric data; (iii) where parental authority is exercised jointly, they have the agreement of the other parent.

7.3. The legal representative assumes full liability for the truthfulness of the declarations under Article 7.2 and shall indemnify NostraBiome for any damage arising from their inaccuracy, in accordance with Article 24.

7.4. Upon reaching the age of 18, the formerly minor person has the right to request the transfer of the Account into their own name, as well as to exercise in their own name all the rights provided for in Article 13, including the right to erasure.

7.5. Recommendations generated for paediatric profiles are strictly complementary in nature and must be validated by the treating paediatrician before being applied.

8.1. Specific consent. By activating a Sampling Kit and by dispatching the Biological Sample, the User gives their explicit consent to the collection, transport, receipt, temporary storage, laboratory processing and analysis of the Biological Sample, as well as to the processing of the resulting Genetic Data and Health Data.

8.2. The User's obligations upon collection. The User undertakes to: (i) strictly follow the collection instructions; (ii) collect the sample exclusively from the Data Subject identified in the Account; (iii) correctly register the kit identification code; (iv) dispatch the sample within the indicated time frame; (v) correctly declare medication, supplements, antibiotics, diet and recent medical events which may influence the result.

8.3. Non-compliant samples. NostraBiome may reject, without any right to compensation, samples that are: expired, damaged, contaminated, quantitatively insufficient, unidentifiable, dispatched late, or in respect of which the temperature chain has been broken. In such cases, NostraBiome may offer, at its sole discretion or in accordance with the applicable commercial policy, a replacement kit.

8.4. Partner laboratories. The analysis may be carried out by accredited partner laboratories acting as processors of NostraBiome, on the basis of agreements compliant with Article 28 GDPR, or, where the law so requires, as joint controllers, in which case the User is informed within the Application.

8.5. Destruction of samples. Save where the User expressly consents to biobanking, the physical Biological Sample is securely destroyed after completion of the analysis and after expiry of the technical re-testing period, in accordance with internal procedures and with the retention policy set out in Article 14.

8.6. Optional biobanking. The User may consent separately to the long-term storage of the Biological Sample or of the extracted nucleic acids, for the purpose of future re-analysis or research. This consent is separate, optional, is not a condition for the provision of the Services and may be withdrawn at any time.

9.1. Nature of the processing. The User acknowledges and expressly consents that NostraBiome, directly or through processors, performs on the Biological Sample operations including, without limitation: extraction of nucleic acids (DNA/RNA); amplification and sequencing (for example 16S rRNA sequencing, ITS, shotgun metagenomics, metatranscriptomics); quality control of the sequences; alignment against taxonomic and functional reference databases; reconstruction of metabolic pathways; quantification of relative and absolute abundance; identification of functional markers, antimicrobial resistance genes and signatures associated with health states.

9.2. Profiling. The resulting data are subject to profiling operations within the meaning of Article 4(4) GDPR, through the application of statistical models, machine learning algorithms and rule engines, for the purpose of generating the Static and Dynamic Functional Reports and personalised recommendations.

9.3. Absence of automated decisions producing legal effects. The profiling carried out by NostraBiome does not produce legal effects concerning the User and does not similarly significantly affect them within the meaning of Article 22(1) GDPR, since the results are informational and complementary in nature and any clinical decision remains a matter for the User and their treating physician. Where, in the future, a functionality were to involve an automated decision with significant effects, NostraBiome will seek separate consent and will ensure the right to human intervention.

9.4. Static reports. The Static Functional Report reflects the state of the biological profile at the moment of collection. Its interpretative validity is limited in time, the microbiome being a dynamic structure influenced by diet, medication, infections, stress, sleep and other factors.

9.5. Dynamic reports. The Dynamic Functional Report is generated through the longitudinal aggregation of several measurement points, of the data declared by the User, of adherence data and, if the User has so opted, of Bio-signalling data. The User understands that the accuracy of dynamic reports depends directly on the quality, frequency and truthfulness of the data they provide.

9.6. Residual human genetic material. The User understands that metagenomic analysis may incidentally generate sequences of human origin. NostraBiome does not perform human genotyping for diagnostic purposes, does not analyse hereditary genetic predispositions and does not report such information, unless the User expressly purchases a dedicated module, which is subject to separate consent and, where the law so requires, to prior genetic counselling. Residual human sequences are filtered out and removed from the analysis pipeline in accordance with internal procedures.

9.7. Incidental findings. Where, in the course of the analysis, findings of potentially major clinical relevance arise, NostraBiome may recommend that the User consult a physician, without formulating a diagnosis. The User may elect, from the Account settings, not to receive such notifications (the "right not to know").

10.1. The User expressly consents to NostraBiome collecting, storing and processing the data declared by them regarding: existing diagnoses and medical history; symptoms and their evolution; medication and supplements taken; allergies and intolerances; dietary habits; physical activity; sleep; stress level; alcohol and tobacco consumption; relevant family history; declared objectives and health interests (for example: improving digestion, oncological support, fertility, weight control, longevity, sports performance, skin health, child health).

10.2. Purpose. These data are processed for: (i) optimising and personalising the User's experience within the Application; (ii) adapting the content, the modules and the interface to the declared profile and interests; (iii) formulating specific nutritional, supplementation and lifestyle recommendations; (iv) selecting the interpretation algorithms relevant to the declared clinical context; (v) prioritising educational information.

10.3. The extent of the processing varies according to the desired experience. The User understands and accepts that the type, volume and depth of the biological data processed depend on (i) the experience the User selects within the Application and on (ii) the type and number of products purchased. A basic product entails more limited processing; advanced products and subscriptions entail extended, longitudinal and integrated processing. The User may consult at any time, within the Application, the product--processed data matrix.

10.4. Accuracy of declared data. The User is responsible for the accuracy of the data they declare. Incorrect, incomplete or omitted data may lead to inadequate interpretations and recommendations, for which NostraBiome cannot be held liable.

10.5. Nutritional and lifestyle recommendations. The recommendations are general-personalised in nature, are based on the available scientific literature and on the User's profile and do not constitute a medical prescription, a mandatory individualised clinical dietary plan, or treatment. Users with active pathology must obtain validation from their physician or from an authorised dietitian.

11.1. Optional nature. At the request of and with the explicit, separate and granular consent of the User, NostraBiome may collect and integrate Bio-signalling data, biometric data and other categories of data, for the purpose of building a broader biological profile of the Data Subject.

11.2. Possible categories. These may include, without limitation: data from wearable devices and sensors (heart rate, heart rate variability, oxygen saturation, temperature, sleep, steps, energy expenditure); interstitial glucose (CGM); blood pressure; body composition; laboratory data uploaded by the User (haematology, biochemistry, inflammatory markers, hormonal profile, vitamins and minerals); imaging data uploaded voluntarily; metabolomic, proteomic or other -omic data; menstrual cycle and fertility data; data on adherence to recommendations.

11.3. Granular and revocable consent. Each additional category of data is activated through separate consent, expressed by unambiguous affirmative action. Consent may be withdrawn at any time, per category, from the Account settings. Withdrawal does not affect the lawfulness of processing carried out beforehand and may result in the limitation or unavailability of certain functionalities, in particular of the Dynamic Functional Reports.

11.4. Third-party sources. Where the User connects a third-party service (for example a wearables platform), the transfer takes place on the basis of the authorisation given by the User. The relationship between the User and the third-party provider is governed by the latter's terms, and NostraBiome is not liable for the accuracy, availability or privacy policies of the third party.

11.5. No use for identification purposes. Biometric data are used exclusively for the purpose of physiological characterisation and are not used for the unique identification of the natural person within the meaning of Article 9(1) GDPR as a biometric authentication instrument, unless the User expressly activates a biometric authentication function on their own device, in which case the data remain locally on the device and are not transmitted to NostraBiome.

12.1. Principle of separation. NostraBiome applies by design ( _privacy by design_, Article 25 GDPR) a technical separation between: (i) directly identifying data (name, e-mail, address, date of birth), stored in logically separated environments; and (ii) biological, genetic, clinical and Bio-signalling data, which circulate within the analysis pipelines under a pseudonymous identifier.

12.2. Pseudonymised processing. The laboratory analyses, the bioinformatics pipelines, the interpretation engines and the report generation processes operate on pseudonymised data. Re-identification is possible exclusively for authorised personnel, on a need-to-know basis, for the purpose of delivering the result to the User or of enabling the exercise of the User's rights.

12.3. Anonymisation for secondary purposes. For the purposes of research, development, clinical validation, algorithm improvement, statistics and the constitution of reference databases, NostraBiome uses anonymised or aggregated data, from which identifying elements have been irreversibly removed. The User acknowledges that, pursuant to Recital 26 GDPR, anonymised data no longer constitute personal data.

12.4. Statement of non-association. The data used for secondary research and development purposes are anonymised and are not associated with the User's identity. They are not and cannot be used to establish a diagnosis of the User and are not communicated as individually identifiable information to third parties.

12.5. Prohibition on the sale of identifiable data. NostraBiome does not sell identifiable personal data, identifiable genetic data or identifiable health data to third parties, for any purpose whatsoever, including advertising, insurance or recruitment purposes.

12.6. Research using pseudonymised data. Where a specific research project requires pseudonymised (rather than anonymised) data, the User's participation takes place exclusively on the basis of separate informed consent, with disclosure of the purpose, duration, partners and withdrawal mechanism, and in compliance, where applicable, with the opinion of an ethics committee.

12.7. Re-use for model development. The User acknowledges that anonymised datasets may be used for the training, validation and improvement of NostraBiome's algorithmic models, as well as for scientific publications and aggregated materials, without this permitting their identification.

13.1. General compliance undertaking. NostraBiome declares and warrants that it processes personal data in full compliance with Regulation (EU) 2016/679 (GDPR), with Law No. 190/2018 on implementing measures for the GDPR, with Law No. 506/2004 on the processing of personal data in the electronic communications sector, as well as with any other applicable data protection legislation. NostraBiome observes the principles of lawfulness, fairness and transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, as well as the principle of accountability.

13.2. Controller. The data controller is SC NOSTRABIOME SRL, with the identification details set out in the Preamble. Contact details for any data protection matter: dpo@nostrabiome.com; alternatively, contact@nostrabiome.com, marked "GDPR".

13.3. Data Protection Officer (DPO). In view of the large-scale processing of special categories of personal data, NostraBiome has appointed a data protection officer, who may be contacted directly by Data Subjects on any question concerning the processing and the exercise of their rights.

13.4. Categories of data processed.

Category Examples Source

Identification and surname, first name, User contact data e-mail, telephone,

delivery address, date

of birth, biological

sex

Account and technical account ID, access Automatic data logs, IP address,

device identifier,

application version,

usage data

Transaction data order history, User / payment subscription plan, processor invoices, last 4 digits of the card (tokenised

at the processor)

Health data diagnoses, symptoms, User medication, allergies,

health objectives and

interests, uploaded

laboratory results

Genetic data nucleic acid sequences Laboratory analysis from the Biological

Sample, taxonomic and

functional profiles

Biometric and heart rate, HRV, sleep, Connected Bio-signalling data activity, interstitial devices/services, with glucose, body consent composition, etc.

Derived data scores, indices, Generated by the classifications, Application reports,

recommendations

Communication data correspondence with User support, marketing preferences

13.5. Legal bases for the processing.

Purpose Legal basis

Creation and administration of the Article 6(1)(b) GDPR — Account; provision of the Services; performance of the contract delivery of the kits

Processing of Biological Samples, Article 6(1)(b) and Article extraction of genetic information, 9(2)(a) GDPR — explicit consent generation of reports

Processing of disease data and Article 6(1)(b) and Article health interests for 9(2)(a) GDPR — explicit consent personalisation and recommendations

Integration of Bio-signalling / Article 6(1)(a) and Article biometric data 9(2)(a) GDPR — explicit, granular consent

Invoicing, accounting, archiving Article 6(1)(c) GDPR — legal obligation

Medical device vigilance, incident Article 6(1)(c) and Article 9(2)(i) reporting GDPR — public interest in the area of public health

System security, fraud prevention, Article 6(1)(f) GDPR — legitimate logging interest

Improvement of the Services on the outside the scope of the GDPR basis of anonymised data (Recital 26)

Research using pseudonymised data Article 6(1)(a) and Article 9(2)(a) or (j) GDPR, with the safeguards of Article 89

Direct marketing by e-mail Article 6(1)(a) GDPR — consent, with unsubscribe available at any time

Establishment, exercise or defence Article 6(1)(f) and Article 9(2)(f) of legal claims GDPR

13.6. Necessity of providing the data. The provision of identification data and of the Biological Sample is necessary for the performance of the Contract; refusal makes the provision of the Services impossible. The provision of Bio-signalling data, biometric data and research data is purely voluntary; refusal does not affect access to the core Services.

13.7. Recipients and processors. The data may be disclosed, strictly to the extent necessary, to: partner analysis laboratories; cloud infrastructure and storage providers; bioinformatics service providers; payment processors; couriers for the delivery of kits; technical support and communication providers; auditors, lawyers and accountants; public authorities, where required by law. All processors are bound by contracts compliant with Article 28 GDPR, containing clauses on confidentiality, security, controlled sub-processing and deletion upon termination.

13.8. Data location — servers in the European Union. All personal data processed within the Services, including health data, genetic data and biometric data, are stored and processed on servers located within the territory of the European Union / European Economic Area. NostraBiome selects infrastructure providers that guarantee data residency within the EU/EEA.

13.9. International transfers. As a rule, NostraBiome does not transfer personal data outside the EU/EEA. In the exceptional situation where such a transfer becomes necessary, it will be carried out exclusively on the basis of an adequacy decision of the European Commission or on the basis of the Standard Contractual Clauses adopted by Implementing Decision (EU) 2021/914, supplemented by additional technical and organisational measures, following a transfer impact assessment. The User will be informed in advance, by way of an update to this document.

13.10. Rights of the Data Subject. The Data Subject enjoys the following rights:

a) the right of access (Article 15) — to obtain confirmation of the processing and a copy of the data; b) the right to rectification (Article 16) — to correct inaccurate or incomplete data; c) the right to erasure / the "right to be forgotten" (Article 17), subject to statutory retention obligations; d) the right to restriction of processing (Article 18); e) the right to data portability (Article 20) — to receive the data in a structured, commonly used and machine-readable format, including, upon request, the sequencing files in a standard format; f) the right to object (Article 21), including objection to processing based on legitimate interest and to direct marketing; g) the right not to be subject to a decision based solely on automated processing (Article 22), under the terms of Article 9.3 of this Contract; h) the right to withdraw consent at any time, without affecting the lawfulness of prior processing; i) the right to lodge a complaint with ANSPDCP — B-dul G-ral. Gheorghe Magheru nr. 28-30, sector 1, Bucharest, anspdcp@dataprotection.ro — or with the supervisory authority of the State of habitual residence, as well as the right to an effective judicial remedy; j) the right not to know — to request that certain categories of results not be communicated to them.

13.11. Manner of exercise. Requests are to be sent to dpo@nostrabiome.com or submitted through the dedicated functions within the Application. NostraBiome responds within no more than one month of receipt, a period which may be extended by two months in the case of complex requests, with prior notice to the applicant. The exercise of rights is free of charge; manifestly unfounded or excessive requests may be subject to a reasonable fee or refused with reasons given.

13.12. Data protection impact assessment. In view of the large-scale processing of special categories of personal data and the profiling carried out, NostraBiome has performed and keeps up to date a data protection impact assessment (DPIA) in accordance with Article 35 GDPR, as well as a record of processing activities in accordance with Article 30 GDPR.

13.13. Personal data breach. In the event of a personal data breach, NostraBiome notifies ANSPDCP without undue delay and, where feasible, within 72 hours of becoming aware of it (Article 33 GDPR), and notifies the Data Subjects where the breach is likely to result in a high risk to their rights and freedoms (Article 34 GDPR).

13.14. Confidentiality of personnel. All personnel and all collaborators having access to data are subject to strict confidentiality obligations, receive periodic training and are subject to a role-based, need-to-know access regime.

13.15. Cookies and similar technologies. The Application and the website use cookies and similar technologies. Strictly necessary cookies are placed on the basis of legitimate interest; analytics, functional and marketing cookies are placed exclusively on the basis of consent, manageable through a preference centre.

14.1. NostraBiome retains data only for as long as is necessary for the purposes for which they were collected, according to the following indicative criteria:

Category Retention period

Account and profile data for the duration of the Account + 3 years from closure (general limitation period)

Health data, genetic data and for the duration of the Account, reports for the purpose of longitudinal comparisons; erasure at the User's request or, absent such a request, upon expiry of 3 years from the closure of the Account

Physical Biological Sample until completion of the analysis and of the technical re-testing period, thereafter securely destroyed, save in the case of consented biobanking

Financial and accounting documents 10 years, in accordance with Law and invoices No. 82/1991 on accounting

Medical device vigilance in accordance with the periods documentation imposed by the MDR and by national legislation

Security logs as a rule 12 months

Evidence of consent and of for the duration of the contract + acceptance of the Terms 3 years, for evidentiary purposes

Anonymised / aggregated data unlimited, as they do not constitute personal data

14.2. Upon expiry of these periods, the data are securely erased or irreversibly anonymised.

15.1. NostraBiome implements appropriate technical and organisational measures, in accordance with Article 32 GDPR and with the ISO/IEC 27001 and ISO/IEC 27701 standards, including without limitation: encryption of data in transit (TLS) and at rest; pseudonymisation of the analysis pipelines; segregation of production, testing and development environments; role-based access control and multi-factor authentication for personnel; access logging and monitoring; periodic penetration testing and vulnerability assessments; backup policies and a business continuity and disaster recovery plan; secure management of the software life cycle in accordance with IEC 62304; documented incident response procedures.

15.2. The User undertakes to contribute to security by: using a strong and unique password, activating two-factor authentication where available, protecting their own device, refraining from accessing the Account from public or compromised devices, and immediately notifying any suspicion of unauthorised access.

15.3. No information system can be secured in absolute terms. NostraBiome does not guarantee the absolute impossibility of a security incident, but rather undertakes to apply the standard of care corresponding to the current state of the art.

16.1. Types of products. NostraBiome offers several product variants, including:

a) One-Time Access products — a single payment for a determined set of analyses, a Static Functional Report and access to the related functionalities, without automatic renewal; b) Subscription products — a recurring monthly payment granting continuous access to the Paid Space, to the Dynamic Functional Reports, to longitudinal monitoring, to the updating of recommendations and to the modules included in the selected plan; c) Combined products — sampling kit and subscription, marketed together; d) Products for professionals and institutions — additionally governed by separate framework agreements.

16.2. 6-MONTH MINIMUM COMMITMENT — ESSENTIAL CLAUSE.

16.2.1. BY SELECTING AND ACTIVATING A SUBSCRIPTION PRODUCT, THE USER AGREES TO, ACCEPTS AND SIGNS A FIRM CONTRACTUAL COMMITMENT FOR A MINIMUM TERM OF 6 (SIX) CONSECUTIVE MONTHS, AS WELL AS THE CORRESPONDING COMMITMENT TO PAY THE 6 (SIX) RELATED MONTHLY INSTALMENTS.

16.2.2. The Minimum Commitment runs from the date of the first successfully completed payment or, if earlier, from the date of activation of access to the Paid Space.

16.2.3. The obligation to pay the 6 monthly instalments is firm, irrevocable and independent of the User's actual degree of use of the Application. Non-use of the Services, uninstalling the Application, failure to send a Biological Sample, failure to download the reports or a subsequent loss of interest do not release the User from the payment obligation.

16.2.4. Unilateral termination of the subscription within the Minimum Commitment period is not permitted, save in the cases expressly provided for in Article 16.4. Where the User deactivates automatic renewal, requests termination or discontinues payments during the 6 months, the remaining instalments outstanding until completion of the Minimum Commitment become immediately due and payable and may be invoiced in full, in a single tranche, as the price owed for the contracted period.

16.2.5. The User expressly confirms that they were informed, prior to the conclusion of the contract, of the minimum term, of the total cost of the commitment and of the consequences of early termination, and that they accept this clause separately and unequivocally by ticking the dedicated box in the payment flow.

16.3. Exception concerning access codes and vouchers.

16.3.1. By way of exception to Article 16.2, the 6-month Minimum Commitment and the monthly payment obligation do NOT apply where access to the Paid Space of the Application has been obtained through an access code or voucher granted, issued or funded by a third party (Third-Party Payer), for the period of validity of that code or voucher.

16.3.2. In such situations, the scope and duration of access are determined by the terms of the code or voucher, and upon their expiry access to the Paid Space ceases automatically, without any payment obligation on the part of the User, unless the User expressly opts to continue access on a paid subscription basis, in which case the Minimum Commitment applies from the date of that election.

16.3.3. Codes and vouchers are personal, non-transferable, cannot be converted into money, cannot be combined unless expressly provided otherwise, and may be cancelled in the event of fraudulent use.

16.4. Limited cases of early termination without penalty. The User may request termination of the subscription before completion of the Minimum Commitment, without payment of the remaining instalments, exclusively in the following situations, duly evidenced:

a) culpable, material and persistent non-performance by NostraBiome of its obligations, not remedied within 30 days of written notice; b) the death of the User or of the Data Subject; c) the occurrence of a medical condition, medically certified, which makes continued use of the Services impossible; d) a substantial unilateral modification of the Terms or of the price to the User's detriment, under the terms of Article 26; e) any other situation in which mandatory consumer protection legislation confers a right of termination which cannot be excluded by agreement of the parties.

16.5. Continuation after the minimum period. After completion of the 6 months, the subscription renews automatically for successive periods of 1 (one) month and may be unilaterally terminated by the User upon 30 days' notice, given through the dedicated function within the Application or at contact@nostrabiome.com. Termination takes effect at the end of the current billing period, without refund of amounts already paid.

16.6. Suspension of the subscription. NostraBiome may, at its sole discretion and upon the reasoned request of the User, grant a temporary suspension ("freeze") of the subscription. The suspension correspondingly extends the duration of the Minimum Commitment by the suspended period, and does not reduce it.

16.7. Change of plan. Moving to a higher plan (upgrade) is possible at any time and does not interrupt the Minimum Commitment, which is recalculated at the new price for the remaining months. Moving to a lower plan (downgrade) is possible exclusively after completion of the Minimum Commitment.

17.1. The applicable prices are those displayed within the Application or on the website at the time the order is placed, expressed in the indicated currency and inclusive of VAT where applicable, unless stated otherwise. The delivery costs of the kits are displayed separately before the order is finalised.

17.2. Payment is made by the means accepted within the Application. By providing the details of a payment instrument, the User authorises NostraBiome and the payment processor to debit, on a recurring, monthly and automatic basis, the amounts due for the duration of the subscription, including during the Minimum Commitment.

17.3. The User undertakes to maintain a valid payment instrument throughout the entire duration of the Minimum Commitment and to update its details in the event of expiry, loss or blocking.

17.4. Late payment. In the event of a failed collection, NostraBiome will re-attempt the debit and will notify the User. If payment is not regularised within 7 calendar days of the due date, NostraBiome may: (i) suspend access to the Paid Space, without such suspension suspending the payment obligation; (ii) charge late payment penalties of 0.1% per day of delay on the outstanding amount, until the debt is fully covered, without such penalties being able to exceed the amount of the outstanding sum where the User is a consumer; (iii) declare the remaining instalments under the Minimum Commitment immediately due and payable (acceleration); (iv) assign the receivable, following prior notice, to a debt collection company or to a lawyer, the reasonable recovery costs being borne by the User, within the limits of the law.

17.5. Invoices are issued electronically and made available within the Account. The User consents to electronic invoicing.

17.6. The User may dispute an invoice within 15 days of its issuance, by reasoned notice sent to contact@nostrabiome.com. The dispute does not suspend the obligation to pay the undisputed amounts.

17.7. Price changes. Subscription prices may be changed for the future, upon a minimum of 30 days' notice. Changes do not apply during an ongoing Minimum Commitment period, save for statutory indexation or changes to the VAT rate. If a price change is to take effect after the minimum period, the User may terminate the subscription before it enters into force.

17.8. Refunds. Save in the cases provided for in Article 18 and in mandatory situations provided by law, amounts paid for periods already invoiced are not refundable. Activated kits, processed samples and generated reports are not subject to refund.

18.1. A User who qualifies as a consumer enjoys, pursuant to Government Emergency Ordinance No. 34/2014, the right to withdraw from the distance contract within 14 calendar days, without having to justify the decision, that period running: (i) for goods (kits), from the date of taking physical possession of them; (ii) for services and digital content, from the date of conclusion of the contract.

18.2. Manner of exercise. Withdrawal is to be communicated by an unequivocal statement sent to contact@nostrabiome.com or by means of the model form set out in Annex 3.

18.3. EXCEPTIONS TO THE RIGHT OF WITHDRAWAL. The User acknowledges and expressly accepts that the right of withdrawal may NOT be exercised, pursuant to Article 16 of Government Emergency Ordinance No. 34/2014, in the following cases:

a) the supply of sealed goods which are not suitable for return due to health protection or hygiene reasons and which were unsealed by the consumer after delivery — namely Sampling Kits whose seal has been broken or which have been activated;

b) the supply of goods which are, after delivery, inseparably mixed with other items, or which are made to the consumer's specifications or clearly personalised — namely the reports generated on the basis of the individual Biological Sample;

c) the supply of services, after the services have been fully performed, where performance began with the consumer's prior express consent and after the consumer acknowledged that they would lose their right of withdrawal — namely the processing of the Biological Sample and the delivery of the report;

d) the supply of digital content which is not supplied on a tangible medium, where performance began with the consumer's prior express consent and with acknowledgement of the loss of the right of withdrawal.

18.4. Consent to immediate commencement of performance. By activating the Kit, by dispatching the Biological Sample or by accessing the Paid Space, the User expressly requests the immediate commencement of performance and confirms that they acknowledge that they lose their right of withdrawal upon full performance of the service.

18.5. Effects of a valid withdrawal. In the event of a validly exercised withdrawal, NostraBiome refunds the amounts received within no more than 14 days from the date on which it was informed, using the same means of payment, with the possibility of withholding the refund until the returned goods are received. The cost of returning the goods is borne by the User, save in the cases provided by law. If the provision of services began at the User's request, the User owes the proportionate value of the services performed up to the communication of the withdrawal.

19.1. Termination by NostraBiome. NostraBiome may suspend or terminate the Account, with prior notice where possible, in the event of: non-payment; the provision of false information; fraudulent use; breach of Article 22; use of the Services in a manner that endangers the health of the User or of a third party; or where a legal obligation so requires.

19.2. Termination by operation of law. Failure to pay two consecutive monthly instalments constitutes a case of termination by operation of law, without any notice of default and without recourse to the courts (express termination clause of the fourth degree — _pact_ _comisoriu_ of grade IV), NostraBiome retaining the right to payment of the instalments already due and of those accelerated in accordance with Article 16.2.4.

19.3. Effects of termination. Upon termination: access to the Paid Space is lost; payment obligations that arose beforehand remain due; reports previously downloaded by the User remain in the User's possession; the data are handled in accordance with Article 14.

19.4. Deletion of the Account at the User's request. The User may request deletion of the Account at any time. A deletion request does not extinguish the payment obligations arising from the Minimum Commitment, which remain due, NostraBiome retaining, on the basis of Article 17(3)(e) GDPR, the minimum data necessary for the establishment, exercise or defence of legal claims.

19.5. Surviving clauses. Articles 1, 4, 12, 13, 14, 16.2, 17, 20, 21, 23, 24, 28, 29 and 30 survive termination of the Contract.

20.1. The Application, the source code, the algorithms, the models, the bioinformatics pipelines, the reference databases, the structure of the reports, the texts, the graphics, the "NostraBiome" trade marks and any other intellectual property elements belong exclusively to NostraBiome or its licensors and are protected by copyright, trade mark, industrial designs and trade secrets legislation.

20.2. The User is granted a personal, limited, non-exclusive, non-transferable, non-sublicensable and revocable licence, exclusively for the use of the Application for personal and non-commercial purposes, for the duration of the Contract.

20.3. The following are prohibited: copying, modifying, decompiling, disassembling, reverse engineering (save within the mandatory limits provided by law), systematic data extraction (scraping), the use of the reports for training competing models, the resale, rental or making available to the public of the Services.

20.4. The User's own raw results (the sequencing files relating to their own Biological Sample) may be obtained by the User in the exercise of the right to data portability; the interpretations, scores and derived reports remain protected as a work and as know-how of NostraBiome, and may be used by the User exclusively for personal purposes and in the relationship with their physician.

20.5. Feedback. Suggestions voluntarily submitted by the User may be freely used by NostraBiome, without any obligation of remuneration or confidentiality.

21.1. The User remains the owner of the content they upload (laboratory results, notes, photographs, food diaries) and grants NostraBiome a limited licence to store and process it exclusively for the purpose of providing the Services.

21.2. The User warrants that they have the right to upload such content and that it does not infringe the rights of third parties.

22.1. The User is prohibited from: using the Services for unlawful purposes; sending biological samples originating from another person without that person's consent; uploading false data or data belonging to another person; attempting unauthorised access to systems; introducing malicious software; overloading the infrastructure; using the Services to formulate diagnoses or treatments for third parties without the requisite legal qualification; using the Services for insurance, employment, creditworthiness assessment or discrimination purposes.

22.2. Breach of this Article entitles NostraBiome to immediate suspension of the Account and to damages.

23.1. NostraBiome makes reasonable efforts to ensure the availability of the Application, without guaranteeing uninterrupted or error-free operation.

23.2. Interruptions are possible for scheduled maintenance, security updates, mandatory updates of the interpretation engines or Force Majeure events. Scheduled maintenance is announced, as far as possible, upon reasonable prior notice.

23.3. The User is under an obligation to keep the Application updated to the latest available version; use of an outdated version may affect the accuracy of the results and security, and NostraBiome is not liable for the consequences thereof.

23.4. The report delivery times communicated within the Application are estimates and may vary depending on the laboratory workflow, the quality of the sample and the need for re-analyses.

24.1. Disclaimer of warranties. To the extent permitted by law, the Services are provided "as is" and "as available". NostraBiome does not warrant: the complete, definitive or invariable character of the scientific interpretations; the achievement of any particular health outcome; compatibility with all devices; the absence of errors.

24.2. Exclusions of liability. NostraBiome is not liable for: (i) medical decisions taken by the User or by their physician; (ii) the consequences of failure to follow the collection instructions; (iii) the inaccuracy of the data declared by the User; (iv) the interruption of third-party services (courier, wearables, payment processors, app stores); (v) use of the Services outside the intended use declared in Article 3.3; (vi) indirect damage, loss of profit, loss of data or loss of opportunity.

24.3. Liability cap. To the extent permitted by law, NostraBiome's total aggregate liability towards the User, on whatever basis, is limited to the amount actually paid by the User to NostraBiome in the 12 months preceding the event giving rise to the claim.

24.4. Mandatory limits. The limitations in Articles 24.2 and 24.3 do not apply in the event of: wilful misconduct or gross negligence; injury to life, bodily integrity or health caused by the fault of NostraBiome; liability for defective products under the applicable legislation; breach of the essential obligations of the contract; or in any other situation in which mandatory law prohibits the limitation of liability, including the mandatory rights of consumers.

24.5. Indemnity. The User shall indemnify and hold NostraBiome harmless against any claim, damage, penalty or reasonable expense (including lawyers' fees) arising from: the User's breach of this Contract; the submission of samples or data belonging to a third party without that party's consent; false declarations regarding the legal representation of a minor; use of the Services for prohibited purposes.

25.1. Any complaint is to be sent to contact@nostrabiome.com. NostraBiome acknowledges receipt within 5 working days and responds, as a rule, within 30 days.

25.2. A User who is a consumer has the right to address the Romanian National Authority for Consumer Protection (ANPC), as well as alternative dispute resolution (ADR) entities pursuant to Government Ordinance No. 38/2015.

25.3. The European Commission makes available the online dispute resolution (ODR) platform, accessible at the address indicated on the Commission's official website. NostraBiome is not obliged to, and as a rule does not undertake to, participate in an ADR procedure, without prejudice to the mandatory rights of the consumer.

26.1. NostraBiome may amend this Contract on objective grounds: legislative developments, requirements of the authorities, changes to the Services, security or compliance requirements.

26.2. Amendments are notified by e-mail and/or by notification within the Application at least 30 days before they enter into force.

26.3. If the amendment is substantial and to the User's detriment, the User may terminate the Contract without penalty, by notice sent before the date of entry into force, including during the Minimum Commitment. Continued use after the date of entry into force constitutes acceptance.

26.4. Amendments imposed by a mandatory rule of law or by an authority take effect from the date imposed by that rule or authority.

27.1. Neither party is liable for non-performance of its obligations caused by an event of force majeure or fortuitous event, within the meaning of Article 1351 of the Romanian Civil Code, including: natural disasters, pandemics, epidemics, acts of the authorities, armed conflicts, general strikes, major interruptions of communications or energy networks, large-scale cyber-attacks, unavailability of laboratory reagents.

27.2. The affected party notifies the other party within 15 days. If the event exceeds 90 days, either party may terminate the Contract, without compensation.

28.1. Assignment. The User may not assign their rights and obligations without the written consent of NostraBiome. NostraBiome may assign the Contract in the context of a reorganisation, merger or transfer of business, with notice to the User and ensuring the continuity of data protection safeguards.

28.2. Severability. The nullity of one clause does not affect the validity of the others; the void clause shall be replaced by a valid provision which comes closest to the original intention of the parties.

28.3. Entire agreement. This Contract, together with its annexes, the privacy and cookie policies, the product-specific conditions and the order confirmation, constitutes the entire agreement between the parties.

28.4. Waiver. The failure of NostraBiome to exercise a right does not constitute a waiver of that right.

28.5. Independence. The Contract does not create any employment, agency, partnership or franchise relationship between the parties.

28.6. Headings. Article headings are indicative only and do not affect interpretation.

29.1. This Contract is governed by Romanian law, supplemented by directly applicable European Union law.

29.2. Disputes are to be settled amicably. Failing that, jurisdiction lies with the Romanian courts of the place of NostraBiome's registered office, namely the competent courts of the city of Arad, Romania.

29.3. By way of exception, where the User is a consumer with habitual residence in another Member State of the European Union, that User enjoys the protection of the mandatory provisions of the law of their State of residence and may bring proceedings before the courts of their domicile, pursuant to Regulation (EU) No 1215/2012 and Regulation (EC) No 593/2008 (Rome I).

29.4. No provision of this Contract limits the right of the Data Subject to lodge a complaint with a supervisory authority or to pursue a judicial remedy in accordance with Articles 77--79 GDPR.

30.1. Communications to the User are made by e-mail to the address held in the Account and/or by notifications within the Application, and are deemed received on the date of dispatch, absent evidence to the contrary.

30.2. Communications to NostraBiome are to be sent to contact@nostrabiome.com or, for data-related matters, to dpo@nostrabiome.com, and, for written correspondence, to the registered office at Str. Nicolae Bălcescu nr. 11, Arad, Romania.

30.3. The User is under an obligation to keep their contact details up to date.

31.1. This Contract is made available in Romanian, English and German.

31.2. In the event of a divergence of interpretation between the language versions, the Romanian language version prevails, save where mandatory consumer protection legislation of the User's State of residence provides otherwise.

By accepting the Terms and by ticking the corresponding boxes within the Application, I declare the following:

A. Mandatory consent (necessary for the provision of the Services)

☐ I explicitly consent, on the basis of Article 9(2)(a) GDPR, to the processing of my health data and of the genetic data resulting from the analysis of the Biological Sample, for the purpose of generating the reports and recommendations described in Articles 8--10.

☐ I confirm that I have understood that the results do not constitute a medical diagnosis and that the Services are complementary to standard therapies.

☐ I confirm that I have read, understood and accept the Terms and Conditions, including the section on data protection (Article 13) and, where applicable, the 6-month Minimum Commitment (Article 16).

B. Optional consents (may be withdrawn at any time)

☐ I consent to the collection and integration of Bio-signalling data and biometric data from wearable devices and sensors, for the purpose of building an extended biological profile (Article 11).

☐ I consent to the uploading and processing of my laboratory results and medical documents.

☐ I consent to the biobanking of the Biological Sample / of the extracted nucleic acids for future re-analysis (Article 8.6).

☐ I consent to the use of my pseudonymised data in specific research projects (Article 12.6).

☐ I consent to the sharing of my reports with the designated healthcare professional (Article 6).

☐ I consent to receiving commercial communications by e-mail.

☐ I request that incidental findings not be communicated to me (the "right not to know", Article 9.7).

C. For paediatric profiles / legally represented persons

☐ I declare that I am the legal representative of the minor Data Subject and that I am entitled to consent on their behalf (Article 7).

Item Content

Type of product Subscription with recurring monthly payment

Firm minimum term 6 (six) consecutive months

Number of instalments due 6 monthly instalments, firm and irrevocable

Start date first successful payment or activation of access to the Paid Space

Renewal after the minimum period automatic, monthly, with 30 days' notice of termination

Early termination not permitted; the remaining instalments become immediately due and payable (Article 16.2.4)

Effect of non-use does not release from payment (Article 16.2.3)

Exception access obtained through an access code / voucher from a third party — no commitment and no payment (Article 16.3)

Temporary suspension possible; correspondingly extends the duration of the commitment (Article 16.6)

Late payment penalty 0.1%/day on the outstanding amount (Article 17.4)

By ticking the dedicated box in the payment flow, the User expressly, separately and unequivocally accepts the clause concerning the 6-month Minimum Commitment and the related payment obligation.

_(To be completed and returned only if you wish to withdraw from the_ _contract, under the terms of Article 18)_

To: SC NOSTRABIOME SRL, Str. Nicolae Bălcescu nr. 11, Arad, Romania — contact@nostrabiome.com

I, the undersigned ______________________________ hereby give notice of my withdrawal from the contract concerning the sale of the following product / the provision of the following service: \_\_\____________________________

Ordered on: ____________ Received on: \_\_\__________

Name of the consumer: \_\_\____________________________

Address of the consumer: \_\_\____________________________

Signature of the consumer (only if this form is notified on paper): \_\_\____________________

Date: ____________

By the act of acceptance within the Application, the User confirms that they:

1. have read this document in full and have understood it; 2. have had the opportunity to download and retain it on a durable medium; 3. expressly accept the clauses regarded as unusual within the meaning of Article 1203 of the Romanian Civil Code (unusual clauses), namely: Article 16.2 (the 6-month Minimum Commitment and the acceleration of the remaining instalments), Article 17.4 (late payment penalties and debt recovery), Articles 18.3--18.4 (loss of the right of withdrawal), Article 19.2 (the express termination clause), Articles 24.2--24.3 (exclusions and the liability cap), Article 29.2 (jurisdiction of the courts of NostraBiome's registered office); 4. sign this Contract electronically.

User Name: \_\_\____________________ Date of acceptance: ____________ Account ID: ____________

Provider SC NOSTRABIOME SRL, through Călin-Laurențiu Popescu, Administrator

_Issued by SC NOSTRABIOME SRL · CUI RO48131957 · J02/731/2023 · Str._ _Nicolae Bălcescu nr. 11, Arad, Romania · contact@nostrabiome.com ·_ _EUDAMED SRN RO-MF-000044337 · ANMDMR RO_I_105_298/10.12.2024_