European Union and EEA Specific Terms

Scope, precedence and language

These EU Terms form part of the Agreement for EU Accounts. To the extent they regulate a matter, they prevail over the Agreement, the DPA and the other policies; in all other respects those documents apply unchanged. The SCCs incorporated under Section 6 prevail over all of the foregoing, including these EU Terms, in the event of conflict (Clause 5 of the SCCs).

For EU Accounts established in Iceland, Liechtenstein or Norway, references to Union law are to the corresponding acts to the extent incorporated into the Agreement on the European Economic Area, and references to a Member State include those States.

Nothing in the Agreement or these EU Terms excludes or limits any right or obligation that Union law or the law of Customer’s Member State makes mandatory. If a provision is invalid under such law, it will apply to the maximum extent permitted and the remainder will remain in force.

These EU Terms are drafted in Spanish, which is the authoritative version. This English version is provided at Customer’s request and is also available on the LIVE website; in the event of any discrepancy the Spanish version prevails, unless applicable mandatory law provides otherwise. The text of the SCCs is the one published by the European Commission in the Official Journal of the European Union, in the official language Customer chooses.

Contracting party and business use only

The Service is provided to EU Accounts solely by JIVSoft S.A., a company organized under the laws of the Republic of Ecuador, which has no establishment in the European Union or the EEA. No representative, reseller or third party is a party to the Agreement.

LIVE is offered only to healthcare professionals, healthcare providers and other businesses, for professional purposes. By creating or using an EU Account, Customer represents and warrants that it is acting for purposes relating to its trade, business, craft or profession, that it is not a consumer within the meaning of Union law, and that the person accepting is authorized to bind Customer. If, notwithstanding that representation, mandatory law treats Customer as a consumer, the non-waivable rights granted by that law will apply.

Patients and other individuals who interact with Customer through the Service (for example, through the public booking page) are Customer’s patients or contacts, not customers of JIVSoft S.A..

Roles of the parties and processing contract (GDPR Article 28)

With respect to personal data that Customer or its users upload to the Service (“Customer Data”), Customer is the controller and JIVSoft S.A. is the processor. With respect to account, billing, payment and usage data, JIVSoft S.A. is the controller, as described in Section 15.

The DPA, as supplemented by these EU Terms, constitutes the contract required by Article 28(3) GDPR. The subject-matter, duration, nature and purpose of the processing, the types of personal data and the categories of data subjects are those described in clauses 1 and 2 of the DPA. Where the SCCs apply, Module Two also governs these matters.

Instructions. JIVSoft S.A. processes Customer Data only on documented instructions from Customer, including with regard to transfers to third countries, unless required to do so by Union or Member State law; in that case it will inform Customer of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest. Obligations arising from the law of third countries are governed by Clauses 14 and 15 of the SCCs. JIVSoft S.A. will immediately inform Customer if, in its opinion, an instruction infringes the GDPR or other Union or Member State data protection provisions, and if it is unable to follow an instruction.

Confidentiality. Persons authorized to process Customer Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, and access Customer Data only to the extent strictly necessary to provide, maintain and monitor the Service.

Security. JIVSoft S.A. implements the technical and organizational measures required by Article 32 GDPR, described in clause 5 of the DPA, and reviews them periodically taking into account the state of the art, costs, the nature of the data and the risks. Customer is responsible for the configuration of its account, the users, roles and permissions it creates, and the security of its credentials and devices.

Assistance. Taking into account the nature of the processing and the information available to it, JIVSoft S.A. will assist Customer, through the features of the Service and support: (a) in responding to requests to exercise data subject rights under Chapter III GDPR; and (b) in complying with its obligations under Articles 32 to 36 GDPR (security, notification and communication of breaches, data protection impact assessment and prior consultation).

Deletion or return. At the end of the provision of the services, at Customer’s choice, JIVSoft S.A. will return Customer Data through the export described in Section 8 or delete it, and will delete existing copies, unless Union or Member State law requires storage. Customer may make that choice by writing to support@jivsoft.com; if it does not, clause 9 of the DPA applies. On request, JIVSoft S.A. will certify the deletion in writing. Backups are deleted in their ordinary rotation cycles and, until then, remain protected and are not processed for any other purpose.

Information and audits. JIVSoft S.A. will make available to Customer all information necessary to demonstrate compliance with Article 28 GDPR and will allow for and contribute to audits, including inspections, conducted by Customer or another auditor mandated by Customer, at reasonable intervals or where there are indications of non-compliance, with reasonable notice. Clause 10 of the DPA applies to the extent it does not conflict with the foregoing or with Clause 8.9 of the SCCs: the auditor will be bound by confidentiality and will not access other customers’ data.

Sub-processors

Customer gives JIVSoft S.A. general written authorization to engage the sub-processors on the current list set out in clause 6 of the DPA. JIVSoft S.A. will inform Customer in writing, at the registered email address, of any intended changes to that list through the addition or replacement of sub-processors at least 15 days in advance, together with the information necessary to exercise its right to object. If Customer objects on reasonable data protection grounds and the parties cannot agree on an alternative, Customer may terminate the Agreement without penalty and receive a refund of the prepaid unused portion.

JIVSoft S.A. imposes on each sub-processor, by contract or other legal act, the same data protection obligations as those set out in the DPA and these EU Terms, in particular sufficient guarantees to implement appropriate technical and organizational measures. Where a sub-processor fails to fulfil its obligations, JIVSoft S.A. remains fully liable to Customer for the performance of that sub-processor’s obligations.

On request, JIVSoft S.A. will provide Customer with a copy of the data protection terms of its sub-processor agreements, from which commercially confidential information may be removed.

Personal data breaches and supply chain security

JIVSoft S.A. will notify Customer of any personal data breach affecting Customer Data without undue delay after becoming aware of it and, in any event, within 48 hours of its confirmation, with the content set out in clause 8 of the DPA, a contact point, and further information as it becomes available. This allows Customer to notify the supervisory authority within the 72 hours provided for in Article 33 GDPR and to communicate the breach to data subjects where required under Article 34. In the event of conflict, Clause 8.6(c) of the SCCs prevails.

If Customer is an entity subject to Directive (EU) 2022/2555 (NIS2) or to the national law transposing it, compliance with its own risk-management and incident-reporting obligations is Customer’s responsibility. JIVSoft S.A. will answer reasonable supply chain security questionnaires in accordance with clause 10 of the DPA.

International transfers: standard contractual clauses

JIVSoft S.A. processes Customer Data from Ecuador, which is not covered by an adequacy decision of the European Commission, and its sub-processors may process it in Ecuador, the United States or other third countries. JIVSoft S.A. does not guarantee that Customer Data will be hosted in the European Union or the EEA.

Incorporation. For transfers of Customer Data from an EU Account, the parties enter into and incorporate by reference the SCCs, Module Two (controller to processor), under which Customer is the data exporter and JIVSoft S.A. is the data importer. Customer’s acceptance of the Agreement for an EU Account constitutes both parties’ signature of Annex I.A. Customer may at any time request from support@jivsoft.com a copy of the SCCs with completed annexes, signed by JIVSoft S.A..

Options. (a) Clause 7 (docking clause) is included. (b) Clause 9(a): Option 2, general written authorization, with a notice period of 15 days. (c) Clause 11(a): the option concerning an independent dispute resolution body is not included. (d) Clause 13: the competent supervisory authority is the one responsible for ensuring Customer’s compliance with the GDPR as regards the data transfer, namely that of the Member State in which Customer is established. (e) Clause 17: Option 2; the SCCs are governed by the law of the Member State in which Customer is established and, where that law does not allow for third-party beneficiary rights, by the law of Ireland. (f) Clause 18(b): the courts of the Member State whose law governs the SCCs under item (e).

Annexes. Annex I.A: data exporter, Customer, with the identification and contact details of its account, acting as controller; data importer, JIVSoft S.A., Ecuador, contact support@jivsoft.com, acting as processor; activities: provision of the LIVE service. Annex I.B: categories of data subjects and of personal data, as set out in clause 2 of the DPA; continuous transfer for the duration of the Agreement; nature and purpose, as described in clause 1 of the DPA; retention, as set out in clause 9 of the DPA and Section 3 of these EU Terms; transfers to sub-processors, for the purposes in clause 6 of the DPA. Sensitive data: data concerning health; restrictions and safeguards applied: access limited to authorized personnel bound by confidentiality and logged, support access to data only at Customer’s request, logical isolation of each account, encryption of communications, and prohibition on using the data for JIVSoft S.A.’s own purposes or to train artificial intelligence models. Annex I.C: the authority indicated in item (d) of the preceding paragraph. Annex II: the measures in clause 5 of the DPA. Annex III: the list of sub-processors in clause 6 of the DPA.

Onward transfers. JIVSoft S.A. will disclose Customer Data to sub-processors in third countries only in accordance with Clauses 8.8 and 9 of the SCCs. The requirement in Clause 9(b) is met through a contract with the sub-processor imposing the same obligations, which may consist of its accession to the SCCs, Module Three, or other appropriate safeguards under Article 46 GDPR. For sub-processors in the United States, the transfer may rely on the EU-US Data Privacy Framework (Implementing Decision (EU) 2023/1795) only where the sub-processor is certified under it and the certification covers the data concerned. JIVSoft S.A. identifies the transfer mechanism for each sub-processor in the sub-processor list.

Transfer assessment. JIVSoft S.A. has taken into account the circumstances of the transfer and the laws and practices of the country of destination in accordance with Clause 14 of the SCCs, will make the relevant information available to Customer for its own assessment, will notify Customer if it has reason to believe that it can no longer comply with the SCCs, and will handle requests for access by public authorities in accordance with Clause 15.

Changes to the framework. If a supervisory authority or court determines that JIVSoft S.A.’s processing is directly subject to the GDPR under Article 3(2), or if the Commission adopts standard clauses specific to that situation or amends the SCCs, the parties will apply the appropriate transfer instrument, and Customer agrees that its acceptance of the updated version of these EU Terms constitutes its signature. In any event, JIVSoft S.A. will comply with the GDPR provisions directly applicable to it.

Health data, professional secrecy and impact assessment

Data concerning health are special categories of personal data (Article 9 GDPR). As controller, Customer is responsible for determining and documenting the legal basis for each processing operation and the applicable condition under Article 9(2), in particular point (h) (preventive or occupational medicine, medical diagnosis, the provision of health care or treatment or the management of health care systems and services), which requires the data to be processed by or under the responsibility of a professional subject to the obligation of professional secrecy, or by another person also subject to an obligation of secrecy, under Article 9(3) and Union or Member State law. Customer warrants that it will give access to health data only to users subject to such secrecy or to an equivalent duty of confidentiality.

Customer is responsible for informing its patients under Articles 13 and 14 GDPR, for obtaining any consents required by its national law (including for WhatsApp, text message or email reminders and under national electronic communications rules), and for complying with its Member State’s healthcare rules on the content, custody and retention periods of medical records. The public booking page and the forms of the Service do not replace the information and consents that Customer must provide and document.

If Customer concludes that processing requires a data protection impact assessment (Article 35 GDPR) or prior consultation with the supervisory authority (Article 36), JIVSoft S.A. will provide the information reasonably available to it about the Service, its security measures, sub-processors and transfers.

Customer is responsible for determining whether it must designate a data protection officer. The contact details of JIVSoft S.A.’s data protection officer are published at https://live.jivsoft.com/en/terms/countries.

Switching and data portability (Data Act)

LIVE is a data processing service within the meaning of Regulation (EU) 2023/2854 (the Data Act). This Section sets out Customer’s rights and JIVSoft S.A.’s obligations in relation to switching and prevails over any contrary provision of the Agreement.

Request and notice period. Customer may at any time, by writing to support@jivsoft.com, request to switch to another provider of data processing services or to an on-premises ICT infrastructure, or to erase its exportable data and digital assets. Customer will indicate the option chosen and, when switching provider, the necessary details of that provider. No notice period is required: the switching process starts upon receipt of the request. In no event will the maximum notice period exceed two months.

Transitional period. Switching will be completed without undue delay and in any event within a transitional period of 30 calendar days from the start of the process. If that period is technically unfeasible, JIVSoft S.A. will notify Customer within 14 working days of the request, duly justifying it and indicating an alternative period not exceeding seven months. Customer may extend the transitional period once, for a period it considers more appropriate. During the transitional period the Agreement continues to apply and JIVSoft S.A. will: (a) provide reasonable assistance to Customer and third parties authorized by Customer; (b) maintain the continuity of the contracted functions and, at a minimum, access to view and export information even if the paid period has expired; (c) provide information on known risks to continuity; and (d) maintain a high level of security of the data during its transfer.

Exportable data. All of Customer’s input and output data may be ported, including metadata, directly or indirectly generated by its use of the Service: patients and contacts; medical records, consultations, vital signs and diagnoses; prescriptions, certificates, test orders and generated documents; appointments and schedules; attached files and images; professionals, users, roles and permissions; products, inventory, receipts, payments and accounting data recorded by Customer; and the account configuration. The only exclusions are JIVSoft S.A.’s source code, models, internal templates and internal service configuration, to the extent they constitute trade secrets or are protected by intellectual property rights, without impeding or delaying switching; and third-party data, such as records held by messaging or payment providers.

Formats. Customer may itself download the Service’s listings in XLSX and PDF format and generated documents in PDF. At Customer’s request, JIVSoft S.A. will export all exportable data in a structured, commonly used and machine-readable format (CSV, JSON or XLSX), together with attached files in their original format, and will publish and keep up to date an online register of the available data structures and formats. JIVSoft S.A. will inform Customer of the procedures, methods, formats and known technical limitations of switching.

Retrieval and erasure. After the transitional period, Customer has a data retrieval period of 90 calendar days, which will never be shorter than 30. Once switching is completed, or at the end of the notice period if Customer has only requested erasure, the Agreement will be deemed terminated and Customer will be notified. After the retrieval period has expired and switching has been completed, JIVSoft S.A. will fully erase all exportable data and digital assets generated directly by Customer or relating to Customer directly, in accordance with Section 3.

Switching charges. JIVSoft S.A. does not charge switching or data egress charges for the switching process. Only the standard service fees for the periods Customer chooses to purchase may apply, and there are no early termination penalties.

Free trial. The free trial is a non-production version provided for a limited period for testing and evaluation purposes; therefore, under Article 31(2) of the Data Act, the obligations of Chapter VI of that Regulation do not apply to it. Even so, during the trial Customer may export its information using the features of the Service.

Artificial intelligence

The artificial intelligence features of LIVE are optional and provide general assistance with drafting and summarizing text. They are not intended to diagnose, predict, triage patients, decide on treatments, for any high-risk use under Regulation (EU) 2024/1689 (the AI Act), or to function as a medical device. Customer must not use them for such purposes.

AI-generated content may be inaccurate or incomplete. Customer and its professionals must review it before incorporating it into a medical record, document or communication, and are responsible for the final content. Where the AI Act so requires, JIVSoft S.A. will identify AI-generated content and adopt the transparency and marking measures applicable to providers under its Article 50 and within the timelines of its Article 113, as amended by Regulation (EU) 2026/1744.

As deployer, Customer must take measures to support the AI literacy of its staff (Article 4 of the AI Act) and comply with the transparency obligations that apply to it if it publishes or communicates AI-generated content to third parties.

Text that a user submits to an AI feature is processed by the sub-processor identified in the DPA solely to generate the response. JIVSoft S.A. does not use Customer Data to train models. Customer should avoid including unnecessary patient identifiers in those requests.

Medical devices and European Health Data Space

LIVE is an administrative and clinical documentation tool. JIVSoft S.A. does not assign it any of the medical purposes listed in Article 2(1) of Regulation (EU) 2017/745, does not place it on the market as a medical device, and it does not bear CE marking. Customer must not use or present it for such purposes; if it does, it assumes the resulting obligations.

Regulation (EU) 2025/327 on the European Health Data Space sets requirements for electronic health record systems, including those offered as a service, which apply in phases from 26 March 2027, 2029 and 2031 under its Article 105. LIVE is not currently offered as an electronic health record system conforming to that Regulation and does not bear its CE marking. JIVSoft S.A. will inform Customers of its plans before those requirements become applicable to the Service. The obligations that Regulation imposes on health professionals and healthcare providers are Customer’s responsibility.

Prescriptions, certificates and other documents generated by LIVE are the responsibility of the issuing professional and do not replace the forms, electronic prescription systems or control mechanisms required by the law of Customer’s Member State.

Invoicing and taxes

Prices are stated and charged in US dollars and exclude value added tax (VAT) and other indirect taxes. Any currency conversion is applied by the issuer of Customer’s payment method.

Customer must provide a valid VAT identification number, which JIVSoft S.A. may verify through the European Commission’s VIES system. Services supplied to a taxable person acting as such are supplied where that person has established its business or where the receiving fixed establishment is located (Article 44 of Directive 2006/112/EC), and VAT is payable by the recipient under the reverse-charge mechanism where the supplier is not established in that Member State (Article 196). Customer will self-assess any VAT due.

If Customer does not provide a valid VAT number, JIVSoft S.A. may treat Customer as a non-taxable person (Article 18 of Implementing Regulation (EU) No 282/2011) and, in that case, will add the VAT of Customer’s Member State to the price, showing it separately before payment, or may refuse the order.

LIVE does not issue electronic invoices under the rules of the Member States: the Service’s electronic invoicing is available only for Ecuador (Section 7 of the Agreement). For each payment, JIVSoft S.A. issues the receipt required under Ecuadorian rules. Customer must verify that this document is sufficient for its tax obligations.

Warranties and liability

The exclusions and limitations in Sections 14 and 15 of the Agreement apply to the extent permitted by applicable law. They do not exclude or limit liability for intent or gross negligence, for death or personal injury caused by negligence, for fraud, or any other liability that cannot be excluded or limited under applicable mandatory law.

Data protection liability. Towards data subjects, each party is liable under Article 82 GDPR and Clause 12 of the SCCs. Between the parties, where both have paid or must pay compensation for the same processing, each will bear the part corresponding to its responsibility for the damage; JIVSoft S.A. is liable only where it has not complied with GDPR obligations specifically directed to processors or has acted outside or contrary to Customer’s lawful instructions. The limitation in Section 15 of the Agreement does not apply to liability towards data subjects and will not be construed so as to contradict or undermine the liability scheme of the SCCs.

No term of the Agreement concerning access to and use of data, or liability for breach of data-related obligations, will be binding on Customer if it is unfair under Article 13 of the Data Act.

Changes to the Agreement

JIVSoft S.A. will change the Agreement, the DPA or these EU Terms only for a valid reason, such as legal, regulatory, security, supplier or Service feature changes, giving notice under Section 17 of the Agreement.

If a change adversely affects Customer, Customer may terminate the Agreement at no cost before the change takes effect and receive a refund of the prepaid unused portion. Price changes are governed by Section 9 of the Agreement and never apply to a period already paid.

Governing law, disputes and authorities

Except as provided in this Section, the Agreement is governed by the laws of the Republic of Ecuador, and disputes will be resolved under Section 18 of the Agreement by international commercial arbitration administered by a legally recognized arbitration and mediation center in Machala, seated in Machala. The award may be recognized and enforced in the Member States under the 1958 New York Convention on the Recognition and Enforcement of Foreign Arbitral Awards. This is without prejudice to the mandatory rules of Union law and of the law of Customer’s Member State, in particular data protection rules.

The SCCs are governed by the law and jurisdiction determined under their Clauses 17 and 18, as set out in Section 6. Disputes arising under the SCCs are not subject to arbitration.

Nothing in the foregoing limits: (a) the right of any data subject to lodge a complaint with a supervisory authority (Article 77 GDPR) or to bring judicial proceedings (Articles 78 and 79 GDPR and Clause 18(c) of the SCCs); (b) the powers of supervisory authorities; or (c) Customer’s ability to approach the supervisory authority of its Member State.

Privacy information for individuals in the EU and the EEA

This Section supplements the Privacy Policy (https://live.jivsoft.com/en/privacy) with respect to data for which JIVSoft S.A. is the controller (registration, account, users, billing, payment, support and Service usage) where they relate to individuals in the European Union or the EEA.

Controller and contact: JIVSoft S.A., support@jivsoft.com. The details of the representative in the Union (Article 27 GDPR) and of the data protection officer are published at https://live.jivsoft.com/en/terms/countries.

Legal bases (Article 6 GDPR): performance of the contract, to create and manage the account, provide, charge and invoice the Service and provide support; legal obligation, for accounting and tax obligations and requests from authorities; legitimate interests, for security, preventing fraud and abuse, evidencing acceptance of the terms, measuring campaigns on our commercial pages and defending claims; and consent, for marketing communications and non-essential cookies or similar technologies where the law requires it, which may be withdrawn at any time without affecting the lawfulness of prior processing.

Retention: while the account is active; afterwards, 90 days to allow data retrieval, and billing data and evidence of acceptance for the limitation periods and the periods required by applicable accounting and tax rules. Unverified sign-up requests expire and are deleted.

Transfers: JIVSoft S.A. collects these data directly from Ecuador and applies the GDPR to them to the extent applicable to it. Where it discloses them to providers in third countries, it does so on the basis of an adequacy decision, the EU-US Data Privacy Framework for certified providers, or the SCCs or other Article 46 GDPR safeguards. A copy of the safeguards may be requested at support@jivsoft.com.

Rights: access, rectification, erasure, restriction of processing, data portability, objection (including objection at any time to direct marketing) and not to be subject to decisions based solely on automated processing; JIVSoft S.A. does not make such decisions. These rights may be exercised by writing to support@jivsoft.com or to the representative in the Union; we will respond within one month, extendable by two further months in the cases set out in Article 12(3) GDPR. Any individual may lodge a complaint with the supervisory authority of the Member State of their habitual residence, place of work or place of the alleged infringement.

Providing registration and billing data is necessary to enter into the contract; without them we cannot provide the Service. Where data are not obtained from the individual concerned (for example, users created by Customer), they come from the Customer that manages the account.

Data about Customer’s patients are not governed by this Section but by the information that Customer, as controller, provides to its patients.

Notices

JIVSoft S.A. will send notices to the email address registered in the account and, where appropriate, within the platform. Customer may give notice to JIVSoft S.A. at support@jivsoft.com, including switching requests, objections to sub-processors and requests for a signed copy of the SCCs. The parties agree to the use of electronic means to enter into the Agreement and to communicate.